High-severity CVEs (page 2)
Page 2 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-48017 | High | 7.5 | 2026-10-22 | OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme op… |
CVE-2021-48015 | High | 7.5 | 2026-10-22 | JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath param… |
CVE-2021-48013 | High | 7.5 | 2026-10-22 | Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /w… |
CVE-2019-25779 | High | 7.5 | 2026-10-22 | WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter… |
CVE-2019-25778 | High | 8.2 | 2026-10-22 | SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through… |
CVE-2018-25439 | High | 7.5 | 2026-10-22 | MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via… |
CVE-2018-25438 | High | 7.5 | 2026-10-22 | Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitra… |
CVE-2017-20289 | High | 7.5 | 2026-10-22 | Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacke… |
CVE-2017-20287 | High | 7.5 | 2026-10-22 | Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn par… |
CVE-2026-112085 | High | 8.2 | 2026-10-22 | webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry… |
CVE-2026-112379 | High | 7.1 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allow… |
CVE-2026-112312 | High | 7.5 | 2026-10-22 | Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-112242 | High | 8.8 | 2026-10-22 | Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from… |
CVE-2026-111851 | High | 7.6 | 2026-10-22 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allow… |
CVE-2026-111830 | High | 7.1 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.Thi… |
CVE-2026-114177 | High | 8.8 | 2026-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro E… |
CVE-2026-97328 | High | 7.5 | 2026-10-22 | The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image… |
CVE-2026-111958 | High | 7.5 | 2026-10-22 | The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid tok… |
CVE-2026-109987 | High | 7.2 | 2026-10-22 | The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing i… |
CVE-2026-109927 | High | 7.2 | 2026-10-22 | The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a us… |
CVE-2026-114221 | High | 7.4 | 2026-10-22 | NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication c… |
CVE-2026-114219 | High | 7.4 | 2026-10-22 | NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic k… |
CVE-2026-114730 | High | 7.2 | 2026-10-22 | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_u… |
CVE-2026-110354 | High | 7.5 | 2026-10-22 | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked… |
CVE-2026-110353 | High | 7.5 | 2026-10-22 | HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame… |
CVE-2026-96365 | High | 7.5 | 2026-10-22 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0… |
CVE-2026-114727 | High | 8.3 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as va… |
CVE-2026-114724 | High | 7.4 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!”… |
CVE-2026-114720 | High | 7.1 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this… |
CVE-2026-114716 | High | 8.5 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the… |
CVE-2026-114664 | High | 7.1 | 2026-10-22 | Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly… |
CVE-2026-114663 | High | 8.4 | 2026-10-22 | Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in… |
CVE-2026-114662 | High | 8.1 | 2026-10-22 | Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing to… |
CVE-2026-114661 | High | 8.5 | 2026-10-22 | OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and q… |
CVE-2026-114658 | High | 8.8 | 2026-10-22 | Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super use… |
CVE-2026-114656 | High | 7.5 | 2026-10-22 | Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because… |
CVE-2026-114642 | High | 8.7 | 2026-10-22 | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport… |
CVE-2026-114640 | High | 8.7 | 2026-10-22 | Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-C… |
CVE-2026-114639 | High | 8.7 | 2026-10-22 | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotia… |
CVE-2026-114638 | High | 8.7 | 2026-10-22 | Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-s… |
CVE-2026-114637 | High | 8.7 | 2026-10-22 | Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negot… |
CVE-2026-114636 | High | 8.7 | 2026-10-22 | Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough… |
CVE-2026-114635 | High | 8.7 | 2026-10-22 | Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthent… |
CVE-2026-114577 | High | 7.3 | 2026-10-22 | A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertio… |
CVE-2026-15723 | High | 8.2 | 2026-10-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth S… |
CVE-2026-112212 | High | 7.5 | 2026-10-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain c… |
CVE-2026-76530 | High | 8.8 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resu… |
CVE-2026-76307 | High | 7.2 | 2026-10-21 | In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API… |
CVE-2026-76306 | High | 7.5 | 2026-10-21 | In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer pas… |
