High-severity CVEs (page 65)
Page 65 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93753 | High | 7.5 | 2026-09-18 | deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target… |
CVE-2026-93752 | High | 7.5 | 2026-09-18 | CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers c… |
CVE-2026-93749 | High | 7.5 | 2026-09-18 | source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values… |
CVE-2026-93748 | High | 7.5 | 2026-09-18 | http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticat… |
CVE-2026-91127 | High | 8.2 | 2026-09-18 | File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1… |
CVE-2026-85058 | High | 7.5 | 2026-09-18 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers… |
CVE-2026-84975 | High | 7.4 | 2026-09-18 | PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuTLS backends in pjlib/src/pj/ssl_sock_os… |
CVE-2026-81180 | High | 8.8 | 2026-09-18 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose form… |
CVE-2026-81179 | High | 8.1 | 2026-09-18 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOS… |
CVE-2026-77396 | High | 7.1 | 2026-09-18 | PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c us… |
CVE-2026-69184 | High | 7.5 | 2026-09-18 | c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total poin… |
CVE-2026-62279 | High | 7.1 | 2026-09-18 | LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user could submit caller-con… |
CVE-2026-62278 | High | 8.1 | 2026-09-18 | LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could… |
CVE-2026-61552 | High | 7.2 | 2026-09-18 | Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into gen… |
CVE-2026-61551 | High | 8.6 | 2026-09-18 | Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth… |
CVE-2026-33625 | High | 8.8 | 2026-09-18 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `l… |
CVE-2026-32641 | High | 7.5 | 2026-09-18 | Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while pa… |
CVE-2026-93758 | High | 8.1 | 2026-09-18 | An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges… |
CVE-2026-93559 | High | 7.3 | 2026-09-18 | A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file ba… |
CVE-2026-91149 | High | 7.5 | 2026-09-18 | A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections t… |
CVE-2026-77301 | High | 7.5 | 2026-09-18 | adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directo… |
CVE-2026-77239 | High | 8.1 | 2026-09-18 | WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do no… |
CVE-2026-61833 | High | 8.1 | 2026-09-18 | zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication ha… |
CVE-2026-61672 | High | 7.1 | 2026-09-18 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied m… |
CVE-2026-61548 | High | 8.1 | 2026-09-18 | Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function in plugins/mmpstrucdat… |
CVE-2026-58197 | High | 8.8 | 2026-09-18 | ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0… |
CVE-2026-46655 | High | 7.8 | 2026-09-18 | virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submi… |
CVE-2026-93690 | High | 7.5 | 2026-09-18 | uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode… |
CVE-2026-93688 | High | 7.5 | 2026-09-18 | SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded trans… |
CVE-2026-93687 | High | 7.5 | 2026-09-18 | braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patt… |
CVE-2026-88259 | High | 7.5 | 2026-09-18 | CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to t… |
CVE-2026-86520 | High | 7.5 | 2026-09-18 | Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that… |
CVE-2026-84447 | High | 7.5 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same… |
CVE-2026-84446 | High | 7.5 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing… |
CVE-2026-84444 | High | 7.4 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image_tile() accepts an… |
CVE-2026-84398 | High | 7.5 | 2026-09-18 | CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affect… |
CVE-2026-84384 | High | 7.5 | 2026-09-18 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompre… |
CVE-2026-81944 | High | 7.5 | 2026-09-18 | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in th… |
CVE-2026-81942 | High | 8.8 | 2026-09-18 | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerabili… |
CVE-2026-7006 | High | 7.3 | 2026-09-18 | Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation vulnerability that allows un… |
CVE-2026-67549 | High | 7.6 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted… |
CVE-2026-63638 | High | 8.3 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0… |
CVE-2026-63422 | High | 7.8 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0… |
CVE-2026-63419 | High | 7.8 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0… |
CVE-2026-54148 | High | 8.1 | 2026-09-18 | http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest doe… |
CVE-2026-11381 | High | 8.8 | 2026-09-18 | IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribut… |
CVE-2026-11378 | High | 8.8 | 2026-09-18 | IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list… |
CVE-2026-11375 | High | 8.8 | 2026-09-18 | IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing… |
CVE-2026-10853 | High | 7.5 | 2026-09-18 | IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation… |
