High-severity CVEs (page 19)
Page 19 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18642 | High | 7.8 | 2026-08-03 | Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue af… |
CVE-2026-18600 | High | 8.8 | 2026-08-03 | A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-h… |
CVE-2026-18092 | High | 8.1 | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with documen… |
CVE-2026-18089 | High | 7.5 | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when n… |
CVE-2026-18599 | High | 8.0 | 2026-08-03 | A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of t… |
CVE-2026-18598 | High | 8.8 | 2026-08-03 | A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/l… |
CVE-2026-21555 | High | 7.5 | 2026-08-03 | In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed |
CVE-2026-21554 | High | 7.5 | 2026-08-03 | In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed |
CVE-2026-21553 | High | 7.5 | 2026-08-03 | In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed |
CVE-2026-21552 | High | 7.5 | 2026-08-03 | In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed |
CVE-2026-21551 | High | 7.5 | 2026-08-03 | In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed |
CVE-2026-21550 | High | 7.5 | 2026-08-03 | In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed |
CVE-2026-21549 | High | 7.5 | 2026-08-03 | In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed |
CVE-2026-21548 | High | 7.5 | 2026-08-03 | In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System execution privileges needed. |
CVE-2026-4793 | High | 7.3 | 2026-08-03 | An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-… |
CVE-2026-18587 | High | 7.5 | 2026-08-03 | A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulatio… |
CVE-2026-16572 | High | 8.6 | 2026-08-03 | The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated us… |
CVE-2026-16539 | High | 8.1 | 2026-08-03 | The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, a… |
CVE-2025-15672 | High | 8.1 | 2026-08-03 | The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated… |
CVE-2026-20495 | High | 7.8 | 2026-08-03 | In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execut… |
CVE-2026-20483 | High | 7.7 | 2026-08-03 | In Telephony, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additiona… |
CVE-2026-20479 | High | 7.5 | 2026-08-03 | In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue b… |
CVE-2026-20465 | High | 8.1 | 2026-08-03 | In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) escalation of privilege… |
CVE-2026-65875 | High | 7.1 | 2026-08-03 | BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code i… |
CVE-2026-3245 | High | 7.5 | 2026-08-03 | A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution. |
CVE-2026-18577 | High | 8.1 | 2026-08-02 | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 |
CVE-2026-10848 | High | 7.0 | 2026-08-02 | The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract… |
CVE-2026-9856 | High | 7.1 | 2026-08-02 | A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in… |
CVE-2026-68581 | High | 8.1 | 2026-08-02 | Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric… |
CVE-2026-68580 | High | 7.5 | 2026-08-02 | FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backend… |
CVE-2026-68578 | High | 7.5 | 2026-08-02 | ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no… |
CVE-2026-67357 | High | 7.5 | 2026-08-02 | ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in… |
CVE-2026-67356 | High | 8.8 | 2026-08-02 | ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().c… |
CVE-2025-71400 | High | 7.1 | 2026-08-02 | better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated… |
CVE-2025-71399 | High | 8.6 | 2026-08-02 | Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path… |
CVE-2026-16540 | High | 7.5 | 2026-08-02 | The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allo… |
CVE-2026-16285 | High | 7.5 | 2026-08-02 | The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing un… |
CVE-2026-16261 | High | 7.5 | 2026-08-02 | The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authen… |
CVE-2026-15241 | High | 7.5 | 2026-08-02 | The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenti… |
CVE-2026-15236 | High | 7.5 | 2026-08-02 | The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected acc… |
CVE-2026-15206 | High | 7.5 | 2026-08-02 | The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker… |
CVE-2026-15151 | High | 7.5 | 2026-08-02 | The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the l… |
CVE-2026-14920 | High | 8.2 | 2026-08-02 | ## Summary |
CVE-2026-12586 | High | 8.1 | 2026-08-02 | The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce… |
CVE-2026-18352 | High | 7.5 | 2026-08-02 | The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter p… |
CVE-2026-13339 | High | 7.5 | 2026-08-02 | The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' fu… |
CVE-2026-18556 | High | 7.4 | 2026-08-01 | Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through… |
CVE-2026-55735 | High | 7.5 | 2026-08-01 | Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Gu… |
CVE-2026-55734 | High | 7.5 | 2026-08-01 | Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom… |
