High-severity CVEs (page 32)
Page 32 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-65150 | High | 7.3 | 2026-10-13 | NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability mighty lead t… |
CVE-2026-65149 | High | 7.3 | 2026-10-13 | NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnerability might lead t… |
CVE-2026-65148 | High | 7.3 | 2026-10-13 | NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code… |
CVE-2026-65147 | High | 7.3 | 2026-10-13 | NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to… |
CVE-2026-65141 | High | 7.8 | 2026-10-13 | NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execut… |
CVE-2026-65110 | High | 7.8 | 2026-10-13 | NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file… |
CVE-2026-65104 | High | 7.1 | 2026-10-13 | NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference reque… |
CVE-2026-65103 | High | 8.1 | 2026-10-13 | NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause… |
CVE-2026-65101 | High | 8.6 | 2026-10-13 | NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a cr… |
CVE-2026-109778 | High | 8.8 | 2026-10-13 | Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109766 | High | 8.1 | 2026-10-13 | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109762 | High | 8.8 | 2026-10-13 | Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109760 | High | 8.1 | 2026-10-13 | Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109759 | High | 8.1 | 2026-10-13 | Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109757 | High | 8.3 | 2026-10-13 | Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderb… |
CVE-2026-109756 | High | 8.8 | 2026-10-13 | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109754 | High | 8.1 | 2026-10-13 | Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 15… |
CVE-2026-109753 | High | 8.1 | 2026-10-13 | Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and… |
CVE-2026-109747 | High | 7.3 | 2026-10-13 | Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. |
CVE-2026-109746 | High | 7.3 | 2026-10-13 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. |
CVE-2026-109744 | High | 8.1 | 2026-10-13 | Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109743 | High | 8.8 | 2026-10-13 | Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153… |
CVE-2026-109739 | High | 8.8 | 2026-10-13 | Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. |
CVE-2026-109737 | High | 8.1 | 2026-10-13 | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109736 | High | 8.1 | 2026-10-13 | Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109734 | High | 8.1 | 2026-10-13 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109733 | High | 8.1 | 2026-10-13 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158… |
CVE-2026-109730 | High | 8.8 | 2026-10-13 | Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbir… |
CVE-2026-109722 | High | 8.1 | 2026-10-13 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158… |
CVE-2026-109720 | High | 7.1 | 2026-10-13 | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 1… |
CVE-2026-109716 | High | 8.1 | 2026-10-13 | Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbi… |
CVE-2026-109715 | High | 8.1 | 2026-10-13 | Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbi… |
CVE-2026-109712 | High | 7.1 | 2026-10-13 | Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thund… |
CVE-2026-109709 | High | 8.8 | 2026-10-13 | Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thu… |
CVE-2026-109704 | High | 8.8 | 2026-10-13 | Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153… |
CVE-2026-109405 | High | 7.3 | 2026-10-13 | A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/j… |
CVE-2026-109403 | High | 7.3 | 2026-10-13 | A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/s… |
CVE-2026-109832 | High | 7.5 | 2026-10-13 | A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUT… |
CVE-2026-89201 | High | 7.5 | 2026-10-13 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or… |
CVE-2026-89199 | High | 8.8 | 2026-10-13 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration it… |
CVE-2026-89198 | High | 8.8 | 2026-10-13 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware… |
CVE-2026-89197 | High | 8.8 | 2026-10-13 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field… |
CVE-2026-89196 | High | 8.8 | 2026-10-13 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names… |
CVE-2026-85114 | High | 7.5 | 2026-10-13 | A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validat… |
CVE-2026-78557 | High | 8.3 | 2026-10-13 | A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data receiv… |
CVE-2026-78556 | High | 7.4 | 2026-10-13 | A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server cert… |
CVE-2026-72895 | High | 7.7 | 2026-10-13 | A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G /… |
CVE-2026-59241 | High | 8.8 | 2026-10-13 | A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions… |
CVE-2026-102076 | High | 7.5 | 2026-10-13 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2026-102075 | High | 7.5 | 2026-10-13 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2026-102074 | High | 7.5 | 2026-10-13 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2026-102073 | High | 8.2 | 2026-10-13 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2026-13138 | High | 8.6 | 2026-10-13 | Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State. … |
