High-severity CVEs (page 51)
Page 51 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54919 | High | 7.4 | 2026-07-10 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed TLS backend versions from 0.31.0 through 0.46.1 and wolfSSL… |
CVE-2026-54063 | High | 7.5 | 2026-07-10 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/… |
CVE-2026-53657 | High | 8.2 | 2026-07-10 | Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbit… |
CVE-2026-39903 | High | 7.1 | 2026-07-10 | Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an authorization bypass vulnerability in Sources/Actions/AttachmentA… |
CVE-2026-39244 | High | 7.5 | 2026-07-10 | adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buf… |
CVE-2026-2398 | High | 8.8 | 2026-07-10 | Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows Privilege Escalation. This issue affects Mob… |
CVE-2026-1667 | High | 7.2 | 2026-07-10 | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and includi… |
CVE-2025-70796 | High | 7.5 | 2026-07-10 | An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology, Inc.) version 3.5.0.r 2024/05/24 00:00:00… |
CVE-2026-56676 | High | 7.4 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/ima… |
CVE-2026-55501 | High | 7.3 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the a… |
CVE-2026-54149 | High | 8.8 | 2026-07-10 | MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/serializers/tool.py and MCP referencing… |
CVE-2026-33382 | High | 7.5 | 2026-07-10 | Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large pa… |
CVE-2026-61437 | High | 7.8 | 2026-07-10 | PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praison… |
CVE-2026-61434 | High | 8.8 | 2026-07-10 | PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via… |
CVE-2026-60091 | High | 7.2 | 2026-07-10 | PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter… |
CVE-2026-59796 | High | 8.1 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks |
CVE-2026-59795 | High | 8.1 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible |
CVE-2026-59794 | High | 7.3 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data |
CVE-2026-59793 | High | 8.8 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration |
CVE-2026-56305 | High | 8.3 | 2026-07-10 | Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without re… |
CVE-2026-56279 | High | 7.5 | 2026-07-10 | Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended… |
CVE-2026-56261 | High | 8.6 | 2026-07-10 | Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept we… |
CVE-2026-56254 | High | 7.0 | 2026-07-10 | In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distributes the private key to each device that downloads the app… |
CVE-2026-38059 | High | 7.5 | 2026-07-10 | The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve s… |
CVE-2026-38057 | High | 8.1 | 2026-07-10 | The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authentica… |
CVE-2026-29519 | High | 8.2 | 2026-07-10 | Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing t… |
CVE-2026-22660 | High | 7.2 | 2026-07-10 | FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows authenticated administrators to delete all built-in authorizati… |
CVE-2026-22659 | High | 8.1 | 2026-07-10 | FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized act… |
CVE-2026-54469 | High | 8.8 | 2026-07-10 | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untrusted Data vulnerability. A low privileged attacker with remote… |
CVE-2026-56690 | High | 8.5 | 2026-07-10 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabil… |
CVE-2026-56689 | High | 7.7 | 2026-07-10 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabil… |
CVE-2026-40454 | High | 7.5 | 2026-07-10 | Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash clie… |
CVE-2026-40452 | High | 7.5 | 2026-07-10 | Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unaut… |
CVE-2026-40007 | High | 7.5 | 2026-07-10 | Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's r… |
CVE-2026-40006 | High | 7.5 | 2026-07-10 | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability i… |
CVE-2026-13347 | High | 7.5 | 2026-07-10 | The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 1.3 via the he_wrapper_js and he_wrapper_css quer… |
CVE-2026-12685 | High | 7.5 | 2026-07-10 | The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscated backdoor that lets an unauthenticated attacker who suppl… |
CVE-2026-15330 | High | 7.3 | 2026-07-10 | A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of the file agent/tools/vi… |
CVE-2026-15298 | High | 7.2 | 2026-07-10 | The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient i… |
CVE-2026-15293 | High | 8.0 | 2026-07-10 | The WP Business Intelligence Lite plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.0. This is due to the pl… |
CVE-2026-15291 | High | 7.5 | 2026-07-10 | The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 vi… |
CVE-2026-15290 | High | 7.5 | 2026-07-10 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to blind… |
CVE-2026-15288 | High | 7.5 | 2026-07-10 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including… |
CVE-2026-54423 | High | 8.2 | 2026-07-10 | In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to… |
CVE-2026-15070 | High | 8.8 | 2026-07-10 | The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.30.32. This i… |
CVE-2026-13430 | High | 7.2 | 2026-07-10 | The Post Export Import with Media plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.13.1 via the import_media… |
CVE-2026-15319 | High | 7.3 | 2026-07-10 | A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This affects the function IPAllowlist of the file web/backend/middleware/access_cont… |
CVE-2026-54771 | High | 8.1 | 2026-07-10 | Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.3, a Langroid application exposing a chat interface to un… |
