Critical-severity CVEs (page 63)
Page 63 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39619 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Busiprof busiprof allows Upload a Web Shell to a Web Server.This issue affects Busiprof: fro… |
CVE-2026-39617 | Critical | 9.6 | 2026-04-08 | Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Bluestreet bluestreet allows Cross Site Request Forgery.This issue affects Bluestreet: from… |
CVE-2026-33088 | Critical | 9.8 | 2026-04-08 | Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement. |
CVE-2026-25776 | Critical | 9.8 | 2026-04-08 | Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script. |
CVE-2026-3535 | Critical | 9.8 | 2026-04-08 | The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGVOGWPdownloadGoogleF… |
CVE-2026-4003 | Critical | 9.8 | 2026-04-08 | The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all versions up to and including 1.1.15. Th… |
CVE-2026-3296 | Critical | 9.8 | 2026-04-08 | The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input… |
CVE-2026-27143 | Critical | 9.8 | 2026-04-08 | Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing t… |
CVE-2026-1346 | Critical | 9.3 | 2026-04-08 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 thr… |
CVE-2026-39847 | Critical | 9.1 | 2026-04-07 | Emmett is a full-stack Python web framework designed with simplicity. From 2.5.0 to before 2.8.1, the RSGI static handler for Emmett's internal assets (/__emme… |
CVE-2026-39846 | Critical | 9.0 | 2026-04-07 | SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious note synced to another user can trigger remote code execution in the SiYuan Elect… |
CVE-2026-34582 | Critical | 9.1 | 2026-04-07 | Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished… |
CVE-2026-34078 | Critical | 10.0 | 2026-04-07 | Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can… |
CVE-2026-31789 | Critical | 9.8 | 2026-04-07 | Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary… |
CVE-2026-39397 | Critical | 9.4 | 2026-04-07 | @delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registere… |
CVE-2026-33439 | Critical | 9.8 | 2026-04-07 | Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code… |
CVE-2025-69515 | Critical | 9.1 | 2026-04-07 | An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system into accepting falsified GPS signals as le… |
CVE-2026-39355 | Critical | 9.9 | 2026-04-07 | Genealogy is a family tree PHP application. Prior to 5.9.1, a critical broken access control vulnerability in the genealogy application allows any authenticate… |
CVE-2026-39351 | Critical | 9.1 | 2026-04-07 | Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit. |
CVE-2025-71058 | Critical | 9.1 | 2026-04-07 | Dual DHCP DNS Server 8.01 improperly accepts and caches UDP DNS responses without validating that the response originates from a legitimate configured upstream… |
CVE-2026-39339 | Critical | 9.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/… |
CVE-2026-39337 | Critical | 10.0 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wiza… |
CVE-2026-39324 | Critical | 9.8 | 2026-04-07 | Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when c… |
CVE-2026-35573 | Critical | 9.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authent… |
CVE-2026-31272 | Critical | 9.8 | 2026-04-07 | MRCMS 3.1.2 contains an access control vulnerability. The save() method in src/main/java/org/marker/mushroom/controller/UserController.java lacks proper author… |
CVE-2026-31271 | Critical | 9.8 | 2026-04-07 | megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks… |
CVE-2026-4631 | Critical | 9.8 | 2026-04-07 | Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An att… |
CVE-2026-39305 | Critical | 9.0 | 2026-04-07 | PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature contains a Path Traversal vulnerability that allows an attacker (or… |
CVE-2026-35614 | Critical | 9.8 | 2026-04-07 | Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_update. This vulnerability is fixed in 16.1… |
CVE-2026-35580 | Critical | 9.1 | 2026-04-07 | Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled work… |
CVE-2026-23696 | Critical | 9.9 | 2026-04-07 | Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authent… |
CVE-2024-36058 | Critical | 9.8 | 2026-04-07 | The Send Basket functionality in Koha Library before 23.05.10 is susceptible to Time-Based SQL Injection because it fails to sanitize the POST parameter bib_li… |
