High-severity CVEs (page 43)
Page 43 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-98348 | High | 7.1 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipw_handle_assoc_resp() reads the… |
CVE-2026-98341 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't free driver-owned scan requests When an interface goes down while a… |
CVE-2026-98339 | High | 8.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP swi… |
CVE-2026-98331 | High | 7.0 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: unlist vifs when their netdev is unregistered mac80211 only removes vifs… |
CVE-2026-98330 | High | 7.0 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: get the wiphy out of a dying network namespace When a network namespace i… |
CVE-2026-98324 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxad_alloc_desc() was converted… |
CVE-2026-98320 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nf_ct_put() releases th… |
CVE-2026-98318 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot u… |
CVE-2026-98315 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfs_non_resident_attr_shrink() calls… |
CVE-2026-98311 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: don't transfer operstate before register virt_wifi_newlink() calls netif… |
CVE-2026-98305 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xx_setup() arms the stats po… |
CVE-2026-98290 | High | 7.5 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcomm_sock_cleanup_li… |
CVE-2026-98283 | High | 8.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() kvmhv_emulate_t… |
CVE-2026-98282 | High | 8.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba The commit b1af23d836f… |
CVE-2026-98281 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork() As Jann demonstrated, it is entirely feasibl… |
CVE-2026-98276 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in sock_gettstamp() sk->sk_flags must only be changed while holding… |
CVE-2026-98261 | High | 8.1 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server use-after-free in cifs_chan_skip_or_disable() When a secondary channel i… |
CVE-2026-98260 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a referen… |
CVE-2026-98258 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyze… |
CVE-2026-98257 | High | 7.5 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rds_conn_drop() on protocol version mismatch rds_ib_cm_connect_complete() ru… |
CVE-2026-98256 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec() race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN… |
CVE-2026-98254 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: swiotlb: use the adjusted address for the highmem page lookup swiotlb_bounce() reads the… |
CVE-2026-98253 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Serialize join and leave on copy_to_user failure rdma_join_multicast() queues… |
CVE-2026-98252 | High | 7.0 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() iwpm_get_nlmsg_request() initiali… |
CVE-2026-98251 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovs_ct_get_conn_labels() adds… |
CVE-2026-98243 | High | 7.1 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "… |
CVE-2026-98241 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6_local_rxpmtu() and xfrm6_local_er… |
CVE-2026-98239 | High | 8.1 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743x_rx_process_buffer() adds each non-fi… |
CVE-2026-98230 | High | 7.0 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: xfrm: use hlist_del_init_rcu for state_cache and state_cache_input Commit 14acf9652e56 ("… |
CVE-2026-98229 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: xfrm: save input state data before secpath resets xfrm_input() stores the current xfrm_st… |
CVE-2026-98228 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ On I6500 CPU cores, lld… |
CVE-2026-98216 | High | 7.1 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIO_CRED credit-return mmap hfi1_file_mmap()'s PIO_CRED case must hand u… |
CVE-2026-98197 | High | 7.0 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove When the fan/pwm 4-5 pins are n… |
CVE-2026-98180 | High | 7.1 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msm_ringbuffer… |
CVE-2026-98175 | High | 7.5 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in clean_demultiplex_info() clean_demultiplex_info() c… |
CVE-2026-98174 | High | 7.5 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCP_Server_Info.rlist is allocated… |
CVE-2026-98173 | High | 7.5 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifs_try_adding_channels() cifs_try_adding_ch… |
CVE-2026-98171 | High | 8.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs Fix several rela… |
CVE-2026-98169 | High | 7.1 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3_enum_snapshots() If snapshot_array_size is sm… |
CVE-2026-98166 | High | 7.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulk_move range ttm_tt_swapout() r… |
CVE-2026-95594 | High | 8.1 | 2026-10-06 | Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This iss… |
CVE-2026-95526 | High | 7.3 | 2026-10-06 | Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions. |
CVE-2026-94675 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions. |
