High-severity CVEs (page 16)
Page 16 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81534 | High | 8.8 | 2026-10-15 | The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to… |
CVE-2026-79822 | High | 7.1 | 2026-10-15 | A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow. |
CVE-2026-79821 | High | 8.2 | 2026-10-15 | A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down. |
CVE-2026-74920 | High | 7.1 | 2026-10-15 | The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the respo… |
CVE-2026-58100 | High | 7.0 | 2026-10-15 | kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's tab… |
CVE-2026-58099 | High | 7.0 | 2026-10-15 | When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) b… |
CVE-2026-58098 | High | 8.4 | 2026-10-15 | When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the se… |
CVE-2026-101305 | High | 8.8 | 2026-10-15 | renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then… |
CVE-2026-101304 | High | 7.1 | 2026-10-15 | When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum… |
CVE-2026-101303 | High | 7.5 | 2026-10-15 | The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A… |
CVE-2026-88043 | High | 7.2 | 2026-10-15 | The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 d… |
CVE-2026-18586 | High | 7.2 | 2026-10-15 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in al… |
CVE-2026-18548 | High | 7.2 | 2026-10-15 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all ve… |
CVE-2026-17031 | High | 8.1 | 2026-10-15 | The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-15090 | High | 7.5 | 2026-10-15 | The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to… |
CVE-2026-76665 | High | 7.1 | 2026-10-15 | A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow. |
CVE-2026-3712 | High | 7.3 | 2026-10-15 | The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service… |
CVE-2026-76663 | High | 7.5 | 2026-10-15 | A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS. |
CVE-2026-110908 | High | 8.8 | 2026-10-15 | Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An au… |
CVE-2026-110907 | High | 7.5 | 2026-10-15 | Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) use… |
CVE-2026-77931 | High | 8.8 | 2026-10-15 | MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions… |
CVE-2026-76661 | High | 7.6 | 2026-10-15 | A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data. |
CVE-2026-76660 | High | 8.7 | 2026-10-15 | A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data. |
CVE-2026-76659 | High | 7.5 | 2026-10-15 | A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service. |
CVE-2026-76066 | High | 7.5 | 2026-10-15 | IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability where the executor validates tool calls against the full tool… |
CVE-2026-73799 | High | 7.5 | 2026-10-15 | A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption |
CVE-2026-109430 | High | 7.5 | 2026-10-15 | Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST r… |
CVE-2026-0993 | High | 7.5 | 2026-10-15 | SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of ser… |
CVE-2026-110873 | High | 7.1 | 2026-10-14 | Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id beca… |
CVE-2026-110869 | High | 7.5 | 2026-10-14 | Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain o… |
CVE-2026-110868 | High | 8.5 | 2026-10-14 | Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs v… |
CVE-2026-110867 | High | 8.5 | 2026-10-14 | Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a sha… |
CVE-2026-110865 | High | 7.1 | 2026-10-14 | Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules he… |
CVE-2026-110864 | High | 7.4 | 2026-10-14 | Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to… |
CVE-2026-110863 | High | 8.1 | 2026-10-14 | Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other u… |
CVE-2026-110859 | High | 7.5 | 2026-10-14 | GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a bran… |
CVE-2026-110858 | High | 8.1 | 2026-10-14 | GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, n… |
CVE-2026-110857 | High | 7.5 | 2026-10-14 | GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_u… |
CVE-2026-110856 | High | 7.5 | 2026-10-14 | GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, com… |
CVE-2026-110839 | High | 7.1 | 2026-10-14 | FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG… |
CVE-2026-110838 | High | 7.5 | 2026-10-14 | FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers… |
CVE-2026-110837 | High | 7.1 | 2026-10-14 | FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right… |
CVE-2026-96540 | High | 8.8 | 2026-10-14 | An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a… |
CVE-2026-71854 | High | 8.2 | 2026-10-14 | OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.26062… |
CVE-2026-61844 | High | 7.1 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths… |
CVE-2026-61843 | High | 8.2 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder… |
CVE-2026-57492 | High | 7.4 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing us… |
CVE-2026-57490 | High | 8.1 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebD… |
CVE-2026-57489 | High | 8.1 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTH_BYPASS… |
