Critical-severity CVEs (page 42)
Page 42 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53830 | Critical | 9.1 | 2026-07-06 | Anti-Virus for ownCloud is an anti-virus application for file storage, synchronization, and sharing application ownCloud. Versions of Anti-Virus for ownCloud b… |
CVE-2025-53827 | Critical | 9.1 | 2026-07-06 | ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior to 10.15.3, the Up… |
CVE-2026-56140 | Critical | 9.8 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific He… |
CVE-2026-53913 | Critical | 9.8 | 2026-07-06 | Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component. … |
CVE-2026-48205 | Critical | 9.1 | 2026-07-06 | Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation paramete… |
CVE-2026-48204 | Critical | 9.8 | 2026-07-06 | Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects… |
CVE-2026-48203 | Critical | 9.1 | 2026-07-06 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSR… |
CVE-2026-46456 | Critical | 9.8 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchan… |
CVE-2026-46455 | Critical | 9.8 | 2026-07-06 | Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAcce… |
CVE-2026-46454 | Critical | 9.8 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the Cam… |
CVE-2026-43867 | Critical | 9.8 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) throug… |
CVE-2026-40047 | Critical | 9.1 | 2026-07-06 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling componen… |
CVE-2026-24014 | Critical | 9.8 | 2026-07-06 | Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient valida… |
CVE-2026-24013 | Critical | 9.1 | 2026-07-06 | Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attack… |
CVE-2026-6382 | Critical | 9.1 | 2026-07-06 | The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File… |
CVE-2026-14808 | Critical | 9.8 | 2026-07-06 | Prog Management System developed by PROG MIS has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a s… |
CVE-2026-14807 | Critical | 9.8 | 2026-07-06 | ERP App developed by PROG MIS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to view application code a… |
CVE-2026-58426 | Critical | 9.6 | 2026-07-03 | Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write |
CVE-2026-58422 | Critical | 9.8 | 2026-07-03 | Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts |
CVE-2026-58289 | Critical | 9.0 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-27780 | Critical | 9.8 | 2026-07-03 | Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-prot… |
CVE-2026-26292 | Critical | 9.8 | 2026-07-03 | Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport prot… |
CVE-2026-26247 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected… |
CVE-2026-26232 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange. |
CVE-2026-25718 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked o… |
CVE-2026-22874 | Critical | 9.6 | 2026-07-03 | Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering. |
CVE-2026-22547 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object for… |
CVE-2026-20896 | Critical | 9.8 | 2026-07-03 | Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when revers… |
CVE-2026-20706 | Critical | 9.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint. |
CVE-2026-12481 | Critical | 9.8 | 2026-07-03 | A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Speci… |
CVE-2026-56015 | Critical | 9.1 | 2026-07-03 | Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length. add() passes the prefix string to the trie builder… |
CVE-2026-4321 | Critical | 9.8 | 2026-07-03 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency… |
CVE-2026-47898 | Critical | 9.8 | 2026-07-03 | Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects Apache Lucen… |
CVE-2026-14544 | Critical | 9.8 | 2026-07-03 | A flaw was found in HPLIP (HP Linux Imaging and Printing Software). This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to esc… |
CVE-2026-9079 | Critical | 9.8 | 2026-07-03 | libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for s… |
CVE-2026-8927 | Critical | 9.1 | 2026-07-03 | When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication stat… |
CVE-2026-8926 | Critical | 9.1 | 2026-07-03 | When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@exam… |
CVE-2026-8925 | Critical | 9.8 | 2026-07-03 | The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free(… |
CVE-2026-8924 | Critical | 9.1 | 2026-07-03 | A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-… |
CVE-2026-11856 | Critical | 9.8 | 2026-07-03 | Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one… |
CVE-2026-11564 | Critical | 9.1 | 2026-07-03 | libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first u… |
CVE-2026-10536 | Critical | 9.8 | 2026-07-03 | A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREA… |
CVE-2026-9725 | Critical | 9.1 | 2026-07-03 | The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5… |
CVE-2026-13768 | Critical | 10.0 | 2026-07-03 | Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns… |
CVE-2026-57100 | Critical | 9.9 | 2026-07-02 | Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network. |
CVE-2026-45499 | Critical | 9.9 | 2026-07-02 | Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network. |
CVE-2026-41106 | Critical | 9.3 | 2026-07-02 | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-52830 | Critical | 9.4 | 2026-07-02 | fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file… |
CVE-2026-38971 | Critical | 9.1 | 2026-07-02 | ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::handle_serial_co… |
CVE-2026-38968 | Critical | 9.8 | 2026-07-02 | ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak… |
