Critical-severity CVEs (page 41)
Page 41 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14480 | Critical | 9.9 | 2026-07-10 | OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attac… |
CVE-2026-11913 | Critical | 9.8 | 2026-07-10 | vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*. |
CVE-2026-12535 | Critical | 9.8 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affe… |
CVE-2026-10768 | Critical | 9.8 | 2026-07-10 | Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0. |
CVE-2026-9726 | Critical | 9.8 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Inject… |
CVE-2026-57807 | Critical | 9.8 | 2026-07-10 | Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allow… |
CVE-2026-55879 | Critical | 9.3 | 2026-07-10 | OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from… |
CVE-2026-12761 | Critical | 9.8 | 2026-07-10 | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account ta… |
CVE-2026-57158 | Critical | 9.1 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix fo… |
CVE-2026-57156 | Critical | 9.8 | 2026-07-10 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_d… |
CVE-2026-61459 | Critical | 9.8 | 2026-07-10 | MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows… |
CVE-2026-5801 | Critical | 9.8 | 2026-07-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek Informatics Software Consulting Trade Ltd. Co. SEM… |
CVE-2026-59151 | Critical | 9.6 | 2026-07-10 | Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding whi… |
CVE-2026-2397 | Critical | 9.8 | 2026-07-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injec… |
CVE-2026-51119 | Critical | 9.1 | 2026-07-10 | An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components |
CVE-2026-55500 | Critical | 9.9 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys… |
CVE-2026-15143 | Critical | 9.3 | 2026-07-10 | A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Defin… |
CVE-2026-61444 | Critical | 9.1 | 2026-07-10 | PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-str… |
CVE-2026-59792 | Critical | 9.6 | 2026-07-10 | In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible |
CVE-2026-56765 | Critical | 9.8 | 2026-07-10 | Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission… |
CVE-2026-56688 | Critical | 9.1 | 2026-07-10 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vuln… |
CVE-2026-53363 | Critical | 9.8 | 2026-07-10 | In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() iptfs_consume_frags() t… |
CVE-2026-15378 | Critical | 9.3 | 2026-07-10 | A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remote attacker to perform a blind Server-Side Request Forgery (SSRF) by… |
CVE-2026-40008 | Critical | 9.8 | 2026-07-10 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Ja… |
CVE-2026-40005 | Critical | 9.1 | 2026-07-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere th… |
CVE-2026-28564 | Critical | 9.8 | 2026-07-10 | Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credenti… |
CVE-2026-15300 | Critical | 9.1 | 2026-07-10 | The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4. The… |
CVE-2026-15282 | Critical | 9.8 | 2026-07-10 | The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachm… |
CVE-2026-14894 | Critical | 9.8 | 2026-07-10 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the su… |
CVE-2026-54769 | Critical | 10.0 | 2026-07-10 | Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to… |
CVE-2026-58123 | Critical | 9.8 | 2026-07-09 | Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands b… |
CVE-2026-58122 | Critical | 9.1 | 2026-07-09 | Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restric… |
CVE-2026-0284 | Critical | 9.9 | 2026-07-09 | An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with net… |
CVE-2026-59827 | Critical | 9.9 | 2026-07-09 | Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2… |
CVE-2026-59826 | Critical | 9.1 | 2026-07-09 | Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not vali… |
CVE-2026-59726 | Critical | 10.0 | 2026-07-09 | Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST… |
CVE-2026-51599 | Critical | 9.8 | 2026-07-09 | An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker… |
CVE-2026-51597 | Critical | 9.1 | 2026-07-09 | MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can c… |
CVE-2026-13461 | Critical | 9.6 | 2026-07-09 | When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScri… |
CVE-2026-14261 | Critical | 9.1 | 2026-07-09 | A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling at… |
CVE-2026-12116 | Critical | 9.8 | 2026-07-09 | A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpre… |
CVE-2026-56291 | Critical | 9.8 | 2026-07-09 | Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauth… |
CVE-2026-5955 | Critical | 9.8 | 2026-07-09 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software and Internet Services BiEticaret allows S… |
CVE-2026-2342 | Critical | 9.3 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OceanicSoft Informatics Systems Ltd. ValeApp allows Store… |
CVE-2026-15158 | Critical | 9.8 | 2026-07-09 | The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the save_attachments functio… |
CVE-2026-14245 | Critical | 9.8 | 2026-07-09 | The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeo… |
CVE-2026-47826 | Critical | 9.1 | 2026-07-09 | The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information. Affected… |
CVE-2026-47646 | Critical | 9.3 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform… |
CVE-2026-54782 | Critical | 10.0 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token val… |
CVE-2026-15113 | Critical | 9.6 | 2026-07-08 | Use after free in Autofill in Google Chrome on Android prior to 150.0.7871.115 allowed a remote attacker to potentially perform a sandbox escape via a crafted… |
