High-severity CVEs (page 36)
Page 36 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63453 | High | 7.2 | 2026-07-21 | Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privi… |
CVE-2026-55084 | High | 8.8 | 2026-07-21 | DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in t… |
CVE-2026-47419 | High | 8.3 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an* Insecure Direct Object Reference. The age… |
CVE-2026-47418 | High | 8.1 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The proj… |
CVE-2026-47417 | High | 8.1 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The comm… |
CVE-2026-47415 | High | 8.3 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The issu… |
CVE-2026-47414 | High | 7.6 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five lab… |
CVE-2026-47412 | High | 8.1 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive… |
CVE-2026-44880 | High | 8.8 | 2026-07-21 | A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-p… |
CVE-2026-21579 | High | 7.5 | 2026-07-21 | This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2… |
CVE-2026-21575 | High | 8.0 | 2026-07-21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (R… |
CVE-2026-16493 | High | 7.8 | 2026-07-21 | A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands with… |
CVE-2026-16243 | High | 7.5 | 2026-07-21 | In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero. |
CVE-2026-47409 | High | 8.1 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockou… |
CVE-2026-47406 | High | 8.1 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The depe… |
CVE-2026-47405 | High | 8.8 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that a… |
CVE-2026-47399 | High | 8.8 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemi… |
CVE-2026-47398 | High | 8.1 | 2026-07-21 | PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the PRAISONAI_ALLOW_LOCAL_T… |
CVE-2026-44907 | High | 7.5 | 2026-07-21 | A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU… |
CVE-2026-15793 | High | 7.5 | 2026-07-21 | BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious… |
CVE-2026-15792 | High | 7.5 | 2026-07-21 | A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. |
CVE-2026-15791 | High | 7.5 | 2026-07-21 | A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete… |
CVE-2026-15789 | High | 7.5 | 2026-07-21 | A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs… |
CVE-2026-15724 | High | 8.7 | 2026-07-21 | In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerabil… |
CVE-2026-64824 | High | 8.4 | 2026-07-21 | Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary ab… |
CVE-2026-8933 | High | 7.8 | 2026-07-21 | A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure… |
CVE-2026-65052 | High | 7.5 | 2026-07-21 | Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbit… |
CVE-2026-59851 | High | 8.8 | 2026-07-21 | A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is au… |
CVE-2026-15226 | High | 8.4 | 2026-07-21 | A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp sec… |
CVE-2026-16447 | High | 7.3 | 2026-07-21 | A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multi_uploadify.php. The manipulation… |
CVE-2026-16445 | High | 7.5 | 2026-07-21 | A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a mal… |
CVE-2026-16409 | High | 7.5 | 2026-07-21 | Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16405 | High | 7.5 | 2026-07-21 | Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbi… |
CVE-2026-16404 | High | 7.4 | 2026-07-21 | Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153. |
CVE-2026-16401 | High | 8.8 | 2026-07-21 | Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16400 | High | 7.5 | 2026-07-21 | Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16399 | High | 7.5 | 2026-07-21 | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16398 | High | 7.5 | 2026-07-21 | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16396 | High | 8.8 | 2026-07-21 | Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16391 | High | 7.5 | 2026-07-21 | Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 1… |
CVE-2026-16386 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16385 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16384 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16379 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird… |
CVE-2026-16378 | High | 7.5 | 2026-07-21 | Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16376 | High | 7.5 | 2026-07-21 | Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16374 | High | 7.5 | 2026-07-21 | Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbir… |
CVE-2026-16373 | High | 7.5 | 2026-07-21 | Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153. |
CVE-2026-16372 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16371 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16366 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16365 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16362 | High | 8.8 | 2026-07-21 | Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16354 | High | 7.5 | 2026-07-21 | Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 15… |
CVE-2026-60080 | High | 7.3 | 2026-07-21 | Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory paylo… |
CVE-2026-1771 | High | 7.2 | 2026-07-21 | The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, a… |
CVE-2026-3183 | High | 7.1 | 2026-07-21 | Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass. |
CVE-2026-8082 | High | 7.5 | 2026-07-21 | The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submis… |
CVE-2026-11767 | High | 8.8 | 2026-07-21 | The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in… |
CVE-2023-37507 | High | 7.5 | 2026-07-21 | HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed. |
CVE-2026-6952 | High | 7.2 | 2026-07-21 | A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7… |
CVE-2026-16332 | High | 7.3 | 2026-07-21 | A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of t… |
CVE-2026-16331 | High | 7.3 | 2026-07-21 | A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/save_ajax.php. Such manipulation… |
CVE-2026-16330 | High | 7.3 | 2026-07-21 | A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipu… |
CVE-2026-16329 | High | 7.3 | 2026-07-21 | A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/uploadify.php. The manipulation of the ar… |
CVE-2026-55833 | High | 7.5 | 2026-07-21 | Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding c… |
CVE-2026-55831 | High | 7.5 | 2026-07-21 | Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decode… |
CVE-2026-16327 | High | 7.3 | 2026-07-21 | A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulati… |
CVE-2026-15905 | High | 7.8 | 2026-07-20 | Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium… |
CVE-2026-15904 | High | 8.8 | 2026-07-20 | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to p… |
CVE-2026-15903 | High | 8.8 | 2026-07-20 | Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-15902 | High | 8.8 | 2026-07-20 | Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-64624 | High | 7.8 | 2026-07-20 | FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted f… |
CVE-2026-55550 | High | 7.1 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application ser… |
CVE-2026-55544 | High | 7.6 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations ove… |
CVE-2026-51031 | High | 7.5 | 2026-07-20 | FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain… |
CVE-2026-47255 | High | 8.2 | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had… |
CVE-2026-16324 | High | 7.3 | 2026-07-20 | A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function of the file /business/qnaire/upload.jsp… |
CVE-2024-51316 | High | 7.5 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevName |
CVE-2026-56624 | High | 7.3 | 2026-07-20 | Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side Open… |
CVE-2026-56623 | High | 7.1 | 2026-07-20 | Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server impl… |
CVE-2026-56452 | High | 7.5 | 2026-07-20 | Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of… |
CVE-2026-47198 | High | 8.5 | 2026-07-20 | Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters… |
CVE-2026-47130 | High | 7.1 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerabi… |
CVE-2026-47129 | High | 8.1 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the `activ… |
CVE-2026-13381 | High | 8.1 | 2026-07-20 | VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker… |
CVE-2026-13380 | High | 7.5 | 2026-07-20 | VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are p… |
CVE-2026-53593 | High | 8.8 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploa… |
CVE-2026-53591 | High | 8.6 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages in… |
CVE-2026-15788 | High | 7.5 | 2026-07-20 | BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A… |
CVE-2026-64619 | High | 7.5 | 2026-07-20 | FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttli… |
CVE-2026-64194 | High | 7.5 | 2026-07-20 | Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compres… |
CVE-2026-63771 | High | 7.1 | 2026-07-20 | Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the… |
CVE-2026-63770 | High | 7.5 | 2026-07-20 | Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lo… |
CVE-2026-63769 | High | 7.7 | 2026-07-20 | Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to mak… |
CVE-2026-63731 | High | 7.7 | 2026-07-20 | HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal de… |
CVE-2026-63108 | High | 8.8 | 2026-07-20 | Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enfor… |
CVE-2026-63107 | High | 7.7 | 2026-07-20 | LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated us… |
CVE-2026-48389 | High | 7.8 | 2026-07-20 | DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contex… |
CVE-2026-12341 | High | 8.8 | 2026-07-20 | This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper val… |