High-severity CVEs (page 27)
Page 27 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-64280 | High | 8.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() afu_ioctl_dma_map() ac… |
CVE-2026-64279 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter deregistration race Adapters can be looked up by their id using i2… |
CVE-2026-64277 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes… |
CVE-2026-64276 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() al… |
CVE-2026-64274 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodix_ts_read_input_report() cop… |
CVE-2026-64273 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: iforce - bound the device-reported force-feedback effect index iforce_process_pack… |
CVE-2026-64272 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch co… |
CVE-2026-64271 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on every complete packet tw_interrupt() accumula… |
CVE-2026-64270 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packet size mms114_interrupt() reads a packet… |
CVE-2026-64266 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the… |
CVE-2026-64265 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() move… |
CVE-2026-64261 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues fuse_uring_async_stop_qu… |
CVE-2026-64260 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stopped races and set/read that value under lock There are sever… |
CVE-2026-64259 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bad userspace might… |
CVE-2026-10818 | High | 8.1 | 2026-07-25 | The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize f… |
CVE-2026-66374 | High | 8.1 | 2026-07-25 | Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path. |
CVE-2026-66373 | High | 7.5 | 2026-07-25 | Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same… |
CVE-2026-61892 | High | 8.8 | 2026-07-24 | Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges. |
CVE-2026-60134 | High | 8.8 | 2026-07-24 | Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges. |
CVE-2025-71408 | High | 7.8 | 2026-07-24 | NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who contr… |
CVE-2026-66041 | High | 8.8 | 2026-07-24 | FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt… |
CVE-2026-66040 | High | 8.8 | 2026-07-24 | FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attacke… |
CVE-2026-66039 | High | 8.8 | 2026-07-24 | FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt hea… |
CVE-2026-66036 | High | 8.8 | 2026-07-24 | FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap… |
CVE-2026-54342 | High | 8.1 | 2026-07-24 | In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a s… |
CVE-2026-17107 | High | 8.5 | 2026-07-24 | A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE)… |
CVE-2026-66035 | High | 7.5 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt… |
CVE-2026-66034 | High | 7.5 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-lengt… |
CVE-2026-66033 | High | 7.5 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/opens… |
CVE-2026-66032 | High | 8.8 | 2026-07-24 | libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH ser… |
CVE-2026-65711 | High | 7.2 | 2026-07-24 | sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web… |
CVE-2026-65710 | High | 7.1 | 2026-07-24 | sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINK_CREATE profile flag to trigge… |
CVE-2026-65709 | High | 8.3 | 2026-07-24 | sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate accou… |
CVE-2026-65708 | High | 8.1 | 2026-07-24 | sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachm… |
CVE-2026-66027 | High | 8.3 | 2026-07-24 | Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue… |
CVE-2026-65693 | High | 7.2 | 2026-07-24 | Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command… |
CVE-2026-64255 | High | 8.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA sessio… |
CVE-2026-64251 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() pwrseq_debugfs_seq_next() d… |
CVE-2026-64249 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: fpga: region: fix use-after-free in child_regions_with_firmware() Move of_node_put(child_… |
CVE-2026-64247 | High | 8.4 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when querying sparse banks When checking if a VP… |
CVE-2026-64246 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() … |
CVE-2026-64243 | High | 7.1 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix enum control bounds check simple_mux_control_put() rejects… |
CVE-2026-64242 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usb_initialize_gadget() install… |
CVE-2026-64239 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() DAMON sysfs maintains the… |
CVE-2026-64237 | High | 7.1 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - validate firmware size before use Ensure that the firmware file is larg… |
CVE-2026-64235 | High | 8.1 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIG_CALL_DE… |
CVE-2026-64226 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path In scx_root_enable_wor… |
CVE-2026-64225 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index cgx_speed_mbps has 13 element… |
CVE-2026-64224 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix double free in rvu_rep_rsrc_init() rvu_rep_rsrc_init() allocates queue… |
CVE-2026-64223 | High | 8.1 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211_tid_to_link_map_size_… |
