High-severity CVEs (page 53)
Page 53 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-59802 | High | 8.2 | 2026-07-08 | PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malici… |
CVE-2026-58253 | High | 8.8 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was c… |
CVE-2026-58250 | High | 7.5 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with net… |
CVE-2026-58213 | High | 7.1 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include prot… |
CVE-2026-58210 | High | 7.5 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client c… |
CVE-2026-55760 | High | 7.5 | 2026-07-08 | Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compi… |
CVE-2026-55404 | High | 7.5 | 2026-07-08 | yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can wri… |
CVE-2026-14891 | High | 8.7 | 2026-07-08 | HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into… |
CVE-2026-14373 | High | 7.7 | 2026-07-08 | HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow… |
CVE-2026-59937 | High | 7.5 | 2026-07-08 | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that caus… |
CVE-2026-60102 | High | 8.8 | 2026-07-08 | Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() met… |
CVE-2026-59928 | High | 7.5 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definit… |
CVE-2026-59925 | High | 7.5 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs… |
CVE-2026-59922 | High | 7.5 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character ca… |
CVE-2026-59892 | High | 7.5 | 2026-07-08 | OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-*… |
CVE-2026-59887 | High | 7.5 | 2026-07-08 | linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked a… |
CVE-2026-59879 | High | 7.5 | 2026-07-08 | Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functiona… |
CVE-2026-59731 | High | 8.2 | 2026-07-08 | Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterati… |
CVE-2026-59261 | High | 7.1 | 2026-07-08 | OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-tru… |
CVE-2026-39822 | High | 7.8 | 2026-07-08 | On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a sym… |
CVE-2026-29009 | High | 8.2 | 2026-07-08 | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malici… |
CVE-2026-29008 | High | 7.5 | 2026-07-08 | U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attack… |
CVE-2025-3110 | High | 7.5 | 2026-07-08 | OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggli… |
CVE-2026-59880 | High | 7.5 | 2026-07-08 | Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit… |
CVE-2026-59874 | High | 7.5 | 2026-07-08 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded e… |
CVE-2026-59873 | High | 7.5 | 2026-07-08 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry coun… |
CVE-2026-59869 | High | 7.5 | 2026-07-08 | js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document w… |
CVE-2026-59725 | High | 7.5 | 2026-07-08 | Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not pro… |
CVE-2026-59724 | High | 7.5 | 2026-07-08 | Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can reso… |
CVE-2026-3144 | High | 8.1 | 2026-07-08 | IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the syst… |
CVE-2026-59703 | High | 7.5 | 2026-07-08 | repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories… |
CVE-2026-55874 | High | 7.7 | 2026-07-08 | SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by Copy… |
CVE-2026-54652 | High | 8.1 | 2026-07-08 | Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer ro… |
CVE-2026-49147 | High | 7.5 | 2026-07-08 | App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose… |
CVE-2026-49146 | High | 7.5 | 2026-07-08 | App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy f… |
CVE-2026-49145 | High | 7.5 | 2026-07-08 | App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current… |
CVE-2026-24700 | High | 7.2 | 2026-07-08 | An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers wi… |
CVE-2026-24699 | High | 7.2 | 2026-07-08 | An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers wit… |
CVE-2026-24698 | High | 7.2 | 2026-07-08 | An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110… |
CVE-2026-24697 | High | 7.2 | 2026-07-08 | An OS command injection vulnerability exists in the start_bonjour() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers… |
CVE-2026-15067 | High | 8.8 | 2026-07-08 | Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized data source input co… |
CVE-2026-11903 | High | 8.0 | 2026-07-08 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue aff… |
CVE-2026-10708 | High | 7.5 | 2026-07-08 | This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A single request to a minimal leaderboard component may return u… |
CVE-2026-10706 | High | 7.5 | 2026-07-08 | In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbI… |
CVE-2026-10699 | High | 7.5 | 2026-07-08 | Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: fro… |
CVE-2026-10698 | High | 7.2 | 2026-07-08 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit… |
CVE-2026-59257 | High | 8.8 | 2026-07-08 | n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. T… |
CVE-2026-58656 | High | 7.5 | 2026-07-08 | Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthent… |
CVE-2026-56776 | High | 7.4 | 2026-07-08 | n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access us… |
CVE-2026-56297 | High | 7.0 | 2026-07-08 | FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_cal… |
CVE-2026-56250 | High | 7.5 | 2026-07-08 | Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST, enabling retargeting to arbitrary R2 bu… |
CVE-2026-56246 | High | 8.1 | 2026-07-08 | Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its o… |
CVE-2026-56226 | High | 7.5 | 2026-07-08 | Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the… |
CVE-2026-56086 | High | 8.8 | 2026-07-08 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-53482 | High | 7.5 | 2026-07-08 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-44840 | High | 7.5 | 2026-07-08 | Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Qu… |
