Critical-severity CVEs (page 43)
Page 43 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32194 | Critical | 9.8 | 2026-03-19 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code ov… |
CVE-2026-32038 | Critical | 9.8 | 2026-03-19 | OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace… |
CVE-2026-30872 | Critical | 9.8 | 2026-03-19 | OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Over… |
CVE-2026-30871 | Critical | 9.8 | 2026-03-19 | OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Over… |
CVE-2026-4395 | Critical | 9.8 | 2026-03-19 | Heap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import_x963_ex() in wolfSSL wolfcrypt allows a remote attacker to write attacker-controlled dat… |
CVE-2026-3849 | Critical | 9.8 | 2026-03-19 | Stack Buffer Overflow in wc_HpkeLabeledExtract via Oversized ECH Config. A vulnerability existed in wolfSSL 5.8.4 ECH (Encrypted Client Hello) support, where a… |
CVE-2026-3549 | Critical | 9.8 | 2026-03-19 | Heap Overflow in TLS 1.3 ECH parsing. An integer underflow existed in ECH extension parsing logic when calculating a buffer length, which resulted in writing b… |
CVE-2026-32191 | Critical | 9.8 | 2026-03-19 | Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute… |
CVE-2026-32169 | Critical | 10.0 | 2026-03-19 | Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-30924 | Critical | 9.6 | 2026-03-19 | qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also re… |
CVE-2026-30836 | Critical | 10.0 | 2026-03-19 | Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unau… |
CVE-2026-26137 | Critical | 9.9 | 2026-03-19 | Server-side request forgery (ssrf) in Microsoft Exchange allows an authorized attacker to elevate privileges over a network. |
CVE-2026-32238 | Critical | 9.1 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection… |
CVE-2026-3548 | Critical | 9.8 | 2026-03-19 | Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a heap-based buffer overflow could occur when improperly storin… |
CVE-2026-30694 | Critical | 9.8 | 2026-03-19 | An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter component |
CVE-2025-67114 | Critical | 9.8 | 2026-03-19 | Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@230804… |
CVE-2025-67113 | Critical | 9.8 | 2026-03-19 | OS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote… |
CVE-2025-67112 | Critical | 9.8 | 2026-03-19 | Use of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3… |
CVE-2026-32865 | Critical | 9.8 | 2026-03-19 | OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswo… |
CVE-2026-30402 | Critical | 9.8 | 2026-03-19 | An issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the test connection function |
CVE-2026-22557 | Critical | 10.0 | 2026-03-19 | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underly… |
CVE-2006-10003 | Critical | 9.8 | 2026-03-19 | XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will… |
CVE-2026-27067 | Critical | 9.1 | 2026-03-19 | Unrestricted Upload of File with Dangerous Type vulnerability in Syarif Mobile App Editor mobile-app-editor allows Upload a Web Shell to a Web Server.This issu… |
CVE-2026-27065 | Critical | 9.8 | 2026-03-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress BuilderPress builderpress al… |
CVE-2025-60237 | Critical | 9.8 | 2026-03-19 | Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0. |
CVE-2025-60233 | Critical | 9.8 | 2026-03-19 | Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2. |
CVE-2026-27542 | Critical | 9.8 | 2026-03-19 | Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Privilege E… |
CVE-2026-27540 | Critical | 9.0 | 2026-03-19 | Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture a… |
CVE-2026-27413 | Critical | 9.3 | 2026-03-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Profile Builder Pro allows Blind SQL Injection… |
CVE-2026-32737 | Critical | 10.0 | 2026-03-18 | Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub… |
CVE-2026-32731 | Critical | 9.9 | 2026-03-18 | ApostropheCMS is an open-source content management framework. Prior to version 3.5.3 of `@apostrophecms/import-export`, The `extract()` function in `gzip.js` c… |
CVE-2025-15031 | Critical | 9.1 | 2026-03-18 | A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use o… |
CVE-2026-32703 | Critical | 9.0 | 2026-03-18 | OpenProject is an open-source, web-based project management software. In versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1, the Repositories module did not… |
CVE-2026-32698 | Critical | 9.1 | 2026-03-18 | OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection a… |
