High-severity CVEs (page 20)
Page 20 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85886 | High | 8.5 | 2026-10-13 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-85876 | High | 7.0 | 2026-10-13 | Use after free in SQL Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-83966 | High | 7.8 | 2026-10-13 | Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exp… |
CVE-2026-83965 | High | 7.8 | 2026-10-13 | Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-83661 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2026-76001 | High | 7.1 | 2026-10-13 | ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit… |
CVE-2026-75996 | High | 7.5 | 2026-10-13 | ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this v… |
CVE-2026-75995 | High | 8.4 | 2026-10-13 | ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attac… |
CVE-2026-75748 | High | 7.6 | 2026-10-13 | ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could… |
CVE-2026-71385 | High | 8.4 | 2026-10-13 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacke… |
CVE-2026-68883 | High | 8.5 | 2026-10-13 | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-67625 | High | 8.5 | 2026-10-13 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-65674 | High | 8.8 | 2026-10-13 | Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-62840 | High | 7.0 | 2026-10-13 | Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-34634 | High | 8.6 | 2026-10-13 | ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not req… |
CVE-2026-34633 | High | 7.7 | 2026-10-13 | ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit… |
CVE-2026-106623 | High | 7.5 | 2026-10-13 | ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerabi… |
CVE-2026-106618 | High | 8.8 | 2026-10-13 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-priv… |
CVE-2026-106617 | High | 8.8 | 2026-10-13 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-priv… |
CVE-2026-106616 | High | 8.6 | 2026-10-13 | ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An atta… |
CVE-2026-106615 | High | 8.8 | 2026-10-13 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-priv… |
CVE-2026-106614 | High | 7.8 | 2026-10-13 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-priv… |
CVE-2026-106613 | High | 8.8 | 2026-10-13 | ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-pr… |
CVE-2026-106090 | High | 8.8 | 2026-10-13 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-priv… |
CVE-2026-106089 | High | 8.8 | 2026-10-13 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-priv… |
CVE-2026-105994 | High | 7.7 | 2026-10-13 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage thi… |
CVE-2026-105901 | High | 8.8 | 2026-10-13 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-priv… |
CVE-2026-105900 | High | 7.5 | 2026-10-13 | ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vuln… |
CVE-2026-105898 | High | 8.2 | 2026-10-13 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-priv… |
CVE-2026-105897 | High | 8.6 | 2026-10-13 | ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not req… |
CVE-2026-105443 | High | 8.2 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install. |
CVE-2026-105442 | High | 7.5 | 2026-10-13 | IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker t… |
CVE-2026-104348 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. E… |
CVE-2026-104347 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-104346 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-103821 | High | 7.8 | 2026-10-13 | Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Ex… |
CVE-2026-101294 | High | 8.7 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass… |
CVE-2026-100129 | High | 7.8 | 2026-10-13 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-100128 | High | 7.8 | 2026-10-13 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-100127 | High | 7.8 | 2026-10-13 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-100112 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-100111 | High | 7.8 | 2026-10-13 | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-86022 | High | 7.0 | 2026-10-13 | VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a comm… |
CVE-2026-86016 | High | 8.2 | 2026-10-13 | VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YA… |
CVE-2026-70098 | High | 8.8 | 2026-10-13 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2026-63174 | High | 8.1 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside the… |
CVE-2026-63172 | High | 7.1 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts… |
CVE-2026-63165 | High | 8.1 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by ma… |
CVE-2026-63163 | High | 7.5 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to… |
CVE-2026-63162 | High | 8.8 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary di… |
CVE-2026-63161 | High | 8.8 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a kn… |
CVE-2026-63160 | High | 7.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value… |
CVE-2026-63159 | High | 7.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accoun… |
CVE-2026-63158 | High | 7.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to… |
CVE-2026-63154 | High | 8.8 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying… |
CVE-2026-63153 | High | 8.1 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access… |
CVE-2026-63152 | High | 8.1 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the… |
CVE-2026-63149 | High | 7.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords ge… |
CVE-2026-55601 | High | 7.3 | 2026-10-13 | MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attac… |
CVE-2026-16753 | High | 8.8 | 2026-10-13 | Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or devel… |
CVE-2026-110084 | High | 7.1 | 2026-10-13 | Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privil… |
CVE-2026-110083 | High | 7.1 | 2026-10-13 | Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result… |
CVE-2026-110005 | High | 8.8 | 2026-10-13 | The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privile… |
CVE-2026-106634 | High | 7.7 | 2026-10-13 | Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in ar… |
CVE-2026-103854 | High | 7.8 | 2026-10-13 | Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploita… |
CVE-2026-103851 | High | 7.8 | 2026-10-13 | Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current use… |
CVE-2026-103847 | High | 8.6 | 2026-10-13 | Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker c… |
CVE-2026-103846 | High | 8.6 | 2026-10-13 | Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the cont… |
CVE-2026-103845 | High | 8.6 | 2026-10-13 | Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A… |
CVE-2026-103844 | High | 7.8 | 2026-10-13 | Dimension is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of… |
CVE-2026-103843 | High | 7.8 | 2026-10-13 | Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitati… |
CVE-2026-103842 | High | 7.8 | 2026-10-13 | Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated… |
CVE-2026-103841 | High | 7.8 | 2026-10-13 | Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated… |
CVE-2026-103840 | High | 7.8 | 2026-10-13 | Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated… |
CVE-2026-103839 | High | 7.8 | 2026-10-13 | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Expl… |
CVE-2026-103838 | High | 7.8 | 2026-10-13 | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Expl… |
CVE-2026-103837 | High | 7.8 | 2026-10-13 | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Expl… |
CVE-2026-103836 | High | 7.8 | 2026-10-13 | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Expl… |
CVE-2026-103835 | High | 7.8 | 2026-10-13 | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Expl… |
CVE-2026-103834 | High | 7.8 | 2026-10-13 | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Expl… |
CVE-2026-103833 | High | 7.8 | 2026-10-13 | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Expl… |
CVE-2026-103832 | High | 7.8 | 2026-10-13 | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Expl… |
CVE-2026-103830 | High | 7.8 | 2026-10-13 | Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current use… |
CVE-2026-102855 | High | 8.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. |
CVE-2026-102235 | High | 8.8 | 2026-10-13 | Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2026-102234 | High | 7.4 | 2026-10-13 | Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-97830 | High | 7.5 | 2026-10-13 | Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network. |
CVE-2026-97812 | High | 7.0 | 2026-10-13 | Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-97811 | High | 7.8 | 2026-10-13 | Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. |
CVE-2026-97810 | High | 7.0 | 2026-10-13 | Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. |
CVE-2026-97809 | High | 7.8 | 2026-10-13 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-97808 | High | 7.0 | 2026-10-13 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-97807 | High | 7.8 | 2026-10-13 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-97806 | High | 7.8 | 2026-10-13 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-97804 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-97803 | High | 7.8 | 2026-10-13 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-97801 | High | 7.5 | 2026-10-13 | Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-97800 | High | 7.8 | 2026-10-13 | Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally. |
CVE-2026-97799 | High | 7.8 | 2026-10-13 | Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-97798 | High | 7.8 | 2026-10-13 | Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileg… |