Critical-severity CVEs (page 9)
Page 9 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55579 | Critical | 9.8 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password… |
CVE-2026-48030 | Critical | 9.9 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the term… |
CVE-2026-17552 | Critical | 9.1 | 2026-07-27 | Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base i… |
CVE-2026-63077 | Critical | 9.8 | 2026-07-27 | In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol |
CVE-2026-17191 | Critical | 9.1 | 2026-07-27 | An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, wh… |
CVE-2026-66395 | Critical | 9.6 | 2026-07-27 | SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbit… |
CVE-2026-16812 | Critical | 10.0 | 2026-07-27 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact t… |
CVE-2025-50455 | Critical | 9.1 | 2026-07-27 | SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability… |
CVE-2026-59550 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions. |
CVE-2026-59549 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions. |
CVE-2026-59538 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions. |
CVE-2026-59533 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions. |
CVE-2026-59527 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. |
CVE-2026-65879 | Critical | 9.8 | 2026-07-27 | Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed att… |
CVE-2026-61511 | Critical | 9.8 | 2026-07-27 | vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template r… |
CVE-2026-58662 | Critical | 9.1 | 2026-07-27 | Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0… |
CVE-2026-58023 | Critical | 9.1 | 2026-07-27 | Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to versi… |
CVE-2026-55971 | Critical | 9.8 | 2026-07-27 | Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to… |
CVE-2026-48144 | Critical | 9.1 | 2026-07-27 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users… |
CVE-2026-64535 | Critical | 9.8 | 2026-07-27 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability tes… |
CVE-2026-64534 | Critical | 9.8 | 2026-07-27 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_tr… |
CVE-2026-14289 | Critical | 9.0 | 2026-07-27 | The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived… |
CVE-2026-13714 | Critical | 9.8 | 2026-07-27 | The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality… |
CVE-2026-13597 | Critical | 9.1 | 2026-07-27 | The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generat… |
CVE-2026-13332 | Critical | 9.1 | 2026-07-27 | The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowin… |
CVE-2026-12394 | Critical | 9.8 | 2026-07-27 | The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an ac… |
CVE-2026-64530 | Critical | 9.8 | 2026-07-26 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return… |
CVE-2026-66012 | Critical | 10.0 | 2026-07-25 | SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckA… |
CVE-2026-64523 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshake_nl_accept_doit() need… |
CVE-2026-64459 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcp_ao_destroy_sock Commit 51e547e8c89c ("tcp: Free TCP-… |
CVE-2026-64450 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE_MSG c… |
CVE-2026-64439 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5_aead_encrypt(), krb5_a… |
CVE-2026-64410 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: IPIP tunnel hardware offload is not yet support No driver supports… |
CVE-2026-64399 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE The FSCTL_DUPLICATE_EXTE… |
CVE-2026-64397 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to i… |
CVE-2026-64393 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener credentials SMB2 SET_INFO handlers call path-based VFS he… |
CVE-2026-64392 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by def… |
CVE-2026-64391 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Un… |
CVE-2026-64387 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return… |
CVE-2026-64386 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a… |
CVE-2026-64385 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return… |
CVE-2026-64384 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a… |
CVE-2026-64383 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffe… |
CVE-2026-64355 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for a… |
CVE-2026-64320 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_… |
CVE-2026-64319 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_repl… |
CVE-2026-64303 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengine_prep_s… |
CVE-2026-64269 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg When the server ans… |
CVE-2026-64268 | Critical | 9.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/… |
CVE-2026-64257 | Critical | 9.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b ("smb: c… |
CVE-2026-16766 | Critical | 9.8 | 2026-07-25 | Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkht… |
CVE-2026-16280 | Critical | 9.8 | 2026-07-24 | An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This c… |