CVE-2026-50181 | High | 7.1 | 2026-07-10 | Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `ReadFileTool` and `WriteFileTool` appear t… |
CVE-2026-12598 | High | 8.1 | 2026-07-10 | The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This i… |
CVE-2026-12597 | High | 8.1 | 2026-07-10 | The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions up to, and including, 6.2.3. The vulne… |
CVE-2026-12595 | High | 8.1 | 2026-07-10 | The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and including 6.2.3. The vulner… |
CVE-2026-59858 | High | 7.8 | 2026-07-09 | Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or… |
CVE-2026-59856 | High | 7.8 | 2026-07-09 | Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or… |
CVE-2026-59834 | High | 7.5 | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates atta… |
CVE-2026-59832 | High | 7.7 | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go jo… |
CVE-2026-33655 | High | 7.7 | 2026-07-09 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the default SSRF protection c… |
CVE-2026-58143 | High | 8.8 | 2026-07-09 | Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuratio… |
CVE-2026-57028 | High | 7.3 | 2026-07-09 | An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-ba… |
CVE-2026-57026 | High | 7.5 | 2026-07-09 | An Improper Validation of Syntactic Correctness of Input vulnerability in the SIP plugin of Juniper Networks Junos OS on MX Series with SPC3 and SRX Series all… |
CVE-2026-57023 | High | 7.5 | 2026-07-09 | An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series… |
CVE-2026-55604 | High | 8.6 | 2026-07-09 | DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-su… |
CVE-2026-53963 | High | 7.3 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled… |
CVE-2026-49256 | High | 7.5 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly r… |
CVE-2026-45788 | High | 7.5 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, secure uploads could be exposed by pull_hotlinked_images… |
CVE-2026-44787 | High | 8.2 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set… |
CVE-2026-39246 | High | 7.5 | 2026-07-09 | decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field… |
CVE-2026-38076 | High | 7.5 | 2026-07-09 | An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2026-15271 | High | 7.5 | 2026-07-09 | A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue i… |
CVE-2026-55212 | High | 7.1 | 2026-07-09 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcor… |
CVE-2026-55208 | High | 7.7 | 2026-07-09 | Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password ha… |
CVE-2026-55207 | High | 8.8 | 2026-07-09 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username c… |
CVE-2026-51926 | High | 7.5 | 2026-07-09 | An issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive information via the login.php component. A vulnerability was identif… |
CVE-2026-51925 | High | 8.1 | 2026-07-09 | A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker to execute arbitrary code via the dfm-menu_rep… |
CVE-2026-51924 | High | 8.1 | 2026-07-09 | An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component |
CVE-2026-51923 | High | 8.1 | 2026-07-09 | An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote attacker to execute arbitrary code via the u… |
CVE-2025-45422 | High | 8.1 | 2026-07-09 | Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding… |
CVE-2026-15270 | High | 7.5 | 2026-07-09 | A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is an unknown functionality of the file /etc/boa/boa.conf o… |
CVE-2026-0278 | High | 7.8 | 2026-07-09 | Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to bypass DLP policy enfo… |
CVE-2026-0276 | High | 7.8 | 2026-07-09 | A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user. |
CVE-2026-59148 | High | 8.8 | 2026-07-09 | Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Exp… |
CVE-2026-54695 | High | 7.5 | 2026-07-09 | Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to 1.4.0, the pipecat development runner re… |
CVE-2026-13492 | High | 8.8 | 2026-07-09 | The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This is due to insufficient validation of f… |
CVE-2026-0287 | High | 7.5 | 2026-07-09 | Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of se… |
CVE-2026-0286 | High | 7.2 | 2026-07-09 | A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS… |
CVE-2026-0283 | High | 7.2 | 2026-07-09 | An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access t… |
CVE-2026-0281 | High | 7.1 | 2026-07-09 | An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web in… |
CVE-2026-0280 | High | 7.2 | 2026-07-09 | An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security… |
CVE-2025-63579 | High | 7.5 | 2026-07-09 | Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming dat… |
CVE-2026-61343 | High | 7.2 | 2026-07-09 | LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with ad… |
CVE-2026-59734 | High | 8.8 | 2026-07-09 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify's app/Jobs/ApplicationDepl… |
CVE-2026-59721 | High | 7.2 | 2026-07-09 | Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attack… |
CVE-2026-59720 | High | 7.5 | 2026-07-09 | Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input f… |
CVE-2026-59221 | High | 7.7 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitize_proxy_path in backend/open_webui/rout… |
CVE-2026-58378 | High | 8.8 | 2026-07-09 | Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privil… |
CVE-2026-55420 | High | 7.5 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of P… |
CVE-2026-59224 | High | 8.0 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_ter… |
CVE-2026-59219 | High | 7.1 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-j… |
CVE-2026-59216 | High | 7.7 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool… |
CVE-2026-59214 | High | 7.3 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a sam… |