CVE-2026-31972 | Critical | 9.8 | 2026-03-18 | SAMtools is a program for reading, manipulating and writing bioinformatics file formats. The `mpileup` command outputs DNA sequences that have been aligned aga… |
CVE-2026-25873 | Critical | 9.8 | 2026-03-18 | OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary co… |
CVE-2026-31967 | Critical | 9.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_dec… |
CVE-2026-31966 | Critical | 9.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of… |
CVE-2026-32633 | Critical | 9.1 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw… |
CVE-2026-30704 | Critical | 9.1 | 2026-03-18 | The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) exposes an unprotected UART interface through accessible hardware pads on the PCB |
CVE-2026-30703 | Critical | 9.8 | 2026-03-18 | A command injection vulnerability exists in the web management interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02). The adm.cgi endpoint im… |
CVE-2026-30702 | Critical | 9.8 | 2026-03-18 | The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web management interface. The login page does no… |
CVE-2026-30701 | Critical | 9.1 | 2026-03-18 | The web interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) contains hardcoded credential disclosure mechanisms (in the form of Server Side… |
CVE-2026-29859 | Critical | 9.8 | 2026-03-18 | An arbitrary file upload vulnerability in aaPanel v7.57.0 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2025-67830 | Critical | 9.8 | 2026-03-18 | Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection. |
CVE-2025-67829 | Critical | 9.8 | 2026-03-18 | Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection. |
CVE-2026-25449 | Critical | 9.8 | 2026-03-18 | Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1. |
CVE-2026-31938 | Critical | 9.6 | 2026-03-18 | jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to… |
CVE-2026-30884 | Critical | 9.6 | 2026-03-18 | mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser. Prior to ve… |
CVE-2026-27459 | Critical | 9.8 | 2026-03-18 | pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_ge… |
CVE-2026-21994 | Critical | 9.8 | 2026-03-17 | Vulnerability in the Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit product of Oracle Open Source Projects (component: Desktop). The sup… |
CVE-2026-3207 | Critical | 9.8 | 2026-03-17 | Configuration issue in Java Management Extensions (JMX) in TIBCO BPM Enterprise version 4.x allows unauthorised access. |
CVE-2026-32298 | Critical | 9.1 | 2026-03-17 | The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level co… |
CVE-2026-25770 | Critical | 9.1 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privileg… |
CVE-2026-25769 | Critical | 9.1 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE)… |
CVE-2026-25534 | Critical | 9.1 | 2026-03-17 | ### Impact Spinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver. However, they missed that Java UR… |
CVE-2026-3564 | Critical | 9.0 | 2026-03-17 | A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unaut… |
CVE-2026-4312 | Critical | 9.8 | 2026-03-17 | GCB/FCB Audit Software developed by DrangSoft has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access certain… |
CVE-2026-4177 | Critical | 9.1 | 2026-03-16 | YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. T… |
CVE-2025-69902 | Critical | 9.8 | 2026-03-16 | A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting… |
CVE-2026-32267 | Critical | 9.8 | 2026-03-16 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-priv… |
CVE-2026-28430 | Critical | 9.8 | 2026-03-16 | Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to… |
CVE-2025-69809 | Critical | 9.8 | 2026-03-16 | A write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to write arbitrary values to memory, enabling arbitrary code execu… |
CVE-2025-69808 | Critical | 9.1 | 2026-03-16 | An out-of-bounds memory access (OOB) in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to access sensitive information and cause a Denial of Serv… |
CVE-2026-4254 | Critical | 9.8 | 2026-03-16 | A weakness has been identified in Tenda AC8 up to 16.03.50.11. This vulnerability affects the function doSystemCmd of the file /goform/SysToolChangePwd of the… |
CVE-2026-27962 | Critical | 9.1 | 2026-03-16 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implem… |
CVE-2026-23489 | Critical | 9.1 | 2026-03-16 | Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from… |
CVE-2026-4252 | Critical | 9.8 | 2026-03-16 | A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation l… |
