Critical-severity CVEs (page 8)
Page 8 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-83031 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1… |
CVE-2026-83029 | Critical | 9.6 | 2026-09-15 | Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected ar… |
CVE-2026-83027 | Critical | 9.3 | 2026-09-15 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1… |
CVE-2026-83021 | Critical | 10.0 | 2026-09-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.4… |
CVE-2026-83020 | Critical | 10.0 | 2026-09-15 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-83006 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected… |
CVE-2026-83001 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-83000 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12… |
CVE-2026-82999 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12… |
CVE-2026-82998 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12… |
CVE-2026-82997 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12… |
CVE-2026-82995 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-82994 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-76675 | Critical | 9.1 | 2026-09-15 | A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated rem… |
CVE-2026-76674 | Critical | 9.8 | 2026-09-15 | Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remo… |
CVE-2026-76673 | Critical | 9.8 | 2026-09-15 | Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent e… |
CVE-2026-76672 | Critical | 9.9 | 2026-09-15 | A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with r… |
CVE-2026-76670 | Critical | 9.9 | 2026-09-15 | Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privi… |
CVE-2026-76669 | Critical | 9.9 | 2026-09-15 | Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privi… |
CVE-2026-73963 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-73962 | Critical | 9.6 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73961 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2026-73957 | Critical | 9.3 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-73956 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-73953 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-73952 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-73950 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73948 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-73947 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73946 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73945 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73944 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73940 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-71163 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-71133 | Critical | 10.0 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-70913 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 1… |
CVE-2026-70757 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-70756 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-70748 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-56960 | Critical | 9.8 | 2026-09-15 | In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote escalation of privilege with no additiona… |
CVE-2026-55366 | Critical | 9.8 | 2026-09-15 | In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. This could lead to remote escalation of privilege with… |
CVE-2026-19773 | Critical | 9.8 | 2026-09-15 | libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2026-61667 | Critical | 9.9 | 2026-09-15 | DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileC… |
CVE-2026-45579 | Critical | 9.9 | 2026-09-15 | DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Servic… |
CVE-2026-12351 | Critical | 9.8 | 2026-09-15 | IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote a… |
CVE-2026-11928 | Critical | 9.8 | 2026-09-15 | IBM Verify Identity Access is vulnerable to a buffer overflow attack. |
CVE-2026-11921 | Critical | 9.1 | 2026-09-15 | IBM Verify Identity Access containers may not apply management password change operations correctly. |
CVE-2026-89026 | Critical | 9.8 | 2026-09-15 | The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index… |
CVE-2026-53710 | Critical | 10.0 | 2026-09-15 | MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/pyth… |
CVE-2024-58385 | Critical | 9.8 | 2026-09-15 | Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 paramete… |
CVE-2023-54398 | Critical | 9.8 | 2026-09-15 | Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote una… |
CVE-2026-91949 | Critical | 9.3 | 2026-09-15 | FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections… |
CVE-2026-55211 | Critical | 9.8 | 2026-09-15 | Surfio is a library for reading and writing surface files. Prior to 0.0.19, surfio does not correctly validate size fields in IRAP files, leading to a buffer o… |
CVE-2026-37152 | Critical | 9.8 | 2026-09-15 | TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access. |
CVE-2026-88617 | Critical | 9.8 | 2026-09-15 | SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges. |
CVE-2026-79303 | Critical | 9.9 | 2026-09-15 | kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without… |
CVE-2026-63696 | Critical | 9.1 | 2026-09-15 | Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. A high privileged attacker with… |
CVE-2026-63695 | Critical | 9.8 | 2026-09-15 | Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Session Fixation vulnerability. An unauthenticated attacker with remote access could pot… |
CVE-2026-59971 | Critical | 10.0 | 2026-09-15 | MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/… |
CVE-2026-55158 | Critical | 9.1 | 2026-09-15 | Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git… |
CVE-2026-39919 | Critical | 9.8 | 2026-09-15 | Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to… |
CVE-2026-92079 | Critical | 9.1 | 2026-09-15 | Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
CVE-2026-92075 | Critical | 9.1 | 2026-09-15 | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
CVE-2026-92071 | Critical | 9.6 | 2026-09-15 | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird… |
CVE-2026-92066 | Critical | 9.8 | 2026-09-15 | Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
CVE-2026-92061 | Critical | 9.8 | 2026-09-15 | Incorrect boundary conditions in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
CVE-2026-92059 | Critical | 9.3 | 2026-09-15 | Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 15… |
CVE-2026-92057 | Critical | 9.1 | 2026-09-15 | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
CVE-2026-92051 | Critical | 9.1 | 2026-09-15 | Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
CVE-2026-92050 | Critical | 9.1 | 2026-09-15 | Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
CVE-2026-92048 | Critical | 9.0 | 2026-09-15 | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird… |
CVE-2026-92045 | Critical | 9.6 | 2026-09-15 | Sandbox escape due to incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, a… |
CVE-2026-92041 | Critical | 9.1 | 2026-09-15 | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
CVE-2026-92038 | Critical | 9.1 | 2026-09-15 | Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153… |
CVE-2026-92037 | Critical | 9.8 | 2026-09-15 | Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
CVE-2026-92036 | Critical | 9.8 | 2026-09-15 | Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
CVE-2026-92035 | Critical | 9.6 | 2026-09-15 | Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153… |
CVE-2026-92034 | Critical | 9.1 | 2026-09-15 | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
CVE-2026-92032 | Critical | 9.6 | 2026-09-15 | Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbir… |
CVE-2026-92018 | Critical | 9.6 | 2026-09-15 | Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thund… |
CVE-2026-91998 | Critical | 9.9 | 2026-09-15 | Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientS… |
CVE-2026-91995 | Critical | 9.1 | 2026-09-15 | pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing… |
CVE-2026-57148 | Critical | 9.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the public dev-secret-change-me HS256 signin… |
CVE-2026-57147 | Critical | 9.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns the public dev-secret-change-me value to JWT_SECRE… |
CVE-2026-57141 | Critical | 9.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScr… |
CVE-2026-57140 | Critical | 9.4 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.6.0 until 1.7.2, AgentOS in src/praisonai-ts/src/os/agentos.ts uses the 0.0.0.0 default from src/praisonai-ts/s… |
CVE-2026-57139 | Critical | 9.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction a… |
CVE-2026-57138 | Critical | 9.9 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript wit… |
CVE-2026-62379 | Critical | 9.8 | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XM… |
CVE-2026-90711 | Critical | 9.1 | 2026-09-15 | proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions… |
CVE-2026-91003 | Critical | 9.1 | 2026-09-15 | A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Service. This manipulat… |
CVE-2026-91001 | Critical | 9.9 | 2026-09-15 | A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Perf… |
CVE-2026-90847 | Critical | 9.1 | 2026-09-15 | A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. Th… |
CVE-2026-12944 | Critical | 9.6 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting co… |
CVE-2026-86881 | Critical | 9.1 | 2026-09-14 | A certificate validation issue was addressed with improved certificate validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS… |
CVE-2026-84625 | Critical | 9.1 | 2026-09-14 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS… |
CVE-2026-84609 | Critical | 9.8 | 2026-09-14 | A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS T… |
CVE-2026-84561 | Critical | 9.8 | 2026-09-14 | A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27… |
CVE-2026-84520 | Critical | 9.8 | 2026-09-14 | A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27. A local attacker may be able to cause unexpected sy… |
CVE-2026-65414 | Critical | 9.8 | 2026-09-14 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden G… |