CVE-2026-35490 | Critical | 9.8 | 2026-04-07 | changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to)… |
CVE-2026-33816 | Critical | 9.8 | 2026-04-07 | Memory-safety vulnerability in github.com/jackc/pgx/v5. |
CVE-2026-33815 | Critical | 9.8 | 2026-04-07 | Memory-safety vulnerability in github.com/jackc/pgx/v5. |
CVE-2025-52908 | Critical | 9.8 | 2026-04-07 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W… |
CVE-2024-36057 | Critical | 9.8 | 2026-04-07 | Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution. The line "qx/unzip $filename -… |
CVE-2026-4277 | Critical | 9.8 | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submissi… |
CVE-2026-35458 | Critical | 9.8 | 2026-04-07 | Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without sett… |
CVE-2026-30079 | Critical | 9.8 | 2026-04-07 | In OpenAirInterface V2.2.0 AMF, Out of sequence messages causes incorrect state transition during UE registration procedure. This allows authentication to be b… |
CVE-2026-21413 | Critical | 9.8 | 2026-04-07 | A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted… |
CVE-2026-20911 | Critical | 9.8 | 2026-04-07 | A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted mali… |
CVE-2026-20889 | Critical | 9.8 | 2026-04-07 | A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead t… |
CVE-2025-62818 | Critical | 9.8 | 2026-04-07 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2025-52909 | Critical | 9.8 | 2026-04-07 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W… |
CVE-2026-5735 | Critical | 9.8 | 2026-04-07 | Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough… |
CVE-2026-5734 | Critical | 9.8 | 2026-04-07 | Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memo… |
CVE-2026-5731 | Critical | 9.8 | 2026-04-07 | Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs s… |
CVE-2026-28808 | Critical | 9.8 | 2026-04-07 | Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via s… |
CVE-2026-22679 | Critical | 9.8 | 2026-04-07 | Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboA… |
CVE-2021-4473 | Critical | 9.8 | 2026-04-07 | Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint that allows unauthenticated attackers… |
CVE-2026-1114 | Critical | 9.8 | 2026-04-07 | In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing… |
CVE-2026-0740 | Critical | 9.8 | 2026-04-07 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_… |
CVE-2026-35471 | Critical | 9.8 | 2026-04-06 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, tdeleteFile() missing return after path traversal check. This vulnerability is fixed in 2.0.0… |
CVE-2026-35393 | Critical | 9.8 | 2026-04-06 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta… |
CVE-2026-35392 | Critical | 9.8 | 2026-04-06 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2… |
CVE-2026-35459 | Critical | 9.1 | 2026-04-06 | pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerabilit… |
CVE-2026-35184 | Critical | 9.8 | 2026-04-06 | EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQL injection vulnerability in v2/templates/query/queryview.php via the custom an… |
CVE-2026-35178 | Critical | 9.8 | 2026-04-06 | Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbenc… |
CVE-2025-54328 | Critical | 10.0 | 2026-04-06 | An issue was discovered in SMS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2025-58349 | Critical | 9.1 | 2026-04-06 | An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2026-35174 | Critical | 9.1 | 2026-04-06 | Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an admini… |
CVE-2026-35171 | Critical | 9.8 | 2026-04-06 | Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG e… |
CVE-2026-35052 | Critical | 9.8 | 2026-04-06 | D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to 3.22.0, users hosting D-Tale publicly wh… |
CVE-2026-35050 | Critical | 9.1 | 2026-04-06 | text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.1.1, users can save extention settings in "py" format and i… |
CVE-2026-35047 | Critical | 9.8 | 2026-04-06 | Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allows attackers to upload arbitrary files… |
CVE-2026-35039 | Critical | 9.1 | 2026-04-06 | fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a custom cacheKeyBuilder method which does not properly crea… |
CVE-2026-35030 | Critical | 9.1 | 2026-04-06 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: tru… |
CVE-2026-34989 | Critical | 9.0 | 2026-04-06 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 31.0.0.0… |