CVE-2026-10751 | High | 7.5 | 2026-09-18 | IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter byp… |
CVE-2026-10744 | High | 7.5 | 2026-09-18 | IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to an i… |
CVE-2026-10575 | High | 8.8 | 2026-09-18 | IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQPU… |
CVE-2026-10030 | High | 7.1 | 2026-09-18 | IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks. |
CVE-2026-10027 | High | 8.1 | 2026-09-18 | IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data… |
CVE-2025-61682 | High | 8.6 | 2026-09-18 | Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and p… |
CVE-2025-14754 | High | 8.8 | 2026-09-18 | IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation… |
CVE-2025-14753 | High | 7.5 | 2026-09-18 | IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request contai… |
CVE-2026-93659 | High | 8.1 | 2026-09-18 | Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers c… |
CVE-2026-93658 | High | 7.0 | 2026-09-18 | uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to l… |
CVE-2026-93657 | High | 7.5 | 2026-09-18 | hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing inv… |
CVE-2026-93652 | High | 7.5 | 2026-09-18 | Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowing remote attackers to reliably cause DoS |
CVE-2026-93576 | High | 7.5 | 2026-09-18 | A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-nam… |
CVE-2026-93569 | High | 8.2 | 2026-09-18 | A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request… |
CVE-2026-93568 | High | 7.5 | 2026-09-18 | A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's… |
CVE-2026-93567 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONN… |
CVE-2026-93565 | High | 7.5 | 2026-09-18 | A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming… |
CVE-2026-93564 | High | 7.5 | 2026-09-18 | A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted P… |
CVE-2026-93558 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to… |
CVE-2026-77929 | High | 8.8 | 2026-09-18 | ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file w… |
CVE-2026-93604 | High | 7.2 | 2026-09-18 | vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM (… |
CVE-2026-93599 | High | 7.5 | 2026-09-18 | rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input gu… |
CVE-2026-93597 | High | 7.7 | 2026-09-18 | ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attacke… |
CVE-2026-93594 | High | 8.1 | 2026-09-18 | ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file… |
CVE-2026-93593 | High | 8.1 | 2026-09-18 | ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but… |
CVE-2026-93592 | High | 7.5 | 2026-09-18 | vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to c… |
CVE-2026-93591 | High | 7.6 | 2026-09-18 | SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string l… |
CVE-2026-93560 | High | 7.5 | 2026-09-18 | A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum inte… |
CVE-2026-88623 | High | 7.5 | 2026-09-18 | NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen() is… |
CVE-2026-88622 | High | 8.8 | 2026-09-18 | NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php. |
CVE-2023-5778 | High | 7.5 | 2026-09-18 | Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC8… |
CVE-2026-93491 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single conn… |
CVE-2026-93488 | High | 7.5 | 2026-09-18 | A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Int… |
CVE-2026-28198 | High | 8.8 | 2026-09-18 | An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a p… |
CVE-2026-28197 | High | 8.8 | 2026-09-18 | An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administra… |
CVE-2026-93575 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet… |
CVE-2026-93572 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP)… |
CVE-2026-93563 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit th… |
CVE-2026-81627 | High | 8.2 | 2026-09-18 | A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A pr… |
CVE-2026-87915 | High | 7.2 | 2026-09-18 | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scri… |
CVE-2026-87743 | High | 7.5 | 2026-09-18 | A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and H… |
CVE-2026-18405 | High | 7.2 | 2026-09-18 | The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-85410 | High | 8.1 | 2026-09-18 | The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerabl… |
CVE-2026-83561 | High | 7.2 | 2026-09-18 | The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocke… |
CVE-2026-6205 | High | 8.1 | 2026-09-18 | An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4… |
CVE-2026-40539 | High | 7.1 | 2026-09-18 | An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allo… |
CVE-2026-40530 | High | 8.0 | 2026-09-18 | An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72… |
CVE-2026-13673 | High | 8.8 | 2026-09-18 | An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9… |
CVE-2026-93494 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body wi… |
CVE-2026-89059 | High | 7.5 | 2026-09-18 | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensi… |
CVE-2026-89058 | High | 7.4 | 2026-09-18 | A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-A… |