High-severity CVEs (page 56)
Page 56 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-100597 | High | 7.8 | 2026-09-26 | OpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation ope… |
CVE-2026-100596 | High | 8.8 | 2026-09-26 | OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Atta… |
CVE-2026-100589 | High | 8.3 | 2026-09-26 | OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node browser actio… |
CVE-2026-100588 | High | 8.3 | 2026-09-26 | OpenClaw (npm package 'openclaw') before 2026.7.1 does not enforce the administrator scope requirement on browser control when it is reached through the node.i… |
CVE-2026-100587 | High | 8.8 | 2026-09-26 | OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can i… |
CVE-2026-100586 | High | 8.8 | 2026-09-26 | OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization when creating native conversation bindings. Non-owner channel senders with command… |
CVE-2026-100585 | High | 8.0 | 2026-09-26 | OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered throug… |
CVE-2026-100580 | High | 8.8 | 2026-09-26 | OpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the age… |
CVE-2026-100579 | High | 7.6 | 2026-09-26 | OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments (authentic… |
CVE-2026-100578 | High | 7.6 | 2026-09-26 | OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployme… |
CVE-2026-100575 | High | 8.8 | 2026-09-26 | OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack a… |
CVE-2026-100570 | High | 7.8 | 2026-09-26 | OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDK_PYTHON_ARGS environment varia… |
CVE-2026-100568 | High | 8.3 | 2026-09-26 | OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute owne… |
CVE-2026-100567 | High | 8.2 | 2026-09-26 | OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions >= 2026.4.5 and < 2026.8.1, the Gateway validated a single DNS resolution r… |
CVE-2026-100561 | High | 8.0 | 2026-09-26 | OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a co… |
CVE-2026-100560 | High | 7.5 | 2026-09-26 | OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on… |
CVE-2026-100559 | High | 8.0 | 2026-09-26 | OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to exe… |
CVE-2026-100558 | High | 7.5 | 2026-09-26 | OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response so… |
CVE-2026-100557 | High | 8.3 | 2026-09-26 | OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status. Non-owner… |
CVE-2026-100555 | High | 7.1 | 2026-09-26 | OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gatew… |
CVE-2026-100552 | High | 8.8 | 2026-09-26 | OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level to… |
CVE-2026-100551 | High | 8.3 | 2026-09-26 | OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gate… |
CVE-2026-100544 | High | 8.8 | 2026-09-26 | openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity… |
CVE-2026-100543 | High | 7.5 | 2026-09-26 | OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configurati… |
CVE-2026-100541 | High | 7.5 | 2026-09-26 | OpenClaw's Matrix integration (npm package @openclaw/matrix) versions >= 2026.2.2 and < 2026.8.1 lowercase complete Matrix user IDs — including historical loca… |
CVE-2026-100535 | High | 7.5 | 2026-09-26 | OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-d… |
CVE-2026-100532 | High | 8.1 | 2026-09-26 | @openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owne… |
CVE-2026-100530 | High | 7.3 | 2026-09-26 | OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directo… |
CVE-2026-100520 | High | 8.8 | 2026-09-26 | Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write ar… |
CVE-2026-100504 | High | 7.0 | 2026-09-26 | Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift… |
CVE-2026-96795 | High | 8.8 | 2026-09-25 | Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns PO… |
CVE-2026-100419 | High | 7.0 | 2026-09-25 | gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree d… |
CVE-2026-91765 | High | 7.5 | 2026-09-25 | cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containi… |
CVE-2026-57443 | High | 7.5 | 2026-09-25 | SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`sc… |
CVE-2026-17545 | High | 7.5 | 2026-09-25 | On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ whe… |
CVE-2026-10758 | High | 7.5 | 2026-09-25 | Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer… |
CVE-2026-100391 | High | 8.2 | 2026-09-25 | MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in… |
CVE-2026-100390 | High | 7.4 | 2026-09-25 | Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers con… |
CVE-2026-100389 | High | 8.1 | 2026-09-25 | GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file… |
CVE-2026-100387 | High | 8.1 | 2026-09-25 | pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users t… |
CVE-2026-100369 | High | 8.4 | 2026-09-25 | CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invoking command-line programs and wrapping executable processes. `Cl… |
CVE-2026-5267 | High | 7.5 | 2026-09-25 | Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly enforce authenticat… |
CVE-2026-100372 | High | 7.2 | 2026-09-25 | ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP… |
CVE-2026-100368 | High | 8.4 | 2026-09-25 | CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` packages provide specialized wrappers for shells such as Po… |
CVE-2026-100310 | High | 7.0 | 2026-09-25 | GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege che… |
CVE-2026-100208 | High | 7.5 | 2026-09-25 | Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
CVE-2026-97060 | High | 7.2 | 2026-09-25 | X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership… |
CVE-2026-97885 | High | 7.3 | 2026-09-25 | A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file up… |
