High-severity CVEs (page 66)
Page 66 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9785 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-9784 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-9783 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2026-9782 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-9781 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-9780 | High | 8.8 | 2026-06-25 | Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication… |
CVE-2026-7570 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-7569 | High | 8.8 | 2026-06-25 | Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication… |
CVE-2026-39951 | High | 7.6 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a Stored SQL Injection vulnerability through graph_name_rege… |
CVE-2025-60474 | High | 7.5 | 2026-06-24 | A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Servi… |
CVE-2025-60467 | High | 7.5 | 2026-06-24 | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to caus… |
CVE-2026-9779 | High | 7.2 | 2026-06-24 | ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability. This vulnerability allows remote attac… |
CVE-2026-9778 | High | 7.2 | 2026-06-24 | ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-9777 | High | 7.2 | 2026-06-24 | ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2026-9776 | High | 7.5 | 2026-06-24 | ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sen… |
CVE-2026-9773 | High | 8.8 | 2026-06-24 | Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af… |
CVE-2026-9772 | High | 8.8 | 2026-06-24 | Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2026-55762 | High | 8.1 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, the POST /ap… |
CVE-2026-55759 | High | 7.4 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, Rocket.Chat'… |
CVE-2026-54070 | High | 7.1 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README f… |
CVE-2026-54066 | High | 7.5 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitize… |
CVE-2026-52794 | High | 7.5 | 2026-06-24 | Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in S… |
CVE-2026-50189 | High | 7.2 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port… |
CVE-2026-2050 | High | 7.8 | 2026-06-24 | GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-10043 | High | 7.8 | 2026-06-24 | MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-52808 | High | 7.1 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, three API endpoints — PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:own… |
CVE-2026-52805 | High | 8.7 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery (SSRF) vulnerability exists in the repository migration function… |
CVE-2026-52801 | High | 8.1 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New… |
CVE-2026-52800 | High | 8.8 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection… |
CVE-2026-52799 | High | 7.5 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, GET /attachments/:uuid returns the raw attachment file without verifying whether the requester… |
CVE-2026-52798 | High | 8.9 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, although .ipynb previews are sanitized on the server side via /-/api/sanitize_ipynb, the inser… |
CVE-2026-52797 | High | 8.5 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.0, as an authorized user, an intruder can dictate the value which is passed to the git diff comma… |
CVE-2026-50129 | High | 7.5 | 2026-06-24 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.11, 4.4.18, and 4.3.24, a DoS can be triggered by (Uncaught Exception… |
CVE-2026-47267 | High | 8.3 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostnam… |
CVE-2026-45687 | High | 8.5 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rock… |
CVE-2026-33235 | High | 7.7 | 2026-06-24 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions prior to 0.6.52, the Fil… |
CVE-2026-1840 | High | 7.5 | 2026-06-24 | The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical system functions. This… |
CVE-2026-13201 | High | 7.3 | 2026-06-24 | A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path… |
CVE-2026-11998 | High | 7.6 | 2026-06-24 | A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execut… |
CVE-2026-55583 | High | 7.6 | 2026-06-24 | Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was vulnerable to a cross-workspace insecure direct object ref… |
CVE-2026-47389 | High | 8.6 | 2026-06-24 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, Priva… |
CVE-2026-23879 | High | 8.0 | 2026-06-24 | py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Versions 1.1.2 and below contain an… |
CVE-2026-53950 | High | 7.5 | 2026-06-24 | @tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts… |
CVE-2026-49247 | High | 8.8 | 2026-06-24 | Jellyfin is an open source self hosted media server. From 10.9.0 until 10.11.10, the POST /ClientLog/Document endpoint accepts the Authorization header's Clien… |
CVE-2026-48793 | High | 8.8 | 2026-06-24 | Jellyfin is an open source self hosted media server. Prior to 10.11.10, a potential FFmpeg argument injection vulnerability exists in the subtitle conversion c… |
CVE-2026-13038 | High | 8.8 | 2026-06-24 | Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Ch… |
CVE-2026-13037 | High | 7.8 | 2026-06-24 | Use after free in WebView in Google Chrome on Android prior to 149.0.7827.197 allowed a local attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-13036 | High | 8.8 | 2026-06-24 | Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-13035 | High | 8.8 | 2026-06-24 | Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a malicious peripheral. (Ch… |
CVE-2026-13033 | High | 8.8 | 2026-06-24 | Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted… |
CVE-2026-13031 | High | 8.8 | 2026-06-24 | Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-13029 | High | 7.5 | 2026-06-24 | Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker who convinced a user to install a malicious extension to pote… |
CVE-2026-13027 | High | 8.8 | 2026-06-24 | Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-13026 | High | 8.8 | 2026-06-24 | Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a cr… |
CVE-2026-13025 | High | 8.3 | 2026-06-24 | Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox e… |