CVE-2026-55733 | High | 7.5 | 2026-08-01 | Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary… |
CVE-2026-54894 | High | 7.5 | 2026-08-01 | Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary… |
CVE-2026-67352 | High | 7.6 | 2026-08-01 | luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HT… |
CVE-2026-67343 | High | 8.8 | 2026-08-01 | ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arca… |
CVE-2026-67336 | High | 8.7 | 2026-08-01 | better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept pla… |
CVE-2026-67333 | High | 7.2 | 2026-08-01 | better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated… |
CVE-2026-67331 | High | 8.3 | 2026-08-01 | better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users… |
CVE-2026-67329 | High | 7.1 | 2026-08-01 | @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription acti… |
CVE-2026-67328 | High | 8.1 | 2026-08-01 | @better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbi… |
CVE-2026-67327 | High | 8.3 | 2026-08-01 | better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hi… |
CVE-2026-67326 | High | 7.0 | 2026-08-01 | GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section header… |
CVE-2026-67325 | High | 8.8 | 2026-08-01 | GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers c… |
CVE-2026-67323 | High | 8.4 | 2026-08-01 | GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command inject… |
CVE-2026-67322 | High | 7.5 | 2026-08-01 | GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_ur… |
CVE-2026-67304 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers… |
CVE-2026-67301 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. Whe… |
CVE-2026-67300 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_ST… |
CVE-2026-67299 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfre… |
CVE-2026-67298 | High | 7.5 | 2026-08-01 | FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/serv… |
CVE-2026-67297 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attacker… |
CVE-2026-67296 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stre… |
CVE-2026-67291 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfre… |
CVE-2026-67290 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficien… |
CVE-2026-67288 | High | 7.5 | 2026-08-01 | FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCA… |
CVE-2025-71403 | High | 7.1 | 2026-08-01 | better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers ca… |
CVE-2026-18536 | High | 7.5 | 2026-08-01 | Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource… |
CVE-2026-16635 | High | 8.8 | 2026-08-01 | The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_update_user_… |
CVE-2026-16144 | High | 8.1 | 2026-08-01 | The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20… |
CVE-2026-15450 | High | 8.1 | 2026-08-01 | The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including… |
CVE-2026-15052 | High | 7.2 | 2026-08-01 | The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Value… |
CVE-2026-15988 | High | 8.8 | 2026-08-01 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu… |
CVE-2026-15368 | High | 8.1 | 2026-08-01 | The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created acc… |
CVE-2026-15244 | High | 7.2 | 2026-08-01 | The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion pat… |
CVE-2026-14839 | High | 7.5 | 2026-08-01 | The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated… |
CVE-2026-14836 | High | 8.1 | 2026-08-01 | The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both th… |
CVE-2026-14596 | High | 8.8 | 2026-08-01 | The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it ema… |
CVE-2026-14309 | High | 8.1 | 2026-08-01 | The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-… |
CVE-2026-13725 | High | 7.1 | 2026-08-01 | The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions… |
CVE-2026-13158 | High | 7.2 | 2026-08-01 | The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is dis… |
CVE-2026-13157 | High | 7.2 | 2026-08-01 | The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabl… |
CVE-2026-15414 | High | 8.8 | 2026-08-01 | The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_… |
CVE-2026-15006 | High | 7.5 | 2026-08-01 | The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all ve… |
CVE-2026-9044 | High | 8.0 | 2026-07-31 | An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to ex… |
CVE-2026-34641 | High | 7.8 | 2026-07-31 | Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-51953 | High | 7.4 | 2026-07-31 | An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components |
CVE-2026-65981 | High | 7.1 | 2026-07-31 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with th… |
CVE-2026-50986 | High | 8.8 | 2026-07-31 | PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment validation controller has no CSRF token. An… |
CVE-2026-38710 | High | 7.2 | 2026-07-31 | TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows atta… |
CVE-2026-62999 | High | 7.5 | 2026-07-31 | Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separator… |
CVE-2026-53599 | High | 7.5 | 2026-07-31 | REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php l… |
CVE-2026-53510 | High | 8.1 | 2026-07-31 | Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passe… |