High-severity CVEs (page 10)
Page 10 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-72601 | High | 7.5 | 2026-08-11 | A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable i… |
CVE-2026-72600 | High | 7.5 | 2026-08-11 | A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer… |
CVE-2026-72596 | High | 8.1 | 2026-08-11 | A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model… |
CVE-2026-72595 | High | 8.1 | 2026-08-11 | A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams vi… |
CVE-2026-72563 | High | 8.1 | 2026-08-11 | A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams v… |
CVE-2026-72562 | High | 8.8 | 2026-08-11 | An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataO… |
CVE-2026-72561 | High | 8.8 | 2026-08-11 | A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the p… |
CVE-2026-72558 | High | 8.8 | 2026-08-11 | An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The c… |
CVE-2026-72557 | High | 8.8 | 2026-08-11 | An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset… |
CVE-2026-72556 | High | 8.8 | 2026-08-11 | A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the… |
CVE-2026-72555 | High | 8.1 | 2026-08-11 | A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causin… |
CVE-2026-72552 | High | 7.5 | 2026-08-11 | A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary… |
CVE-2026-72551 | High | 8.8 | 2026-08-11 | A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a… |
CVE-2026-72548 | High | 7.5 | 2026-08-11 | An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant rec… |
CVE-2026-72547 | High | 7.1 | 2026-08-11 | An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into ev… |
CVE-2026-72546 | High | 7.1 | 2026-08-11 | An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders i… |
CVE-2026-72545 | High | 7.5 | 2026-08-11 | An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact recor… |
CVE-2026-72544 | High | 7.5 | 2026-08-11 | An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries v… |
CVE-2026-72543 | High | 7.5 | 2026-08-11 | An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact recor… |
CVE-2026-72538 | High | 8.8 | 2026-08-11 | An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step… |
CVE-2026-72537 | High | 8.8 | 2026-08-11 | A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take o… |
CVE-2026-72536 | High | 8.6 | 2026-08-11 | A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription v… |
CVE-2026-72535 | High | 8.6 | 2026-08-11 | A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any… |
CVE-2026-72534 | High | 8.8 | 2026-08-11 | A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain s… |
CVE-2026-72533 | High | 8.8 | 2026-08-11 | An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via… |
CVE-2026-50237 | High | 7.4 | 2026-08-11 | A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepos… |
CVE-2026-50236 | High | 7.4 | 2026-08-11 | An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation… |
CVE-2026-72694 | High | 7.1 | 2026-08-11 | A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symb… |
CVE-2026-72693 | High | 7.8 | 2026-08-11 | `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/… |
CVE-2026-71217 | High | 7.5 | 2026-08-11 | A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as… |
CVE-2026-15567 | High | 7.5 | 2026-08-11 | A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled lengt… |
CVE-2026-15565 | High | 7.5 | 2026-08-11 | A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any… |
CVE-2026-15563 | High | 7.4 | 2026-08-11 | A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and… |
CVE-2026-15562 | High | 7.5 | 2026-08-11 | A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting ha… |
CVE-2026-15561 | High | 7.5 | 2026-08-11 | A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connec… |
CVE-2026-15560 | High | 8.1 | 2026-08-11 | when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthent… |
CVE-2026-15556 | High | 8.1 | 2026-08-11 | A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker… |
CVE-2026-15555 | High | 8.8 | 2026-08-11 | A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshalle… |
CVE-2026-15554 | High | 7.4 | 2026-08-11 | the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated… |
CVE-2026-16053 | High | 8.5 | 2026-08-11 | Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Onlin… |
CVE-2026-4757 | High | 7.2 | 2026-08-11 | A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be expl… |
CVE-2026-19424 | High | 7.5 | 2026-08-11 | Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific par… |
CVE-2026-66763 | High | 7.9 | 2026-08-11 | SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An a… |
CVE-2026-58243 | High | 8.8 | 2026-08-11 | SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unaut… |
CVE-2026-58230 | High | 7.0 | 2026-08-11 | SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted to… |
CVE-2026-44765 | High | 7.3 | 2026-08-11 | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access schedulin… |
CVE-2026-44764 | High | 7.3 | 2026-08-11 | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests t… |
CVE-2026-44763 | High | 7.6 | 2026-08-11 | SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially c… |
CVE-2026-8718 | High | 8.4 | 2026-08-10 | tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the cal… |
CVE-2026-72915 | High | 7.5 | 2026-08-10 | Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use… |
CVE-2026-72914 | High | 7.5 | 2026-08-10 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics end… |