CVE-2026-62072 | High | 8.8 | 2026-10-06 | Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions. |
CVE-2026-48199 | High | 7.5 | 2026-10-06 | Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions. |
CVE-2026-48197 | High | 7.2 | 2026-10-06 | Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affec… |
CVE-2026-42638 | High | 7.5 | 2026-10-06 | Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2026-42636 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions. |
CVE-2026-42635 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions. |
CVE-2026-42634 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions. |
CVE-2026-42418 | High | 7.1 | 2026-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected… |
CVE-2026-42416 | High | 8.5 | 2026-10-06 | Subscriber SQL Injection in UDesign Core <= 4.15.0 versions. |
CVE-2026-42414 | High | 8.5 | 2026-10-06 | Subscriber SQL Injection in ListingPro <= 2.9.12 versions. |
CVE-2026-42413 | High | 7.5 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions. |
CVE-2026-41562 | High | 7.5 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions. |
CVE-2026-41561 | High | 7.5 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions. |
CVE-2026-41560 | High | 7.5 | 2026-10-06 | Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions. |
CVE-2026-41559 | High | 7.5 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions. |
CVE-2026-40807 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions. |
CVE-2026-40806 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions. |
CVE-2026-39796 | High | 7.5 | 2026-10-06 | Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions. |
CVE-2026-39794 | High | 7.5 | 2026-10-06 | Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions. |
CVE-2026-39793 | High | 8.8 | 2026-10-06 | Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions. |
CVE-2026-39792 | High | 8.6 | 2026-10-06 | Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions. |
CVE-2026-39790 | High | 7.1 | 2026-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This… |
CVE-2026-39784 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions. |
CVE-2026-39781 | High | 7.1 | 2026-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Ref… |
CVE-2026-39780 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions. |
CVE-2026-39778 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions. |
CVE-2026-39776 | High | 8.0 | 2026-10-06 | Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions. |
CVE-2026-39775 | High | 8.8 | 2026-10-06 | Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions. |
CVE-2026-39774 | High | 8.8 | 2026-10-06 | Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions. |
CVE-2026-39771 | High | 8.5 | 2026-10-06 | Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions. |
CVE-2026-39769 | High | 7.5 | 2026-10-06 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-a… |
CVE-2026-39766 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. |
CVE-2026-39765 | High | 7.2 | 2026-10-06 | Shop Manager Privilege Escalation in Challan <= 3.7.88 versions. |
CVE-2026-39758 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions. |
CVE-2026-39752 | High | 7.7 | 2026-10-06 | Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions. |
CVE-2026-39751 | High | 7.5 | 2026-10-06 | Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions. |
CVE-2026-39750 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6… |
CVE-2026-39748 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions. |
CVE-2026-39747 | High | 8.5 | 2026-10-06 | Subscriber SQL Injection in Woffice <= 5.4.35 versions. |
CVE-2026-39745 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions. |
CVE-2026-39731 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions. |
CVE-2026-39730 | High | 7.1 | 2026-10-06 | Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wi… |
CVE-2026-39729 | High | 7.2 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions. |
CVE-2026-39728 | High | 7.2 | 2026-10-06 | Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions. |
CVE-2026-39726 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions. |
CVE-2026-39724 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions. |
CVE-2026-39722 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions. |
CVE-2026-39720 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions. |
CVE-2026-39719 | High | 7.2 | 2026-10-06 | Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions. |
CVE-2026-32581 | High | 7.1 | 2026-10-06 | Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions. |
CVE-2026-32580 | High | 7.5 | 2026-10-06 | Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions. |
CVE-2026-32578 | High | 7.1 | 2026-10-06 | Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions. |
CVE-2026-32577 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions. |
CVE-2026-32575 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions. |
CVE-2026-32574 | High | 7.1 | 2026-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.T… |
CVE-2026-32572 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions. |
CVE-2026-32570 | High | 7.1 | 2026-10-06 | Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions. |