High-severity CVEs (page 21)
Page 21 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12947 | High | 7.5 | 2026-07-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read… |
CVE-2026-11980 | High | 7.3 | 2026-07-30 | IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up. |
CVE-2026-11897 | High | 7.5 | 2026-07-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A rem… |
CVE-2026-67351 | High | 8.8 | 2026-07-30 | Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without… |
CVE-2026-60075 | High | 7.5 | 2026-07-30 | Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time rem… |
CVE-2026-60074 | High | 7.5 | 2026-07-30 | Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes c… |
CVE-2026-5219 | High | 8.3 | 2026-07-30 | Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue… |
CVE-2026-57859 | High | 7.5 | 2026-07-30 | e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database wr… |
CVE-2026-56428 | High | 8.1 | 2026-07-30 | The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration. An inse… |
CVE-2026-12722 | High | 8.2 | 2026-07-30 | Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issu… |
CVE-2026-54368 | High | 8.8 | 2026-07-30 | CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arb… |
CVE-2026-54367 | High | 8.6 | 2026-07-30 | CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account setti… |
CVE-2026-54366 | High | 7.5 | 2026-07-30 | CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by su… |
CVE-2026-54365 | High | 7.5 | 2026-07-30 | CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary… |
CVE-2026-41703 | High | 7.6 | 2026-07-30 | VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds… |
CVE-2026-18381 | High | 7.6 | 2026-07-30 | A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the… |
CVE-2026-18378 | High | 7.6 | 2026-07-30 | A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary u… |
CVE-2026-15397 | High | 7.2 | 2026-07-30 | The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the p… |
CVE-2026-22622 | High | 8.8 | 2026-07-30 | Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate pr… |
CVE-2026-22621 | High | 8.3 | 2026-07-30 | Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to e… |
CVE-2026-22620 | High | 8.6 | 2026-07-30 | Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass a… |
CVE-2026-18361 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function. |
CVE-2026-18360 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function. |
CVE-2026-16969 | High | 7.6 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function. |
CVE-2026-44107 | High | 7.5 | 2026-07-30 | A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the… |
CVE-2026-44106 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulti… |
CVE-2026-44099 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full sy… |
CVE-2026-44098 | High | 8.6 | 2026-07-30 | This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulti… |
CVE-2026-44097 | High | 7.1 | 2026-07-30 | A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent… |
CVE-2026-44096 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise. |
CVE-2026-44095 | High | 7.8 | 2026-07-30 | A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resul… |
CVE-2026-44094 | High | 8.6 | 2026-07-30 | An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. Th… |
CVE-2026-44093 | High | 7.8 | 2026-07-30 | A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, r… |
CVE-2026-58043 | High | 7.5 | 2026-07-30 | A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who i… |
CVE-2026-47882 | High | 8.3 | 2026-07-30 | When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Das… |
CVE-2026-47873 | High | 8.0 | 2026-07-30 | The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricti… |
CVE-2026-47858 | High | 8.0 | 2026-07-30 | Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote… |
CVE-2026-16529 | High | 7.5 | 2026-07-30 | A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permane… |
CVE-2026-16527 | High | 7.3 | 2026-07-30 | An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overw… |
CVE-2026-16526 | High | 8.8 | 2026-07-30 | A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privilege… |
CVE-2026-16524 | High | 7.8 | 2026-07-30 | A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets… |
CVE-2026-15240 | High | 7.5 | 2026-07-30 | The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower… |
CVE-2026-14239 | High | 7.1 | 2026-07-30 | The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not esc… |
CVE-2026-13395 | High | 8.6 | 2026-07-30 | The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauth… |
CVE-2026-13178 | High | 7.5 | 2026-07-30 | The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated… |
CVE-2026-12687 | High | 7.5 | 2026-07-30 | The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allow… |
CVE-2026-12500 | High | 7.5 | 2026-07-30 | The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin bef… |
CVE-2026-67248 | High | 8.8 | 2026-07-30 | A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly v… |
CVE-2026-67245 | High | 8.1 | 2026-07-30 | A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficie… |
CVE-2026-1360 | High | 7.5 | 2026-07-30 | The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unse… |
CVE-2026-14356 | High | 8.8 | 2026-07-30 | The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not proper… |
CVE-2026-67244 | High | 7.2 | 2026-07-30 | A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration… |
