High-severity CVEs (page 70)
Page 70 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56345 | High | 8.1 | 2026-06-20 | AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives the target users_id… |
CVE-2026-56341 | High | 7.5 | 2026-06-20 | AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens… |
CVE-2026-56340 | High | 8.8 | 2026-06-20 | vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant… |
CVE-2020-37255 | High | 7.5 | 2026-06-20 | WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by se… |
CVE-2026-11912 | High | 7.5 | 2026-06-20 | The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and incl… |
CVE-2026-11911 | High | 7.5 | 2026-06-20 | The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in… |
CVE-2026-9843 | High | 8.1 | 2026-06-20 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validatio… |
CVE-2026-56216 | High | 8.8 | 2026-06-20 | Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows app-limited API keys to mint unrestricted… |
CVE-2026-56215 | High | 8.3 | 2026-06-20 | Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts… |
CVE-2026-56214 | High | 7.5 | 2026-06-20 | Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org and is_paying_org that allows unauthent… |
CVE-2026-56082 | High | 7.5 | 2026-06-19 | Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.record_build_time… |
CVE-2026-50559 | High | 7.5 | 2026-06-19 | Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus… |
CVE-2026-49346 | High | 7.1 | 2026-06-19 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-bit bit… |
CVE-2026-49295 | High | 7.1 | 2026-06-19 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write i… |
CVE-2026-47645 | High | 8.8 | 2026-06-19 | Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a netwo… |
CVE-2026-32208 | High | 8.8 | 2026-06-19 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Entra ID allows an authorized attacker to perform spoofing ov… |
CVE-2026-48774 | High | 7.5 | 2026-06-19 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 through 3.0.8, ProxySQL's GenAI/MCP `run_sql_readonly` tool violates its… |
CVE-2026-48715 | High | 8.8 | 2026-06-19 | radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route… |
CVE-2026-49340 | High | 8.1 | 2026-06-19 | gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in `ServeCreateOrUpdatePlaylist` a… |
CVE-2026-49339 | High | 7.1 | 2026-06-19 | gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410… |
CVE-2026-49338 | High | 7.1 | 2026-06-19 | gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist… |
CVE-2026-49293 | High | 7.5 | 2026-06-19 | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 parse hexadecimal / octal / binary intege… |
CVE-2026-49291 | High | 8.1 | 2026-06-19 | mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read… |
CVE-2023-54357 | High | 7.5 | 2026-06-19 | Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploit… |
CVE-2026-49287 | High | 7.4 | 2026-06-19 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It addressed the… |
CVE-2026-49286 | High | 8.1 | 2026-06-19 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output file… |
CVE-2019-25762 | High | 7.5 | 2026-06-19 | Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by e… |
CVE-2019-25761 | High | 7.1 | 2026-06-19 | Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malic… |
CVE-2019-25759 | High | 7.1 | 2026-06-19 | Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2019-25758 | High | 8.8 | 2026-06-19 | Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submittin… |
CVE-2019-25757 | High | 7.1 | 2026-06-19 | Joomla vWishlist 1.0.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2019-25756 | High | 8.2 | 2026-06-19 | Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting ma… |
CVE-2019-25755 | High | 8.2 | 2026-06-19 | Joomla Component vReview 1.9.11 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mal… |
CVE-2019-25754 | High | 8.2 | 2026-06-19 | Joomla Component vRestaurant 1.9.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting… |
CVE-2019-25753 | High | 8.2 | 2026-06-19 | Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malici… |
CVE-2019-25752 | High | 8.2 | 2026-06-19 | Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by i… |
CVE-2019-25751 | High | 8.2 | 2026-06-19 | Joomla Component J-ClassifiedsManager 3.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by i… |
CVE-2019-25750 | High | 8.2 | 2026-06-19 | Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL querie… |
CVE-2019-25749 | High | 7.1 | 2026-06-19 | Joomla J-CruisePortal 6.0.4 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious… |
