Critical-severity CVEs (page 43)
Page 43 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34116 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.php (line 15) without sanitization: exec(\"php jobs/transcri… |
CVE-2026-34115 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_amazon.php (line 15) without sanitization: exec(\"php jobs/t… |
CVE-2026-34114 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_text.php (line 18) without sanitization: exec(\"php jobs/tran… |
CVE-2026-34113 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech_text.php (line 18) without sanitization: exec(\"php jobs/speech_… |
CVE-2026-34112 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.php (line 18) without sanitization: exec(\"php jobs/speech_au… |
CVE-2026-34111 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_text.php (line 18) without sanitization: exec(\"php jobs/spee… |
CVE-2026-34110 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_start.php (line 14) without sanitization: exec(\"php jobs/compl… |
CVE-2026-34109 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php (line 18) without sanitization: exec(\"php jobs/speech_audio… |
CVE-2026-34108 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in text.php (line 15) without sanitization: exec(\"php jobs/text.php \".$l… |
CVE-2026-34107 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate.php (line 14) without sanitization: exec(\"php jobs/translate… |
CVE-2026-34106 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitle_… |
CVE-2026-34099 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info.php (line 16): SELECT * FROM jobs where id = '\".$_GET[… |
CVE-2026-58127 | Critical | 9.8 | 2026-07-01 | PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemot… |
CVE-2026-58126 | Critical | 9.8 | 2026-07-01 | PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by expl… |
CVE-2026-58025 | Critical | 9.8 | 2026-07-01 | Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiIm… |
CVE-2026-57517 | Critical | 9.8 | 2026-07-01 | Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries… |
CVE-2026-24270 | Critical | 9.8 | 2026-07-01 | NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication. A successful exploit of this vulnerability might lead to denia… |
CVE-2025-23351 | Critical | 9.0 | 2026-07-01 | NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bo… |
CVE-2025-23350 | Critical | 9.0 | 2026-07-01 | NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bo… |
CVE-2025-15646 | Critical | 9.8 | 2026-07-01 | HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, bu… |
CVE-2026-23537 | Critical | 9.1 | 2026-07-01 | A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that allows an unauthenticated remote attacker to write arbitrary J… |
CVE-2026-57692 | Critical | 9.8 | 2026-07-01 | Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. This issue affects PrivateContent: from n/a through 9.9.2. |
CVE-2026-53355 | Critical | 9.8 | 2026-07-01 | In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is written so… |
CVE-2026-14198 | Critical | 9.1 | 2026-07-01 | @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underl… |
CVE-2026-11387 | Critical | 9.8 | 2026-07-01 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account… |
CVE-2026-10539 | Critical | 9.0 | 2026-07-01 | A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauth… |
CVE-2026-7840 | Critical | 9.8 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in… |
CVE-2026-7839 | Critical | 9.1 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when setting… |
CVE-2026-6070 | Critical | 9.1 | 2026-07-01 | The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to in… |
CVE-2026-56700 | Critical | 9.8 | 2026-06-30 | Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapte… |
CVE-2026-56415 | Critical | 10.0 | 2026-06-30 | Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authentication. A remote attac… |
CVE-2026-56413 | Critical | 10.0 | 2026-06-30 | Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by default and accepts… |
CVE-2026-56278 | Critical | 9.1 | 2026-06-30 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRES… |
CVE-2026-55721 | Critical | 9.3 | 2026-06-30 | Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incor… |
CVE-2026-50110 | Critical | 9.2 | 2026-06-30 | Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are… |
CVE-2026-14152 | Critical | 9.6 | 2026-06-30 | Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-14121 | Critical | 9.8 | 2026-06-30 | Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic… |
CVE-2026-14120 | Critical | 9.6 | 2026-06-30 | Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentia… |
CVE-2026-14113 | Critical | 9.6 | 2026-06-30 | Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-14109 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-14106 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Text in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendere… |
CVE-2026-14104 | Critical | 9.8 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside… |
CVE-2026-14101 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-14097 | Critical | 9.6 | 2026-06-30 | Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-14095 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potent… |
CVE-2026-14093 | Critical | 9.6 | 2026-06-30 | Use after free in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
