High-severity CVEs (page 34)
Page 34 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-109363 | High | 7.5 | 2026-10-12 | ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx cons… |
CVE-2026-109361 | High | 7.3 | 2026-10-12 | MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_i… |
CVE-2026-109360 | High | 7.5 | 2026-10-12 | MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weight… |
CVE-2026-109359 | High | 7.7 | 2026-10-12 | Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same… |
CVE-2026-109358 | High | 7.8 | 2026-10-12 | Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writa… |
CVE-2026-109357 | High | 8.1 | 2026-10-12 | LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP se… |
CVE-2026-109353 | High | 7.1 | 2026-10-12 | LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parame… |
CVE-2026-109347 | High | 7.2 | 2026-10-12 | Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by pre… |
CVE-2026-109346 | High | 8.1 | 2026-10-12 | better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the r… |
CVE-2026-109343 | High | 8.1 | 2026-10-12 | SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the ca… |
CVE-2026-109341 | High | 7.1 | 2026-10-12 | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by… |
CVE-2026-109334 | High | 8.1 | 2026-10-12 | SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authentic… |
CVE-2026-109331 | High | 7.4 | 2026-10-12 | Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only… |
CVE-2026-109326 | High | 7.5 | 2026-10-12 | Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document… |
CVE-2026-109325 | High | 7.5 | 2026-10-12 | Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticate… |
CVE-2026-109318 | High | 8.8 | 2026-10-12 | Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting she… |
CVE-2026-109317 | High | 7.2 | 2026-10-12 | Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing po… |
CVE-2026-109314 | High | 7.3 | 2026-10-12 | Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a pag… |
CVE-2026-109313 | High | 8.1 | 2026-10-12 | Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authenticat… |
CVE-2026-109312 | High | 8.1 | 2026-10-12 | Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pendin… |
CVE-2026-109308 | High | 8.8 | 2026-10-12 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without… |
CVE-2026-109305 | High | 8.8 | 2026-10-12 | Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every"… |
CVE-2026-109291 | High | 7.3 | 2026-10-12 | Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by st… |
CVE-2026-109290 | High | 7.3 | 2026-10-12 | Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute scri… |
CVE-2026-109286 | High | 8.1 | 2026-10-12 | Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user'… |
CVE-2026-109242 | High | 7.1 | 2026-10-12 | FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated… |
CVE-2026-109238 | High | 8.6 | 2026-10-12 | Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_c… |
CVE-2026-109237 | High | 8.1 | 2026-10-12 | Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping t… |
CVE-2026-85954 | High | 8.6 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQue… |
CVE-2026-85953 | High | 8.5 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently val… |
CVE-2026-85952 | High | 8.5 | 2026-10-12 | Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability… |
CVE-2026-85951 | High | 8.5 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could a… |
CVE-2026-85950 | High | 8.4 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with adm… |
CVE-2026-85949 | High | 8.1 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certai… |
CVE-2026-109399 | High | 8.1 | 2026-10-12 | SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certif… |
CVE-2026-109398 | High | 7.5 | 2026-10-12 | Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD… |
CVE-2026-109397 | High | 7.2 | 2026-10-12 | Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files b… |
CVE-2026-109394 | High | 7.4 | 2026-10-12 | Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to res… |
CVE-2026-109391 | High | 8.1 | 2026-10-12 | Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POS… |
CVE-2026-108906 | High | 7.2 | 2026-10-12 | A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The… |
CVE-2026-108900 | High | 7.3 | 2026-10-12 | A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such mani… |
CVE-2026-108899 | High | 7.3 | 2026-10-12 | A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component… |
CVE-2026-107248 | High | 8.8 | 2026-10-12 | Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages”… |
CVE-2026-108094 | High | 7.8 | 2026-10-12 | A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client c… |
CVE-2026-103535 | High | 8.8 | 2026-10-12 | Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. Th… |
CVE-2026-103522 | High | 7.2 | 2026-10-12 | In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker… |
CVE-2026-103521 | High | 7.2 | 2026-10-12 | In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same… |
CVE-2026-18390 | High | 7.8 | 2026-10-12 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Informat… |
CVE-2026-12613 | High | 8.8 | 2026-10-12 | Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux… |
CVE-2026-109229 | High | 7.5 | 2026-10-12 | SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIX… |
CVE-2026-109228 | High | 7.5 | 2026-10-12 | SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps… |
CVE-2026-109227 | High | 7.5 | 2026-10-12 | SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution bef… |
