High-severity CVEs (page 19)
Page 19 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-95816 | High | 7.2 | 2026-10-14 | The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter… |
CVE-2026-95808 | High | 7.5 | 2026-10-14 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter… |
CVE-2026-94377 | High | 7.2 | 2026-10-14 | The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, an… |
CVE-2026-93885 | High | 7.2 | 2026-10-14 | The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all… |
CVE-2026-83592 | High | 7.2 | 2026-10-14 | The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and inclu… |
CVE-2026-78193 | High | 7.5 | 2026-10-14 | The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, an… |
CVE-2026-77114 | High | 7.2 | 2026-10-14 | The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and… |
CVE-2026-110449 | High | 7.5 | 2026-10-14 | Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocatio… |
CVE-2026-100153 | High | 7.2 | 2026-10-14 | The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and in… |
CVE-2026-14765 | High | 7.7 | 2026-10-14 | Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary… |
CVE-2026-110445 | High | 8.8 | 2026-10-14 | TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with… |
CVE-2026-110444 | High | 8.8 | 2026-10-14 | TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted… |
CVE-2026-103422 | High | 7.2 | 2026-10-14 | The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due… |
CVE-2026-102251 | High | 7.5 | 2026-10-14 | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and incl… |
CVE-2026-82715 | High | 7.9 | 2026-10-14 | Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. This issue affects Hitachi Di… |
CVE-2026-17092 | High | 8.1 | 2026-10-14 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and… |
CVE-2026-104995 | High | 8.1 | 2026-10-14 | The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed fro… |
CVE-2026-104767 | High | 7.5 | 2026-10-14 | The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and includin… |
CVE-2026-104749 | High | 7.5 | 2026-10-14 | The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log… |
CVE-2026-103423 | High | 7.5 | 2026-10-14 | The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not prope… |
CVE-2026-110359 | High | 7.8 | 2026-10-14 | Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA… |
CVE-2026-92817 | High | 8.8 | 2026-10-14 | The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vi… |
CVE-2026-95634 | High | 8.6 | 2026-10-13 | CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue… |
CVE-2026-95633 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An att… |
CVE-2026-95632 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An att… |
CVE-2026-94453 | High | 7.5 | 2026-10-13 | Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or… |
CVE-2026-77207 | High | 7.5 | 2026-10-13 | Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type… |
CVE-2026-77206 | High | 7.5 | 2026-10-13 | Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 s… |
CVE-2026-110172 | High | 8.8 | 2026-10-13 | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
CVE-2026-110171 | High | 8.8 | 2026-10-13 | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
CVE-2026-110169 | High | 8.8 | 2026-10-13 | Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-110168 | High | 8.8 | 2026-10-13 | Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-110167 | High | 8.8 | 2026-10-13 | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
CVE-2026-110166 | High | 8.8 | 2026-10-13 | Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… |
CVE-2026-110164 | High | 8.8 | 2026-10-13 | Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted… |
CVE-2026-110163 | High | 8.8 | 2026-10-13 | Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
CVE-2026-110162 | High | 8.8 | 2026-10-13 | Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pag… |
CVE-2026-110158 | High | 8.3 | 2026-10-13 | Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary cod… |
CVE-2026-110157 | High | 8.8 | 2026-10-13 | Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
CVE-2026-110156 | High | 8.3 | 2026-10-13 | Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-110155 | High | 8.8 | 2026-10-13 | Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pag… |
CVE-2026-110154 | High | 8.8 | 2026-10-13 | Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a craft… |
CVE-2026-110153 | High | 8.8 | 2026-10-13 | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
CVE-2026-110151 | High | 8.8 | 2026-10-13 | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
CVE-2026-110148 | High | 8.8 | 2026-10-13 | Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
CVE-2026-110147 | High | 8.8 | 2026-10-13 | Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
CVE-2026-110145 | High | 8.3 | 2026-10-13 | Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary cod… |
CVE-2026-110144 | High | 8.6 | 2026-10-13 | Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside th… |
CVE-2026-110140 | High | 8.8 | 2026-10-13 | Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-110139 | High | 8.8 | 2026-10-13 | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
CVE-2026-110138 | High | 8.3 | 2026-10-13 | Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrar… |
CVE-2026-110137 | High | 8.8 | 2026-10-13 | Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
CVE-2026-106627 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-105902 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-104345 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-103297 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An att… |
CVE-2026-103296 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An att… |
CVE-2026-100139 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-100138 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-100137 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-100136 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could… |
CVE-2026-100135 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-100124 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-100123 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could lever… |
CVE-2026-100122 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could lever… |
CVE-2026-100121 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could lever… |
CVE-2026-100120 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-100119 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-100118 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could lever… |
CVE-2026-100117 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-100115 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this… |
CVE-2026-100114 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this… |
CVE-2026-100113 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-97312 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-96956 | High | 8.0 | 2026-10-13 | Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-96523 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-96522 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-96521 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-95695 | High | 7.4 | 2026-10-13 | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authoriza… |
CVE-2026-95641 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-95639 | High | 8.6 | 2026-10-13 | Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An… |
CVE-2026-95638 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. E… |
CVE-2026-95637 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-95636 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-95635 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker coul… |
CVE-2026-94512 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-93905 | High | 8.2 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch j… |
CVE-2026-88088 | High | 7.0 | 2026-10-13 | Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-88083 | High | 7.5 | 2026-10-13 | Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-88082 | High | 7.0 | 2026-10-13 | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-88081 | High | 7.7 | 2026-10-13 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-85919 | High | 7.0 | 2026-10-13 | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-85888 | High | 7.7 | 2026-10-13 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-85886 | High | 8.5 | 2026-10-13 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-85876 | High | 7.0 | 2026-10-13 | Use after free in SQL Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-83966 | High | 7.8 | 2026-10-13 | Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-83965 | High | 7.8 | 2026-10-13 | Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-83661 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-76001 | High | 7.1 | 2026-10-13 | ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit… |
CVE-2026-75996 | High | 7.5 | 2026-10-13 | ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this v… |