High-severity CVEs (page 56)
Page 56 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-60109 | High | 7.5 | 2026-07-09 | Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows unauthenticated remote attackers to crash the… |
CVE-2026-60108 | High | 7.5 | 2026-07-09 | Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause process t… |
CVE-2026-56292 | High | 7.5 | 2026-07-09 | Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was dis… |
CVE-2026-54801 | High | 7.2 | 2026-07-09 | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affec… |
CVE-2026-4256 | High | 8.2 | 2026-07-09 | Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection. T… |
CVE-2026-9253 | High | 7.2 | 2026-07-09 | The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customerInfos' parameter… |
CVE-2026-59692 | High | 7.5 | 2026-07-09 | A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed… |
CVE-2026-59691 | High | 7.1 | 2026-07-09 | A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp frame… |
CVE-2026-4275 | High | 8.8 | 2026-07-09 | The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu… |
CVE-2026-14372 | High | 7.1 | 2026-07-09 | The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion du… |
CVE-2026-13441 | High | 7.2 | 2026-07-09 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_col… |
CVE-2026-1989 | High | 7.5 | 2026-07-09 | Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allows Exploitation of Trusted Identifiers… |
CVE-2026-8848 | High | 7.2 | 2026-07-09 | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to authorization bypass i… |
CVE-2026-57111 | High | 7.5 | 2026-07-09 | Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) in Apache Helix through 2.0.0 on… |
CVE-2026-33390 | High | 8.1 | 2026-07-09 | An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authentica… |
CVE-2026-31985 | High | 8.1 | 2026-07-09 | When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS certificate verification, and n… |
CVE-2026-31984 | High | 7.5 | 2026-07-09 | A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on inp… |
CVE-2026-31982 | High | 7.1 | 2026-07-09 | An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection paramete… |
CVE-2026-15000 | High | 7.2 | 2026-07-09 | The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values in all versions up… |
CVE-2026-47840 | High | 7.5 | 2026-07-09 | A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP… |
CVE-2026-47831 | High | 7.5 | 2026-07-09 | Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-stemcell-builder allows a remote attacker to bru… |
CVE-2026-47830 | High | 8.8 | 2026-07-09 | Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users to overwrite C:\bos… |
CVE-2026-47829 | High | 7.8 | 2026-07-09 | Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned ssh process when an operator run… |
CVE-2026-47828 | High | 8.8 | 2026-07-09 | During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without v… |
CVE-2026-11571 | High | 7.5 | 2026-07-09 | The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them pu… |
CVE-2026-5523 | High | 8.8 | 2026-07-09 | The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due to the update_user() fun… |
CVE-2026-41857 | High | 7.8 | 2026-07-09 | A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh l… |
CVE-2026-15137 | High | 7.3 | 2026-07-09 | A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file \inc\classes\View.php. Thi… |
CVE-2026-15135 | High | 7.3 | 2026-07-09 | A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file /edit_food_items.php. The manipulat… |
CVE-2026-15134 | High | 7.3 | 2026-07-09 | A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2026-59723 | High | 8.8 | 2026-07-08 | Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard… |
CVE-2026-54784 | High | 7.4 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation… |
CVE-2026-54783 | High | 7.4 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security endorsing and suppo… |
CVE-2026-54781 | High | 7.4 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token validation does not… |
CVE-2026-54774 | High | 7.4 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, SamlSerializer skips final SignatureVal… |
CVE-2026-54772 | High | 7.5 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated remote attacker that… |
CVE-2026-54499 | High | 7.5 | 2026-07-08 | Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loader… |
CVE-2026-15133 | High | 8.8 | 2026-07-08 | Use after free in InterestGroups in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HT… |
CVE-2026-15132 | High | 8.8 | 2026-07-08 | Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-15129 | High | 8.8 | 2026-07-08 | Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2026-15126 | High | 8.8 | 2026-07-08 | Use after free in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-15125 | High | 8.8 | 2026-07-08 | Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a craft… |
CVE-2026-15123 | High | 8.8 | 2026-07-08 | Inappropriate implementation in DOM in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2026-15122 | High | 8.3 | 2026-07-08 | Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the rend… |
CVE-2026-15121 | High | 8.8 | 2026-07-08 | Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-15120 | High | 8.3 | 2026-07-08 | Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-15119 | High | 8.3 | 2026-07-08 | Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandb… |
CVE-2026-15118 | High | 8.8 | 2026-07-08 | Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-15117 | High | 7.5 | 2026-07-08 | Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to engage in specific UI gestures to potenti… |
CVE-2026-15116 | High | 8.8 | 2026-07-08 | Use after free in Actor in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-15114 | High | 8.8 | 2026-07-08 | Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2026-15112 | High | 8.8 | 2026-07-08 | Use after free in Ozone in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2026-15111 | High | 7.5 | 2026-07-08 | Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentiall… |
CVE-2026-15110 | High | 8.8 | 2026-07-08 | Use after free in Extensions in Google Chrome prior to 150.0.7871.115 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2026-15107 | High | 8.8 | 2026-07-08 | Use after free in IndexedDB in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2026-55878 | High | 7.8 | 2026-07-08 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a r… |
CVE-2026-55830 | High | 8.3 | 2026-07-08 | RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8… |
CVE-2026-55470 | High | 7.5 | 2026-07-08 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incomplete… |
CVE-2026-51535 | High | 7.5 | 2026-07-08 | In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network processing loop. |
CVE-2026-44161 | High | 7.2 | 2026-07-08 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http o… |
CVE-2026-44160 | High | 7.5 | 2026-07-08 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and… |
CVE-2026-44025 | High | 7.5 | 2026-07-08 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agen… |
CVE-2026-35552 | High | 8.1 | 2026-07-08 | In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API… |
CVE-2026-10037 | High | 8.8 | 2026-07-08 | A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as ex… |
CVE-2026-6896 | High | 8.7 | 2026-07-08 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain con… |
CVE-2026-60105 | High | 8.6 | 2026-07-08 | Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the i… |
CVE-2026-58525 | High | 8.2 | 2026-07-08 | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-58207 | High | 7.7 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client able to send account-sc… |
CVE-2026-58192 | High | 8.6 | 2026-07-08 | Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin ex… |
CVE-2026-56669 | High | 7.5 | 2026-07-08 | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses g… |
CVE-2026-55596 | High | 8.7 | 2026-07-08 | Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMe… |
CVE-2026-54591 | High | 8.1 | 2026-07-08 | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prio… |
CVE-2026-54528 | High | 7.1 | 2026-07-08 | JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers… |
CVE-2026-49866 | High | 7.5 | 2026-07-08 | libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub defaultDecodeRpcLimits set maxIhaveMessageIDs and maxIwant… |
CVE-2026-35210 | High | 7.1 | 2026-07-08 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability… |
CVE-2026-15167 | High | 7.5 | 2026-07-08 | DBS Etherwatch file parser crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service |
CVE-2026-13320 | High | 7.3 | 2026-07-08 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain c… |
CVE-2026-0288 | High | 7.5 | 2026-07-08 | Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated at… |
CVE-2026-60104 | High | 8.7 | 2026-07-08 | Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low… |
CVE-2026-59948 | High | 7.0 | 2026-07-08 | Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packag… |
CVE-2026-59939 | High | 7.5 | 2026-07-08 | httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Con… |
CVE-2026-59936 | High | 7.5 | 2026-07-08 | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated in… |
CVE-2026-59935 | High | 7.5 | 2026-07-08 | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated in… |
CVE-2026-59822 | High | 8.2 | 2026-07-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauth… |
CVE-2026-59821 | High | 7.2 | 2026-07-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production creat… |
CVE-2026-59806 | High | 7.4 | 2026-07-08 | Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perfo… |
CVE-2026-59803 | High | 7.5 | 2026-07-08 | rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). When a message has th… |
CVE-2026-59802 | High | 8.2 | 2026-07-08 | PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malici… |
CVE-2026-58253 | High | 8.8 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was c… |
CVE-2026-58250 | High | 7.5 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with net… |
CVE-2026-58213 | High | 7.1 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include prot… |
CVE-2026-58210 | High | 7.5 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client c… |
CVE-2026-55760 | High | 7.5 | 2026-07-08 | Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compi… |
CVE-2026-55404 | High | 7.5 | 2026-07-08 | yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can wri… |
CVE-2026-14891 | High | 8.7 | 2026-07-08 | HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into… |
CVE-2026-14373 | High | 7.7 | 2026-07-08 | HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow… |
CVE-2026-59937 | High | 7.5 | 2026-07-08 | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that caus… |
CVE-2026-60102 | High | 8.8 | 2026-07-08 | Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() met… |
CVE-2026-59928 | High | 7.5 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definit… |
CVE-2026-59925 | High | 7.5 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs… |