High-severity CVEs (page 6)
Page 6 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19559 | High | 8.8 | 2026-08-11 | Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-19558 | High | 7.5 | 2026-08-11 | Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convinced a user to install a malicious extension to execute arbi… |
CVE-2026-19557 | High | 8.3 | 2026-08-11 | Use after free in TabStrip in Google Chrome on Mac prior to 151.0.7922.137 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-19556 | High | 8.8 | 2026-08-11 | Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2026-66154 | High | 8.3 | 2026-08-11 | An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions… |
CVE-2026-66150 | High | 7.8 | 2026-08-11 | Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access… |
CVE-2026-66149 | High | 7.8 | 2026-08-11 | Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access… |
CVE-2026-63177 | High | 7.1 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the r… |
CVE-2026-55676 | High | 8.8 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores… |
CVE-2026-48763 | High | 8.2 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/typebots/{typebotId}/blocks/{blockId}/st… |
CVE-2026-18634 | High | 8.4 | 2026-08-11 | An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A… |
CVE-2026-15606 | High | 8.8 | 2026-08-11 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the pl… |
CVE-2026-14863 | High | 8.8 | 2026-08-11 | FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code executio… |
CVE-2026-73234 | High | 7.8 | 2026-08-11 | FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates… |
CVE-2026-73232 | High | 7.5 | 2026-08-11 | ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response… |
CVE-2026-73231 | High | 7.8 | 2026-08-11 | Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows a… |
CVE-2026-73031 | High | 8.7 | 2026-08-11 | telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sendi… |
CVE-2026-71467 | High | 7.5 | 2026-08-11 | A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upg… |
CVE-2026-48804 | High | 7.5 | 2026-08-11 | python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in… |
CVE-2026-19091 | High | 8.1 | 2026-08-11 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insuffic… |
CVE-2026-18844 | High | 8.1 | 2026-08-11 | The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent… |
CVE-2026-13457 | High | 7.5 | 2026-08-11 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6… |
CVE-2026-73227 | High | 8.1 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write at… |
CVE-2026-73226 | High | 8.8 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client… |
CVE-2026-73225 | High | 8.1 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to… |
CVE-2026-73224 | High | 8.8 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to… |
CVE-2026-73223 | High | 8.1 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write a… |
CVE-2026-73222 | High | 8.8 | 2026-08-11 | Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option… |
CVE-2026-72742 | High | 8.6 | 2026-08-11 | DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model o… |
CVE-2026-69119 | High | 8.3 | 2026-08-11 | Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently… |
CVE-2026-48809 | High | 7.5 | 2026-08-11 | python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python… |
CVE-2026-48802 | High | 7.5 | 2026-08-11 | python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecess… |
CVE-2026-18712 | High | 8.1 | 2026-08-11 | An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause… |
CVE-2026-18711 | High | 7.1 | 2026-08-11 | An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used… |
CVE-2026-18697 | High | 7.5 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitt… |
CVE-2026-18694 | High | 7.1 | 2026-08-11 | An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be… |
CVE-2026-18693 | High | 7.6 | 2026-08-11 | An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to… |
CVE-2026-18692 | High | 8.8 | 2026-08-11 | An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to… |
CVE-2026-18691 | High | 8.8 | 2026-08-11 | An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is use… |
CVE-2026-18690 | High | 8.1 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that… |
CVE-2026-18688 | High | 7.1 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed nu… |
CVE-2026-18687 | High | 7.1 | 2026-08-11 | MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypt… |
CVE-2026-15426 | High | 8.8 | 2026-08-11 | The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in al… |
CVE-2026-72713 | High | 7.5 | 2026-08-11 | XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files o… |
CVE-2026-48771 | High | 8.2 | 2026-08-11 | ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side dat… |
CVE-2026-48767 | High | 7.6 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token… |
CVE-2026-48447 | High | 7.7 | 2026-08-11 | Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An… |
CVE-2026-48441 | High | 8.6 | 2026-08-11 | Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary f… |
CVE-2026-48416 | High | 7.5 | 2026-08-11 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerab… |
CVE-2026-48415 | High | 7.6 | 2026-08-11 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage… |
CVE-2026-48414 | High | 7.7 | 2026-08-11 | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts i… |
CVE-2026-48413 | High | 8.7 | 2026-08-11 | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts i… |
CVE-2026-48410 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48409 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48408 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48407 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48406 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48405 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48404 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48397 | High | 8.6 | 2026-08-11 | Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current… |
CVE-2026-47940 | High | 7.8 | 2026-08-11 | Lightroom Classic is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current us… |
CVE-2022-50997 | High | 7.5 | 2026-08-11 | Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attack… |
CVE-2016-20097 | High | 7.5 | 2026-08-11 | Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbit… |
CVE-2026-73089 | High | 7.5 | 2026-08-11 | Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct… |
CVE-2026-73088 | High | 7.5 | 2026-08-11 | Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, re… |
CVE-2026-73086 | High | 7.4 | 2026-08-11 | nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and ind… |
CVE-2026-71387 | High | 8.8 | 2026-08-11 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacke… |
CVE-2026-71386 | High | 8.8 | 2026-08-11 | is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could e… |
CVE-2026-71383 | High | 7.3 | 2026-08-11 | is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass… |
CVE-2026-71331 | High | 8.1 | 2026-08-11 | Integer overflow or wraparound in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to execute code ove… |
CVE-2026-70355 | High | 7.3 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate pr… |
CVE-2026-70354 | High | 7.8 | 2026-08-11 | Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. |
CVE-2026-70347 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-70346 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-70345 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-70344 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-70340 | High | 8.1 | 2026-08-11 | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70338 | High | 7.8 | 2026-08-11 | Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-70337 | High | 8.8 | 2026-08-11 | Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network. |
CVE-2026-70336 | High | 8.8 | 2026-08-11 | Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2026-70335 | High | 7.8 | 2026-08-11 | Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized atta… |
CVE-2026-70329 | High | 8.8 | 2026-08-11 | Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
CVE-2026-70326 | High | 8.8 | 2026-08-11 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70324 | High | 8.8 | 2026-08-11 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70321 | High | 8.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-70313 | High | 7.8 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70311 | High | 7.8 | 2026-08-11 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-70307 | High | 7.0 | 2026-08-11 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-70130 | High | 8.4 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-69320 | High | 8.8 | 2026-08-11 | Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute cod… |
CVE-2026-69306 | High | 8.2 | 2026-08-11 | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-69278 | High | 7.8 | 2026-08-11 | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-68821 | High | 7.3 | 2026-08-11 | Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally. |
CVE-2026-68820 | High | 7.0 | 2026-08-11 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-68817 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68816 | High | 7.8 | 2026-08-11 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68815 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68814 | High | 7.8 | 2026-08-11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68812 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-68811 | High | 7.8 | 2026-08-11 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |