High-severity CVEs (page 55)
Page 55 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-100852 | High | 8.8 | 2026-09-27 | AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer user… |
CVE-2026-100851 | High | 7.6 | 2026-09-27 | AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with o… |
CVE-2026-100850 | High | 7.7 | 2026-09-27 | AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backend/src/Radio/AutoDJ/… |
CVE-2026-100849 | High | 7.1 | 2026-09-27 | AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl() (back… |
CVE-2026-100848 | High | 7.1 | 2026-09-27 | AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme (Utilities… |
CVE-2026-100847 | High | 7.5 | 2026-09-27 | AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitra… |
CVE-2026-100846 | High | 7.6 | 2026-09-27 | MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads… |
CVE-2026-100845 | High | 7.8 | 2026-09-27 | MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when l… |
CVE-2026-100844 | High | 8.4 | 2026-09-27 | MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from… |
CVE-2026-100843 | High | 7.8 | 2026-09-27 | MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in mo… |
CVE-2026-100842 | High | 7.0 | 2026-09-27 | MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions… |
CVE-2026-100841 | High | 7.8 | 2026-09-27 | In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache Me… |
CVE-2026-100840 | High | 7.8 | 2026-09-27 | MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable cal… |
CVE-2026-100839 | High | 8.4 | 2026-09-27 | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection… |
CVE-2026-100838 | High | 8.1 | 2026-09-27 | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw… |
CVE-2026-100835 | High | 7.4 | 2026-09-27 | Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained t… |
CVE-2026-100744 | High | 7.3 | 2026-09-27 | A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of t… |
CVE-2026-100723 | High | 7.5 | 2026-09-27 | vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host… |
CVE-2025-71426 | High | 7.1 | 2026-09-27 | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.4.1, a recovering Coordinator does not verify the seed supplied by the recove… |
CVE-2025-71425 | High | 7.3 | 2026-09-27 | Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONT… |
CVE-2025-71423 | High | 7.3 | 2026-09-27 | Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response —… |
CVE-2026-100739 | High | 7.3 | 2026-09-26 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the… |
CVE-2026-72668 | High | 7.3 | 2026-09-26 | Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit… |
CVE-2026-77203 | High | 8.8 | 2026-09-26 | The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due… |
CVE-2026-97161 | High | 7.5 | 2026-09-26 | Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 |
CVE-2026-97160 | High | 8.8 | 2026-09-26 | Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 |
CVE-2026-94132 | High | 8.1 | 2026-09-26 | Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of i… |
CVE-2026-94131 | High | 8.1 | 2026-09-26 | Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a… |
CVE-2026-100720 | High | 8.7 | 2026-09-26 | Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificat… |
CVE-2026-100718 | High | 7.1 | 2026-09-26 | Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowe… |
CVE-2026-100713 | High | 7.8 | 2026-09-26 | Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php… |
CVE-2026-100711 | High | 7.5 | 2026-09-26 | froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding h… |
CVE-2026-100709 | High | 7.5 | 2026-09-26 | Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-to… |
CVE-2026-100708 | High | 7.1 | 2026-09-26 | Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.g… |
CVE-2026-100707 | High | 7.7 | 2026-09-26 | Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation… |
CVE-2026-100705 | High | 7.6 | 2026-09-26 | Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 1… |
CVE-2026-100704 | High | 7.7 | 2026-09-26 | Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never reads the… |
CVE-2026-100703 | High | 7.7 | 2026-09-26 | Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the… |
CVE-2026-100700 | High | 7.5 | 2026-09-26 | nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking… |
CVE-2026-100697 | High | 8.6 | 2026-09-26 | Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-au… |
CVE-2026-100693 | High | 8.4 | 2026-09-26 | Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to by… |
CVE-2026-100692 | High | 7.5 | 2026-09-26 | Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme… |
CVE-2026-100690 | High | 7.5 | 2026-09-26 | Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file sys… |
CVE-2026-100686 | High | 8.1 | 2026-09-26 | Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign appli… |
CVE-2026-100685 | High | 7.7 | 2026-09-26 | Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across… |
CVE-2026-100684 | High | 8.1 | 2026-09-26 | Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing u… |
CVE-2026-100683 | High | 8.0 | 2026-09-26 | Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers di… |
CVE-2026-100682 | High | 8.8 | 2026-09-26 | Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without p… |
CVE-2026-100680 | High | 8.1 | 2026-09-26 | Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to… |