CVE-2026-109226 | High | 7.5 | 2026-10-12 | SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly co… |
CVE-2026-109225 | High | 7.5 | 2026-10-12 | SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversiz… |
CVE-2026-109205 | High | 7.5 | 2026-10-12 | LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files… |
CVE-2026-109201 | High | 8.3 | 2026-10-12 | LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to ac… |
CVE-2026-109199 | High | 8.8 | 2026-10-12 | LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity… |
CVE-2026-93695 | High | 7.4 | 2026-10-12 | In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path w… |
CVE-2026-52903 | High | 8.8 | 2026-10-12 | A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsa… |
CVE-2026-109186 | High | 8.8 | 2026-10-12 | jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields… |
CVE-2026-109185 | High | 8.8 | 2026-10-12 | jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary… |
CVE-2026-109164 | High | 7.1 | 2026-10-12 | TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submission… |
CVE-2026-108953 | High | 7.8 | 2026-10-12 | mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharac… |
CVE-2026-108836 | High | 7.3 | 2026-10-12 | A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API… |
CVE-2026-108826 | High | 7.3 | 2026-10-12 | A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen_db_perform in the library includes/modules/payment/paypaldp.php of the compone… |
CVE-2026-105412 | High | 7.1 | 2026-10-12 | An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to have read access the Tuleap database. |
CVE-2026-105411 | High | 8.1 | 2026-10-12 | An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with track… |
CVE-2026-105410 | High | 8.7 | 2026-10-12 | A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary scrip… |
CVE-2026-105409 | High | 8.7 | 2026-10-12 | A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary scrip… |
CVE-2026-105408 | High | 8.7 | 2026-10-12 | A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary scrip… |
CVE-2026-105407 | High | 8.8 | 2026-10-12 | An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the s… |
CVE-2026-103903 | High | 8.8 | 2026-10-12 | An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a l… |
CVE-2026-103902 | High | 7.5 | 2026-10-12 | Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The… |
CVE-2026-108819 | High | 7.3 | 2026-10-12 | A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the function exec of the component Agent Orchestration Layer… |
CVE-2026-108818 | High | 7.3 | 2026-10-12 | A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authentication_dependency of the file auth.py. Such manipulati… |
CVE-2026-78355 | High | 8.7 | 2026-10-12 | A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended d… |
CVE-2026-108807 | High | 7.3 | 2026-10-12 | A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects the function mysql_query of the… |
CVE-2026-108806 | High | 7.3 | 2026-10-12 | A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function m… |
CVE-2026-108805 | High | 7.3 | 2026-10-12 | A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function my… |
CVE-2026-87690 | High | 8.8 | 2026-10-12 | The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpo… |
CVE-2026-108799 | High | 7.3 | 2026-10-12 | A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the… |
CVE-2026-108798 | High | 7.3 | 2026-10-12 | A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-code… |
CVE-2026-108985 | High | 7.1 | 2026-10-12 | ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and li… |
CVE-2026-108980 | High | 8.8 | 2026-10-12 | Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized na… |
CVE-2026-108783 | High | 7.3 | 2026-10-12 | A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Bac… |
CVE-2026-108976 | High | 7.8 | 2026-10-11 | GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed input… |
CVE-2026-108963 | High | 8.8 | 2026-10-11 | databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any… |
CVE-2026-19935 | High | 7.5 | 2026-10-11 | The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel obje… |
CVE-2026-19736 | High | 7.8 | 2026-10-11 | The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TRNG_GetRandomData()… |
CVE-2026-19669 | High | 7.8 | 2026-10-11 | The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared tw… |
CVE-2026-19577 | High | 7.1 | 2026-10-11 | net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without first checking whethe… |
CVE-2026-108913 | High | 7.1 | 2026-10-11 | omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme ma… |
CVE-2026-108905 | High | 7.5 | 2026-10-11 | pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass… |
CVE-2026-108902 | High | 8.1 | 2026-10-11 | pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated m… |
CVE-2026-108865 | High | 8.2 | 2026-10-11 | AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAu… |
CVE-2026-108863 | High | 7.5 | 2026-10-11 | Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface… |
CVE-2026-108859 | High | 7.5 | 2026-10-11 | mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memor… |
CVE-2026-108853 | High | 8.1 | 2026-10-11 | UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants'… |
CVE-2026-108760 | High | 7.6 | 2026-10-11 | LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI si… |
CVE-2026-108758 | High | 8.2 | 2026-10-11 | Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appoi… |