CVE-2026-48448 | High | 8.6 | 2026-07-30 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could le… |
CVE-2026-18188 | High | 8.1 | 2026-07-30 | A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data… |
CVE-2026-18187 | High | 8.1 | 2026-07-30 | A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an er… |
CVE-2026-18186 | High | 8.1 | 2026-07-30 | A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be… |
CVE-2026-18017 | High | 8.8 | 2026-07-30 | Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-18012 | High | 8.8 | 2026-07-30 | Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (… |
CVE-2026-17995 | High | 8.1 | 2026-07-30 | Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (… |
CVE-2026-17993 | High | 7.0 | 2026-07-30 | Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium sec… |
CVE-2026-17989 | High | 8.8 | 2026-07-30 | Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2026-17979 | High | 7.5 | 2026-07-30 | Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium secu… |
CVE-2026-17971 | High | 8.8 | 2026-07-30 | Inappropriate implementation in Frame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform out of bounds memory access via… |
CVE-2026-17969 | High | 8.8 | 2026-07-30 | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr… |
CVE-2026-17967 | High | 8.8 | 2026-07-30 | Use after free in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2026-17956 | High | 8.8 | 2026-07-30 | Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a c… |
CVE-2026-17952 | High | 7.5 | 2026-07-30 | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute… |
CVE-2026-17951 | High | 8.8 | 2026-07-30 | Heap buffer overflow in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML pag… |
CVE-2026-17950 | High | 8.8 | 2026-07-30 | Inappropriate implementation in Safebrowsing in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a malicious… |
CVE-2026-17948 | High | 7.5 | 2026-07-30 | Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary cod… |
CVE-2026-17935 | High | 8.8 | 2026-07-30 | Heap buffer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… |
CVE-2026-17930 | High | 7.5 | 2026-07-30 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-17922 | High | 8.8 | 2026-07-30 | Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a crafted HTML page… |
CVE-2026-17920 | High | 8.8 | 2026-07-30 | Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary cod… |
CVE-2026-17918 | High | 8.8 | 2026-07-30 | Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-17916 | High | 7.5 | 2026-07-30 | Insufficient policy enforcement in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perfo… |
CVE-2026-17899 | High | 8.8 | 2026-07-30 | Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-17898 | High | 7.5 | 2026-07-30 | Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitra… |
CVE-2026-17896 | High | 7.5 | 2026-07-30 | Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-17894 | High | 8.8 | 2026-07-30 | Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2026-17888 | High | 7.1 | 2026-07-30 | Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape v… |
CVE-2026-17887 | High | 7.5 | 2026-07-30 | Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentia… |
CVE-2026-17886 | High | 8.8 | 2026-07-30 | Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-17884 | High | 8.8 | 2026-07-30 | Object lifecycle issue in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2026-17881 | High | 8.8 | 2026-07-30 | Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-17877 | High | 8.4 | 2026-07-30 | Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation v… |
CVE-2026-17875 | High | 8.8 | 2026-07-30 | Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (… |
CVE-2026-17869 | High | 8.1 | 2026-07-30 | Out of bounds read in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page… |
CVE-2026-17868 | High | 8.8 | 2026-07-30 | Insufficient policy enforcement in USB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform privilege escalation via a crafted HTML pag… |
CVE-2026-17867 | High | 7.1 | 2026-07-30 | Insufficient validation of untrusted input in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape vi… |
CVE-2026-17864 | High | 7.8 | 2026-07-30 | Inappropriate implementation in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a… |
CVE-2026-17863 | High | 7.8 | 2026-07-30 | Inappropriate implementation in Browser in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malic… |
CVE-2026-17862 | High | 7.8 | 2026-07-30 | Use after free in Tracing in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious… |
CVE-2026-17861 | High | 7.8 | 2026-07-30 | Insufficient validation of untrusted input in Updater in Google Chrome prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation… |
CVE-2026-17836 | High | 8.8 | 2026-07-30 | Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2026-17816 | High | 7.5 | 2026-07-30 | Insufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-17811 | High | 7.1 | 2026-07-30 | Use after free in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
CVE-2026-17807 | High | 8.8 | 2026-07-30 | Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2026-17786 | High | 8.8 | 2026-07-30 | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious… |
CVE-2026-17784 | High | 8.8 | 2026-07-30 | Use after free in Audio in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perfor… |