CVE-2025-62319 | Critical | 9.8 | 2026-03-16 | Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into app… |
CVE-2026-4184 | Critical | 9.8 | 2026-03-16 | A vulnerability was detected in D-Link DIR-816 1.10CNB05. Affected by this vulnerability is an unknown functionality of the file /goform/form2Wl5BasicSetup.cgi… |
CVE-2026-4183 | Critical | 9.8 | 2026-03-16 | A security vulnerability has been detected in D-Link DIR-816 1.10CNB05. Affected is an unknown function of the file /goform/form2WlanBasicSetup.cgi of the comp… |
CVE-2026-4182 | Critical | 9.8 | 2026-03-16 | A weakness has been identified in D-Link DIR-816 1.10CNB05. This impacts an unknown function of the file /goform/form2Wl5RepeaterStep2.cgi of the component goa… |
CVE-2026-4181 | Critical | 9.8 | 2026-03-16 | A security flaw has been discovered in D-Link DIR-816 1.10CNB05. This affects an unknown function of the file /goform/form2RepeaterStep2.cgi of the component g… |
CVE-2026-4170 | Critical | 9.8 | 2026-03-16 | A weakness has been identified in Topsec TopACM 3.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfig/management/nmc_s… |
CVE-2026-4164 | Critical | 9.8 | 2026-03-16 | A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is the function Delete_Mac_list/SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the compone… |
CVE-2026-4163 | Critical | 9.8 | 2026-03-16 | A vulnerability was detected in Wavlink WL-WN579A3 220323. This issue affects the function SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component… |
CVE-2026-32640 | Critical | 9.8 | 2026-03-16 | SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through… |
CVE-2026-32635 | Critical | 9.0 | 2026-03-16 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21… |
CVE-2026-32626 | Critical | 9.6 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, AnythingLLM… |
CVE-2026-32621 | Critical | 9.9 | 2026-03-16 | Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability… |
CVE-2026-20998 | Critical | 9.8 | 2026-03-16 | Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication. |
CVE-2026-20997 | Critical | 9.8 | 2026-03-16 | Improper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass authentication. |
CVE-2025-69246 | Critical | 9.8 | 2026-03-16 | Raytha CMS does not have any brute force protection mechanism implemented. It allows an attacker to send multiple automated logon requests without triggering l… |
CVE-2025-15060 | Critical | 9.8 | 2026-03-16 | claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2017-20224 | Critical | 9.8 | 2026-03-16 | Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious con… |
CVE-2017-20223 | Critical | 9.8 | 2026-03-16 | Telesquare SKT LTE Router SDT-CS3B1 firmware version 1.2.0 contains an insecure direct object reference vulnerability that allows attackers to bypass authoriza… |
CVE-2016-20030 | Critical | 9.8 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial char… |
CVE-2016-20026 | Critical | 9.8 | 2026-03-16 | ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager applicat… |
CVE-2016-20024 | Critical | 9.8 | 2026-03-16 | ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to escalate privileges by modifying executable fil… |
CVE-2026-3891 | Critical | 9.8 | 2026-03-13 | The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'l… |
CVE-2026-32746 | Critical | 9.8 | 2026-03-13 | telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check… |
CVE-2026-32367 | Critical | 9.1 | 2026-03-13 | Improper Control of Generation of Code ('Code Injection') vulnerability in Yannick Lefebvre Modal Dialog modal-dialog allows Remote Code Inclusion.This issue a… |
CVE-2026-32306 | Critical | 9.9 | 2026-03-13 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, a… |
CVE-2026-32304 | Critical | 9.8 | 2026-03-13 | Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes… |
CVE-2026-32301 | Critical | 9.3 | 2026-03-13 | Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configure… |
CVE-2026-31886 | Critical | 9.1 | 2026-03-13 | Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is pass… |
CVE-2026-31806 | Critical | 9.8 | 2026-03-13 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent… |
CVE-2026-26954 | Critical | 10.0 | 2026-03-13 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an… |
CVE-2026-25823 | Critical | 9.8 | 2026-03-13 | HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have a stack buffer o… |
CVE-2026-25818 | Critical | 9.1 | 2026-03-13 | HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have weak entropy for… |