Critical-severity CVEs (page 5)
Page 5 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-86591 | Critical | 9.8 | 2026-09-19 | The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbi… |
CVE-2026-93741 | Critical | 10.0 | 2026-09-19 | A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlW… |
CVE-2026-92229 | Critical | 9.1 | 2026-09-19 | The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions… |
CVE-2026-89274 | Critical | 9.1 | 2026-09-19 | The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists… |
CVE-2026-84434 | Critical | 9.8 | 2026-09-19 | The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This… |
CVE-2026-93740 | Critical | 10.0 | 2026-09-18 | A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulatio… |
CVE-2026-93739 | Critical | 9.9 | 2026-09-18 | A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation… |
CVE-2026-75885 | Critical | 9.3 | 2026-09-18 | A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send… |
CVE-2026-93738 | Critical | 9.9 | 2026-09-18 | A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipula… |
CVE-2026-93839 | Critical | 9.8 | 2026-09-18 | LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register… |
CVE-2026-84082 | Critical | 9.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an… |
CVE-2026-84078 | Critical | 9.9 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to a missing authentication vulnerability in the LoadBalancerServlet. An unauthenticated user can access privil… |
CVE-2026-84075 | Critical | 9.9 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to missing authentication for the ChangeTrackerServlet. |
CVE-2026-84073 | Critical | 9.1 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special eleme… |
CVE-2026-84064 | Critical | 9.9 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special eleme… |
CVE-2026-84031 | Critical | 9.0 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page… |
CVE-2026-82967 | Critical | 9.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls a… |
CVE-2026-82832 | Critical | 9.6 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page… |
CVE-2026-82340 | Critical | 9.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Au… |
CVE-2026-81657 | Critical | 9.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted… |
CVE-2026-80442 | Critical | 9.9 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful explo… |
CVE-2026-80441 | Critical | 9.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of chan… |
CVE-2026-75878 | Critical | 9.1 | 2026-09-18 | IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an… |
CVE-2026-61781 | Critical | 9.9 | 2026-09-18 | pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time… |
CVE-2026-58264 | Critical | 9.8 | 2026-09-18 | FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitch_bend_range… |
CVE-2023-54399 | Critical | 9.8 | 2026-09-18 | Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a databa… |
CVE-2026-93762 | Critical | 9.8 | 2026-09-18 | Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to c… |
CVE-2026-92702 | Critical | 9.1 | 2026-09-18 | Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-ha… |
CVE-2026-92701 | Critical | 9.1 | 2026-09-18 | Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-ha… |
CVE-2026-61550 | Critical | 9.8 | 2026-09-18 | Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that th… |
CVE-2026-59163 | Critical | 9.1 | 2026-09-18 | Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_server.py parsed the JWT's header and p… |
CVE-2025-66455 | Critical | 9.8 | 2026-09-18 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch… |
CVE-2026-93765 | Critical | 9.1 | 2026-09-18 | Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from… |
CVE-2026-85497 | Critical | 9.8 | 2026-09-18 | CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking… |
CVE-2026-81321 | Critical | 9.8 | 2026-09-18 | CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through ph… |
CVE-2026-77240 | Critical | 9.9 | 2026-09-18 | WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_update row-level security policy in supabase/migrations/017_acco… |
CVE-2026-84383 | Critical | 9.8 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl refer… |
CVE-2026-75031 | Critical | 9.8 | 2026-09-18 | In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin feature. In default insta… |
CVE-2026-61682 | Critical | 9.9 | 2026-09-18 | kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-prox… |
CVE-2026-10858 | Critical | 9.9 | 2026-09-18 | IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a… |
CVE-2026-10747 | Critical | 10.0 | 2026-09-18 | IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol mes… |
CVE-2025-53837 | Critical | 9.9 | 2026-09-18 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to… |
CVE-2025-15399 | Critical | 10.0 | 2026-09-18 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could all… |
CVE-2026-93606 | Critical | 10.0 | 2026-09-18 | vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes a host API that returns a host-realm Promise, the… |
CVE-2026-93605 | Critical | 10.0 | 2026-09-18 | vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-… |
CVE-2026-93603 | Critical | 10.0 | 2026-09-18 | vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code c… |
CVE-2026-93019 | Critical | 9.1 | 2026-09-18 | Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. The reader unpacks the two… |
CVE-2026-13684 | Critical | 9.8 | 2026-09-18 | An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and… |
CVE-2026-13639 | Critical | 9.8 | 2026-09-18 | An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 al… |
CVE-2026-67101 | Critical | 9.3 | 2026-09-18 | HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to f… |
