High-severity CVEs (page 57)
Page 57 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-98112 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix listener task lifetime on netdev events The listener thread exits when its lis… |
CVE-2026-98108 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan l2cap_new_connection(… |
CVE-2026-98096 | High | 7.4 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with s… |
CVE-2026-98093 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl_micfil: balance mclk enable/disable hw_params() enables mclk unconditionally an… |
CVE-2026-98083 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID st… |
CVE-2026-98073 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). syzbot… |
CVE-2026-98070 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() rds_tcp_reset_callbacks() quies… |
CVE-2026-98069 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire the fastpath locks in rds_conn_shutdown() rds_conn_shutdown() quiesces t… |
CVE-2026-98056 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvme_scan_ns_list() drops the sta… |
CVE-2026-98052 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb->last before writing each descriptor bcmasp_xmit() only wrote txc… |
CVE-2026-98050 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context Currently mlxs… |
CVE-2026-98041 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: … |
CVE-2026-98030 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size bcm_sf2_cfp_rule_g… |
CVE-2026-98029 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfp_net_get_fs_loc() dum… |
CVE-2026-98027 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxx_get… |
CVE-2026-98023 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fix… |
CVE-2026-98017 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make cls… |
CVE-2026-98002 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amd_iommu_pdom_id_allo… |
CVE-2026-97991 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_blk: reject out-of-range sector starts vdpasim_blk_check_range() logs an invalid… |
CVE-2026-97990 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_net: check TX pull result before RX copy vringh_iov_pull_iotlb() returns a signe… |
CVE-2026-97971 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permission before taking a namespace reference legitimize_ns() take… |
CVE-2026-97957 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment buffer overflow check_mbox_seq_id_and_seg_len() validates… |
CVE-2026-97953 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmac_tso_xmit() estim… |
CVE-2026-97941 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race Commit ba7425312… |
CVE-2026-97940 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6_route_iter_active() treats a walker in FWS_U a… |
CVE-2026-97937 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ftrace: fork: Initialize function graph state before copy_exec_state() dup_task_struct()… |
CVE-2026-97931 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects re… |
CVE-2026-97926 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ufs: validate cylinder group metadata before caching it ufs_read_cylinder() copies the cy… |
CVE-2026-97911 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set th… |
CVE-2026-97910 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprd_platform_compr_… |
CVE-2026-97903 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to thread_pid across proc_flush_pid Commit 0a36bad01731 ("release_… |
CVE-2026-97875 | High | 8.1 | 2026-09-25 | Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all… |
CVE-2026-97612 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear inner_protocol when the last label is popped skb_mpls_push() records the… |
CVE-2026-97611 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tbl_mask_array_realloc(… |
CVE-2026-97609 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: prevent UAF during module unload nf_ct_set_timeout() protects the t… |
CVE-2026-97608 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: unregister loggers before per-net teardown nf_log_syslog and nfnetlink… |
CVE-2026-97602 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: inet: frags: invalidate queues before flushing them fqdir_pre_exit() flushes the skbs fro… |
CVE-2026-97595 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee8… |
CVE-2026-97594 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of the source's parent directory current_check_refer_path()… |
CVE-2026-97589 | High | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return code to engine in asynch callbacks When crypto_finalize_has… |
CVE-2026-97584 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix incorrect free in candidate cleanup in afs_lookup_server() Fix afs_lookup_server… |
CVE-2026-97583 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: afs: Clear stale peer app data after address list changes afs_fs_probe_fileserver() fetch… |
CVE-2026-97580 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity compute_tiles_unifo… |
CVE-2026-97579 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdec_av1_slice_s… |
CVE-2026-97578 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer rockchip_vpu981_av… |
CVE-2026-97577 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity rockchip_vpu9… |
CVE-2026-97576 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read num_tile_co… |
CVE-2026-97575 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tile_info.tile… |
CVE-2026-97573 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() bnxt_rx_ring_reset() fr… |
