High-severity CVEs (page 16)
Page 16 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20270 | High | 8.6 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive inter… |
CVE-2026-20269 | High | 8.6 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive inter… |
CVE-2026-20268 | High | 8.6 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive inter… |
CVE-2026-20263 | High | 8.6 | 2026-08-05 | A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a d… |
CVE-2026-20200 | High | 8.8 | 2026-08-05 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary comma… |
CVE-2026-20124 | High | 7.7 | 2026-08-05 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause an a… |
CVE-2026-17630 | High | 7.2 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to improper validation of configuration parameters. |
CVE-2026-17626 | High | 8.8 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP serve… |
CVE-2026-17623 | High | 8.8 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field… |
CVE-2026-17617 | High | 8.5 | 2026-08-05 | IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of URLs specified in cus… |
CVE-2026-9203 | High | 8.5 | 2026-08-05 | A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to byp… |
CVE-2026-8400 | High | 8.1 | 2026-08-05 | IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Ja… |
CVE-2026-7327 | High | 8.1 | 2026-08-05 | An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an aut… |
CVE-2026-7326 | High | 7.5 | 2026-08-05 | A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenti… |
CVE-2026-70604 | High | 7.4 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom… |
CVE-2026-70601 | High | 7.5 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, app… |
CVE-2026-60023 | High | 7.5 | 2026-08-05 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted or pendin… |
CVE-2026-48911 | High | 7.5 | 2026-08-05 | Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check… |
CVE-2026-48834 | High | 7.5 | 2026-08-05 | Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attacker… |
CVE-2026-39923 | High | 8.1 | 2026-08-05 | Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens b… |
CVE-2026-16442 | High | 7.4 | 2026-08-05 | A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the Id… |
CVE-2026-15572 | High | 8.8 | 2026-08-05 | A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which… |
CVE-2026-10025 | High | 8.2 | 2026-08-05 | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability r… |
CVE-2026-54876 | High | 7.5 | 2026-08-05 | Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains… |
CVE-2026-17613 | High | 7.5 | 2026-08-05 | Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the targ… |
CVE-2026-16102 | High | 8.1 | 2026-08-05 | A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to pr… |
CVE-2026-15573 | High | 8.1 | 2026-08-05 | A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properl… |
CVE-2026-12410 | High | 7.8 | 2026-08-05 | Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privile… |
CVE-2026-7529 | High | 7.5 | 2026-08-05 | The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of… |
CVE-2026-67623 | High | 8.8 | 2026-08-05 | Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsm… |
CVE-2026-17506 | High | 7.2 | 2026-08-05 | The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 not_found_url tracking parameter in versions up to, and… |
CVE-2026-16443 | High | 7.4 | 2026-08-05 | A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build… |
CVE-2026-15979 | High | 8.1 | 2026-08-05 | The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up… |
CVE-2025-70962 | High | 7.5 | 2026-08-05 | Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. A… |
CVE-2026-71294 | High | 7.6 | 2026-08-05 | Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions… |
CVE-2026-71292 | High | 7.2 | 2026-08-05 | Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_a… |
CVE-2026-71291 | High | 8.8 | 2026-08-05 | Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/En… |
CVE-2026-71288 | High | 8.8 | 2026-08-05 | Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both dire… |
CVE-2026-71287 | High | 8.8 | 2026-08-05 | Cacti's sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits… |
CVE-2026-71285 | High | 8.1 | 2026-08-05 | Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript ex… |
CVE-2026-71284 | High | 7.2 | 2026-08-05 | Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar… |
CVE-2026-71281 | High | 8.8 | 2026-08-05 | Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101)… |
CVE-2026-71280 | High | 8.5 | 2026-08-05 | go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destina… |
CVE-2026-71279 | High | 8.0 | 2026-08-05 | Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/ex… |
CVE-2026-71276 | High | 7.1 | 2026-08-05 | Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolat… |
CVE-2026-71274 | High | 8.5 | 2026-08-05 | OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitiz… |
CVE-2026-71272 | High | 8.5 | 2026-08-05 | Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates th… |
CVE-2026-71271 | High | 8.5 | 2026-08-05 | Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never c… |
CVE-2026-71270 | High | 8.6 | 2026-08-05 | Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protect… |
CVE-2026-71269 | High | 7.2 | 2026-08-05 | Node-RED's local-filesystem library storage module (getLibraryEntry and saveLibraryEntry in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem… |
CVE-2026-71266 | High | 7.8 | 2026-08-05 | tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(… |
CVE-2026-71265 | High | 7.5 | 2026-08-05 | Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer… |
