Critical-severity CVEs (page 79)
Page 79 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22908 | Critical | 9.1 | 2026-01-15 | Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality. |
CVE-2026-22907 | Critical | 9.9 | 2026-01-15 | An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data. |
CVE-2026-22859 | Critical | 9.1 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_I… |
CVE-2026-22858 | Critical | 9.1 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The ro… |
CVE-2026-22857 | Critical | 9.8 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irp_thread_func because the IRP is freed by i… |
CVE-2026-22855 | Critical | 9.1 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrL… |
CVE-2026-22854 | Critical | 9.8 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow occurs in drive read when a server-controlled read len… |
CVE-2026-22853 | Critical | 9.8 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire ele… |
CVE-2026-22852 | Critical | 9.8 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRD… |
CVE-2026-22708 | Critical | 9.8 | 2026-01-14 | Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shel… |
CVE-2025-70968 | Critical | 9.8 | 2026-01-14 | FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE(). |
CVE-2025-37184 | Critical | 9.8 | 2026-01-14 | A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Succe… |
CVE-2026-22238 | Critical | 9.8 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs. An unauthenticated remote attacker could exploit this vulnerabi… |
CVE-2026-22237 | Critical | 9.8 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated remote attacker could exploit this vulnera… |
CVE-2026-22236 | Critical | 9.8 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated remote attacker could exploit this vulnera… |
CVE-2025-71116 | Critical | 9.1 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (ma… |
CVE-2026-23550 | Critical | 9.8 | 2026-01-14 | Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a thr… |
CVE-2025-14502 | Critical | 9.8 | 2026-01-14 | The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template paramet… |
CVE-2025-14301 | Critical | 9.8 | 2026-01-14 | The Integration Opvius AI for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.0. This is due to the… |
CVE-2026-22686 | Critical | 10.0 | 2026-01-14 | Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-v… |
CVE-2023-54339 | Critical | 9.8 | 2026-01-13 | Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index… |
CVE-2023-54337 | Critical | 9.1 | 2026-01-13 | Sysax Multi Server 6.95 contains a denial of service vulnerability in the administrative password field that allows attackers to crash the application. Attacke… |
CVE-2023-54335 | Critical | 9.8 | 2026-01-13 | eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers… |
CVE-2023-54334 | Critical | 9.8 | 2026-01-13 | Explorer32++ 1.3.5.531 contains a buffer overflow vulnerability in Structured Exception Handler (SEH) records that allows attackers to execute arbitrary code… |
CVE-2023-54330 | Critical | 9.8 | 2026-01-13 | Inbit Messenger versions 4.6.0 to 4.9.0 contain a remote stack-based buffer overflow vulnerability that allows unauthenticated attackers to execute arbitrary c… |
CVE-2023-54329 | Critical | 9.8 | 2026-01-13 | Inbit Messenger 4.6.0 - 4.9.0 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by exploiti… |
CVE-2022-50935 | Critical | 9.8 | 2026-01-13 | Flame II HSPA USB Modem contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path in 'C:\Pr… |
CVE-2022-50926 | Critical | 9.8 | 2026-01-13 | WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can… |
CVE-2022-50925 | Critical | 9.8 | 2026-01-13 | Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send keyboard events through an exposed WebSocket on… |
CVE-2022-50922 | Critical | 9.8 | 2026-01-13 | Audio Conversion Wizard v2.01 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory with a specially c… |
CVE-2022-50919 | Critical | 9.8 | 2026-01-13 | Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands… |
CVE-2022-50912 | Critical | 9.8 | 2026-01-13 | ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers c… |
CVE-2022-50910 | Critical | 9.8 | 2026-01-13 | Beehive Forum 1.5.2 contains a host header injection vulnerability in the forgot password functionality that allows attackers to manipulate password reset requ… |