CVE-2026-97570 | High | 8.1 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so t… |
CVE-2026-97562 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tcon_super_cb() stores a raw superbl… |
CVE-2026-97557 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifs_queue_oplock_break() cifs_queue_oplock_break(… |
CVE-2026-97555 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When id_mode_to_cifs_acl rewri… |
CVE-2026-97548 | High | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions The _maxlevels_ondisk func… |
CVE-2026-97536 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown The response queue MSI-… |
CVE-2026-97531 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xx_report_id_acqui… |
CVE-2026-97528 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qla_nvme_xmt_ls_rs… |
CVE-2026-97527 | High | 8.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock The fcport->unsol_ctx… |
CVE-2026-97525 | High | 8.2 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Allocate split page tables as kernel page tables A PTE is allocated directly… |
CVE-2026-97524 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid unneeded actions on subflow reset Once in a blue moon, the mptcp receive pat… |
CVE-2026-97523 | High | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mptcp: close race between scheduler and state change The mptcp scheduler may race with su… |
CVE-2026-92564 | High | 7.5 | 2026-09-25 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qp… |
CVE-2026-92560 | High | 7.5 | 2026-09-25 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects… |
CVE-2026-92550 | High | 7.5 | 2026-09-25 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects… |
CVE-2026-96752 | High | 7.2 | 2026-09-25 | The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all… |
CVE-2026-96568 | High | 7.2 | 2026-09-25 | The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to… |
CVE-2026-95866 | High | 7.2 | 2026-09-25 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-95864 | High | 7.2 | 2026-09-25 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 du… |
CVE-2026-94573 | High | 7.2 | 2026-09-25 | The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and i… |
CVE-2026-93901 | High | 7.3 | 2026-09-25 | The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the `provisionBlo… |
CVE-2026-93654 | High | 7.2 | 2026-09-25 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cart_items[][product_name]' Parame… |
CVE-2026-92713 | High | 8.1 | 2026-09-25 | The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in… |
CVE-2026-92608 | High | 7.5 | 2026-09-25 | Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQ… |
CVE-2026-89426 | High | 8.8 | 2026-09-25 | The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including… |
CVE-2026-89406 | High | 7.5 | 2026-09-25 | The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up… |
CVE-2026-84280 | High | 7.2 | 2026-09-25 | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter in all versions u… |
CVE-2026-19804 | High | 8.8 | 2026-09-25 | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote… |
CVE-2026-13456 | High | 7.5 | 2026-09-25 | The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all vers… |
CVE-2026-96039 | High | 7.2 | 2026-09-25 | The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27… |
CVE-2026-93303 | High | 7.2 | 2026-09-25 | The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'form_data' Rich T… |
CVE-2026-84281 | High | 7.2 | 2026-09-25 | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta in all versions… |
CVE-2026-84279 | High | 7.2 | 2026-09-25 | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter in all versions up to, and inclu… |
CVE-2026-83591 | High | 7.2 | 2026-09-25 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all… |
CVE-2026-62062 | High | 8.8 | 2026-09-25 | Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder… |
CVE-2026-97818 | High | 8.6 | 2026-09-25 | phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php. |
CVE-2026-97737 | High | 7.4 | 2026-09-25 | In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover. |
CVE-2026-97735 | High | 8.0 | 2026-09-25 | ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrar… |
CVE-2026-97731 | High | 7.1 | 2026-09-25 | MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSigne… |
CVE-2026-97730 | High | 8.5 | 2026-09-25 | In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data… |
CVE-2026-97646 | High | 7.3 | 2026-09-25 | A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the… |
CVE-2026-85491 | High | 8.8 | 2026-09-24 | Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on… |
CVE-2026-88388 | High | 7.5 | 2026-09-24 | Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remot… |
CVE-2026-81630 | High | 8.1 | 2026-09-24 | The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through an unprot… |
CVE-2026-97326 | High | 7.3 | 2026-09-24 | A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of t… |
CVE-2026-97324 | High | 7.3 | 2026-09-24 | A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/s… |
CVE-2026-96883 | High | 8.8 | 2026-09-24 | pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user… |
CVE-2026-93354 | High | 8.1 | 2026-09-24 | Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and… |
CVE-2026-93289 | High | 7.5 | 2026-09-24 | The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing pro… |
CVE-2026-85496 | High | 8.8 | 2026-09-24 | The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictable source. An unaut… |
CVE-2026-84399 | High | 8.8 | 2026-09-24 | The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently as… |