CVE-2026-71264 | High | 8.2 | 2026-08-05 | WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly che… |
CVE-2026-71261 | High | 7.8 | 2026-08-05 | dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk, a stag… |
CVE-2026-71259 | High | 8.6 | 2026-08-05 | ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file… |
CVE-2026-71226 | High | 7.3 | 2026-08-05 | Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later… |
CVE-2026-16022 | High | 7.8 | 2026-08-05 | @oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string conc… |
CVE-2026-71255 | High | 8.6 | 2026-08-05 | nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Devic… |
CVE-2026-64582 | High | 7.8 | 2026-08-05 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxe_mmap rxe_mmap() removes a rxe_mmap_info str… |
CVE-2026-61891 | High | 7.5 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /f… |
CVE-2026-46581 | High | 7.5 | 2026-08-05 | In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker… |
CVE-2026-18933 | High | 7.2 | 2026-08-05 | The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_… |
CVE-2026-71252 | High | 8.2 | 2026-08-05 | toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdi… |
CVE-2026-71245 | High | 7.1 | 2026-08-05 | Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper… |
CVE-2026-71243 | High | 8.8 | 2026-08-05 | The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p… |
CVE-2026-71242 | High | 8.3 | 2026-08-05 | Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and ot… |
CVE-2026-71241 | High | 7.5 | 2026-08-05 | Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator tha… |
CVE-2026-71239 | High | 8.1 | 2026-08-05 | DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at leas… |
CVE-2026-71236 | High | 8.7 | 2026-08-05 | Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then… |
CVE-2026-71235 | High | 8.8 | 2026-08-05 | Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua scr… |
CVE-2026-71234 | High | 7.5 | 2026-08-05 | Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a q… |
CVE-2026-71233 | High | 8.7 | 2026-08-05 | InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/v… |
CVE-2026-71232 | High | 7.2 | 2026-08-05 | MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the… |
CVE-2026-60009 | High | 8.8 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The han… |
CVE-2026-12609 | High | 7.5 | 2026-08-05 | In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, w… |
CVE-2026-25703 | High | 7.3 | 2026-08-05 | NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive… |
CVE-2026-7693 | High | 7.2 | 2026-08-05 | The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization… |
CVE-2026-7520 | High | 8.1 | 2026-08-05 | The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` a… |
CVE-2026-7444 | High | 8.1 | 2026-08-05 | The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missi… |
CVE-2026-71215 | High | 7.5 | 2026-08-05 | art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include and extend template directives, resolves the t… |
CVE-2026-71211 | High | 7.1 | 2026-08-05 | MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation… |
CVE-2026-71209 | High | 7.5 | 2026-08-05 | audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a li… |
CVE-2026-71206 | High | 8.3 | 2026-08-05 | Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, neve… |
CVE-2026-71202 | High | 7.5 | 2026-08-05 | The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters a… |
CVE-2026-70378 | High | 7.5 | 2026-08-05 | imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes… |
CVE-2026-70377 | High | 7.5 | 2026-08-05 | imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validati… |
CVE-2026-6639 | High | 7.5 | 2026-08-05 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6… |
CVE-2026-6627 | High | 8.2 | 2026-08-05 | The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentia… |
CVE-2026-6147 | High | 8.8 | 2026-08-05 | The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_replace_media() function in all… |
CVE-2026-6079 | High | 7.3 | 2026-08-05 | The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amd_ajax_targ… |
CVE-2026-6020 | High | 7.2 | 2026-08-05 | The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to… |
CVE-2026-64581 | High | 7.8 | 2026-08-05 | In the Linux kernel, the following vulnerability has been resolved: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() xfrm_user_policy() clears the so… |
CVE-2026-64580 | High | 7.8 | 2026-08-05 | In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() On the error… |
CVE-2026-64578 | High | 8.2 | 2026-08-05 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates… |
CVE-2026-64577 | High | 7.5 | 2026-08-05 | In the Linux kernel, the following vulnerability has been resolved: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() gtp1u_send_echo_resp() ignore… |
CVE-2026-64576 | High | 7.1 | 2026-08-05 | In the Linux kernel, the following vulnerability has been resolved: nexthop: initialize extack in nh_res_bucket_migrate() nh_res_bucket_migrate() passes an u… |
CVE-2026-64575 | High | 7.8 | 2026-08-05 | In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpf_iter_tcp_batch() releases the curr… |
CVE-2026-64574 | High | 7.8 | 2026-08-05 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211_vif_update_li… |
CVE-2026-64570 | High | 7.8 | 2026-08-05 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix fils_discovery double free on alloc failure ieee80211_set_fils_discov… |
CVE-2026-64568 | High | 7.8 | 2026-08-05 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure ieee80211_set_uns… |