CVE-2026-61884 | Critical | 9.8 | 2026-07-24 | The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credentials during the login process. By submitti… |
CVE-2026-62835 | Critical | 9.3 | 2026-07-24 | Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network. |
CVE-2026-48021 | Critical | 9.1 | 2026-07-24 | In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake wi… |
CVE-2026-64232 | Critical | 9.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_segments in blk_insert_cloned_request blk_insert_cloned_req… |
CVE-2026-64216 | Critical | 9.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs_unlock_abandoned_re… |
CVE-2026-58630 | Critical | 10.0 | 2026-07-24 | Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-58586 | Critical | 9.8 | 2026-07-24 | Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled… |
CVE-2026-57106 | Critical | 10.0 | 2026-07-24 | Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-56163 | Critical | 10.0 | 2026-07-24 | Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-16634 | Critical | 9.8 | 2026-07-24 | TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncont… |
CVE-2026-15704 | Critical | 9.8 | 2026-07-24 | In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent tr… |
CVE-2026-12877 | Critical | 9.1 | 2026-07-24 | The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL… |
CVE-2026-62825 | Critical | 10.0 | 2026-07-24 | Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-58275 | Critical | 10.0 | 2026-07-24 | Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-56191 | Critical | 10.0 | 2026-07-24 | Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-56165 | Critical | 9.8 | 2026-07-24 | Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network. |
CVE-2026-56160 | Critical | 9.1 | 2026-07-24 | Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network. |
CVE-2026-54120 | Critical | 9.9 | 2026-07-24 | Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network. |
CVE-2026-50517 | Critical | 9.9 | 2026-07-24 | Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network. |
CVE-2026-42933 | Critical | 10.0 | 2026-07-23 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, whi… |
CVE-2026-63732 | Critical | 9.9 | 2026-07-23 | 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass… |
CVE-2025-71389 | Critical | 10.0 | 2026-07-23 | Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Compone… |
CVE-2024-58354 | Critical | 9.9 | 2026-07-23 | cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses… |
CVE-2026-52439 | Critical | 9.8 | 2026-07-23 | An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism |
CVE-2026-47724 | Critical | 9.9 | 2026-07-23 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bear… |
CVE-2026-15981 | Critical | 9.8 | 2026-07-23 | The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the… |
CVE-2026-15630 | Critical | 9.9 | 2026-07-23 | A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch… |
CVE-2026-63359 | Critical | 9.8 | 2026-07-23 | The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted reque… |
CVE-2026-6516 | Critical | 10.0 | 2026-07-23 | Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API. |
CVE-2026-65701 | Critical | 9.1 | 2026-07-23 | SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticat… |
CVE-2026-65700 | Critical | 9.8 | 2026-07-23 | h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, an… |
CVE-2026-47752 | Critical | 9.9 | 2026-07-23 | Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in… |
CVE-2026-47668 | Critical | 10.0 | 2026-07-23 | DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via co… |
CVE-2026-44210 | Critical | 9.9 | 2026-07-23 | Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions pr… |
CVE-2026-15617 | Critical | 9.1 | 2026-07-23 | Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Uni… |
CVE-2026-15616 | Critical | 9.1 | 2026-07-23 | Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access. |
CVE-2026-15612 | Critical | 9.1 | 2026-07-23 | Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding. |
CVE-2026-15611 | Critical | 9.1 | 2026-07-23 | Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unaut… |
CVE-2026-65689 | Critical | 9.8 | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauth… |
CVE-2026-65688 | Critical | 9.8 | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthen… |
CVE-2026-65687 | Critical | 9.8 | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthent… |
CVE-2026-65907 | Critical | 9.1 | 2026-07-23 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible |
CVE-2026-65606 | Critical | 9.6 | 2026-07-23 | SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name tha… |
CVE-2026-65605 | Critical | 9.6 | 2026-07-23 | SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as H… |
CVE-2026-65471 | Critical | 9.6 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions. |
CVE-2026-65461 | Critical | 9.1 | 2026-07-23 | Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions. |
CVE-2026-65455 | Critical | 9.1 | 2026-07-23 | Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions. |
CVE-2026-64813 | Critical | 10.0 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session |