High-severity CVEs (page 60)
Page 60 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13918 | High | 8.8 | 2026-06-30 | Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2026-13915 | High | 8.8 | 2026-06-30 | Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gesture… |
CVE-2026-13903 | High | 8.8 | 2026-06-30 | Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HT… |
CVE-2026-13899 | High | 8.8 | 2026-06-30 | Use after free in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-13898 | High | 8.8 | 2026-06-30 | Use after free in Cast Receiver in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… |
CVE-2026-13897 | High | 8.8 | 2026-06-30 | Insufficient policy enforcement in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted H… |
CVE-2026-13891 | High | 7.5 | 2026-06-30 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-13888 | High | 8.8 | 2026-06-30 | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2026-13885 | High | 8.8 | 2026-06-30 | Use after free in Skia in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HT… |
CVE-2026-13884 | High | 8.8 | 2026-06-30 | Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via malicious network traffic. (Chrom… |
CVE-2026-13870 | High | 8.8 | 2026-06-30 | Use after free in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-13864 | High | 8.1 | 2026-06-30 | Insufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2026-13863 | High | 7.8 | 2026-06-30 | Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform privilege escal… |
CVE-2026-13856 | High | 7.5 | 2026-06-30 | Insufficient validation of untrusted input in Speech in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the rende… |
CVE-2026-13855 | High | 7.5 | 2026-06-30 | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to ex… |
CVE-2026-13850 | High | 8.8 | 2026-06-30 | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code… |
CVE-2026-13849 | High | 8.6 | 2026-06-30 | Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to potentially perform a s… |
CVE-2026-13848 | High | 8.8 | 2026-06-30 | Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-13845 | High | 8.8 | 2026-06-30 | Use after free in DOM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2026-13844 | High | 7.8 | 2026-06-30 | Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious… |
CVE-2026-13841 | High | 8.3 | 2026-06-30 | Integer overflow in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-13835 | High | 8.8 | 2026-06-30 | Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2026-13834 | High | 8.3 | 2026-06-30 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-13832 | High | 8.3 | 2026-06-30 | Use after free in Headless in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-13831 | High | 7.5 | 2026-06-30 | Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to execute arbit… |
CVE-2026-13830 | High | 8.8 | 2026-06-30 | Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic… |
CVE-2026-13829 | High | 8.3 | 2026-06-30 | Insufficient validation of untrusted input in Settings in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the ren… |
CVE-2026-13827 | High | 7.8 | 2026-06-30 | Use after free in Updater in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromi… |
CVE-2026-13825 | High | 8.8 | 2026-06-30 | Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-13824 | High | 7.5 | 2026-06-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to per… |
CVE-2026-13823 | High | 8.3 | 2026-06-30 | Use after free in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
CVE-2026-13821 | High | 8.8 | 2026-06-30 | Use after free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-13819 | High | 8.1 | 2026-06-30 | Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform an out… |
CVE-2026-13817 | High | 8.8 | 2026-06-30 | Insufficient validation of untrusted input in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape vi… |
CVE-2026-13815 | High | 8.8 | 2026-06-30 | Use after free in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-13814 | High | 7.5 | 2026-06-30 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
CVE-2026-13813 | High | 8.3 | 2026-06-30 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-13811 | High | 8.8 | 2026-06-30 | Use after free in IME in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2026-13807 | High | 7.5 | 2026-06-30 | Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to exe… |
CVE-2026-13806 | High | 8.1 | 2026-06-30 | Insufficient validation of untrusted input in Accessibility in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer… |
CVE-2026-13805 | High | 8.8 | 2026-06-30 | Use after free in GFX in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium sec… |
CVE-2026-13804 | High | 8.3 | 2026-06-30 | Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-13803 | High | 8.3 | 2026-06-30 | Type Confusion in Chrome Tabs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-13802 | High | 7.5 | 2026-06-30 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arb… |
CVE-2026-13801 | High | 8.3 | 2026-06-30 | Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
CVE-2026-13800 | High | 7.8 | 2026-06-30 | Inappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation vi… |
CVE-2026-13799 | High | 8.1 | 2026-06-30 | Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic… |
CVE-2026-13794 | High | 7.5 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user… |
CVE-2026-13791 | High | 8.1 | 2026-06-30 | Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious… |