CVE-2022-50905 | Critical | 9.8 | 2026-01-13 | e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks. The first vulnerability is a reflected XSS that occurs… |
CVE-2022-50895 | Critical | 9.8 | 2026-01-13 | Aero CMS 0.0.1 contains a SQL injection vulnerability in the author parameter that allows attackers to manipulate database queries. Attackers can exploit boole… |
CVE-2022-50893 | Critical | 9.8 | 2026-01-13 | VIAVIWEB Wallpaper Admin 1.0 contains an unauthenticated remote code execution vulnerability in the image upload functionality. Attackers can upload a maliciou… |
CVE-2020-36911 | Critical | 9.8 | 2026-01-13 | Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attacke… |
CVE-2026-23478 | Critical | 9.8 | 2026-01-13 | Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gai… |
CVE-2026-22871 | Critical | 9.8 | 2026-01-13 | GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safe_extract() functio… |
CVE-2026-22869 | Critical | 9.8 | 2026-01-13 | Eigent is a multi-agent Workforce. A critical security vulnerability in the CI workflow (.github/workflows/ci.yml) allows arbitrary code execution from fork pu… |
CVE-2025-68271 | Critical | 10.0 | 2026-01-13 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.0 to 6.10.1, OpenC3 COSMOS con… |
CVE-2026-20963 | Critical | 9.8 | 2026-01-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. |
CVE-2025-64155 | Critical | 9.8 | 2026-01-13 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 throug… |
CVE-2025-47855 | Critical | 9.8 | 2026-01-13 | An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.2… |
CVE-2025-25176 | Critical | 9.1 | 2026-01-13 | Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platfor… |
CVE-2025-71095 | Critical | 9.1 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix the crash issue for zero copy XDP_TX action There is a crash issue when… |
CVE-2025-71093 | Critical | 9.1 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: e1000: fix OOB in e1000_tbi_should_accept() In e1000_tbi_should_accept() we read the last… |
CVE-2025-71068 | Critical | 9.8 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: bound check rq_pages index in inline path svc_rdma_copy_inline_range indexed rqs… |
CVE-2025-69992 | Critical | 9.8 | 2026-01-13 | phpgurukul News Portal Project V4.1 has File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identit… |
CVE-2025-69991 | Critical | 9.8 | 2026-01-13 | phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php. |
CVE-2025-69990 | Critical | 9.1 | 2026-01-13 | phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted. |
CVE-2025-68817 | Critical | 9.8 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency Under high concurre… |
CVE-2025-68811 | Critical | 9.8 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rc_pageoff for memcpy byte offset svc_rdma_copy_inline_range added rc_curpag… |
CVE-2025-68809 | Critical | 9.1 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: vfs: fix race on m_flags in vfs_cache ksmbd maintains delete-on-close and pending-… |
CVE-2025-68794 | Critical | 9.8 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: iomap: adjust read range correctly for non-block-aligned positions iomap_adjust_read_rang… |
CVE-2025-68775 | Critical | 9.8 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations leak socket When a handshake request is… |
CVE-2025-65783 | Critical | 9.8 | 2026-01-13 | An arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows attackers to execute ar… |
CVE-2025-12548 | Critical | 9.0 | 2026-01-13 | A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH key… |
CVE-2026-0892 | Critical | 9.8 | 2026-01-13 | Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-0884 | Critical | 9.8 | 2026-01-13 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
CVE-2026-0881 | Critical | 10.0 | 2026-01-13 | Sandbox escape in the Messaging System component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. |
CVE-2026-0879 | Critical | 9.8 | 2026-01-13 | Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140… |
CVE-2025-11250 | Critical | 9.1 | 2026-01-13 | Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations. |
CVE-2025-40805 | Critical | 10.0 | 2026-01-13 | Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent… |
CVE-2025-14829 | Critical | 9.1 | 2026-01-13 | The E-xact | Hosted Payment | WordPress plugin through 2.0 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it pos… |
CVE-2025-10915 | Critical | 9.8 | 2026-01-13 | The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check. |
