Critical-severity CVEs (page 5)
Page 5 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-16054 | Critical | 9.1 | 2026-08-06 | The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that i… |
CVE-2026-12713 | Critical | 9.1 | 2026-08-06 | The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthen… |
CVE-2026-67873 | Critical | 9.8 | 2026-08-06 | A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegment_encode() valida… |
CVE-2026-67870 | Critical | 9.8 | 2026-08-06 | In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacke… |
CVE-2026-52466 | Critical | 9.8 | 2026-08-06 | Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuF… |
CVE-2026-71319 | Critical | 9.6 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the… |
CVE-2025-63823 | Critical | 9.8 | 2026-08-05 | My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and… |
CVE-2026-70615 | Critical | 9.9 | 2026-08-05 | boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject… |
CVE-2026-48168 | Critical | 10.0 | 2026-08-05 | PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it… |
CVE-2026-70426 | Critical | 9.0 | 2026-08-05 | In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class f… |
CVE-2026-20310 | Critical | 9.1 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive inter… |
CVE-2026-20304 | Critical | 9.9 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive inter… |
CVE-2026-20303 | Critical | 9.9 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive inter… |
CVE-2026-20272 | Critical | 9.8 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive inter… |
CVE-2026-20267 | Critical | 9.0 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive inter… |
CVE-2026-9195 | Critical | 9.3 | 2026-08-05 | A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authentic… |
CVE-2026-9193 | Critical | 9.9 | 2026-08-05 | An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user wit… |
CVE-2026-9192 | Critical | 9.8 | 2026-08-05 | An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker t… |
CVE-2026-9190 | Critical | 9.1 | 2026-08-05 | An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authent… |
CVE-2026-8709 | Critical | 9.9 | 2026-08-05 | An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authent… |
CVE-2026-7557 | Critical | 9.1 | 2026-08-05 | An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allow… |
CVE-2026-7329 | Critical | 9.9 | 2026-08-05 | An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows… |
CVE-2026-60053 | Critical | 9.1 | 2026-08-05 | Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable afte… |
CVE-2026-71289 | Critical | 9.8 | 2026-08-05 | The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API… |
CVE-2026-71278 | Critical | 9.8 | 2026-08-05 | rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route d… |
CVE-2026-71277 | Critical | 9.1 | 2026-08-05 | rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates… |
CVE-2026-71268 | Critical | 9.9 | 2026-08-05 | OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referen… |
CVE-2026-71267 | Critical | 9.8 | 2026-08-05 | microtar's mtar_write_file_header and mtar_write_dir_header functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte field of a stack-all… |
CVE-2026-71263 | Critical | 9.1 | 2026-08-05 | The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/porttcp.c). The check uses a strict greater-than comp… |
CVE-2026-71262 | Critical | 9.8 | 2026-08-05 | IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController… |
CVE-2026-71256 | Critical | 9.8 | 2026-08-05 | nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic / recv_read_device_ide… |
CVE-2026-71254 | Critical | 9.8 | 2026-08-05 | nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record function (FC 0x14, Read File Record) in nanomodbus… |
CVE-2026-71248 | Critical | 9.8 | 2026-08-05 | Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select * from user w… |
CVE-2026-71238 | Critical | 9.1 | 2026-08-05 | DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key… |
CVE-2026-71237 | Critical | 9.8 | 2026-08-05 | Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a r… |
CVE-2026-71231 | Critical | 9.8 | 2026-08-05 | IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-deco… |
CVE-2026-66747 | Critical | 9.8 | 2026-08-05 | Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source… |
CVE-2026-44945 | Critical | 9.1 | 2026-08-05 | A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the de… |
CVE-2026-10090 | Critical | 9.0 | 2026-08-05 | A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM)… |
CVE-2026-10059 | Critical | 9.1 | 2026-08-05 | A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this… |
CVE-2026-71214 | Critical | 9.8 | 2026-08-05 | The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, wh… |
CVE-2026-71213 | Critical | 9.1 | 2026-08-05 | Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is dis… |
CVE-2026-71207 | Critical | 9.8 | 2026-08-05 | The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatena… |
CVE-2026-70376 | Critical | 9.6 | 2026-08-05 | Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action)… |
CVE-2026-64566 | Critical | 9.8 | 2026-08-05 | In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() When iptfs_skb_add_frag… |
CVE-2026-61486 | Critical | 9.8 | 2026-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is re… |
CVE-2026-61484 | Critical | 9.8 | 2026-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project… |
CVE-2026-5581 | Critical | 9.1 | 2026-08-05 | The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. T… |
CVE-2026-4431 | Critical | 9.1 | 2026-08-05 | The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `create_post()` funct… |
