Critical-severity CVEs (page 57)
Page 57 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-43414 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is s… |
CVE-2026-43407 | Critical | 9.1 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() This patch fixes… |
CVE-2026-43406 | Critical | 9.1 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in process_message_header() If the message… |
CVE-2026-43402 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: kthread: consolidate kthread exit paths to prevent use-after-free Guillaume reported cras… |
CVE-2026-43384 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need t… |
CVE-2026-43383 | Critical | 9.4 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need… |
CVE-2026-43379 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() opinfo pointer obtained… |
CVE-2026-43378 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: smb: server: fix use-after-free in smb2_open() The opinfo pointer obtained via rcu_derefe… |
CVE-2026-43376 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free by using call_rcu() for oplock_info ksmbd currently frees oploc… |
CVE-2026-41588 | Critical | 9.0 | 2026-05-08 | RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py — check_sign_in_key(). This issue h… |
CVE-2026-41583 | Critical | 9.1 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to val… |
CVE-2026-41574 | Critical | 9.8 | 2026-05-08 | Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incoming OAuth identity to an existing Nhost a… |
CVE-2026-37431 | Critical | 9.8 | 2026-05-08 | Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoi… |
CVE-2026-44336 | Critical | 9.6 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (praisonai mcp serve) registers four file-han… |
CVE-2026-44335 | Critical | 9.8 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, l… |
CVE-2026-43341 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill ioam6_fill_trace_data() s… |
CVE-2026-43304 | Critical | 9.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key m… |
CVE-2026-41512 | Critical | 9.9 | 2026-05-08 | ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via… |
CVE-2026-41509 | Critical | 9.8 | 2026-05-08 | CROSS implementation contains reference and optimized implementations of the CROSS post-quantum signature algorithm. Prior to commit fc6b7e7, there is a buffer… |
CVE-2026-41507 | Critical | 9.8 | 2026-05-08 | math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse() is injected verbatim into a new… |
CVE-2026-41497 | Critical | 9.8 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's MCP command handling does not add a command allowlist or argument vali… |
CVE-2026-25199 | Critical | 9.1 | 2026-05-08 | Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects Apache CloudStack: from… |
CVE-2026-8153 | Critical | 9.8 | 2026-05-08 | OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthenticated attacker to craft commands tha… |
CVE-2013-10075 | Critical | 9.1 | 2026-05-08 | Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::File and Apache::Session::Store::DB_Fil… |
CVE-2025-69691 | Critical | 9.9 | 2026-05-08 | Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available… |
CVE-2025-69690 | Critical | 9.1 | 2026-05-08 | Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_command… |
CVE-2025-69599 | Critical | 9.8 | 2026-05-08 | RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable. NOTE: this is disp… |
CVE-2025-67887 | Critical | 9.8 | 2026-05-08 | 1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code b… |
CVE-2023-46453 | Critical | 9.8 | 2026-05-08 | Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid S… |
CVE-2024-51092 | Critical | 9.1 | 2026-05-08 | LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController… |
CVE-2026-43944 | Critical | 9.6 | 2026-05-08 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbit… |
CVE-2026-43941 | Critical | 9.6 | 2026-05-08 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, Electerm's terminal hyperlink handler p… |
CVE-2026-42208 | Critical | 9.8 | 2026-05-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used duri… |
CVE-2026-41501 | Critical | 9.8 | 2026-05-08 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in g… |
CVE-2026-41500 | Critical | 9.8 | 2026-05-08 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in g… |
CVE-2026-42880 | Critical | 9.6 | 2026-05-07 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing au… |
CVE-2026-8034 | Critical | 9.8 | 2026-05-07 | A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal s… |
CVE-2026-42826 | Critical | 10.0 | 2026-05-07 | Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network. |
CVE-2026-35428 | Critical | 9.6 | 2026-05-07 | Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing ov… |
CVE-2026-33844 | Critical | 9.0 | 2026-05-07 | Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network. |
CVE-2026-33823 | Critical | 9.6 | 2026-05-07 | Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network. |
CVE-2026-33109 | Critical | 9.9 | 2026-05-07 | Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network. |
CVE-2026-41902 | Critical | 9.1 | 2026-05-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-setup/{hash} endpoint accepts a 60-chara… |
CVE-2026-37709 | Critical | 9.8 | 2026-05-07 | Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute ar… |
CVE-2026-7415 | Critical | 9.8 | 2026-05-07 | The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same net… |
CVE-2026-7414 | Critical | 9.8 | 2026-05-07 | Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running… |
CVE-2025-63704 | Critical | 9.8 | 2026-05-07 | NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges th… |
CVE-2025-63703 | Critical | 9.8 | 2026-05-07 | npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js(). |
CVE-2026-36458 | Critical | 9.8 | 2026-05-07 | ChestnutCMS v1.5.10 has a SQL injection vulnerability. The content parameter of the cms_content tag can be manipulated in the admin backend and injected into a… |