CVE-2026-67100 | Critical | 9.8 | 2026-09-18 | HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attac… |
CVE-2026-84738 | Critical | 9.1 | 2026-09-18 | The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-priv… |
CVE-2026-93467 | Critical | 9.8 | 2026-09-18 | The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by send… |
CVE-2026-85878 | Critical | 9.9 | 2026-09-18 | Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network. |
CVE-2026-69843 | Critical | 10.0 | 2026-09-18 | Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-62874 | Critical | 10.0 | 2026-09-18 | Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-87701 | Critical | 9.6 | 2026-09-17 | Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate… |
CVE-2026-85889 | Critical | 10.0 | 2026-09-17 | Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-85885 | Critical | 9.9 | 2026-09-17 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a… |
CVE-2026-83944 | Critical | 10.0 | 2026-09-17 | Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-77903 | Critical | 9.0 | 2026-09-17 | Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-70200 | Critical | 10.0 | 2026-09-17 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a… |
CVE-2026-70009 | Critical | 9.3 | 2026-09-17 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a networ… |
CVE-2026-69865 | Critical | 10.0 | 2026-09-17 | Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-69399 | Critical | 10.0 | 2026-09-17 | Azure Arc Elevation of Privilege Vulnerability |
CVE-2026-73639 | Critical | 9.1 | 2026-09-17 | Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8. … |
CVE-2026-54767 | Critical | 9.1 | 2026-09-17 | WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoin… |
CVE-2026-54734 | Critical | 10.0 | 2026-09-17 | Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request UR… |
CVE-2026-54670 | Critical | 9.1 | 2026-09-17 | WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts… |
CVE-2026-93374 | Critical | 9.6 | 2026-09-17 | Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbo… |
CVE-2026-93373 | Critical | 9.6 | 2026-09-17 | Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chro… |
CVE-2026-93372 | Critical | 9.6 | 2026-09-17 | Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a cr… |
CVE-2026-54460 | Critical | 9.8 | 2026-09-17 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a r… |
CVE-2026-45143 | Critical | 9.0 | 2026-09-17 | Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side san… |
CVE-2026-45140 | Critical | 9.8 | 2026-09-17 | Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on th… |
CVE-2025-55787 | Critical | 9.8 | 2026-09-17 | In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists. |
CVE-2026-54752 | Critical | 9.6 | 2026-09-17 | NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pul… |
CVE-2026-54627 | Critical | 9.8 | 2026-09-17 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psd_private_sail_… |
CVE-2026-54626 | Critical | 9.8 | 2026-09-17 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGA_INDEXED_R… |
CVE-2026-54618 | Critical | 9.4 | 2026-09-17 | Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or… |
CVE-2026-54617 | Critical | 9.8 | 2026-09-17 | GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request targe… |
CVE-2026-47252 | Critical | 9.0 | 2026-09-17 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can e… |
CVE-2026-54053 | Critical | 9.6 | 2026-09-17 | Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedV… |
CVE-2026-92489 | Critical | 9.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix skb double-free in xfrm_dev_direct_output() A return value other than 1 from lo… |
CVE-2026-90414 | Critical | 9.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject PDUs declaring more data than was received isert_recv_done() hands each… |
CVE-2026-90413 | Critical | 9.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject login PDUs declaring more data than was received isert_login_recv_done()… |
CVE-2026-90235 | Critical | 9.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE xprtsock rep… |
CVE-2026-90230 | Critical | 9.1 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() nvmet_execute_auth_send() al… |
CVE-2026-90173 | Critical | 9.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: free completion queues with ib_free_cq() smbdirect_connection_destroy_qp(… |
CVE-2026-90151 | Critical | 9.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client allocation failure nfs4_alloc_client() allocat… |
CVE-2026-90110 | Critical | 9.4 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting syst… |
CVE-2026-90104 | Critical | 9.8 | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decode_cb_sequence_args() allocates cs… |
CVE-2026-86863 | Critical | 9.8 | 2026-09-17 | pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered throug… |
CVE-2026-63472 | Critical | 9.1 | 2026-09-17 | Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/… |
CVE-2026-92960 | Critical | 10.0 | 2026-09-17 | vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity a… |
CVE-2026-92957 | Critical | 9.9 | 2026-09-17 | vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require po… |
CVE-2026-92956 | Critical | 10.0 | 2026-09-17 | vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreamin… |
CVE-2026-92955 | Critical | 10.0 | 2026-09-17 | vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout an… |
CVE-2026-92953 | Critical | 10.0 | 2026-09-17 | vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking pr… |
CVE-2026-92951 | Critical | 9.9 | 2026-09-17 | vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of f… |