Critical-severity CVEs (page 44)
Page 44 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48286 | Critical | 10.0 | 2026-06-30 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code… |
CVE-2026-48283 | Critical | 10.0 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary… |
CVE-2026-48282 | Critical | 10.0 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability… |
CVE-2026-48281 | Critical | 10.0 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-48277 | Critical | 10.0 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-48276 | Critical | 10.0 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary… |
CVE-2026-14241 | Critical | 9.8 | 2026-06-30 | Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these cou… |
CVE-2026-8655 | Critical | 9.8 | 2026-06-30 | Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScal… |
CVE-2026-8452 | Critical | 9.8 | 2026-06-30 | Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is conf… |
CVE-2026-6556 | Critical | 9.1 | 2026-06-30 | @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount path… |
CVE-2026-58116 | Critical | 9.8 | 2026-06-30 | LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplyin… |
CVE-2026-8402 | Critical | 9.8 | 2026-06-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Tra… |
CVE-2026-14162 | Critical | 9.8 | 2026-06-30 | Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific… |
CVE-2026-13766 | Critical | 9.8 | 2026-06-30 | DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. The default SQL builder, a SQL::Abstract subclass, sets bin… |
CVE-2026-9711 | Critical | 9.8 | 2026-06-30 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versio… |
CVE-2026-12073 | Critical | 9.8 | 2026-06-30 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to… |
CVE-2026-55276 | Critical | 9.1 | 2026-06-29 | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when… |
CVE-2026-53434 | Critical | 9.1 | 2026-06-29 | Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat… |
CVE-2026-57498 | Critical | 9.6 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consiste… |
CVE-2026-39868 | Critical | 9.1 | 2026-06-29 | This issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15… |
CVE-2026-37637 | Critical | 9.1 | 2026-06-29 | An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php component |
CVE-2026-13763 | Critical | 9.8 | 2026-06-29 | Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule b… |
CVE-2026-13762 | Critical | 9.8 | 2026-06-29 | Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspecti… |
CVE-2026-56782 | Critical | 9.8 | 2026-06-29 | Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access… |
CVE-2026-11720 | Critical | 9.1 | 2026-06-29 | A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder subst… |
CVE-2026-57331 | Critical | 9.9 | 2026-06-29 | Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions. |
CVE-2026-56290 | Critical | 9.8 | 2026-06-29 | Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an un… |
CVE-2026-49048 | Critical | 9.8 | 2026-06-28 | The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter in… |
CVE-2026-58053 | Critical | 9.9 | 2026-06-28 | Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when… |
CVE-2026-12415 | Critical | 9.8 | 2026-06-27 | The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX ac… |
CVE-2026-28701 | Critical | 9.8 | 2026-06-26 | Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate ar… |
CVE-2026-53576 | Critical | 10.0 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) t… |
CVE-2026-49869 | Critical | 10.0 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("… |
CVE-2026-54352 | Critical | 9.6 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-upl… |
CVE-2026-54350 | Critical | 10.0 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing M… |
CVE-2026-50137 | Critical | 9.4 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id (app_...) and an S3-source datas… |
CVE-2026-53309 | Critical | 9.8 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison The local-vs-remote re… |
CVE-2026-52785 | Critical | 9.9 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a SQL injection in timestamps functionality. OpenProjec… |
CVE-2026-52782 | Critical | 9.9 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects/<A>/settings/project_storages… |
CVE-2026-52780 | Critical | 9.6 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, cache store poisoning leads to Remote Code Execution (RCE). This… |
CVE-2026-46386 | Critical | 9.9 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERW… |
CVE-2026-33646 | Critical | 9.6 | 2026-06-26 | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes .tool-versions files through the Tera template engine during… |
CVE-2026-54636 | Critical | 9.0 | 2026-06-26 | Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app… |
CVE-2026-45408 | Critical | 9.0 | 2026-06-26 | Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user… |
CVE-2026-45406 | Critical | 9.0 | 2026-06-26 | Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to th… |
CVE-2026-45405 | Critical | 9.0 | 2026-06-26 | Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories… |
CVE-2026-0685 | Critical | 9.8 | 2026-06-26 | Server side template inject (SSTI) in the expression evaluation component in Genshi Template Engine version 0.7.9 allows a remote attacker to achieve remote co… |
