High-severity CVEs (page 14)
Page 14 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19177 | High | 8.3 | 2026-08-06 | Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-19176 | High | 7.5 | 2026-08-06 | Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to execute arbitrary code in… |
CVE-2026-19174 | High | 8.8 | 2026-08-06 | Integer overflow in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-19173 | High | 8.3 | 2026-08-06 | Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-19172 | High | 8.3 | 2026-08-06 | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-19169 | High | 8.8 | 2026-08-06 | Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform privilege escalati… |
CVE-2026-19168 | High | 8.8 | 2026-08-06 | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-19165 | High | 7.5 | 2026-08-06 | Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to execute arbi… |
CVE-2026-19163 | High | 8.3 | 2026-08-06 | Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-19162 | High | 8.8 | 2026-08-06 | Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-19159 | High | 7.5 | 2026-08-06 | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentiall… |
CVE-2026-19158 | High | 7.5 | 2026-08-06 | Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2026-19156 | High | 7.5 | 2026-08-06 | Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2026-19155 | High | 8.3 | 2026-08-06 | Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-19154 | High | 8.3 | 2026-08-06 | Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-19153 | High | 8.1 | 2026-08-06 | Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-19152 | High | 8.3 | 2026-08-06 | Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to po… |
CVE-2026-19151 | High | 8.8 | 2026-08-06 | Use after free in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2026-19150 | High | 8.8 | 2026-08-06 | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-19148 | High | 8.3 | 2026-08-06 | Out of bounds write in GPU in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-19147 | High | 8.3 | 2026-08-06 | Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perf… |
CVE-2026-19145 | High | 8.8 | 2026-08-06 | Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2026-19144 | High | 8.8 | 2026-08-06 | Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2026-19143 | High | 8.6 | 2026-08-06 | Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potentially perform a san… |
CVE-2026-19142 | High | 7.5 | 2026-08-06 | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentiall… |
CVE-2026-19141 | High | 8.3 | 2026-08-06 | Use after free in Resources in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-19140 | High | 8.3 | 2026-08-06 | Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
CVE-2026-19139 | High | 7.4 | 2026-08-06 | Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a maliciou… |
CVE-2026-19138 | High | 8.3 | 2026-08-06 | Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-19137 | High | 8.3 | 2026-08-06 | Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-19111 | High | 8.1 | 2026-08-06 | Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow rem… |
CVE-2026-19062 | High | 7.3 | 2026-08-06 | A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.ac… |
CVE-2026-16620 | High | 7.5 | 2026-08-06 | The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" pric… |
CVE-2026-16619 | High | 7.5 | 2026-08-06 | The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-sup… |
CVE-2026-13399 | High | 7.5 | 2026-08-06 | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticate… |
CVE-2026-12584 | High | 7.5 | 2026-08-06 | The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provider notifications for… |
CVE-2026-11803 | High | 7.8 | 2026-08-06 | A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerab… |
CVE-2026-10599 | High | 7.5 | 2026-08-06 | The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked a… |
CVE-2026-10524 | High | 7.5 | 2026-08-06 | The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart throug… |
CVE-2024-39024 | High | 8.8 | 2026-08-06 | In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution. |
CVE-2026-68750 | High | 7.5 | 2026-08-06 | Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server… |
CVE-2026-68749 | High | 7.5 | 2026-08-06 | Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust ser… |
CVE-2026-53985 | High | 7.5 | 2026-08-06 | Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows a… |
CVE-2026-53977 | High | 7.5 | 2026-08-06 | OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a PO… |
CVE-2026-43622 | High | 7.8 | 2026-08-06 | llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() wh… |
CVE-2026-3430 | High | 8.6 | 2026-08-06 | The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated… |
CVE-2026-18427 | High | 7.5 | 2026-08-06 | @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segm… |
CVE-2026-18359 | High | 8.5 | 2026-08-06 | Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the ser… |
CVE-2026-18277 | High | 7.1 | 2026-08-06 | Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselv… |
CVE-2026-18258 | High | 8.8 | 2026-08-06 | Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote a… |
CVE-2026-70646 | High | 7.5 | 2026-08-06 | aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body bef… |
CVE-2026-66712 | High | 7.5 | 2026-08-06 | Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions. |
CVE-2026-66711 | High | 7.1 | 2026-08-06 | Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions. |
CVE-2026-66710 | High | 8.1 | 2026-08-06 | Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions. |
CVE-2026-66708 | High | 8.2 | 2026-08-06 | Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions. |
CVE-2026-66707 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions. |
CVE-2026-66705 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions. |
CVE-2026-66702 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions. |
CVE-2026-66694 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions. |
CVE-2026-66690 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions. |
CVE-2026-66664 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions. |
CVE-2026-66663 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. |
CVE-2026-66470 | High | 7.1 | 2026-08-06 | Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions. |
CVE-2026-66457 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Events Manager <= 7.4.1 versions. |
CVE-2026-66440 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions. |
CVE-2026-66439 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions. |
CVE-2026-65570 | High | 8.1 | 2026-08-06 | Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions. |
CVE-2026-65569 | High | 8.5 | 2026-08-06 | Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions. |
CVE-2026-65565 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions. |
CVE-2026-65560 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions. |
CVE-2026-65559 | High | 7.2 | 2026-08-06 | Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions. |
CVE-2026-65554 | High | 7.1 | 2026-08-06 | Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions. |
CVE-2026-65549 | High | 7.2 | 2026-08-06 | Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions. |
CVE-2026-65547 | High | 8.5 | 2026-08-06 | Subscriber SQL Injection in Creative Mail <= 1.6.9 versions. |
CVE-2026-65545 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions. |
CVE-2026-65544 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions. |
CVE-2026-65543 | High | 7.5 | 2026-08-06 | Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. |
CVE-2026-65542 | High | 8.8 | 2026-08-06 | Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. |
CVE-2026-65541 | High | 7.3 | 2026-08-06 | Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions. |
CVE-2026-65523 | High | 7.5 | 2026-08-06 | Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions. |
CVE-2026-65517 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions. |
CVE-2026-65515 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions. |
CVE-2026-65513 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions. |
CVE-2026-65509 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions. |
CVE-2026-65504 | High | 7.5 | 2026-08-06 | Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions. |
CVE-2026-61982 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions. |
CVE-2026-61964 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions. |
CVE-2026-61963 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions. |
CVE-2026-61961 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions. |
CVE-2026-34502 | High | 7.5 | 2026-08-06 | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 th… |
CVE-2026-34501 | High | 7.5 | 2026-08-06 | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 throu… |
CVE-2026-28177 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions. |
CVE-2026-28172 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions. |
CVE-2026-28143 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions. |
CVE-2026-28141 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions. |
CVE-2026-28140 | High | 7.5 | 2026-08-06 | Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions. |
CVE-2026-28111 | High | 8.8 | 2026-08-06 | Contributor Privilege Escalation in Forminator <= 1.56.0 versions. |
CVE-2026-28082 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions. |
CVE-2025-49506 | High | 7.5 | 2026-08-06 | APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaki… |
CVE-2026-16315 | High | 8.7 | 2026-08-06 | OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an u… |