CVE-2026-59099 | Critical | 9.1 | 2026-07-02 | Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state b… |
CVE-2026-58466 | Critical | 9.8 | 2026-07-02 | AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by… |
CVE-2026-44935 | Critical | 9.9 | 2026-07-02 | Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 befor… |
CVE-2024-14037 | Critical | 9.8 | 2026-07-02 | Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious… |
CVE-2022-50973 | Critical | 9.8 | 2026-07-02 | Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attacker… |
CVE-2026-58455 | Critical | 9.8 | 2026-07-02 | Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by ex… |
CVE-2026-56004 | Critical | 10.0 | 2026-07-02 | A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service fi… |
CVE-2026-55116 | Critical | 9.0 | 2026-07-02 | A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain d… |
CVE-2026-55115 | Critical | 9.9 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate pri… |
CVE-2026-54402 | Critical | 9.9 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command… |
CVE-2026-54400 | Critical | 9.1 | 2026-07-02 | A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to es… |
CVE-2026-50748 | Critical | 9.9 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to e… |
CVE-2026-50747 | Critical | 9.9 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Appli… |
CVE-2026-50746 | Critical | 10.0 | 2026-07-02 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Inj… |
CVE-2026-4767 | Critical | 9.8 | 2026-07-02 | Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. WAF-ASP allows Authentication Abuse. This issue affects WAF-ASP: from v… |
CVE-2026-5524 | Critical | 9.8 | 2026-07-02 | The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. T… |
CVE-2026-57683 | Critical | 9.3 | 2026-07-02 | Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions. |
CVE-2026-57679 | Critical | 9.3 | 2026-07-02 | Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions. |
CVE-2026-57677 | Critical | 9.8 | 2026-07-02 | Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions. |
CVE-2026-57625 | Critical | 9.6 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions. |
CVE-2026-57624 | Critical | 10.0 | 2026-07-02 | Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions. |
CVE-2026-57623 | Critical | 9.0 | 2026-07-02 | Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions. |
CVE-2026-57621 | Critical | 9.8 | 2026-07-02 | Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions. |
CVE-2026-27436 | Critical | 9.1 | 2026-07-02 | Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions. |
CVE-2026-27419 | Critical | 9.9 | 2026-07-02 | Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions. |
CVE-2026-14425 | Critical | 9.6 | 2026-07-01 | Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
CVE-2026-14424 | Critical | 9.6 | 2026-07-01 | Use after free in Dawn in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page… |
CVE-2026-14423 | Critical | 9.6 | 2026-07-01 | Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chro… |
CVE-2026-14420 | Critical | 9.6 | 2026-07-01 | Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HT… |
CVE-2026-14419 | Critical | 9.6 | 2026-07-01 | Use after free in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chro… |
CVE-2026-14417 | Critical | 9.6 | 2026-07-01 | Use after free in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chro… |
CVE-2026-14416 | Critical | 9.6 | 2026-07-01 | Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (… |
CVE-2026-14411 | Critical | 9.6 | 2026-07-01 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape v… |
CVE-2026-14405 | Critical | 9.6 | 2026-07-01 | Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-14398 | Critical | 9.6 | 2026-07-01 | Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
CVE-2026-14397 | Critical | 9.6 | 2026-07-01 | Out of bounds write in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-14392 | Critical | 9.6 | 2026-07-01 | Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page… |
CVE-2026-14390 | Critical | 9.6 | 2026-07-01 | Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
CVE-2026-14387 | Critical | 9.6 | 2026-07-01 | Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Ch… |
CVE-2026-14382 | Critical | 9.6 | 2026-07-01 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape v… |
CVE-2026-52186 | Critical | 9.8 | 2026-07-01 | SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub_463bbc component |
CVE-2026-58457 | Critical | 9.8 | 2026-07-01 | Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS command injection vulnerability that allows network-adjacent attackers… |
CVE-2026-14363 | Critical | 9.8 | 2026-07-01 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allo… |
CVE-2026-53492 | Critical | 9.6 | 2026-07-01 | containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interfac… |
CVE-2026-51947 | Critical | 9.8 | 2026-07-01 | An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_20260316.zip) allows a… |
CVE-2026-50195 | Critical | 9.9 | 2026-07-01 | containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it… |
CVE-2026-50160 | Critical | 10.0 | 2026-07-01 | Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/on… |
CVE-2026-58521 | Critical | 9.8 | 2026-07-01 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allo… |
CVE-2026-58453 | Critical | 9.8 | 2026-07-01 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to g… |
CVE-2026-34117 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in text_to_subtitles.php (line 19) without sanitization: exec(\"php jobs/t… |