CVE-2026-56211 | High | 7.1 | 2026-06-19 | A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Sca… |
CVE-2026-56210 | High | 7.1 | 2026-06-19 | A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding… |
CVE-2026-56209 | High | 7.1 | 2026-06-19 | An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding)… |
CVE-2026-56208 | High | 7.6 | 2026-06-19 | A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode… |
CVE-2026-49260 | High | 8.2 | 2026-06-19 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.5.1, `pontedilana/php-weasyprint` builds the shell comman… |
CVE-2026-3195 | High | 7.4 | 2026-06-19 | A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov c… |
CVE-2019-25748 | High | 8.2 | 2026-06-19 | Joomla JHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mali… |
CVE-2017-20282 | High | 8.2 | 2026-06-19 | Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by inject… |
CVE-2017-20281 | High | 8.2 | 2026-06-19 | Joomla! Component Extra Search 2.2.8 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting… |
CVE-2017-20280 | High | 8.2 | 2026-06-19 | Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQ… |
CVE-2017-20279 | High | 8.2 | 2026-06-19 | Joomla Payage 2.05 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through t… |
CVE-2017-20278 | High | 8.2 | 2026-06-19 | Joomla Component JoomRecipe 1.0.3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL… |
CVE-2017-20277 | High | 8.2 | 2026-06-19 | Joomla JoomRecipe 1.0.4 component contains a blind SQL injection vulnerability in the search_author parameter on the search results page. Attackers can inject… |
CVE-2017-20276 | High | 8.2 | 2026-06-19 | Joomla! Component SIMGenealogy 2.1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting… |
CVE-2017-20275 | High | 8.2 | 2026-06-19 | Joomla! Component PHP-Bridge 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting… |
CVE-2017-20274 | High | 8.2 | 2026-06-19 | Joomla LMS King Professional 3.2.4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting… |
CVE-2017-20273 | High | 8.2 | 2026-06-19 | Joomla Event Registration Pro Calendar 4.1.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by… |
CVE-2017-20272 | High | 8.2 | 2026-06-19 | Joomla Ultimate Property Listing 1.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by inject… |
CVE-2017-20271 | High | 8.2 | 2026-06-19 | Joomla StreetGuessr Game 1.1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mali… |
CVE-2017-20270 | High | 8.2 | 2026-06-19 | Joomla! Component Twitch Tv 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mal… |
CVE-2017-20269 | High | 8.2 | 2026-06-19 | Joomla! Component KissGallery 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the component… |
CVE-2017-20268 | High | 8.2 | 2026-06-19 | Joomla! Component Zap Calendar Lite 4.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by inj… |
CVE-2017-20267 | High | 8.2 | 2026-06-19 | Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the categ… |
CVE-2017-20266 | High | 8.2 | 2026-06-19 | Joomla SP Movie Database 1.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malici… |
CVE-2017-20265 | High | 7.1 | 2026-06-19 | Joomla! Component Flip Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mal… |
CVE-2017-20264 | High | 7.1 | 2026-06-19 | Joomla! Component Sponsor Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting… |
CVE-2017-20263 | High | 8.2 | 2026-06-19 | Joomla! Component FocalPoint Pro/Free 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by i… |
CVE-2017-20262 | High | 8.2 | 2026-06-19 | Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mal… |
CVE-2017-20261 | High | 8.2 | 2026-06-19 | Joomla! Component Bargain Product VM3 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by inj… |
CVE-2017-20260 | High | 8.2 | 2026-06-19 | Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting… |
CVE-2017-20259 | High | 8.2 | 2026-06-19 | Joomla OSDownloads 1.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious… |
CVE-2017-20258 | High | 8.2 | 2026-06-19 | Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries… |
CVE-2017-20257 | High | 8.2 | 2026-06-19 | Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the… |
CVE-2017-20256 | High | 8.2 | 2026-06-19 | Joomla Survey Force Deluxe 3.2.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting ma… |
CVE-2017-20255 | High | 8.2 | 2026-06-19 | Joomla! Component JB Visa 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malic… |
CVE-2017-20254 | High | 8.2 | 2026-06-19 | Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting ma… |
