Critical-severity CVEs (page 6)
Page 6 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-92720 | Critical | 9.1 | 2026-09-16 | Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and se… |
CVE-2026-92717 | Critical | 9.1 | 2026-09-16 | Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and re… |
CVE-2026-92716 | Critical | 9.6 | 2026-09-16 | Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and re… |
CVE-2026-51990 | Critical | 9.8 | 2026-09-16 | An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component |
CVE-2026-92398 | Critical | 9.1 | 2026-09-16 | A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this issue is some unknown functionality of the file /etc/rg_config/admin of the… |
CVE-2026-85385 | Critical | 9.6 | 2026-09-16 | Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashboard user management… |
CVE-2026-76420 | Critical | 9.0 | 2026-09-16 | A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow an unauthenticated, r… |
CVE-2026-20331 | Critical | 9.6 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall T… |
CVE-2026-20307 | Critical | 9.9 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlyin… |
CVE-2026-20306 | Critical | 9.1 | 2026-09-16 | A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying o… |
CVE-2026-20305 | Critical | 9.1 | 2026-09-16 | A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the unde… |
CVE-2026-20234 | Critical | 9.9 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connec… |
CVE-2026-92397 | Critical | 9.1 | 2026-09-16 | A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerability is the function cc_set of the file unifyframe-sgi.elf of… |
CVE-2026-90999 | Critical | 9.8 | 2026-09-16 | Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed b… |
CVE-2026-70416 | Critical | 10.0 | 2026-09-16 | Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could p… |
CVE-2025-59953 | Critical | 9.8 | 2026-09-16 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implem… |
CVE-2026-92395 | Critical | 9.1 | 2026-09-16 | @fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request… |
CVE-2026-91843 | Critical | 9.8 | 2026-09-16 | A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges. |
CVE-2026-90049 | Critical | 9.3 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() skb_zerocopy() copies… |
CVE-2026-90048 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() ni_create_attr_list() all… |
CVE-2026-90042 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc() buffers The fscrypt subsystem uses the scat… |
CVE-2026-90038 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4_revoke_export_st… |
CVE-2026-90037 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during close_lru reaping An nfs4_openowner left on nn… |
CVE-2026-90036 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its… |
CVE-2026-90012 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mappin… |
CVE-2026-90011 | Critical | 9.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_l… |
CVE-2026-89990 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in ceph_mds_check_access() MDS session OPEN handling replaces mdsc->s_ca… |
CVE-2026-89972 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvme_alloc_ns() error path at out_unlin… |
CVE-2026-89970 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth… |
CVE-2026-89969 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmet_tcp_try_recv_pdu… |
CVE-2026-89930 | Critical | 9.3 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter KVM services local TLB flu… |
CVE-2026-89918 | Critical | 9.3 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA… |
CVE-2026-89916 | Critical | 9.3 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB inval… |
CVE-2026-89915 | Critical | 9.3 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used t… |
CVE-2026-89914 | Critical | 9.3 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decode_range_tlbi()… |
CVE-2026-89857 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qla_nvme_ls_reject_iocb() allo… |
CVE-2026-89847 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid double completion in async IOCB timeout qla2x00_async_iocb_timeout()… |
CVE-2026-89846 | Critical | 9.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry()… |
CVE-2026-86106 | Critical | 9.6 | 2026-09-16 | An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in… |
CVE-2026-76187 | Critical | 9.8 | 2026-09-16 | Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak… |
CVE-2026-76186 | Critical | 9.1 | 2026-09-16 | Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keyclo… |
CVE-2026-73453 | Critical | 10.0 | 2026-09-16 | An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions… |
CVE-2026-89788 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2_tree_connect() ksmbd_tree_conn_connect(… |
CVE-2026-89786 | Critical | 9.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bounds read in ext4_read_inline_dir() ext4_read_inline_dir() can read a… |
CVE-2026-89783 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full The depth check… |
CVE-2026-89779 | Critical | 9.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef->size covers the record's name and value When an EA record has a no… |
CVE-2026-89778 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofs_uncompress_block(… |
CVE-2026-89775 | Critical | 9.3 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effe… |
CVE-2026-86462 | Critical | 9.1 | 2026-09-16 | Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed ses… |
CVE-2026-82717 | Critical | 9.8 | 2026-09-16 | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compila… |
CVE-2026-82311 | Critical | 9.8 | 2026-09-16 | Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it do… |
CVE-2026-81642 | Critical | 9.8 | 2026-09-16 | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code exe… |
CVE-2026-27565 | Critical | 9.8 | 2026-09-16 | An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains acti… |
CVE-2026-27546 | Critical | 9.8 | 2026-09-16 | An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly con… |
CVE-2026-73447 | Critical | 9.1 | 2026-09-16 | A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated use… |
CVE-2026-14349 | Critical | 9.8 | 2026-09-16 | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2… |
CVE-2026-12793 | Critical | 9.8 | 2026-09-16 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This i… |
CVE-2026-81855 | Critical | 9.1 | 2026-09-15 | A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard. |
CVE-2026-78225 | Critical | 9.0 | 2026-09-15 | A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard. |
CVE-2026-73807 | Critical | 9.8 | 2026-09-15 | The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the… |
CVE-2026-73437 | Critical | 9.6 | 2026-09-15 | On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access coul… |
CVE-2026-61560 | Critical | 9.8 | 2026-09-15 | `@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools withou… |
CVE-2026-91939 | Critical | 9.8 | 2026-09-15 | Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantia… |
CVE-2026-91749 | Critical | 9.6 | 2026-09-15 | Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a cra… |
CVE-2026-91738 | Critical | 9.6 | 2026-09-15 | Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox… |
CVE-2026-91729 | Critical | 9.6 | 2026-09-15 | Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execute arbitrary code… |
CVE-2026-91728 | Critical | 9.6 | 2026-09-15 | Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
CVE-2026-91718 | Critical | 9.6 | 2026-09-15 | Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page… |
CVE-2026-91716 | Critical | 9.6 | 2026-09-15 | Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page… |
CVE-2026-91710 | Critical | 9.6 | 2026-09-15 | Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted… |
CVE-2026-66890 | Critical | 9.6 | 2026-09-15 | The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable. |
CVE-2026-66887 | Critical | 9.6 | 2026-09-15 | The affected products are missing authorization on state-changing CGIs and session checks are not performed. |
CVE-2026-61568 | Critical | 9.6 | 2026-09-15 | `@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Hos… |
CVE-2026-61559 | Critical | 9.6 | 2026-09-15 | `@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable `ENA… |
CVE-2026-54337 | Critical | 9.8 | 2026-09-15 | Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated at… |
CVE-2026-92240 | Critical | 9.1 | 2026-09-15 | A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbi… |
CVE-2026-92238 | Critical | 9.8 | 2026-09-15 | A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in… |
CVE-2026-89040 | Critical | 9.8 | 2026-09-15 | Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on th… |
CVE-2026-87230 | Critical | 10.0 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87223 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87217 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87214 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87189 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87188 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87186 | Critical | 9.6 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87184 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87176 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87175 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87173 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87172 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87170 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87129 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is… |
CVE-2026-87128 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is… |
CVE-2026-83462 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affecte… |
CVE-2026-83452 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that… |
CVE-2026-83355 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: Metrics). Supported versions that are af… |
CVE-2026-83339 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected… |
CVE-2026-83327 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 1… |
CVE-2026-83283 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that i… |
CVE-2026-83282 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that i… |