CVE-2026-16940 | Critical | 10.0 | 2026-08-05 | The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary… |
CVE-2026-15360 | Critical | 9.1 | 2026-08-05 | The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated at… |
CVE-2026-15210 | Critical | 9.1 | 2026-08-05 | The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-tim… |
CVE-2026-9273 | Critical | 9.3 | 2026-08-05 | The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account… |
CVE-2026-45537 | Critical | 9.1 | 2026-08-04 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates mult… |
CVE-2026-45100 | Critical | 9.1 | 2026-08-04 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64… |
CVE-2026-70554 | Critical | 9.8 | 2026-08-04 | MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serial… |
CVE-2026-67979 | Critical | 9.1 | 2026-08-04 | Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via p… |
CVE-2026-66902 | Critical | 9.8 | 2026-08-04 | Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call. The Pluggable subclass read… |
CVE-2026-45538 | Critical | 9.8 | 2026-08-04 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255… |
CVE-2026-70553 | Critical | 9.8 | 2026-08-04 | MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuratio… |
CVE-2026-70552 | Critical | 9.8 | 2026-08-04 | MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gate… |
CVE-2026-69703 | Critical | 9.8 | 2026-08-04 | Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to… |
CVE-2026-49435 | Critical | 9.8 | 2026-08-04 | Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted pack… |
CVE-2026-0163 | Critical | 9.8 | 2026-08-04 | In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no add… |
CVE-2017-20242 | Critical | 9.8 | 2026-08-04 | Keysight IxChariot Endpoint before 9.5.102 contains a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet to cr… |
CVE-2017-20241 | Critical | 9.8 | 2026-08-04 | Keysight IxChariot Endpoint before 9.5.102 contains a heap-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet to cra… |
CVE-2026-24254 | Critical | 9.8 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit… |
CVE-2026-63456 | Critical | 9.8 | 2026-08-04 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentic… |
CVE-2026-63455 | Critical | 9.8 | 2026-08-04 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentic… |
CVE-2025-29296 | Critical | 9.8 | 2026-08-04 | H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C… |
CVE-2026-69110 | Critical | 9.1 | 2026-08-04 | OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the te… |
CVE-2026-69098 | Critical | 9.8 | 2026-08-04 | kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiat… |
CVE-2026-25289 | Critical | 9.6 | 2026-08-04 | Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values. |
CVE-2026-61515 | Critical | 9.8 | 2026-08-04 | Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrar… |
CVE-2026-61514 | Critical | 9.8 | 2026-08-04 | Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device funct… |
CVE-2026-10050 | Critical | 9.1 | 2026-08-04 | In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specifi… |
CVE-2026-15721 | Critical | 9.8 | 2026-08-04 | Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injecti… |
CVE-2026-14804 | Critical | 9.1 | 2026-08-04 | Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Con… |
CVE-2026-14175 | Critical | 9.8 | 2026-08-04 | Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload… |
CVE-2026-18754 | Critical | 9.1 | 2026-08-04 | The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows … |
CVE-2026-18753 | Critical | 9.1 | 2026-08-04 | The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows … |
CVE-2026-64564 | Critical | 9.8 | 2026-08-04 | In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() ca… |
CVE-2026-16618 | Critical | 9.8 | 2026-08-04 | The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the… |
CVE-2026-15958 | Critical | 9.3 | 2026-08-04 | The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it al… |
CVE-2026-18686 | Critical | 9.8 | 2026-08-04 | A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component… |
CVE-2026-18685 | Critical | 9.8 | 2026-08-04 | A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component mod… |
CVE-2026-48333 | Critical | 9.8 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this… |
CVE-2026-48331 | Critical | 10.0 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this… |
CVE-2026-48330 | Critical | 10.0 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |
CVE-2026-48326 | Critical | 9.9 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |
CVE-2026-48323 | Critical | 10.0 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitra… |
CVE-2026-48317 | Critical | 9.6 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could… |
CVE-2026-18684 | Critical | 9.8 | 2026-08-03 | A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function remove_profile of the file /cgi-bin/glc of the component modem… |
CVE-2026-18667 | Critical | 9.6 | 2026-08-03 | A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an a… |
CVE-2026-69240 | Critical | 9.8 | 2026-08-03 | Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-s… |
CVE-2026-52102 | Critical | 9.8 | 2026-08-03 | An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via inj… |
CVE-2026-51775 | Critical | 9.8 | 2026-08-03 | SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php compon… |
CVE-2026-51190 | Critical | 9.8 | 2026-08-03 | The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in "… |
CVE-2026-68980 | Critical | 9.1 | 2026-08-03 | Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authoriz… |
CVE-2026-68979 | Critical | 9.8 | 2026-08-03 | Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Par… |