High-severity CVEs (page 28)

Page 28 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.

All high-severity CVEs — newest first (page 28 of 100)
CVESeverityScorePublishedSummary
CVE-2026-49035High8.12026-07-23The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when A…
CVE-2026-38764High7.82026-07-23An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys
CVE-2026-16796High7.32026-07-23Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenti…
CVE-2026-16002High8.22026-07-23The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service.
CVE-2026-15968High7.12026-07-23Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Tran…
CVE-2026-15967High7.52026-07-23Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
CVE-2026-15966High7.52026-07-23Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5…
CVE-2026-10697High7.52026-07-23Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
CVE-2026-65706High7.82026-07-23FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by…
CVE-2026-65705High7.82026-07-23FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by…
CVE-2026-65704High7.82026-07-23FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processe…
CVE-2026-65703High7.82026-07-23FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption…
CVE-2026-60122High7.82026-07-23gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS i…
CVE-2026-25800High7.52026-07-23Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembl…
CVE-2026-15212High8.82026-07-23The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::ve…
CVE-2026-63765High8.22026-07-23Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitra…
CVE-2026-16756High7.52026-07-23Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might a…
CVE-2026-65919High7.52026-07-23Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pas…
CVE-2026-65918High7.12026-07-23PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback t…
CVE-2026-65702High8.62026-07-23Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attac…
CVE-2026-47743High8.72026-07-23Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclos…
CVE-2026-44909High7.52026-07-23Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-co…
CVE-2026-65917High8.82026-07-23CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incrementa…
CVE-2026-65916High8.12026-07-23CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated…
CVE-2026-16584High7.02026-07-23Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security pol…
CVE-2026-15615High7.52026-07-23Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.
CVE-2026-15614High7.52026-07-23Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.
CVE-2026-43823High7.52026-07-23When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This ca…
CVE-2026-43820High7.72026-07-23NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an AS…
CVE-2026-65898High7.22026-07-23DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently…
CVE-2026-65690High8.82026-07-23Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authen…
CVE-2026-14257High7.52026-07-23brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (d…
CVE-2026-65908High8.62026-07-23In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open
CVE-2026-65906High8.82026-07-23In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
CVE-2026-65897High8.82026-07-23Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to…
CVE-2026-65896High7.12026-07-23Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. Pa…
CVE-2026-65895High8.52026-07-23Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.co…
CVE-2026-65608High8.82026-07-23Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives…
CVE-2026-65540High7.12026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.
CVE-2026-65539High7.12026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.
CVE-2026-65532High7.62026-07-23Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.
CVE-2026-65526High8.52026-07-23Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This is…
CVE-2026-65516High7.22026-07-23Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.
CVE-2026-65511High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
CVE-2026-65510High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.
CVE-2026-65500High7.52026-07-23Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
CVE-2026-65497High7.22026-07-23Administrator PHP Object Injection in Complianz <= 7.5.0 versions.
CVE-2026-65495High7.52026-07-23Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.
CVE-2026-65494High7.12026-07-23Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.
CVE-2026-65493High7.52026-07-23Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.
CVE-2026-65492High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Dokan Pro <= 5.0.0 versions.
CVE-2026-65488High7.12026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
CVE-2026-65481High7.52026-07-23Contributor Local File Inclusion in Vino <= 1.9 versions.
CVE-2026-65477High7.52026-07-23Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.
CVE-2026-65462High7.62026-07-23Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.
CVE-2026-65454High8.52026-07-23Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.
CVE-2026-65451High8.52026-07-23Contributor SQL Injection in MapSVG <= 8.14.0 versions.
CVE-2026-65450High8.52026-07-23Contributor SQL Injection in MapSVG <= 8.14.0 versions.
CVE-2026-64815High8.12026-07-23In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
CVE-2026-64814High8.62026-07-23In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session
CVE-2026-64811High7.82026-07-23In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration
CVE-2026-64809High8.42026-07-23In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter
CVE-2026-64808High8.42026-07-23In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling
CVE-2026-64807High7.82026-07-23In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration
CVE-2026-64806High8.42026-07-23In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter
CVE-2026-64805High8.42026-07-23In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling
CVE-2026-64804High8.42026-07-23In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling
CVE-2026-64803High7.82026-07-23In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK
CVE-2026-64802High7.82026-07-23In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration
CVE-2026-61954High7.52026-07-23Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.
CVE-2026-61947High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.
CVE-2026-61944High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.
CVE-2026-61943High7.52026-07-23Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.
CVE-2026-59554High7.52026-07-23Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.
CVE-2026-59547High7.52026-07-23Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.
CVE-2026-59545High8.12026-07-23Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.
CVE-2026-59542High7.72026-07-23Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.
CVE-2026-59541High8.82026-07-23Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.
CVE-2026-59517High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.
CVE-2026-59512High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.
CVE-2026-57809High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.
CVE-2026-57785High8.82026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.
CVE-2026-57769High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.
CVE-2026-57767High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.
CVE-2026-57735High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.
CVE-2026-57704High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.
CVE-2026-57701High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.
CVE-2026-57699High7.12026-07-23Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.
CVE-2026-57696High7.12026-07-23Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.
CVE-2026-57626High7.12026-07-23Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0.
CVE-2026-57428High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions.
CVE-2026-57427High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.
CVE-2026-57397High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.
CVE-2026-57374High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions.
CVE-2026-57370High7.12026-07-23Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions.
CVE-2026-57367High7.12026-07-23Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.
CVE-2026-25405High8.52026-07-23Contributor SQL Injection in eRoom <= 1.7.1 versions.
CVE-2026-24552High8.52026-07-23Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create allows Blind SQL Injection. …
CVE-2026-64611High7.52026-07-23A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device I…
CVE-2026-16745High8.82026-07-23A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cl…