CVE-2025-11919 | Critical | 9.6 | 2026-06-26 | The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTempora… |
CVE-2026-57658 | Critical | 9.1 | 2026-06-26 | Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions. |
CVE-2026-56070 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions. |
CVE-2026-56068 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions. |
CVE-2026-56067 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions. |
CVE-2026-56062 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions. |
CVE-2026-56059 | Critical | 9.9 | 2026-06-26 | Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions. |
CVE-2026-56058 | Critical | 9.9 | 2026-06-26 | Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions. |
CVE-2026-56057 | Critical | 9.8 | 2026-06-26 | Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions. |
CVE-2026-56036 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions. |
CVE-2026-56034 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions. |
CVE-2026-56033 | Critical | 9.8 | 2026-06-26 | Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions. |
CVE-2026-56032 | Critical | 9.8 | 2026-06-26 | Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions. |
CVE-2026-56030 | Critical | 9.8 | 2026-06-26 | Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions. |
CVE-2026-56028 | Critical | 9.8 | 2026-06-26 | Unauthenticated Privilege Escalation in Easy Elements for Elementor – Addons & Website Templates <= 1.4.9 versions. |
CVE-2026-56027 | Critical | 9.9 | 2026-06-26 | Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions. |
CVE-2026-54831 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. |
CVE-2026-54827 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. |
CVE-2026-54825 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in wpDataTables <= 7.4 versions. |
CVE-2026-54820 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. |
CVE-2025-64152 | Critical | 9.1 | 2026-06-26 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 befo… |
CVE-2025-55017 | Critical | 9.1 | 2026-06-26 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 befo… |
CVE-2026-57881 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is cau… |
CVE-2026-57880 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caus… |
CVE-2026-57879 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caus… |
CVE-2026-57878 | Critical | 9.8 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is ca… |
CVE-2026-48930 | Critical | 9.8 | 2026-06-26 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings… |
CVE-2026-40702 | Critical | 9.4 | 2026-06-25 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weaknes… |
CVE-2025-71338 | Critical | 10.0 | 2026-06-25 | Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the stor… |
CVE-2025-71336 | Critical | 9.8 | 2026-06-25 | Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which… |
CVE-2025-71334 | Critical | 9.8 | 2026-06-25 | Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and ch… |
CVE-2025-71333 | Critical | 9.8 | 2026-06-25 | Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Att… |
CVE-2025-71327 | Critical | 9.1 | 2026-06-25 | Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create us… |
CVE-2026-56445 | Critical | 9.1 | 2026-06-25 | The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowin… |
CVE-2026-7531 | Critical | 9.8 | 2026-06-25 | Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 (released in 5.9.1): a malicious TLS 1.3 server sending a… |
CVE-2026-57700 | Critical | 10.0 | 2026-06-25 | Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through… |
CVE-2026-56786 | Critical | 9.8 | 2026-06-25 | RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size… |
CVE-2026-54917 | Critical | 10.0 | 2026-06-25 | SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST cat… |
CVE-2026-54089 | Critical | 9.1 | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc… |
CVE-2026-50549 | Critical | 9.8 | 2026-06-25 | Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent can… |
CVE-2026-50548 | Critical | 9.8 | 2026-06-25 | Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write… |
CVE-2026-6094 | Critical | 9.1 | 2026-06-25 | Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data… |
CVE-2026-54849 | Critical | 9.3 | 2026-06-25 | Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions. |
CVE-2026-54843 | Critical | 9.3 | 2026-06-25 | Unauthenticated SQL Injection in MDTF <= 1.3.7 versions. |
CVE-2026-54836 | Critical | 9.3 | 2026-06-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC… |
CVE-2026-54823 | Critical | 9.9 | 2026-06-25 | Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions. |
CVE-2026-41120 | Critical | 9.8 | 2026-06-25 | Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged… |
CVE-2026-53260 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a w… |
CVE-2026-53247 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() ca… |
CVE-2026-53246 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening S… |
CVE-2026-53228 | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inn… |
CVE-2026-53225 | Critical | 9.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sc… |
CVE-2026-53224 | Critical | 9.1 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie(… |