Critical-severity CVEs (page 7)
Page 7 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89788 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2_tree_connect() ksmbd_tree_conn_connect(… |
CVE-2026-89786 | Critical | 9.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bounds read in ext4_read_inline_dir() ext4_read_inline_dir() can read a… |
CVE-2026-89783 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full The depth check… |
CVE-2026-89779 | Critical | 9.1 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef->size covers the record's name and value When an EA record has a no… |
CVE-2026-89778 | Critical | 9.8 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofs_uncompress_block(… |
CVE-2026-89775 | Critical | 9.3 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effe… |
CVE-2026-86462 | Critical | 9.1 | 2026-09-16 | Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed ses… |
CVE-2026-82717 | Critical | 9.8 | 2026-09-16 | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compila… |
CVE-2026-82311 | Critical | 9.8 | 2026-09-16 | Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it do… |
CVE-2026-81642 | Critical | 9.8 | 2026-09-16 | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code exe… |
CVE-2026-27565 | Critical | 9.8 | 2026-09-16 | An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains acti… |
CVE-2026-27546 | Critical | 9.8 | 2026-09-16 | An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly con… |
CVE-2026-73447 | Critical | 9.1 | 2026-09-16 | A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated use… |
CVE-2026-14349 | Critical | 9.8 | 2026-09-16 | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2… |
CVE-2026-12793 | Critical | 9.8 | 2026-09-16 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This i… |
CVE-2026-81855 | Critical | 9.1 | 2026-09-15 | A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard. |
CVE-2026-78225 | Critical | 9.0 | 2026-09-15 | A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard. |
CVE-2026-73807 | Critical | 9.8 | 2026-09-15 | The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the… |
CVE-2026-73437 | Critical | 9.6 | 2026-09-15 | On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access coul… |
CVE-2026-61560 | Critical | 9.8 | 2026-09-15 | `@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools withou… |
CVE-2026-91939 | Critical | 9.8 | 2026-09-15 | Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantia… |
CVE-2026-91749 | Critical | 9.6 | 2026-09-15 | Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a cra… |
CVE-2026-91738 | Critical | 9.6 | 2026-09-15 | Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox… |
CVE-2026-91729 | Critical | 9.6 | 2026-09-15 | Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execute arbitrary code… |
CVE-2026-91728 | Critical | 9.6 | 2026-09-15 | Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
CVE-2026-91718 | Critical | 9.6 | 2026-09-15 | Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page… |
CVE-2026-91716 | Critical | 9.6 | 2026-09-15 | Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page… |
CVE-2026-91710 | Critical | 9.6 | 2026-09-15 | Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted… |
CVE-2026-66890 | Critical | 9.6 | 2026-09-15 | The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable. |
CVE-2026-66887 | Critical | 9.6 | 2026-09-15 | The affected products are missing authorization on state-changing CGIs and session checks are not performed. |
CVE-2026-61568 | Critical | 9.6 | 2026-09-15 | `@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Hos… |
CVE-2026-61559 | Critical | 9.6 | 2026-09-15 | `@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable `ENA… |
CVE-2026-54337 | Critical | 9.8 | 2026-09-15 | Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated at… |
CVE-2026-92240 | Critical | 9.1 | 2026-09-15 | A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbi… |
CVE-2026-92238 | Critical | 9.8 | 2026-09-15 | A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in… |
CVE-2026-89040 | Critical | 9.8 | 2026-09-15 | Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on th… |
CVE-2026-87230 | Critical | 10.0 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87223 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87217 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87214 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87189 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87188 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87186 | Critical | 9.6 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87184 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87176 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87175 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87173 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87172 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87170 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87129 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is… |
CVE-2026-87128 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is… |
CVE-2026-83462 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affecte… |
CVE-2026-83452 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that… |
CVE-2026-83355 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: Metrics). Supported versions that are af… |
CVE-2026-83339 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected… |
CVE-2026-83327 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 1… |
CVE-2026-83283 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that i… |
CVE-2026-83282 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that i… |
CVE-2026-83269 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12… |
CVE-2026-83268 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12… |
CVE-2026-83261 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Core). The supported version that is affected is 3.6.1. Ea… |
CVE-2026-83260 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Event Java PX). The supported version that is affected is 9.3.6. Easily expl… |
CVE-2026-83232 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). Supported versions that are affect… |
CVE-2026-83229 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Management Console). Supported versions that are affected are 17.0-… |
CVE-2026-83202 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83201 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83197 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Siebel Apps - Financial Services product of Oracle Siebel CRM (component: Financial Accounts). Supported versions that are affected are 1… |
CVE-2026-83196 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83154 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.7. Easily exploit… |
CVE-2026-83151 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12… |
CVE-2026-83149 | Critical | 9.1 | 2026-09-15 | Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged… |
CVE-2026-83108 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83107 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83105 | Critical | 9.0 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83104 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83103 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83100 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83099 | Critical | 10.0 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83098 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83095 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83094 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83066 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83064 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4… |
CVE-2026-83062 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83061 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83060 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83059 | Critical | 10.0 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83058 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83057 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83056 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83055 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83054 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83043 | Critical | 9.6 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-83042 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4… |
CVE-2026-83040 | Critical | 9.6 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-83039 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-83038 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: TopLink Integration). Supported versions that are affected are 12… |
CVE-2026-83037 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1… |
CVE-2026-83036 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1… |
CVE-2026-83035 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1… |