CVE-2026-13788 | High | 8.8 | 2026-06-30 | Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (C… |
CVE-2026-13787 | High | 8.1 | 2026-06-30 | Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traff… |
CVE-2026-13786 | High | 8.8 | 2026-06-30 | Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security… |
CVE-2026-13784 | High | 8.8 | 2026-06-30 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
CVE-2026-13783 | High | 8.8 | 2026-06-30 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
CVE-2026-13779 | High | 8.1 | 2026-06-30 | Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traf… |
CVE-2026-13778 | High | 7.8 | 2026-06-30 | Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via a malicious peripheral. (Chromiu… |
CVE-2026-13777 | High | 8.8 | 2026-06-30 | Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corru… |
CVE-2026-13774 | High | 8.1 | 2026-06-30 | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbit… |
CVE-2025-71374 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arb… |
CVE-2025-71371 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payload… |
CVE-2025-71368 | High | 8.1 | 2026-06-30 | picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote at… |
CVE-2025-71363 | High | 8.1 | 2026-06-30 | picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers c… |
CVE-2025-71352 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used in pickle file reduce methods, allowing attackers to execute… |
CVE-2025-71350 | High | 8.1 | 2026-06-30 | picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in reduce methods. Attackers can embed undetected co… |
CVE-2025-71349 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing attackers to embed undetected malicious co… |
CVE-2026-57585 | High | 7.5 | 2026-06-30 | MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught erro… |
CVE-2026-52868 | High | 8.2 | 2026-06-30 | An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area deployment, this can… |
CVE-2026-52196 | High | 7.5 | 2026-06-30 | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_416f28 compon… |
CVE-2026-50254 | High | 7.5 | 2026-06-30 | An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode… |
CVE-2026-35505 | High | 7.5 | 2026-06-30 | An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the ser… |
CVE-2026-11541 | High | 7.4 | 2026-06-30 | IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Li… |
CVE-2026-44628 | High | 7.5 | 2026-06-30 | An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expe… |
CVE-2026-13207 | High | 7.5 | 2026-06-30 | FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in the REST API. The API router fails to normal… |
CVE-2026-11594 | High | 8.5 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console. |
CVE-2025-36359 | High | 8.1 | 2026-06-30 | IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate a… |
CVE-2026-13772 | High | 7.5 | 2026-06-30 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes thei… |
CVE-2026-13759 | High | 7.5 | 2026-06-30 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, Object… |
CVE-2026-13449 | High | 7.6 | 2026-06-30 | IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A re… |
CVE-2026-11806 | High | 7.2 | 2026-06-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature ena… |
CVE-2026-11714 | High | 8.5 | 2026-06-30 | IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled. |
CVE-2026-11546 | High | 7.1 | 2026-06-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 featur… |
CVE-2026-10564 | High | 8.2 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py… |
CVE-2026-10560 | High | 8.2 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated atta… |
CVE-2026-10546 | High | 7.1 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component ( src/lfx/src/lfx/components/data_source/… |
CVE-2026-10129 | High | 8.5 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component. An authenticat… |
CVE-2026-10513 | High | 7.2 | 2026-06-30 | The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.8.0 via parser-derived 'avatar' and 'url' au… |
CVE-2026-58377 | High | 8.1 | 2026-06-30 | JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and… |
CVE-2026-58376 | High | 7.6 | 2026-06-30 | Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database c… |
CVE-2026-58375 | High | 7.5 | 2026-06-30 | JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTo… |
CVE-2026-58372 | High | 8.1 | 2026-06-30 | SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write… |
CVE-2026-58370 | High | 8.1 | 2026-06-30 | Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from t… |
CVE-2026-58170 | High | 8.3 | 2026-06-30 | Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal identifier onto the broker proposals directory without sanitizat… |
CVE-2026-58169 | High | 7.5 | 2026-06-30 | Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by e… |
CVE-2026-58168 | High | 8.8 | 2026-06-30 | DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allo… |
CVE-2026-58165 | High | 8.8 | 2026-06-30 | OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained… |
CVE-2026-49451 | High | 7.5 | 2026-06-30 | The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents f… |
CVE-2026-48307 | High | 8.8 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerabil… |
CVE-2026-48285 | High | 8.6 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypa… |
CVE-2026-27957 | High | 8.8 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, an authenticated command injection… |
CVE-2026-8451 | High | 7.5 | 2026-06-30 | Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML I… |