CVE-2026-55471 | Critical | 9.1 | 2026-07-08 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities… |
CVE-2026-52200 | Critical | 9.8 | 2026-07-08 | An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiSer… |
CVE-2026-44024 | Critical | 9.8 | 2026-07-08 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamic… |
CVE-2026-31309 | Critical | 9.8 | 2026-07-08 | Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrari… |
CVE-2026-54527 | Critical | 9.0 | 2026-07-08 | JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to inne… |
CVE-2026-9074 | Critical | 9.1 | 2026-07-08 | IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functiona… |
CVE-2026-59702 | Critical | 9.3 | 2026-07-08 | repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound re… |
CVE-2026-15062 | Critical | 9.6 | 2026-07-08 | SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to… |
CVE-2026-58480 | Critical | 9.8 | 2026-07-08 | Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload execut… |
CVE-2026-54061 | Critical | 9.1 | 2026-07-08 | Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public g… |
CVE-2026-8307 | Critical | 9.8 | 2026-07-08 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Webbeyaz Web Design Mediküm Web allows SQL Injection. Th… |
CVE-2026-14454 | Critical | 9.8 | 2026-07-08 | Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as ne… |
CVE-2026-41042 | Critical | 9.1 | 2026-07-08 | Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT param… |
CVE-2026-9695 | Critical | 9.8 | 2026-07-08 | An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to th… |
CVE-2026-12153 | Critical | 9.8 | 2026-07-08 | The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not prop… |
CVE-2026-9701 | Critical | 9.8 | 2026-07-08 | The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plainte… |
CVE-2026-14487 | Critical | 9.1 | 2026-07-08 | The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removeUploadDir function… |
CVE-2026-56843 | Critical | 9.9 | 2026-07-08 | Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own… |
CVE-2026-59705 | Critical | 9.8 | 2026-07-07 | mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary use… |
CVE-2026-37271 | Critical | 9.8 | 2026-07-07 | Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without suffi… |
CVE-2026-37270 | Critical | 9.8 | 2026-07-07 | Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper password validation and the presence of hard-c… |
CVE-2026-14740 | Critical | 9.1 | 2026-07-07 | DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and remove… |
CVE-2026-14739 | Critical | 9.8 | 2026-07-07 | DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did… |
CVE-2026-59706 | Critical | 9.3 | 2026-07-07 | mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_b… |
CVE-2026-46354 | Critical | 9.1 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33… |
CVE-2026-58473 | Critical | 9.1 | 2026-07-07 | Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration… |
CVE-2026-59800 | Critical | 9.8 | 2026-07-07 | 9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not cove… |
CVE-2026-13019 | Critical | 9.8 | 2026-07-07 | Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a re… |
CVE-2026-53483 | Critical | 9.8 | 2026-07-07 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-53481 | Critical | 9.8 | 2026-07-07 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2011-10043 | Critical | 9.8 | 2026-07-07 | Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load f… |
CVE-2026-33264 | Critical | 9.8 | 2026-07-07 | A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a s… |
CVE-2026-4375 | Critical | 9.0 | 2026-07-07 | The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have been seen to be used to achieve RCE, once they are added addin… |
CVE-2026-14345 | Critical | 9.8 | 2026-07-07 | The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up… |
CVE-2026-12375 | Critical | 9.8 | 2026-07-07 | The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before… |
CVE-2026-34048 | Critical | 9.9 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap route… |
CVE-2026-34047 | Critical | 9.9 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap route… |
CVE-2026-34037 | Critical | 9.9 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in R… |
CVE-2026-57572 | Critical | 10.0 | 2026-07-06 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, whi… |
CVE-2026-57571 | Critical | 9.6 | 2026-07-06 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken f… |
CVE-2026-54763 | Critical | 10.0 | 2026-07-06 | Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip… |
CVE-2026-34038 | Critical | 9.9 | 2026-07-06 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, an authenticated remote command in… |
CVE-2026-11405 | Critical | 9.8 | 2026-07-06 | The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8. - The function contains a normal a… |
CVE-2026-9182 | Critical | 9.8 | 2026-07-06 | Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the… |
CVE-2026-9181 | Critical | 9.8 | 2026-07-06 | Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit thi… |
CVE-2026-48614 | Critical | 9.9 | 2026-07-06 | An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary… |
CVE-2026-48316 | Critical | 10.0 | 2026-07-06 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-40141 | Critical | 9.9 | 2026-07-06 | A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of cer… |
CVE-2026-40139 | Critical | 9.8 | 2026-07-06 | A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication request… |
CVE-2026-5268 | Critical | 9.1 | 2026-07-06 | An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remot… |