Critical-severity CVEs (page 9)
Page 9 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-91003 | Critical | 9.1 | 2026-09-15 | A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Service. This manipulat… |
CVE-2026-91001 | Critical | 9.9 | 2026-09-15 | A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Perf… |
CVE-2026-90847 | Critical | 9.1 | 2026-09-15 | A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. Th… |
CVE-2026-12944 | Critical | 9.6 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting co… |
CVE-2026-86881 | Critical | 9.1 | 2026-09-14 | A certificate validation issue was addressed with improved certificate validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS… |
CVE-2026-84625 | Critical | 9.1 | 2026-09-14 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS… |
CVE-2026-84609 | Critical | 9.8 | 2026-09-14 | A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS T… |
CVE-2026-84561 | Critical | 9.8 | 2026-09-14 | A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27… |
CVE-2026-84520 | Critical | 9.8 | 2026-09-14 | A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27. A local attacker may be able to cause unexpected sy… |
CVE-2026-65414 | Critical | 9.8 | 2026-09-14 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden G… |
CVE-2026-65381 | Critical | 10.0 | 2026-09-14 | A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed i… |
CVE-2026-53713 | Critical | 9.1 | 2026-09-14 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute… |
CVE-2026-43790 | Critical | 9.1 | 2026-09-14 | The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may… |
CVE-2026-55209 | Critical | 9.8 | 2026-09-14 | resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric fields… |
CVE-2026-54334 | Critical | 9.8 | 2026-09-14 | UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefi_firmware… |
CVE-2026-54333 | Critical | 9.8 | 2026-09-14 | UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable() in uefi_firmwar… |
CVE-2026-50006 | Critical | 9.1 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to S… |
CVE-2026-18119 | Critical | 9.0 | 2026-09-14 | Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cr… |
CVE-2026-16338 | Critical | 9.9 | 2026-09-14 | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper valida… |
CVE-2026-59178 | Critical | 9.8 | 2026-09-14 | ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication crede… |
CVE-2026-90945 | Critical | 9.8 | 2026-09-14 | Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthen… |
CVE-2026-90942 | Critical | 9.6 | 2026-09-14 | Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organiz… |
CVE-2026-76461 | Critical | 9.8 | 2026-09-14 | A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitr… |
CVE-2026-76443 | Critical | 9.8 | 2026-09-14 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineer… |
CVE-2026-76441 | Critical | 9.8 | 2026-09-14 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineer… |
CVE-2026-76440 | Critical | 9.8 | 2026-09-14 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineer… |
CVE-2026-20353 | Critical | 9.8 | 2026-09-14 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineer… |
CVE-2026-61534 | Critical | 9.1 | 2026-09-14 | Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, a… |
CVE-2026-57145 | Critical | 9.1 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to o… |
CVE-2026-57131 | Critical | 9.8 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs withou… |
CVE-2026-57127 | Critical | 9.8 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or J… |
CVE-2026-57124 | Critical | 9.8 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and ac… |
CVE-2026-82435 | Critical | 9.8 | 2026-09-14 | Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentica… |
CVE-2026-82431 | Critical | 9.8 | 2026-09-14 | Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.groups` was considered… |
CVE-2026-57125 | Critical | 9.8 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-… |
CVE-2026-57123 | Critical | 9.8 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse an… |
CVE-2026-82441 | Critical | 9.1 | 2026-09-14 | Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading… |
CVE-2026-82439 | Critical | 9.8 | 2026-09-14 | Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No code path ever rem… |
CVE-2026-73370 | Critical | 9.8 | 2026-09-14 | Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by Reconciliation service's pull and push, being… |
CVE-2026-90937 | Critical | 9.9 | 2026-09-14 | froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apa… |
CVE-2026-78330 | Critical | 9.8 | 2026-09-14 | Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least prot… |
CVE-2026-78299 | Critical | 9.1 | 2026-09-14 | In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations o… |
CVE-2026-77181 | Critical | 9.8 | 2026-09-14 | Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, wh… |
CVE-2026-77051 | Critical | 9.8 | 2026-09-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entit… |
CVE-2026-75030 | Critical | 9.8 | 2026-09-14 | Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provision group members… |
CVE-2026-73668 | Critical | 9.8 | 2026-09-14 | Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the ful… |
CVE-2026-73579 | Critical | 9.8 | 2026-09-14 | Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, dependin… |
CVE-2026-73470 | Critical | 9.8 | 2026-09-14 | Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not f… |
CVE-2026-90919 | Critical | 9.8 | 2026-09-14 | LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes th… |
CVE-2026-90898 | Critical | 9.8 | 2026-09-14 | Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the clie… |