CVE-2026-41122 | High | 7.1 | 2026-07-08 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-22927 | High | 7.8 | 2026-07-08 | Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability. |
CVE-2026-15053 | High | 7.5 | 2026-07-08 | Tanium addressed a denial of service vulnerability in Tanium Server. |
CVE-2026-6820 | High | 7.2 | 2026-07-08 | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, an… |
CVE-2026-5356 | High | 7.5 | 2026-07-08 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and… |
CVE-2026-6854 | High | 7.5 | 2026-07-08 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up… |
CVE-2026-6818 | High | 7.2 | 2026-07-08 | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all version… |
CVE-2026-6230 | High | 7.5 | 2026-07-08 | The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to… |
CVE-2026-3688 | High | 8.1 | 2026-07-08 | The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version… |
CVE-2026-56003 | High | 8.5 | 2026-07-08 | A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 befor… |
CVE-2026-56002 | High | 8.5 | 2026-07-08 | A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code w… |
CVE-2026-57260 | High | 7.8 | 2026-07-08 | The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of the abnormal object… |
CVE-2026-57256 | High | 7.8 | 2026-07-08 | When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repeated after the form… |
CVE-2026-57254 | High | 7.8 | 2026-07-08 | There is an abnormal annotation within the PDF that is referenced by other objects. When the application parses the PDF, it fails to perform proper type checki… |
CVE-2026-57252 | High | 7.8 | 2026-07-08 | When the application opens a PDF file, during the process of JavaScript deleting pages and removing attachment annotations, it will cause the attachment panel… |
CVE-2026-57251 | High | 7.8 | 2026-07-08 | The application opens a PDF, but the cloud-like appearance of the construction process lacks proper setting of an upper limit and consistency checks. Out-of-bo… |
CVE-2026-57250 | High | 7.8 | 2026-07-08 | When the application opens a PDF and JavaScript resets the form fields, the script re-enters the interface. The underlying native object is damaged, but the ap… |
CVE-2026-57249 | High | 7.8 | 2026-07-08 | After the application opened the PDF file, the script first reset the annotation status, then triggered the reset form event by additional action. During the r… |
CVE-2026-57248 | High | 7.8 | 2026-07-08 | When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient object type and argument checks. As a result… |
CVE-2026-57247 | High | 7.8 | 2026-07-08 | The application re-enters the document structure via field processing and deletes the current page, and then continues using the field objects obtained before… |
CVE-2026-57246 | High | 7.8 | 2026-07-08 | When dealing with abnormally constructed objects, there is a lack of argument validation; JavaScript triggers signature verification, but the signature plugin… |
CVE-2026-57245 | High | 7.8 | 2026-07-08 | When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationship… |
CVE-2026-57244 | High | 7.8 | 2026-07-08 | After JavaScript resetting the form, the synchronization process lacks re-entry protection and object lifecycle verification, resulting in the failure of the c… |
CVE-2026-57242 | High | 7.8 | 2026-07-08 | The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management and null value val… |
CVE-2026-57240 | High | 7.8 | 2026-07-08 | When the application opens a PDF file and JavaScript deletes the PDF fields, the subsequent logic still uses the old field pointers, resulting in invalid point… |
CVE-2026-57239 | High | 8.2 | 2026-07-08 | The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate t… |
CVE-2026-57238 | High | 7.8 | 2026-07-08 | After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the appli… |
CVE-2026-57237 | High | 7.8 | 2026-07-08 | When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects referenced by the program… |
CVE-2026-56001 | High | 8.5 | 2026-07-08 | A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server… |
CVE-2026-56000 | High | 7.8 | 2026-07-08 | Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use Af… |
CVE-2026-55999 | High | 8.5 | 2026-07-08 | Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffe… |
CVE-2026-13129 | High | 7.8 | 2026-07-08 | When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resulting in the program holding an invalid form obje… |
CVE-2026-13128 | High | 7.8 | 2026-07-08 | Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document vi… |
CVE-2026-13127 | High | 7.8 | 2026-07-08 | The application opens the PDF file. JavaScript then rewrites the document to modify the page structure, resulting in the invalidation of the page objects. Howe… |
CVE-2026-13126 | High | 7.8 | 2026-07-08 | The embedded JavaScript in the PDF deleted the pages, making the object invalid. The application attempted to perform a write operation on the invalid pop-up a… |
CVE-2026-12378 | High | 8.1 | 2026-07-08 | The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserializatio… |
CVE-2026-9700 | High | 7.5 | 2026-07-08 | The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insuffic… |
CVE-2026-57895 | High | 7.8 | 2026-07-08 | Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installation folder, which r… |
CVE-2026-56437 | High | 7.8 | 2026-07-08 | Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer… |
CVE-2026-14495 | High | 8.8 | 2026-07-08 | The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vul… |
CVE-2026-14489 | High | 8.8 | 2026-07-08 | The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect() function in all versions up… |
CVE-2026-9842 | High | 7.5 | 2026-07-08 | The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to t… |
CVE-2026-14482 | High | 8.8 | 2026-07-08 | The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. The vulnerability exists due to a missing ca… |
CVE-2026-14244 | High | 7.5 | 2026-07-08 | The Jssor Slider by jssor.com plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.1.24 via the 'url' parameter pa… |