CVE-2026-54699 | High | 7.7 | 2026-06-24 | Warp is an agentic development environment. From 0.2024.03.12.08.02.stable_01 until 0.2026.05.06.15.42.stable_01, Warp contains an OS command injection vulnera… |
CVE-2026-49851 | High | 7.5 | 2026-06-24 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately… |
CVE-2026-48732 | High | 8.8 | 2026-06-24 | Warp is an agentic development environment. From 0.2023.03.21.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection issue in th… |
CVE-2026-48731 | High | 7.8 | 2026-06-24 | Warp is an agentic development environment. From 0.2024.02.20.08.01.stable_01 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection issue in th… |
CVE-2026-48725 | High | 8.1 | 2026-06-24 | Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15.42.stable_01, Warp allows terminal output to request access… |
CVE-2026-48721 | High | 8.6 | 2026-06-24 | Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution permission-… |
CVE-2026-48720 | High | 8.8 | 2026-06-24 | Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepts non-inline `OSC 1337;File` paylo… |
CVE-2026-48719 | High | 8.0 | 2026-06-24 | Warp is an agentic development environment. From 0.2025.08.06.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection in the prom… |
CVE-2026-48704 | High | 8.8 | 2026-06-24 | Warp is an agentic development environment. From 0.2023.10.24.08.03.stable_00 until 0.2026.05.06.15.42.stable_01, Warp may open executable local files through… |
CVE-2026-48703 | High | 7.8 | 2026-06-24 | Warp is an agentic development environment. From 0.2025.04.09.08.11.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution policy bypa… |
CVE-2026-44020 | High | 7.5 | 2026-06-24 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, the US… |
CVE-2026-44017 | High | 7.5 | 2026-06-24 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.91.0, the EasyOCR mod… |
CVE-2026-44016 | High | 8.2 | 2026-06-24 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. FIn versions >= 2.82.0, < 2.91.0… |
CVE-2026-54904 | High | 7.5 | 2026-06-24 | concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update can enter a permanent busy retry loop when the curre… |
CVE-2026-54297 | High | 7.5 | 2026-06-24 | Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedPar… |
CVE-2026-53130 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START omfs_fill_super() rejects ove… |
CVE-2026-53129 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: fs/mbcache: cancel shrink work before destroying the cache mb_cache_destroy() calls shrin… |
CVE-2026-53120 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: PCI: use generic driver_override infrastructure When a driver is probed through __driver_… |
CVE-2026-53119 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: platform/wmi: use generic driver_override infrastructure When a driver is probed through… |
CVE-2026-53118 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: vdpa: use generic driver_override infrastructure When a driver is probed through __driver… |
CVE-2026-53117 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: s390/cio: use generic driver_override infrastructure When a driver is probed through __dr… |
CVE-2026-53116 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: s390/ap: use generic driver_override infrastructure When the AP masks are updated via apm… |
CVE-2026-53115 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: use generic driver_override infrastructure When a driver is probed through _… |
CVE-2026-53112 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_taskl… |
CVE-2026-53110 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Zero-extend bpf prog return values and kfunc arguments s390x ABI requires calle… |
CVE-2026-53109 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy powerpc uses pt_frag_refcoun… |
CVE-2026-53098 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() When the mt7915 pci… |
CVE-2026-53097 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() When the mt7996 pci… |
CVE-2026-53096 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path The DEVMAP_HASH branch i… |
CVE-2026-53094 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stale offload->prog pointer after constant blinding When a dev-bound-only BPF pr… |
CVE-2026-53092 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix linked reg delta tracking when src_reg == dst_reg Consider the case of rX += rX… |
CVE-2026-53091 | High | 8.4 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net: pull headers in qdisc_pkt_len_segs_init() Most ndo_start_xmit() methods expects head… |
CVE-2026-53090 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ld_{abs,ind} failure path analysis in subprogs Usage of ld_{abs,ind} instruction… |
CVE-2026-53089 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in offloaded map/prog info fill When querying info for an offload… |
CVE-2026-53087 | High | 7.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix leaking free_bds While reclaiming the tx queue we fast forward the wri… |
CVE-2026-53085 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: fix mm lifecycle in open-coded task_vma iterator The open-coded task_vma iterator re… |
CVE-2026-53081 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars When regsafe() compare… |
CVE-2026-53078 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops When a BPF sock_ops… |
CVE-2026-53077 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net/rds: Restrict use of RDS/IB to the initial network namespace Prevent using RDS/IB in… |
CVE-2026-53076 | High | 7.1 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix OOB in pcpu_init_value An out-of-bounds read occurs when copying element from a … |
CVE-2026-53075 | High | 8.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is current… |
CVE-2026-53072 | High | 8.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER When protocol sets… |
CVE-2026-53071 | High | 8.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp(… |
CVE-2026-53070 | High | 7.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udp_tunnel_xmit_skb() udp_tunnel_xmit_skb() / udp_tunnel6… |
CVE-2026-53069 | High | 7.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master syzkaller reported… |