CVE-2026-76298 | High | 8.8 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar databas… |
CVE-2026-76293 | High | 7.2 | 2026-10-21 | In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary… |
CVE-2026-76291 | High | 8.8 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected… |
CVE-2026-76290 | High | 7.5 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download en… |
CVE-2026-76288 | High | 7.5 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScri… |
CVE-2026-114441 | High | 7.3 | 2026-10-21 | A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulatio… |
CVE-2026-114440 | High | 7.3 | 2026-10-21 | A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argume… |
CVE-2026-114439 | High | 7.3 | 2026-10-21 | A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the… |
CVE-2026-29001 | High | 7.2 | 2026-10-21 | TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitt… |
CVE-2026-114145 | High | 7.5 | 2026-10-21 | GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-i… |
CVE-2026-114144 | High | 7.5 | 2026-10-21 | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences f… |
CVE-2026-114138 | High | 7.5 | 2026-10-21 | Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts a… |
CVE-2026-114137 | High | 7.4 | 2026-10-21 | Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's… |
CVE-2026-114136 | High | 7.5 | 2026-10-21 | Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Conte… |
CVE-2026-114135 | High | 8.8 | 2026-10-21 | Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with… |
CVE-2026-112408 | High | 8.1 | 2026-10-21 | Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257… |
CVE-2026-111810 | High | 7.5 | 2026-10-21 | Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many su… |
CVE-2026-111808 | High | 8.6 | 2026-10-21 | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Se… |
CVE-2026-111805 | High | 8.6 | 2026-10-21 | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic… |
CVE-2026-79976 | High | 7.1 | 2026-10-21 | The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a… |
CVE-2026-78118 | High | 7.0 | 2026-10-21 | The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without… |
CVE-2026-19676 | High | 7.8 | 2026-10-21 | The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission a… |
CVE-2026-114267 | High | 7.3 | 2026-10-21 | A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulat… |
CVE-2026-113870 | High | 8.8 | 2026-10-21 | MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a Mon… |
CVE-2026-111804 | High | 8.2 | 2026-10-21 | Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to th… |
CVE-2025-55702 | High | 8.7 | 2026-10-21 | When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the c… |
CVE-2025-31699 | High | 8.9 | 2026-10-21 | Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never full… |
CVE-2026-92210 | High | 7.2 | 2026-10-21 | NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side… |
CVE-2026-92209 | High | 7.8 | 2026-10-21 | NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2026-92208 | High | 8.8 | 2026-10-21 | NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code o… |
CVE-2026-92207 | High | 8.8 | 2026-10-21 | MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected instal… |
CVE-2026-92206 | High | 8.8 | 2026-10-21 | CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2026-92204 | High | 7.7 | 2026-10-21 | Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attacker… |
CVE-2026-92203 | High | 7.7 | 2026-10-21 | Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attack… |
CVE-2026-92202 | High | 7.8 | 2026-10-21 | Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2026-92183 | High | 7.8 | 2026-10-21 | GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-89035 | High | 7.4 | 2026-10-21 | MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replay… |
CVE-2026-114493 | High | 8.6 | 2026-10-21 | LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config U… |
CVE-2026-114263 | High | 7.3 | 2026-10-21 | A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individua… |
CVE-2026-114262 | High | 7.3 | 2026-10-21 | A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controll… |
CVE-2026-111184 | High | 7.8 | 2026-10-21 | NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges… |
CVE-2026-110744 | High | 7.2 | 2026-10-21 | A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that gra… |
CVE-2026-76524 | High | 7.8 | 2026-10-21 | A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to ex… |
CVE-2026-76505 | High | 7.5 | 2026-10-21 | A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers a… |
CVE-2026-76496 | High | 7.0 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehe… |
CVE-2026-76495 | High | 7.8 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehe… |
CVE-2026-76494 | High | 7.8 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehe… |
CVE-2026-76493 | High | 7.5 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehe… |
CVE-2026-76492 | High | 7.5 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehe… |
CVE-2026-76491 | High | 7.5 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehe… |
CVE-2026-76490 | High | 8.6 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehe… |