CVE-2026-87802 | Critical | 9.1 | 2026-09-14 | Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an att… |
CVE-2026-87785 | Critical | 9.1 | 2026-09-14 | Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least… |
CVE-2026-86460 | Critical | 9.8 | 2026-09-14 | Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0… |
CVE-2026-82232 | Critical | 9.8 | 2026-09-14 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitle… |
CVE-2026-90703 | Critical | 9.1 | 2026-09-14 | A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShare. Such manipulatio… |
CVE-2026-90702 | Critical | 9.1 | 2026-09-14 | A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partitio… |
CVE-2026-90699 | Critical | 9.9 | 2026-09-14 | A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation o… |
CVE-2026-90693 | Critical | 9.9 | 2026-09-14 | A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Prim… |
CVE-2026-90692 | Critical | 9.9 | 2026-09-14 | A vulnerability was detected in D-Link DIR-878 120B05. This affects the function SetDynamicDNSIPv6Settings of the component Dynamic DNS IPv6 Settings. The mani… |
CVE-2026-82787 | Critical | 9.8 | 2026-09-14 | Missing authentication for critical function vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an affected product may be operated by a… |
CVE-2026-90680 | Critical | 9.9 | 2026-09-14 | A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207. The impacted element is the function strcpy of the file /HNAP1/SetStaticRouteSettings… |
CVE-2026-90608 | Critical | 9.9 | 2026-09-14 | A flaw has been found in Totolink A3002MU Hh-B20211125.1046. The affected element is the function formPortFw of the file /boafrm/formPortFw of the component bo… |
CVE-2026-90607 | Critical | 9.9 | 2026-09-14 | A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the compone… |
CVE-2026-90606 | Critical | 9.9 | 2026-09-14 | A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Set… |
CVE-2026-90605 | Critical | 9.9 | 2026-09-14 | A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the… |
CVE-2026-81648 | Critical | 10.0 | 2026-09-13 | The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated use… |
CVE-2026-90558 | Critical | 9.8 | 2026-09-12 | sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. A… |
CVE-2026-78159 | Critical | 9.8 | 2026-09-12 | The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function… |
CVE-2026-78006 | Critical | 9.8 | 2026-09-12 | The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instanc… |
CVE-2026-85681 | Critical | 9.8 | 2026-09-12 | The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users… |
CVE-2026-84171 | Critical | 9.8 | 2026-09-12 | The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible… |
CVE-2026-82845 | Critical | 9.9 | 2026-09-12 | The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowi… |
CVE-2026-81402 | Critical | 9.8 | 2026-09-12 | The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler… |
CVE-2026-77006 | Critical | 9.6 | 2026-09-12 | The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, a… |
CVE-2026-77005 | Critical | 9.6 | 2026-09-12 | The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capabilit… |
CVE-2026-75800 | Critical | 9.8 | 2026-09-12 | The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, al… |
CVE-2026-87719 | Critical | 9.9 | 2026-09-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 1… |
CVE-2026-85706 | Critical | 10.0 | 2026-09-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, an… |
CVE-2026-89713 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd_setattr() checks whether a size upd… |
CVE-2026-89712 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount… |
CVE-2026-89708 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY… |
CVE-2026-89703 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations nfsd4_drop_revoked_s… |
CVE-2026-89702 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: size fh_verify server sockaddr slot by xpt_locallen The nfsd_fh_verify and nfsd_fh_… |
CVE-2026-89697 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() The BOTH_TIME… |
CVE-2026-89689 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4_sequence() can free the very s… |
CVE-2026-89688 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry In nfs4_preprocess_s… |
CVE-2026-89686 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke nfsd4_alloc_la… |
CVE-2026-89681 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORK_STRUCT… |
CVE-2026-89677 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() dentry_create() can… |
CVE-2026-89676 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy()… |
CVE-2026-89675 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used afte… |
CVE-2026-89674 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget The XDR buffer size calcula… |
CVE-2026-89672 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL v2 SETACL path shares the decoder convent… |
CVE-2026-89671 | Critical | 9.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp->mask nfsd3_proc_setacl() calls set_posix_acl() unconditio… |
CVE-2026-89669 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4_copy_notify() finished in… |
CVE-2026-89662 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown __destroy_client() release… |
CVE-2026-89660 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a… |
CVE-2026-89659 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds o… |
CVE-2026-89658 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40_clean_admi… |
CVE-2026-89656 | Critical | 9.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush_decode() stores bucket data by ar… |