CVE-2026-34977 | Critical | 9.8 | 2026-04-06 | Aperi'Solve is an open-source steganalysis web platform. In versions 3.1.3 through 3.2.0, when uploading a JPEG, a user can specify an optional password to acc… |
CVE-2026-34976 | Critical | 10.0 | 2026-04-06 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (a… |
CVE-2026-34841 | Critical | 9.8 | 2026-04-06 | Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the a… |
CVE-2026-34950 | Critical | 9.1 | 2026-04-06 | fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that… |
CVE-2026-34444 | Critical | 10.0 | 2026-04-06 | Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed thro… |
CVE-2026-34208 | Critical | 10.0 | 2026-04-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this p… |
CVE-2026-31151 | Critical | 9.8 | 2026-04-06 | An issue in the login mechanism of Kaleris YMS v7.2.2.1 allows attackers to bypass login verification to access the application 's resources. |
CVE-2026-31059 | Critical | 9.8 | 2026-04-06 | A remote command execution (RCE) vulnerability in the /goform/formDia component of UTT Aggressive HiPER 520W v3v1.7.7-180627 allows attackers to execute arbitr… |
CVE-2026-26026 | Critical | 9.1 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability i… |
CVE-2026-31405 | Critical | 9.8 | 2026-04-06 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handl… |
CVE-2019-25687 | Critical | 9.8 | 2026-04-05 | Pegasus CMS 1.0 contains a remote code execution vulnerability in the extra_fields.php plugin that allows unauthenticated attackers to execute arbitrary comman… |
CVE-2018-25254 | Critical | 9.8 | 2026-04-04 | NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending craft… |
CVE-2016-20052 | Critical | 9.8 | 2026-04-04 | Snews CMS 1.7 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files including PHP executables to t… |
CVE-2026-35616 | Critical | 9.8 | 2026-04-04 | A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or co… |
CVE-2026-34953 | Critical | 9.1 | 2026-04-03 | PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, whi… |
CVE-2026-34952 | Critical | 9.1 | 2026-04-03 | PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology a… |
CVE-2026-34938 | Critical | 10.0 | 2026-04-03 | PraisonAI is a multi-agent teams system. Prior to version 1.5.90, execute_code() in praisonai-agents runs attacker-controlled Python inside a three-layer sandb… |
CVE-2026-34935 | Critical | 9.8 | 2026-04-03 | PraisonAI is a multi-agent teams system. From version 4.5.15 to before version 4.5.69, the --mcp CLI argument is passed directly to shlex.split() and forwarded… |
CVE-2026-34934 | Critical | 9.8 | 2026-04-03 | PraisonAI is a multi-agent teams system. Prior to version 4.5.90, the get_all_user_threads function constructs raw SQL queries using f-strings with unescaped t… |
CVE-2026-34612 | Critical | 9.9 | 2026-04-03 | Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vuln… |
CVE-2021-4477 | Critical | 9.1 | 2026-04-03 | Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN connections to byp… |
CVE-2018-25236 | Critical | 9.8 | 2026-04-03 | Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) m… |
CVE-2017-20236 | Critical | 9.8 | 2026-04-03 | ProSoft Technology ICX35-HWC versions 1.3 and prior cellular gateways contain an input validation vulnerability in the web user interface that allows remote at… |
CVE-2017-20235 | Critical | 9.1 | 2026-04-03 | ProSoft Technology ICX35-HWC version 1.3 and prior cellular gateways contain an authentication bypass vulnerability in the web user interface that allows unaut… |
CVE-2017-20234 | Critical | 9.8 | 2026-04-03 | GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access… |
CVE-2026-27634 | Critical | 9.8 | 2026-04-03 | Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_avai… |
CVE-2018-25237 | Critical | 9.8 | 2026-04-03 | Hirschmann HiSecOS devices versions prior to 05.3.03 contain a buffer overflow vulnerability in the HTTPS login interface when RADIUS authentication is enabled… |
CVE-2026-28766 | Critical | 9.3 | 2026-04-03 | A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication. |
CVE-2026-25197 | Critical | 9.1 | 2026-04-03 | A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call. |
CVE-2017-20237 | Critical | 9.8 | 2026-04-03 | Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in the master service that allows unauthen… |
CVE-2026-28798 | Critical | 9.0 | 2026-04-03 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a proxy endpoint (/v1/sys/proxy) exposed… |