Critical-severity CVEs (page 4)
Page 4 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-94301 | Critical | 9.8 | 2026-09-21 | The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 an… |
CVE-2026-86473 | Critical | 9.1 | 2026-09-21 | Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as a… |
CVE-2026-82187 | Critical | 9.8 | 2026-09-21 | The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those… |
CVE-2026-94101 | Critical | 9.9 | 2026-09-21 | A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlan_load_form_uci of the file /usr/bin/… |
CVE-2026-94100 | Critical | 9.9 | 2026-09-21 | A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function wan_config_set_vlan of the file /usr/bin/routerd of the componen… |
CVE-2026-94099 | Critical | 9.9 | 2026-09-21 | A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cgi of the component… |
CVE-2026-94098 | Critical | 9.1 | 2026-09-21 | A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component… |
CVE-2026-94097 | Critical | 10.0 | 2026-09-21 | A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI… |
CVE-2026-94096 | Critical | 9.9 | 2026-09-21 | A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the… |
CVE-2026-94095 | Critical | 9.9 | 2026-09-21 | A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_t… |
CVE-2026-94089 | Critical | 10.0 | 2026-09-20 | A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfa_authentication.cgi of the component Authen… |
CVE-2026-90817 | Critical | 9.8 | 2026-09-20 | An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user… |
CVE-2026-94003 | Critical | 10.0 | 2026-09-20 | A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web… |
CVE-2026-94084 | Critical | 9.4 | 2026-09-20 | Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a trans… |
CVE-2026-94083 | Critical | 9.4 | 2026-09-20 | Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual sta… |
CVE-2026-93958 | Critical | 9.1 | 2026-09-20 | A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipu… |
CVE-2026-93985 | Critical | 9.9 | 2026-09-19 | OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed… |
CVE-2026-78030 | Critical | 9.8 | 2026-09-19 | DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_… |
CVE-2026-93742 | Critical | 9.9 | 2026-09-19 | A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipula… |
CVE-2026-86591 | Critical | 9.8 | 2026-09-19 | The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbi… |
CVE-2026-93741 | Critical | 10.0 | 2026-09-19 | A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlW… |
CVE-2026-92229 | Critical | 9.1 | 2026-09-19 | The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions… |
CVE-2026-89274 | Critical | 9.1 | 2026-09-19 | The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists… |
CVE-2026-84434 | Critical | 9.8 | 2026-09-19 | The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This… |
CVE-2026-93740 | Critical | 10.0 | 2026-09-18 | A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulatio… |
CVE-2026-93739 | Critical | 9.9 | 2026-09-18 | A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation… |
CVE-2026-75885 | Critical | 9.3 | 2026-09-18 | A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send… |
CVE-2026-93738 | Critical | 9.9 | 2026-09-18 | A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipula… |
CVE-2026-93839 | Critical | 9.8 | 2026-09-18 | LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register… |
CVE-2026-84082 | Critical | 9.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an… |
CVE-2026-84078 | Critical | 9.9 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to a missing authentication vulnerability in the LoadBalancerServlet. An unauthenticated user can access privil… |
CVE-2026-84075 | Critical | 9.9 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to missing authentication for the ChangeTrackerServlet. |
CVE-2026-84073 | Critical | 9.1 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special eleme… |
CVE-2026-84064 | Critical | 9.9 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special eleme… |
CVE-2026-84031 | Critical | 9.0 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page… |
CVE-2026-82967 | Critical | 9.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls a… |
CVE-2026-82832 | Critical | 9.6 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page… |
CVE-2026-82340 | Critical | 9.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Au… |
CVE-2026-81657 | Critical | 9.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted… |
CVE-2026-80442 | Critical | 9.9 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful explo… |
CVE-2026-80441 | Critical | 9.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of chan… |
CVE-2026-75878 | Critical | 9.1 | 2026-09-18 | IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an… |
CVE-2026-61781 | Critical | 9.9 | 2026-09-18 | pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time… |
CVE-2026-58264 | Critical | 9.8 | 2026-09-18 | FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range… |
CVE-2023-54399 | Critical | 9.8 | 2026-09-18 | Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a databa… |
CVE-2026-93762 | Critical | 9.8 | 2026-09-18 | Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to c… |
CVE-2026-92702 | Critical | 9.1 | 2026-09-18 | Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-ha… |
CVE-2026-92701 | Critical | 9.1 | 2026-09-18 | Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-ha… |
CVE-2026-61550 | Critical | 9.8 | 2026-09-18 | Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that th… |