CVE-2026-110679 | High | 7.3 | 2026-10-14 | A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. Th… |
CVE-2026-110670 | High | 7.3 | 2026-10-14 | A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing… |
CVE-2026-104108 | High | 8.1 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC id… |
CVE-2026-103977 | High | 8.1 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verificati… |
CVE-2026-100232 | High | 7.2 | 2026-10-14 | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWa… |
CVE-2026-55682 | High | 8.1 | 2026-10-14 | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSES… |
CVE-2026-55681 | High | 8.8 | 2026-10-14 | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto… |
CVE-2026-55383 | High | 8.2 | 2026-10-14 | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, Inv… |
CVE-2026-55382 | High | 7.6 | 2026-10-14 | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, Inv… |
CVE-2026-55381 | High | 7.1 | 2026-10-14 | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POS… |
CVE-2026-110668 | High | 7.3 | 2026-10-14 | A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argumen… |
CVE-2026-102986 | High | 8.1 | 2026-10-14 | Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{a… |
CVE-2026-73261 | High | 7.5 | 2026-10-14 | Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not rejec… |
CVE-2026-73260 | High | 7.5 | 2026-10-14 | Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a lo… |
CVE-2026-73252 | High | 7.5 | 2026-10-14 | Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3… |
CVE-2026-63626 | High | 8.8 | 2026-10-14 | Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking… |
CVE-2026-55787 | High | 7.1 | 2026-10-14 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_private_ip in src/core/utils.py compare res… |
CVE-2026-55786 | High | 8.4 | 2026-10-14 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-R… |
CVE-2026-54525 | High | 8.8 | 2026-10-14 | Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a dec… |
CVE-2026-53999 | High | 7.7 | 2026-10-14 | Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes… |
CVE-2026-110770 | High | 8.1 | 2026-10-14 | Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via PO… |
CVE-2026-110769 | High | 8.6 | 2026-10-14 | holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent… |
CVE-2026-110767 | High | 7.5 | 2026-10-14 | Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read ser… |
CVE-2026-110761 | High | 8.8 | 2026-10-14 | ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to des… |
CVE-2026-110667 | High | 7.3 | 2026-10-14 | A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulat… |
CVE-2026-102944 | High | 7.5 | 2026-10-14 | cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers whe… |
CVE-2026-92158 | High | 7.2 | 2026-10-14 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer… |
CVE-2026-92155 | High | 7.5 | 2026-10-14 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket des… |
CVE-2026-92154 | High | 8.1 | 2026-10-14 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink ha… |
CVE-2026-92150 | High | 7.5 | 2026-10-14 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fr… |
CVE-2026-88164 | High | 8.8 | 2026-10-14 | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-86848 | High | 8.8 | 2026-10-14 | A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to c… |
CVE-2026-86567 | High | 8.8 | 2026-10-14 | A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap. |
CVE-2026-86461 | High | 8.8 | 2026-10-14 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the ch… |
CVE-2026-79957 | High | 8.1 | 2026-10-14 | ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the req… |
CVE-2026-54554 | High | 7.5 | 2026-10-14 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/… |
CVE-2026-109527 | High | 7.5 | 2026-10-14 | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1… |
CVE-2026-108484 | High | 7.1 | 2026-10-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form… |
CVE-2026-108483 | High | 7.1 | 2026-10-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows R… |
CVE-2026-108480 | High | 8.2 | 2026-10-14 | Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sk… |
CVE-2026-108395 | High | 7.5 | 2026-10-14 | The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelc… |
CVE-2026-107350 | High | 8.8 | 2026-10-14 | Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other… |
CVE-2026-107349 | High | 7.5 | 2026-10-14 | An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options para… |
CVE-2026-105066 | High | 7.1 | 2026-10-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows… |
CVE-2026-104103 | High | 8.1 | 2026-10-14 | Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() vali… |
CVE-2026-103081 | High | 7.5 | 2026-10-14 | Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: f… |
CVE-2026-102077 | High | 7.5 | 2026-10-14 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3… |
CVE-2026-101981 | High | 8.8 | 2026-10-14 | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated ad… |
CVE-2026-101979 | High | 8.8 | 2026-10-14 | A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to exec… |
CVE-2026-101976 | High | 7.5 | 2026-10-14 | An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not n… |
CVE-2026-101963 | High | 7.5 | 2026-10-14 | An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cau… |