CVE-2026-14056 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-14055 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Device Trust in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the… |
CVE-2026-14044 | Critical | 9.6 | 2026-06-30 | Use after free in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2026-14043 | Critical | 9.6 | 2026-06-30 | Use after free in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
CVE-2026-14038 | Critical | 9.3 | 2026-06-30 | Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer p… |
CVE-2026-14037 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentiall… |
CVE-2026-14017 | Critical | 9.6 | 2026-06-30 | Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potent… |
CVE-2026-13934 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendere… |
CVE-2026-13920 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the render… |
CVE-2026-13909 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to poten… |
CVE-2026-13901 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potenti… |
CVE-2026-13883 | Critical | 9.6 | 2026-06-30 | Type Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
CVE-2026-13882 | Critical | 9.6 | 2026-06-30 | Race in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape… |
CVE-2026-13880 | Critical | 9.6 | 2026-06-30 | Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-13878 | Critical | 9.6 | 2026-06-30 | Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-13872 | Critical | 9.1 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to potentially perform… |
CVE-2026-13869 | Critical | 9.6 | 2026-06-30 | Use after free in Device in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-13861 | Critical | 9.6 | 2026-06-30 | Use after free in Core in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
CVE-2026-13859 | Critical | 9.6 | 2026-06-30 | Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
CVE-2026-13854 | Critical | 9.6 | 2026-06-30 | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perf… |
CVE-2026-13853 | Critical | 9.6 | 2026-06-30 | Use after free in Journeys in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-13852 | Critical | 9.1 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionar… |
CVE-2026-13851 | Critical | 9.1 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionar… |
CVE-2026-13846 | Critical | 9.6 | 2026-06-30 | Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-13843 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromised the r… |
CVE-2026-13798 | Critical | 9.6 | 2026-06-30 | Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-13797 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-13796 | Critical | 9.6 | 2026-06-30 | Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
CVE-2026-13792 | Critical | 9.6 | 2026-06-30 | Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
CVE-2026-13789 | Critical | 9.6 | 2026-06-30 | Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandb… |
CVE-2026-13785 | Critical | 9.6 | 2026-06-30 | Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2026-13782 | Critical | 10.0 | 2026-06-30 | Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2026-13781 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-13780 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-13776 | Critical | 9.8 | 2026-06-30 | Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
CVE-2026-13775 | Critical | 9.8 | 2026-06-30 | Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandb… |
CVE-2026-58449 | Critical | 9.8 | 2026-06-30 | txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body parameter is resolved through txtai.util.Resolver, which pe… |
CVE-2026-50003 | Critical | 9.8 | 2026-06-30 | A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both r… |
CVE-2026-37106 | Critical | 9.8 | 2026-06-30 | An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disput… |
CVE-2026-7874 | Critical | 9.1 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanis… |
CVE-2026-7873 | Critical | 9.9 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling… |
CVE-2026-7871 | Critical | 9.8 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data… |
CVE-2026-7803 | Critical | 9.8 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields. |
CVE-2026-7663 | Critical | 9.1 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper… |
CVE-2026-11712 | Critical | 9.3 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system. |
CVE-2026-11708 | Critical | 9.3 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system. |
CVE-2026-10140 | Critical | 9.6 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenti… |
CVE-2026-10134 | Critical | 10.0 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, messa… |
CVE-2026-10109 | Critical | 9.8 | 2026-06-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling. |
CVE-2026-58138 | Critical | 9.8 | 2026-06-30 | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS comm… |
CVE-2026-58172 | Critical | 9.1 | 2026-06-30 | Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restr… |
CVE-2026-58166 | Critical | 9.1 | 2026-06-30 | OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that allows unauthenticated remote attackers to write or delete… |
CVE-2026-48315 | Critical | 9.3 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-48313 | Critical | 9.3 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability… |