CVE-2026-59163 | Critical | 9.1 | 2026-09-18 | Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_server.py parsed the JWT's header and p… |
CVE-2025-66455 | Critical | 9.8 | 2026-09-18 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch… |
CVE-2026-93765 | Critical | 9.1 | 2026-09-18 | Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from… |
CVE-2026-85497 | Critical | 9.8 | 2026-09-18 | CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking… |
CVE-2026-81321 | Critical | 9.8 | 2026-09-18 | CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through ph… |
CVE-2026-77240 | Critical | 9.9 | 2026-09-18 | WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_update row-level security policy in supabase/migrations/017_acco… |
CVE-2026-84383 | Critical | 9.8 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl refer… |
CVE-2026-75031 | Critical | 9.8 | 2026-09-18 | In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin feature. In default insta… |
CVE-2026-61682 | Critical | 9.9 | 2026-09-18 | kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-prox… |
CVE-2026-10858 | Critical | 9.9 | 2026-09-18 | IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a… |
CVE-2026-10747 | Critical | 10.0 | 2026-09-18 | IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol mes… |
CVE-2025-53837 | Critical | 9.9 | 2026-09-18 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to… |
CVE-2025-15399 | Critical | 10.0 | 2026-09-18 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could all… |
CVE-2026-93606 | Critical | 10.0 | 2026-09-18 | vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes a host API that returns a host-realm Promise, the… |
CVE-2026-93605 | Critical | 10.0 | 2026-09-18 | vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-… |
CVE-2026-93603 | Critical | 10.0 | 2026-09-18 | vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code c… |
CVE-2026-93019 | Critical | 9.1 | 2026-09-18 | Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. The reader unpacks the two… |
CVE-2026-13684 | Critical | 9.8 | 2026-09-18 | An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and… |
CVE-2026-13639 | Critical | 9.8 | 2026-09-18 | An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 al… |
CVE-2026-67101 | Critical | 9.3 | 2026-09-18 | HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to f… |
CVE-2026-67100 | Critical | 9.8 | 2026-09-18 | HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attac… |
CVE-2026-84738 | Critical | 9.1 | 2026-09-18 | The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-priv… |
CVE-2026-93467 | Critical | 9.8 | 2026-09-18 | The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by send… |
CVE-2026-85878 | Critical | 9.9 | 2026-09-18 | Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network. |
CVE-2026-69843 | Critical | 10.0 | 2026-09-18 | Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-62874 | Critical | 10.0 | 2026-09-18 | Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-87701 | Critical | 9.6 | 2026-09-17 | Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate… |
CVE-2026-85889 | Critical | 10.0 | 2026-09-17 | Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-85885 | Critical | 9.9 | 2026-09-17 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a… |
CVE-2026-83944 | Critical | 10.0 | 2026-09-17 | Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-77903 | Critical | 9.0 | 2026-09-17 | Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-70200 | Critical | 10.0 | 2026-09-17 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a… |
CVE-2026-70009 | Critical | 9.3 | 2026-09-17 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a networ… |
CVE-2026-69865 | Critical | 10.0 | 2026-09-17 | Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-69399 | Critical | 10.0 | 2026-09-17 | Azure Arc Elevation of Privilege Vulnerability |
CVE-2026-73639 | Critical | 9.1 | 2026-09-17 | Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8. … |
CVE-2026-54767 | Critical | 9.1 | 2026-09-17 | WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoin… |
CVE-2026-54734 | Critical | 10.0 | 2026-09-17 | Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request UR… |
CVE-2026-54670 | Critical | 9.1 | 2026-09-17 | WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts… |
CVE-2026-93374 | Critical | 9.6 | 2026-09-17 | Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbo… |
CVE-2026-93373 | Critical | 9.6 | 2026-09-17 | Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chro… |
CVE-2026-93372 | Critical | 9.6 | 2026-09-17 | Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a cr… |
CVE-2026-54460 | Critical | 9.8 | 2026-09-17 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a r… |
CVE-2026-45143 | Critical | 9.0 | 2026-09-17 | Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side san… |
CVE-2026-45140 | Critical | 9.8 | 2026-09-17 | Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on th… |
CVE-2025-55787 | Critical | 9.8 | 2026-09-17 | In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists. |
CVE-2026-54752 | Critical | 9.6 | 2026-09-17 | NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pul… |
CVE-2026-54627 | Critical | 9.8 | 2026-09-17 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psd_private_sail_… |
CVE-2026-54626 | Critical | 9.8 | 2026-09-17 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGA_INDEXED_R… |
CVE-2026-54618 | Critical | 9.4 | 2026-09-17 | Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or… |
CVE-2026-54617 | Critical | 9.8 | 2026-09-17 | GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request targe… |