Critical-severity CVEs (page 46)

Page 46 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.

All critical-severity CVEs — newest first (page 46 of 100)
CVESeverityScorePublishedSummary
CVE-2026-5366Critical9.92026-06-20Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `comm…
CVE-2024-58351Critical9.82026-06-20Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web…
CVE-2022-50972Critical9.82026-06-20WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the pr…
CVE-2019-25763Critical9.82026-06-20WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by explo…
CVE-2026-48939Critical9.82026-06-20A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code uplo…
CVE-2026-48908Critical9.82026-06-20A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP c…
CVE-2026-9265Critical9.12026-06-20Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRING ASN.1 a…
CVE-2026-11551Critical9.82026-06-20The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plu…
CVE-2026-56081Critical9.12026-06-19Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before tha…
CVE-2026-56073Critical9.42026-06-19Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying serv…
CVE-2026-48584Critical9.92026-06-19Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network.
CVE-2026-48582Critical9.62026-06-19Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
CVE-2026-45480Critical10.02026-06-19Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-48773Critical9.82026-06-19ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 have a pre-authentication heap memory corruption vulnerabilit…
CVE-2026-48772Critical10.02026-06-19ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL frontend accepts the `PROXY UNKNOWN <ad…
CVE-2026-51846Critical9.82026-06-19In Tenda AC7 v15.03.06.44, the wanSpeed parameter of the route /goform/AdvSetMacMtuWan has a stack buffer overflow vulnerability that can lead to remote arbitr…
CVE-2026-51845Critical9.82026-06-19Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the mac parameter.
CVE-2026-51844Critical9.82026-06-19Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the cloneType parameter.
CVE-2026-51843Critical9.82026-06-19Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the wanMTU parameter.
CVE-2026-9142Critical9.12026-06-19There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback.  This m…
CVE-2026-49871Critical9.32026-06-19Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send…
CVE-2026-49230Critical9.12026-06-19Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to authenticatio…
CVE-2026-48137Critical9.12026-06-19There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an arbitrary memory de…
CVE-2026-44087Critical9.12026-06-19Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an attack surface tha…
CVE-2026-39999Critical9.12026-06-19Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication capitalising on certain configurations of…
CVE-2025-62821Critical9.12026-06-19Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data si…
CVE-2026-56142Critical9.92026-06-19In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authenticatio…
CVE-2026-56141Critical9.82026-06-19In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes…
CVE-2026-50242Critical10.02026-06-19In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database acces…
CVE-2026-8713Critical9.12026-06-19The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files fun…
CVE-2026-7515Critical9.82026-06-19The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 via the `doc_style` parameter. This makes…
CVE-2026-54414Critical9.82026-06-19FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file w…
CVE-2026-40624Critical9.82026-06-19Improper input validation in AVer PTC500S, PTC115, PTC500+, and PTC115+ cameras may allow a remote, unauthenticated attacker to achieve arbitrary code execut…
CVE-2026-12048Critical9.32026-06-19Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, includi…
CVE-2026-12046Critical9.02026-06-19Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connecti…
CVE-2026-12045Critical9.02026-06-19Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary…
CVE-2026-54130Critical9.82026-06-18Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-47647Critical9.92026-06-18Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.
CVE-2026-49454Critical9.12026-06-18Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and Phoenix. Versions 1.0.0 and 1.1.0 accept forged SAML signatures because Signatur…
CVE-2026-49257Critical10.02026-06-18mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running a…
CVE-2026-49252Critical9.92026-06-18deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to…
CVE-2026-47846Critical9.82026-06-18Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSAN…
CVE-2026-54390Critical9.82026-06-18JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious templat…
CVE-2026-54103Critical9.82026-06-18The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing S…
CVE-2026-38717Critical9.82026-06-18InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the fi…
CVE-2026-38716Critical9.82026-06-18InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Py…
CVE-2026-38715Critical9.82026-06-18InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the lo…
CVE-2026-38714Critical9.82026-06-18InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Py…
CVE-2026-9158Critical9.82026-06-18In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This…
CVE-2026-8024Critical9.82026-06-18A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full access to the affe…
CVE-2026-54419Critical9.82026-06-18claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multip…
CVE-2026-11718Critical9.12026-06-18An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When the toolbox va…
CVE-2026-11717Critical9.12026-06-18An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When verifying an u…
CVE-2026-55742Critical9.62026-06-18Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.p…
CVE-2026-55740Critical9.82026-06-18Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in…
CVE-2026-12569Critical9.82026-06-18A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the…
CVE-2026-48768Critical9.32026-06-18TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized f…
CVE-2026-54388Critical9.12026-06-17Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all du…
CVE-2026-54387Critical9.12026-06-17Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbat…
CVE-2026-48814Critical9.12026-06-17Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the MCP SSE server allows unauthenticated cross-origin MCP tool inv…
CVE-2026-55196Critical9.12026-06-17Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to…
CVE-2026-53805Critical9.82026-06-17NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-in…
CVE-2026-3894Critical9.12026-06-17Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 befo…
CVE-2026-30803Critical9.12026-06-17Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers. This issue affects Connext Micro: from 4.0…
CVE-2026-20266Critical9.12026-06-17In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterpri…
CVE-2026-53874Critical9.82026-06-17picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested u…
CVE-2026-53873Critical9.82026-06-17picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function, allowing attackers…
CVE-2026-3490Critical10.02026-06-17picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolving any dangerous function through indi…
CVE-2026-36418Critical9.12026-06-17JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions. The /jmreport/executeSelectApi end…
CVE-2026-20181Critical9.12026-06-17A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an a…
CVE-2025-71325Critical9.82026-06-17picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the cor…
CVE-2025-71323Critical9.82026-06-17picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw me…
CVE-2025-71321Critical9.82026-06-17picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util…
CVE-2025-71320Critical9.82026-06-17picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass se…
CVE-2026-55743Critical9.62026-06-17The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execut…
CVE-2026-54812Critical9.32026-06-17Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-li…
CVE-2026-47103Critical9.82026-06-17Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying mal…
CVE-2026-54819Critical9.32026-06-17Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL Injection. This is…
CVE-2026-54815Critical9.32026-06-17Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows B…
CVE-2026-54809Critical9.32026-06-17Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue…
CVE-2026-54808Critical9.32026-06-17Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Blind SQL Inj…
CVE-2026-49268Critical9.12026-06-17A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is d…
CVE-2026-49108Critical9.82026-06-17Unauthenticated PHP Object Injection in Moderno < 1.43 versions.
CVE-2025-69127Critical9.82026-06-17Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.
CVE-2025-69111Critical9.82026-06-17Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.
CVE-2025-60236Critical9.82026-06-17Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5.
CVE-2025-60231Critical9.82026-06-17Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue affects The Hospital: from n/a through 1.8…
CVE-2025-60230Critical9.82026-06-17Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9.
CVE-2025-60229Critical9.82026-06-17Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0.
CVE-2025-59554Critical9.32026-06-17Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions.
CVE-2026-54811Critical9.32026-06-17Unauthenticated SQL Injection in WP eMember < v10.9.4 versions.
CVE-2026-54807Critical9.82026-06-17Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.
CVE-2026-54806Critical9.82026-06-17Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.
CVE-2026-54803Critical9.82026-06-17Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.
CVE-2026-54194Critical9.82026-06-17Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.
CVE-2026-54187Critical9.32026-06-17Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.
CVE-2026-54186Critical9.32026-06-17Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.
CVE-2026-52706Critical9.82026-06-17Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.
CVE-2026-52705Critical9.02026-06-17Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions.
CVE-2026-50203Critical9.12026-06-17A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write f…