High-severity CVEs (page 37)
Page 37 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-107826 | High | 7.5 | 2026-10-09 | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can s… |
CVE-2026-107823 | High | 7.2 | 2026-10-09 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM pa… |
CVE-2026-107821 | High | 8.0 | 2026-10-09 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently… |
CVE-2026-107818 | High | 8.4 | 2026-10-09 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service uni… |
CVE-2026-75347 | High | 7.5 | 2026-10-09 | EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) ha… |
CVE-2026-55797 | High | 8.8 | 2026-10-09 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vu… |
CVE-2026-108160 | High | 7.5 | 2026-10-09 | AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing… |
CVE-2026-108159 | High | 7.5 | 2026-10-09 | AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS c… |
CVE-2026-108157 | High | 8.1 | 2026-10-09 | Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts… |
CVE-2026-108156 | High | 7.1 | 2026-10-09 | LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDi… |
CVE-2026-107815 | High | 8.5 | 2026-10-09 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DO… |
CVE-2025-61560 | High | 8.1 | 2026-10-09 | A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and per… |
CVE-2026-90983 | High | 8.2 | 2026-10-09 | Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass. This issue affects… |
CVE-2026-75349 | High | 7.5 | 2026-10-09 | EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remot… |
CVE-2026-75348 | High | 7.5 | 2026-10-09 | An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format… |
CVE-2026-75346 | High | 7.5 | 2026-10-09 | An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This… |
CVE-2026-75345 | High | 7.5 | 2026-10-09 | OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of se… |
CVE-2026-108113 | High | 8.8 | 2026-10-09 | ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows… |
CVE-2026-107814 | High | 8.4 | 2026-10-09 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages cr… |
CVE-2026-107813 | High | 8.8 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cl… |
CVE-2026-107812 | High | 7.5 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-or… |
CVE-2026-107811 | High | 8.8 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose… |
CVE-2026-107810 | High | 8.1 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the resto… |
CVE-2026-107809 | High | 8.8 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential aft… |
CVE-2026-107808 | High | 8.1 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion… |
CVE-2026-107807 | High | 8.8 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret q… |
CVE-2026-104084 | High | 8.8 | 2026-10-09 | SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not reva… |
CVE-2026-104082 | High | 7.2 | 2026-10-09 | SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volum… |
CVE-2026-78795 | High | 7.5 | 2026-10-09 | An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive in… |
CVE-2026-39460 | High | 8.1 | 2026-10-09 | Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the confi… |
CVE-2026-39453 | High | 8.3 | 2026-10-09 | Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where… |
CVE-2026-33367 | High | 8.1 | 2026-10-09 | SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware… |
CVE-2026-29797 | High | 7.1 | 2026-10-09 | No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with th… |
CVE-2026-28745 | High | 7.5 | 2026-10-09 | Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by… |
CVE-2026-108108 | High | 7.1 | 2026-10-09 | PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the… |
CVE-2026-108106 | High | 7.5 | 2026-10-09 | Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncom… |
CVE-2026-108101 | High | 7.5 | 2026-10-09 | HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files… |
CVE-2026-107806 | High | 7.2 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit atta… |
CVE-2026-107805 | High | 7.5 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an… |
CVE-2026-104081 | High | 8.1 | 2026-10-09 | KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-re… |
CVE-2026-94067 | High | 8.1 | 2026-10-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows… |
CVE-2026-94066 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affect… |
CVE-2026-94065 | High | 8.8 | 2026-10-09 | Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3. |
CVE-2026-94064 | High | 8.8 | 2026-10-09 | Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barbe… |
CVE-2026-94063 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS… |
CVE-2026-62026 | High | 7.1 | 2026-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard… |
CVE-2026-105281 | High | 7.5 | 2026-10-09 | The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can… |
CVE-2026-104629 | High | 8.8 | 2026-10-09 | A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker wi… |
CVE-2026-94062 | High | 8.1 | 2026-10-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows… |
CVE-2026-94061 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club al… |
CVE-2026-94060 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Voldor voldor allows Reflected XSS.This issue… |
CVE-2026-94059 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS.This issue… |
CVE-2026-94058 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue af… |
CVE-2026-105883 | High | 7.1 | 2026-10-09 | Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-105872 | High | 7.2 | 2026-10-09 | Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection… |
CVE-2026-105870 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-… |
CVE-2026-105318 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows… |
CVE-2026-104392 | High | 8.8 | 2026-10-09 | Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Surv… |
CVE-2026-103413 | High | 8.8 | 2026-10-09 | Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and appli… |
CVE-2026-103412 | High | 8.8 | 2026-10-09 | Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file name supplied through t… |
CVE-2026-97791 | High | 7.5 | 2026-10-09 | In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stor… |
CVE-2026-86463 | High | 7.5 | 2026-10-09 | Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinat… |
CVE-2026-78384 | High | 7.5 | 2026-10-09 | CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on th… |
CVE-2026-73179 | High | 8.1 | 2026-10-09 | Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to ob… |
CVE-2026-108039 | High | 7.5 | 2026-10-09 | By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefor… |
CVE-2026-107937 | High | 7.5 | 2026-10-09 | In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) a… |
CVE-2026-100227 | High | 7.5 | 2026-10-09 | Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandl… |
CVE-2026-96761 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XS… |
CVE-2026-96671 | High | 8.8 | 2026-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affect… |
CVE-2026-96607 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows… |
CVE-2026-96553 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows… |
CVE-2026-96461 | High | 7.5 | 2026-10-09 | Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amel… |
CVE-2026-96336 | High | 7.5 | 2026-10-09 | Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57… |
CVE-2026-96333 | High | 7.5 | 2026-10-09 | Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16… |
CVE-2026-96332 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-payment allows Reflected… |
CVE-2026-96329 | High | 8.5 | 2026-10-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind… |
CVE-2026-95610 | High | 8.5 | 2026-10-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UpSolution UpSolution Core us-core allows Blind SQL Injec… |
CVE-2026-95609 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assis… |
CVE-2026-95608 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Ref… |
CVE-2026-95607 | High | 8.5 | 2026-10-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This i… |
CVE-2026-95599 | High | 8.5 | 2026-10-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Inje… |
CVE-2026-95598 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflect… |
CVE-2026-95596 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builde… |
CVE-2026-95591 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking… |
CVE-2026-94668 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system… |
CVE-2026-94666 | High | 7.5 | 2026-10-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using… |
CVE-2026-94664 | High | 7.5 | 2026-10-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allow… |
CVE-2026-94663 | High | 8.5 | 2026-10-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-an… |
CVE-2026-94661 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This iss… |
CVE-2026-94641 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue a… |
CVE-2026-94632 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blocks… |
CVE-2026-94568 | High | 7.2 | 2026-10-09 | Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with V… |
CVE-2026-94415 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muffingroup Betheme betheme allows Reflected XSS.This iss… |
CVE-2026-94170 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Sassy Social Share sassy-social-share all… |
CVE-2026-94167 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflecte… |
CVE-2026-94166 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.T… |
CVE-2026-94161 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflec… |
CVE-2026-94159 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Total Donations totaldonations allows Stored XSS… |
CVE-2026-94158 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bkninja Gloria Admin Panel gloria-admin-panel allows Refl… |
CVE-2026-78025 | High | 7.5 | 2026-10-09 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unaut… |