CVE-2026-73030 | High | 8.1 | 2026-08-10 | unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths befo… |
CVE-2026-72910 | High | 7.1 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc… |
CVE-2026-72903 | High | 8.1 | 2026-08-10 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename throu… |
CVE-2026-63622 | High | 7.8 | 2026-08-10 | A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in… |
CVE-2026-18982 | High | 8.8 | 2026-08-10 | A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate the… |
CVE-2026-18951 | High | 8.8 | 2026-08-10 | A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permiss… |
CVE-2026-18950 | High | 8.8 | 2026-08-10 | A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does… |
CVE-2026-18949 | High | 8.8 | 2026-08-10 | A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly bro… |
CVE-2026-18947 | High | 8.5 | 2026-08-10 | A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially craf… |
CVE-2026-18941 | High | 7.7 | 2026-08-10 | A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager… |
CVE-2026-18621 | High | 7.6 | 2026-08-10 | A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Wor… |
CVE-2026-18620 | High | 7.1 | 2026-08-10 | A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount f… |
CVE-2026-18618 | High | 7.5 | 2026-08-10 | A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issu… |
CVE-2026-18617 | High | 8.8 | 2026-08-10 | A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, wh… |
CVE-2026-18611 | High | 7.5 | 2026-08-10 | A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB… |
CVE-2026-18608 | High | 8.7 | 2026-08-10 | A flaw was found in the Data Science Pipelines Operator (DSPO). The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond… |
CVE-2026-15581 | High | 8.0 | 2026-08-10 | A flaw was found in the TrustyAI Service (TAS) deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly acces… |
CVE-2026-15467 | High | 8.1 | 2026-08-10 | A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configurin… |
CVE-2026-13717 | High | 8.8 | 2026-08-10 | A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with… |
CVE-2026-11810 | High | 7.5 | 2026-08-10 | The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updatehub.c) parses the JSON metadata returned by the up… |
CVE-2026-72883 | High | 8.8 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in apps/dokploy/server/wss/terminal.ts, apps/dokploy/se… |
CVE-2026-72875 | High | 8.8 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes… |
CVE-2026-71966 | High | 8.8 | 2026-08-10 | CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenti… |
CVE-2026-71965 | High | 8.8 | 2026-08-10 | CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated… |
CVE-2026-69118 | High | 8.8 | 2026-08-10 | Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrar… |
CVE-2026-69112 | High | 7.1 | 2026-08-10 | Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail… |
CVE-2026-14886 | High | 8.2 | 2026-08-10 | Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one… |
CVE-2026-72871 | High | 7.5 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/ap… |
CVE-2026-72866 | High | 8.8 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a sessi… |
CVE-2026-71962 | High | 7.5 | 2026-08-10 | Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows una… |
CVE-2026-59091 | High | 7.3 | 2026-08-10 | A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user… |
CVE-2026-72734 | High | 8.4 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/se… |
CVE-2026-72731 | High | 7.1 | 2026-08-10 | Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameter… |
CVE-2026-72730 | High | 8.7 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username… |
CVE-2026-71576 | High | 8.5 | 2026-08-10 | A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A r… |
CVE-2026-66738 | High | 8.8 | 2026-08-10 | SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user inp… |
CVE-2026-48048 | High | 7.5 | 2026-08-10 | XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to v… |
CVE-2026-72692 | High | 7.5 | 2026-08-10 | A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-fl… |
CVE-2026-72691 | High | 7.5 | 2026-08-10 | An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file a… |
CVE-2026-72690 | High | 7.1 | 2026-08-10 | An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey quest… |
CVE-2026-72689 | High | 7.5 | 2026-08-10 | A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete cont… |
CVE-2026-72688 | High | 7.5 | 2026-08-10 | A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documen… |
CVE-2026-6374 | High | 7.3 | 2026-08-10 | Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: throug… |
CVE-2026-68427 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings __host1x_bo_unpin() dr… |
CVE-2026-68425 | High | 7.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: IB/mad: Drop unmatched RMPP responses before reassembly Kernel-handled RMPP receive proce… |
CVE-2026-68420 | High | 7.1 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: xfrm: reject optional IPTFS templates in outbound policies syzbot reported a stack-out-of… |
CVE-2026-68419 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent rereg_mr for non-mem regions When a QP/CQ/SRQ is created, a two step… |
CVE-2026-68417 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siw_create_qp() currently calls siw_qp_add() be… |
CVE-2026-68415 | High | 7.8 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrm_state_gc_task can run long after… |