CVE-2026-0501 | Critical | 9.9 | 2026-01-13 | Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could execute crafted SQL q… |
CVE-2026-0500 | Critical | 9.6 | 2026-01-13 | Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malici… |
CVE-2026-0498 | Critical | 9.1 | 2026-01-13 | SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This fla… |
CVE-2026-0491 | Critical | 9.1 | 2026-01-13 | SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the… |
CVE-2026-22214 | Critical | 9.8 | 2026-01-12 | RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking… |
CVE-2026-22213 | Critical | 9.8 | 2026-01-12 | RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused… |
CVE-2026-22794 | Critical | 9.6 | 2026-01-12 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the e… |
CVE-2025-67146 | Critical | 9.4 | 2026-01-12 | Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search… |
CVE-2025-29329 | Critical | 9.8 | 2026-01-12 | Buffer Overflow in the ippprint (Internet Printing Protocol) service in Sagemcom F@st 3686 MAGYAR_4.121.0 allows remote attacker to execute arbitrary code by s… |
CVE-2025-12420 | Critical | 9.8 | 2026-01-12 | A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operati… |
CVE-2025-67147 | Critical | 9.8 | 2026-01-12 | Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_c… |
CVE-2025-66802 | Critical | 9.8 | 2026-01-12 | Sourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution). The application receives a reverse shell (php) into imagem of… |
CVE-2025-51567 | Critical | 9.1 | 2026-01-12 | A SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote attackers to execute arbitrary SQL comma… |
CVE-2026-22785 | Critical | 9.8 | 2026-01-12 | orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relie… |
CVE-2026-22783 | Critical | 9.6 | 2026-01-12 | Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore fil… |
CVE-2026-22781 | Critical | 9.8 | 2026-01-12 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDE… |
CVE-2026-22252 | Critical | 9.1 | 2026-01-12 | LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allo… |
CVE-2025-63314 | Critical | 10.0 | 2026-01-12 | A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and… |
CVE-2025-46070 | Critical | 9.8 | 2026-01-12 | An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component |
CVE-2025-46066 | Critical | 9.9 | 2026-01-12 | An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges |
CVE-2025-65552 | Critical | 9.8 | 2026-01-12 | D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel. The system does not implement roll… |
CVE-2025-69270 | Critical | 9.8 | 2026-01-12 | Information Exposure Through Query Strings in GET Request vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Session Hijacking.This issue af… |
CVE-2025-69269 | Critical | 9.8 | 2026-01-12 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allow… |
CVE-2025-52694 | Critical | 10.0 | 2026-01-12 | Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable s… |
CVE-2026-22688 | Critical | 9.9 | 2026-01-10 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulne… |
CVE-2025-65091 | Critical | 10.0 | 2026-01-10 | XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (i… |
CVE-2025-61686 | Critical | 9.1 | 2026-01-10 | React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to v… |
CVE-2026-22600 | Critical | 9.1 | 2026-01-10 | OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality… |
CVE-2025-15501 | Critical | 9.8 | 2026-01-09 | A vulnerability was determined in Sangfor Operation and Maintenance Management System up to 3.0.8. Impacted is the function WriterHandle.getCmd of the file /is… |
CVE-2026-22584 | Critical | 9.8 | 2026-01-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Ex… |
CVE-2025-15500 | Critical | 9.8 | 2026-01-09 | A vulnerability was found in Sangfor Operation and Maintenance Management System up to 3.0.8. This issue affects some unknown processing of the file /isomp-pro… |
CVE-2025-70161 | Critical | 9.8 | 2026-01-09 | EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName field is directly passed to a shell command via the system() f… |
CVE-2025-69542 | Critical | 9.8 | 2026-01-09 | A Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link DIR895LA1 v102b07. The vulnerability exists in the lease renewal pro… |
CVE-2025-14598 | Critical | 9.8 | 2026-01-09 | BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQ… |