CVE-2026-97883 | High | 7.3 | 2026-09-25 | A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown f… |
CVE-2026-97882 | High | 7.3 | 2026-09-25 | A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown fu… |
CVE-2026-91841 | High | 7.8 | 2026-09-25 | A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline chara… |
CVE-2026-91840 | High | 7.8 | 2026-09-25 | A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character i… |
CVE-2026-91839 | High | 7.8 | 2026-09-25 | A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-f… |
CVE-2026-91838 | High | 7.8 | 2026-09-25 | A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special… |
CVE-2026-97878 | High | 7.3 | 2026-09-25 | A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the component Druid… |
CVE-2026-97877 | High | 7.3 | 2026-09-25 | A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. This issue affects the function UserLoginService.createToken of the file application.yml… |
CVE-2026-97871 | High | 7.3 | 2026-09-25 | A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge… |
CVE-2026-94445 | High | 8.8 | 2026-09-25 | A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the… |
CVE-2026-91837 | High | 7.8 | 2026-09-25 | A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserv… |
CVE-2026-89032 | High | 7.7 | 2026-09-25 | BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other… |
CVE-2026-67412 | High | 7.1 | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authori… |
CVE-2026-67411 | High | 7.1 | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted… |
CVE-2026-67410 | High | 7.1 | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200)… |
CVE-2026-67407 | High | 7.1 | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does… |
CVE-2026-67230 | High | 7.5 | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max_frame_… |
CVE-2026-67225 | High | 7.5 | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated du… |
CVE-2026-67223 | High | 7.1 | 2026-09-25 | RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-f… |
CVE-2026-50547 | High | 7.5 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() met… |
CVE-2026-49850 | High | 7.5 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete() and… |
CVE-2026-44642 | High | 8.1 | 2026-09-25 | Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade… |
CVE-2026-42324 | High | 7.2 | 2026-09-25 | Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_set_ranks.php stores administrator-controlled image… |
CVE-2026-42323 | High | 7.2 | 2026-09-25 | Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimensio… |
CVE-2026-33639 | High | 7.2 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator… |
CVE-2026-93306 | High | 7.1 | 2026-09-25 | IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulne… |
CVE-2026-84882 | High | 7.5 | 2026-09-25 | IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker c… |
CVE-2026-84862 | High | 7.2 | 2026-09-25 | IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerab… |
CVE-2026-97865 | High | 7.3 | 2026-09-25 | A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Rem… |
CVE-2026-93834 | High | 8.8 | 2026-09-25 | A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcr… |
CVE-2026-85750 | High | 7.2 | 2026-09-25 | Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficien… |
CVE-2026-85542 | High | 8.8 | 2026-09-25 | IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provid… |
CVE-2026-85029 | High | 7.5 | 2026-09-25 | IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code due to impro… |
CVE-2026-84893 | High | 7.6 | 2026-09-25 | IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sens… |
CVE-2026-84884 | High | 7.5 | 2026-09-25 | IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gai… |
CVE-2026-100072 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ACPI: platform: Use acpi_bus_get_primary_device() The acpi_get_first_physical_node() usag… |
CVE-2026-88421 | High | 7.5 | 2026-09-25 | Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog e… |
CVE-2026-79153 | High | 7.8 | 2026-09-25 | Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticat… |
CVE-2026-52622 | High | 7.5 | 2026-09-25 | An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker… |
CVE-2026-51773 | High | 8.1 | 2026-09-25 | An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker provides a maliciously crafted image location URI pointing to… |
CVE-2025-51457 | High | 8.8 | 2026-09-25 | D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker wi… |
CVE-2026-98156 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses… |
CVE-2026-98155 | High | 7.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() Although 'commit 2feec5… |
CVE-2026-98154 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a h… |
CVE-2026-98150 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPF_F_CPU validation for sparse CPU IDs BPF_F_CPU stores the target CPU ID in th… |
CVE-2026-98149 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix percpu map update indexing with sparse CPU IDs Per-CPU array, hash, and cgroup s… |
CVE-2026-98143 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Don't read the U65 rounding mode as a storage mode Bits 15:14 of NPU_SET_{… |
CVE-2026-98136 | High | 7.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfs_attr_find_in_attrdef() walk… |
CVE-2026-98130 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START The SCTP_CMD_TIMER_START handler checks t… |
CVE-2026-98122 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() vxlan_mdb_is_valid_source()… |
CVE-2026-98116 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params(… |
CVE-2026-98115 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one sess… |