CVE-2025-63706 | Critical | 9.8 | 2026-05-07 | NPM package next-npm-version1.0.1 is vulnerable to Command injection. |
CVE-2026-6795 | Critical | 9.6 | 2026-05-07 | URL redirection to untrusted site ('open redirect') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Parameter Injection. This issu… |
CVE-2026-41589 | Critical | 9.6 | 2026-05-07 | Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vu… |
CVE-2026-30496 | Critical | 9.8 | 2026-05-07 | The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that allows full unauthenticated remote con… |
CVE-2026-8094 | Critical | 9.8 | 2026-05-07 | Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2. |
CVE-2026-8091 | Critical | 9.8 | 2026-05-07 | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thund… |
CVE-2026-6508 | Critical | 9.8 | 2026-05-07 | Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Accessing Functionality Not Properly Constra… |
CVE-2026-33587 | Critical | 10.0 | 2026-05-07 | Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker contain… |
CVE-2026-41586 | Critical | 9.8 | 2026-05-07 | Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, C… |
CVE-2026-42217 | Critical | 9.8 | 2026-05-07 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions… |
CVE-2026-42216 | Critical | 9.1 | 2026-05-07 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions… |
CVE-2026-41201 | Critical | 9.1 | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. In version 0.31.4… |
CVE-2026-40982 | Critical | 9.1 | 2026-05-07 | Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker… |
CVE-2026-40281 | Critical | 10.0 | 2026-05-06 | Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control char… |
CVE-2026-44112 | Critical | 9.6 | 2026-05-06 | OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes o… |
CVE-2026-44109 | Critical | 9.8 | 2026-05-06 | OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to… |
CVE-2026-43581 | Critical | 9.6 | 2026-05-06 | OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0… |
CVE-2026-43578 | Critical | 9.1 | 2026-05-06 | OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background asy… |
CVE-2026-43575 | Critical | 9.8 | 2026-05-06 | OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser… |
CVE-2026-7910 | Critical | 9.6 | 2026-05-06 | Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via… |
CVE-2026-7908 | Critical | 9.6 | 2026-05-06 | Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page… |
CVE-2026-41930 | Critical | 9.8 | 2026-05-06 | Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attack… |
CVE-2026-0300 | Critical | 9.8 | 2026-05-06 | A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthentica… |
CVE-2026-5081 | Critical | 9.1 | 2026-05-06 | Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in ver… |
CVE-2026-43208 | Critical | 9.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: do not pass flow_id to set_rps_cpu() Blamed commit made the assumption that the RPS… |
CVE-2026-43198 | Critical | 9.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after th… |
CVE-2026-43197 | Critical | 9.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the… |
CVE-2026-43186 | Critical | 9.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __… |
CVE-2026-43185 | Critical | 9.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() smb_direct_prepare_negoti… |
CVE-2026-43125 | Critical | 9.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is n… |
CVE-2026-43117 | Critical | 9.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() If over… |
CVE-2026-43114 | Critical | 9.4 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case f… |
CVE-2026-43083 | Critical | 9.1 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.b… |
CVE-2026-40010 | Critical | 9.1 | 2026-05-06 | Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. T… |
CVE-2026-28780 | Critical | 9.8 | 2026-05-05 | Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a… |
CVE-2026-35579 | Critical | 9.8 | 2026-05-05 | CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authenticat… |
CVE-2026-34084 | Critical | 9.8 | 2026-05-05 | PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through… |
CVE-2026-7854 | Critical | 9.8 | 2026-05-05 | A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp… |
CVE-2026-38428 | Critical | 9.8 | 2026-05-05 | Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated i… |
CVE-2026-27960 | Critical | 9.8 | 2026-05-05 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege esc… |
CVE-2026-7853 | Critical | 9.8 | 2026-05-05 | A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp of the component HTTP Handler. This… |
CVE-2026-38431 | Critical | 9.8 | 2026-05-05 | ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject t… |
CVE-2026-38429 | Critical | 9.8 | 2026-05-05 | OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files contai… |
CVE-2026-7411 | Critical | 10.0 | 2026-05-05 | In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote… |
CVE-2026-43071 | Critical | 9.1 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal number of bucket to two There is an OOB read problem on dentry_… |
CVE-2026-43067 | Critical | 9.8 | 2026-05-05 | In the Linux kernel, the following vulnerability has been resolved: ext4: handle wraparound when searching for blocks for indirect mapped blocks Commit 4865c… |
CVE-2026-7834 | Critical | 9.8 | 2026-05-05 | A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This issue affects the function get_csrf_whites of the file /cgi/advanced/misc_main.c… |
CVE-2026-36356 | Critical | 9.1 | 2026-05-05 | The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /actio… |
CVE-2026-34408 | Critical | 9.1 | 2026-05-05 | An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0). The password reset function can be bypassed to set arbitrar… |
CVE-2026-43566 | Critical | 9.1 | 2026-05-05 | OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carryi… |
CVE-2026-43534 | Critical | 9.1 | 2026-05-05 | OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can… |