CVE-2026-64222 | High | 7.0 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool->stack on AQ init failure otx2_pool_aq_init() fre… |
CVE-2026-64221 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mod… |
CVE-2026-64219 | High | 7.0 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_as… |
CVE-2026-64218 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix report_work leak on backbone_gw purge batadv_bla_purge_backbone_gw()… |
CVE-2026-64217 | High | 7.8 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in netfs_extract_user_iter() Fix netfs_extract_user_iter() so th… |
CVE-2026-64210 | High | 7.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked writing to ICOSQ During napi poll, when the affinity changes… |
CVE-2026-64209 | High | 7.1 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swing_tbl and pre_… |
CVE-2026-64208 | High | 7.5 | 2026-07-24 | In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 cryp… |
CVE-2026-8789 | High | 8.1 | 2026-07-24 | The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification… |
CVE-2026-16801 | High | 8.8 | 2026-07-24 | Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authentic… |
CVE-2026-16800 | High | 8.8 | 2026-07-24 | Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authentica… |
CVE-2026-9765 | High | 7.1 | 2026-07-24 | Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resourc… |
CVE-2026-66144 | High | 7.5 | 2026-07-24 | Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service at… |
CVE-2026-66143 | High | 7.5 | 2026-07-24 | It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which ma… |
CVE-2026-66142 | High | 7.5 | 2026-07-24 | Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial o… |
CVE-2026-45816 | High | 7.5 | 2026-07-24 | NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts (otherwise assert would trigger befo… |
CVE-2026-45815 | High | 7.5 | 2026-07-24 | Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert i… |
CVE-2026-45813 | High | 8.8 | 2026-07-24 | Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add So… |
CVE-2026-45811 | High | 7.5 | 2026-07-24 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI socket transport did not check whether a receive… |
CVE-2026-15401 | High | 7.2 | 2026-07-24 | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and… |
CVE-2026-10033 | High | 7.3 | 2026-07-24 | The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not… |
CVE-2026-49745 | High | 7.8 | 2026-07-24 | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualis… |
CVE-2026-49744 | High | 7.8 | 2026-07-24 | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualis… |
CVE-2026-49743 | High | 7.8 | 2026-07-24 | Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel… |
CVE-2026-16519 | High | 7.3 | 2026-07-24 | A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries (DLLs)… |
CVE-2026-14603 | High | 7.5 | 2026-07-24 | The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to dis… |
CVE-2026-14172 | High | 7.8 | 2026-07-24 | Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a l… |
CVE-2026-12981 | High | 7.5 | 2026-07-24 | The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attack… |
CVE-2026-12497 | High | 7.5 | 2026-07-24 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 does not consistent… |
CVE-2026-16870 | High | 8.8 | 2026-07-24 | Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stac… |
CVE-2026-66141 | High | 7.4 | 2026-07-24 | Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled. |
CVE-2026-66140 | High | 8.4 | 2026-07-24 | Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-n… |
CVE-2026-66138 | High | 7.2 | 2026-07-24 | In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Ag… |
CVE-2026-12736 | High | 8.0 | 2026-07-24 | The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option(… |
CVE-2026-56167 | High | 8.5 | 2026-07-24 | Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network. |
CVE-2026-35425 | High | 8.0 | 2026-07-24 | Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network. |
CVE-2026-40430 | High | 7.5 | 2026-07-23 | Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API. |
CVE-2026-28698 | High | 8.6 | 2026-07-23 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could exp… |
CVE-2026-65694 | High | 7.5 | 2026-07-23 | Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitr… |
CVE-2026-65604 | High | 8.2 | 2026-07-23 | Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a r… |
CVE-2026-63313 | High | 7.7 | 2026-07-23 | 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url par… |
CVE-2026-16807 | High | 8.8 | 2026-07-23 | Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML pag… |
CVE-2026-16806 | High | 8.8 | 2026-07-23 | Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-16805 | High | 8.8 | 2026-07-23 | Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-16804 | High | 8.3 | 2026-07-23 | Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-16765 | High | 7.3 | 2026-07-23 | A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkad… |
CVE-2024-58355 | High | 8.9 | 2026-07-23 | Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/bookin… |
CVE-2024-58353 | High | 8.9 | 2026-07-23 | Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /bo… |
CVE-2026-50039 | High | 7.5 | 2026-07-23 | The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a Read Request. |
CVE-2026-50032 | High | 7.5 | 2026-07-23 | A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequ… |