CVE-2017-20253 | High | 8.2 | 2026-06-19 | Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting m… |
CVE-2017-20252 | High | 8.2 | 2026-06-19 | Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the plname… |
CVE-2026-52910 | High | 7.8 | 2026-06-19 | In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period. Eulgyu Kim reported the splat below… |
CVE-2026-52909 | High | 7.8 | 2026-06-19 | In the Linux kernel, the following vulnerability has been resolved: ip6_vti: set netns_immutable on the fallback device. john1988 and Noam Rathaus reported t… |
CVE-2026-52908 | High | 7.8 | 2026-06-19 | In the Linux kernel, the following vulnerability has been resolved: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible If IB_MR_REREG_ACCESS change… |
CVE-2025-71326 | High | 7.8 | 2026-06-19 | AVAST Antivirus 25.11 contains an unquoted service path vulnerability in the SecureLine service that allows local non-privileged users to execute code with ele… |
CVE-2023-54353 | High | 7.8 | 2026-06-19 | Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that allows local attackers to execute arbitrary code by placin… |
CVE-2022-50971 | High | 7.8 | 2026-06-19 | Malwarebytes 4.5 contains an unquoted service path vulnerability in the MBAMService executable that allows local attackers to escalate privileges by injecting… |
CVE-2021-47985 | High | 7.8 | 2026-06-19 | Brother SAPSprint 7.60 contains an unquoted service path vulnerability in the SAPSprint service binary that allows local attackers to escalate privileges. Atta… |
CVE-2020-37254 | High | 7.8 | 2026-06-19 | Wondershare PDFelement 5.2.9 contains a privilege escalation vulnerability due to an unquoted service path in the WsAppService Windows service. Local attackers… |
CVE-2020-37253 | High | 7.8 | 2026-06-19 | Winstep 18.06.0096 contains an unquoted service path vulnerability in the Winstep Xtreme Service that allows local attackers to escalate privileges. Attackers… |
CVE-2020-37252 | High | 7.8 | 2026-06-19 | Realtek Audio Service 1.0.0.55 contains an unquoted service path vulnerability in RtkAudioService64.exe that allows local attackers to escalate privileges by i… |
CVE-2020-37251 | High | 7.8 | 2026-06-19 | RealTimes Desktop Service 18.1.4 contains an unquoted service path vulnerability in the rpdsvc.exe binary that allows local attackers to escalate privileges. A… |
CVE-2020-37250 | High | 7.8 | 2026-06-19 | TFTP Broadband 4.3.0.1465 contains an unquoted service path vulnerability in the tftpt.exe service binary that allows local attackers to execute arbitrary code… |
CVE-2019-25747 | High | 7.8 | 2026-06-19 | Network Inventory Advisor 5.0.26.0 installs the niaservice service with an unquoted binary path that allows local attackers to escalate privileges by placing m… |
CVE-2016-20095 | High | 7.8 | 2026-06-19 | Matrix42 Remote Control Host 3.20.0031 contains an unquoted service path vulnerability in the FastViewerRemoteService and FastViewerRemoteProxy services that a… |
CVE-2016-20094 | High | 7.8 | 2026-06-19 | AnyDesk 2.5.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the servic… |
CVE-2016-20093 | High | 7.8 | 2026-06-19 | Wise Care 365 4.27 and Wise Disk Cleaner 9.29 contain unquoted service path vulnerabilities in the WiseBootAssistant and SpyHunter 4 Service respectively, allo… |
CVE-2016-20092 | High | 7.8 | 2026-06-19 | NetDrive 2.6.12 contains an unquoted service path vulnerability in the Netdrive2_Service_Netdrive2 service that allows local users to execute arbitrary code wi… |
CVE-2016-20091 | High | 7.8 | 2026-06-19 | Windows Firewall Control 4.8.6.0 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by inserting malicious exec… |
CVE-2016-20090 | High | 7.8 | 2026-06-19 | Comodo Dragon Browser versions up to 52.15.25.663 contain a privilege escalation vulnerability in the DragonUpdater service due to an unquoted service path run… |
CVE-2016-20089 | High | 7.8 | 2026-06-19 | Iperius Remote 1.7.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the… |
CVE-2016-20088 | High | 7.8 | 2026-06-19 | Comodo Chromodo Browser 52.15.25.664 contains an unquoted service path vulnerability in the ChromodoUpdater service that runs with SYSTEM privileges. A local a… |
CVE-2016-20087 | High | 7.8 | 2026-06-19 | Fortitude HTTP 1.0.4.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated privileges by exploiting… |
CVE-2016-20086 | High | 7.8 | 2026-06-19 | Vembu StoreGrid 4.0 contains an unquoted service path vulnerability in the RemoteBackup and RemoteBackup_webServer services that allows local attackers to esca… |