CVE-2026-109687 | High | 7.6 | 2026-10-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Bl… |
CVE-2026-109116 | High | 7.3 | 2026-10-13 | A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_q… |
CVE-2026-109115 | High | 7.3 | 2026-10-13 | A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown proces… |
CVE-2026-109114 | High | 7.3 | 2026-10-13 | A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknow… |
CVE-2026-108179 | High | 7.6 | 2026-10-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection… |
CVE-2026-101020 | High | 7.8 | 2026-10-13 | An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited… |
CVE-2026-103418 | High | 8.8 | 2026-10-13 | Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Fi… |
CVE-2026-102562 | High | 7.2 | 2026-10-13 | The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint i… |
CVE-2026-102007 | High | 7.2 | 2026-10-13 | The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… |
CVE-2026-108975 | High | 7.3 | 2026-10-13 | A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file adm… |
CVE-2026-108974 | High | 7.3 | 2026-10-13 | A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipu… |
CVE-2026-108973 | High | 7.3 | 2026-10-13 | A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Use… |
CVE-2026-103316 | High | 7.1 | 2026-10-13 | The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIE… |
CVE-2026-108972 | High | 7.3 | 2026-10-13 | A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file cont… |
CVE-2026-108970 | High | 7.3 | 2026-10-13 | A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::add… |
CVE-2026-108969 | High | 7.3 | 2026-10-13 | A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is… |
CVE-2026-108968 | High | 7.3 | 2026-10-13 | A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_h… |
CVE-2026-108967 | High | 7.3 | 2026-10-13 | A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.ph… |
CVE-2026-108966 | High | 7.3 | 2026-10-13 | A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product… |
CVE-2026-108965 | High | 7.3 | 2026-10-13 | A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quanti… |
CVE-2026-108964 | High | 7.3 | 2026-10-13 | A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing… |
CVE-2026-96893 | High | 7.3 | 2026-10-13 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain cond… |
CVE-2026-92883 | High | 8.7 | 2026-10-13 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain… |
CVE-2026-81839 | High | 7.7 | 2026-10-13 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain cond… |
CVE-2026-35001 | High | 7.0 | 2026-10-13 | OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. An attacker can supply a crafted S-102 HDF5… |
CVE-2026-16301 | High | 8.5 | 2026-10-13 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain c… |
CVE-2026-14814 | High | 8.2 | 2026-10-13 | GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions… |
CVE-2026-108956 | High | 7.3 | 2026-10-13 | A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/adm… |
CVE-2026-89120 | High | 7.1 | 2026-10-13 | A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single t… |
CVE-2026-89113 | High | 8.8 | 2026-10-13 | SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send… |
CVE-2026-58249 | High | 7.5 | 2026-10-13 | SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauth… |
CVE-2026-93886 | High | 8.3 | 2026-10-13 | IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input. |
CVE-2026-93892 | High | 8.1 | 2026-10-12 | IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tok… |
CVE-2026-93891 | High | 7.6 | 2026-10-12 | IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity… |
CVE-2026-85457 | High | 8.1 | 2026-10-12 | IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow. |
CVE-2026-84418 | High | 7.4 | 2026-10-12 | IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture t… |
CVE-2026-82108 | High | 8.8 | 2026-10-12 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special ele… |
CVE-2026-82096 | High | 8.8 | 2026-10-12 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special… |
CVE-2026-75782 | High | 7.8 | 2026-10-12 | IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable. |
CVE-2026-75095 | High | 7.5 | 2026-10-12 | IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. |
CVE-2026-75061 | High | 7.5 | 2026-10-12 | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request… |
CVE-2026-19627 | High | 8.2 | 2026-10-12 | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validati… |
CVE-2026-19622 | High | 8.8 | 2026-10-12 | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests. |
CVE-2026-19620 | High | 8.8 | 2026-10-12 | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication. |
CVE-2026-17475 | High | 7.1 | 2026-10-12 | IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper fun… |
CVE-2026-109673 | High | 7.3 | 2026-10-12 | Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not proper… |
CVE-2026-109671 | High | 7.3 | 2026-10-12 | Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escapin… |