CVE-2026-100679 | High | 8.8 | 2026-09-26 | stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket w… |
CVE-2026-100676 | High | 8.2 | 2026-09-26 | January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG <image href> values as local filesyste… |
CVE-2026-100673 | High | 8.2 | 2026-09-26 | The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates… |
CVE-2026-100672 | High | 7.5 | 2026-09-26 | The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any… |
CVE-2026-100671 | High | 8.0 | 2026-09-26 | Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page c… |
CVE-2026-100670 | High | 8.8 | 2026-09-26 | Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a `security@: admi… |
CVE-2026-100669 | High | 7.5 | 2026-09-26 | Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config (IIS)… |
CVE-2026-100666 | High | 7.3 | 2026-09-26 | Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each o… |
CVE-2026-100665 | High | 7.5 | 2026-09-26 | Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a pla… |
CVE-2026-100664 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host hea… |
CVE-2026-100663 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets whe… |
CVE-2026-100662 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the Q… |
CVE-2026-100661 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-int… |
CVE-2026-100660 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a… |
CVE-2026-100646 | High | 8.1 | 2026-09-26 | SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/mo… |
CVE-2026-100645 | High | 8.0 | 2026-09-26 | SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are no… |
CVE-2026-100644 | High | 7.5 | 2026-09-26 | SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without… |
CVE-2026-100643 | High | 8.0 | 2026-09-26 | SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaSc… |
CVE-2026-100642 | High | 7.6 | 2026-09-26 | SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants admin… |
CVE-2026-100641 | High | 8.0 | 2026-09-26 | SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /… |
CVE-2026-100639 | High | 8.8 | 2026-09-26 | SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in… |
CVE-2026-100638 | High | 7.6 | 2026-09-26 | SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitra… |
CVE-2026-100637 | High | 7.6 | 2026-09-26 | SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files… |
CVE-2026-100636 | High | 7.6 | 2026-09-26 | SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitr… |
CVE-2026-100631 | High | 7.5 | 2026-09-26 | Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication l… |
CVE-2026-100627 | High | 8.1 | 2026-09-26 | Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoi… |
CVE-2026-100625 | High | 7.1 | 2026-09-26 | Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build… |
CVE-2026-100623 | High | 8.8 | 2026-09-26 | Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies "Allow org… |
CVE-2026-100622 | High | 7.5 | 2026-09-26 | capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers c… |
CVE-2026-100619 | High | 8.8 | 2026-09-26 | Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed… |
CVE-2026-100618 | High | 8.5 | 2026-09-26 | Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalize… |
CVE-2026-100617 | High | 8.8 | 2026-09-26 | Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant c… |
CVE-2026-100615 | High | 8.8 | 2026-09-26 | Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super… |
CVE-2026-100614 | High | 8.8 | 2026-09-26 | Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows… |
CVE-2026-100612 | High | 7.2 | 2026-09-26 | Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers… |
CVE-2026-100610 | High | 7.5 | 2026-09-26 | Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service pe… |
CVE-2026-100608 | High | 8.3 | 2026-09-26 | Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cl… |
CVE-2026-100607 | High | 7.7 | 2026-09-26 | Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to auth… |
CVE-2026-100606 | High | 7.7 | 2026-09-26 | Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback arrives with an… |
CVE-2026-100605 | High | 7.1 | 2026-09-26 | Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. At… |
CVE-2026-100315 | High | 7.3 | 2026-09-26 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the… |
CVE-2026-100314 | High | 7.3 | 2026-09-26 | A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown f… |
CVE-2026-98163 | High | 7.8 | 2026-09-26 | In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea ("cgro… |
CVE-2026-96532 | High | 7.5 | 2026-09-26 | The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form… |
CVE-2026-96524 | High | 8.8 | 2026-09-26 | The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a con… |
CVE-2026-85081 | High | 7.5 | 2026-09-26 | The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly… |
CVE-2026-84096 | High | 8.0 | 2026-09-26 | The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and th… |
CVE-2026-84095 | High | 8.0 | 2026-09-26 | The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is genera… |
CVE-2026-16591 | High | 7.2 | 2026-09-26 | The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attribu… |
CVE-2026-100599 | High | 8.8 | 2026-09-26 | OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts… |
CVE-2026-100598 | High | 7.1 | 2026-09-26 | OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured… |