High-severity CVEs (page 73)
Page 73 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34895 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions. |
CVE-2026-34894 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions. |
CVE-2026-34893 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions. |
CVE-2026-34888 | High | 7.5 | 2026-06-17 | Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions. |
CVE-2026-28615 | High | 7.8 | 2026-06-17 | In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with… |
CVE-2026-27400 | High | 8.6 | 2026-06-17 | Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions. |
CVE-2026-25439 | High | 8.1 | 2026-06-17 | Unauthenticated Broken Authentication in Booknetic <= 4.8.5 versions. |
CVE-2026-22343 | High | 8.6 | 2026-06-17 | Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions. |
CVE-2026-22342 | High | 8.8 | 2026-06-17 | Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions. |
CVE-2026-22339 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions. |
CVE-2026-22338 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions. |
CVE-2026-22335 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions. |
CVE-2026-22334 | High | 7.5 | 2026-06-17 | Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions. |
CVE-2026-22331 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions. |
CVE-2026-22330 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Right Way <= 4.0 versions. |
CVE-2026-22329 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions. |
CVE-2026-22328 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions. |
CVE-2026-22326 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions. |
CVE-2026-22325 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions. |
CVE-2026-12468 | High | 8.3 | 2026-06-17 | Race in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2026-12467 | High | 8.3 | 2026-06-17 | Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-12466 | High | 8.8 | 2026-06-17 | Heap buffer overflow in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page… |
CVE-2026-12465 | High | 8.3 | 2026-06-17 | Object lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-12464 | High | 8.3 | 2026-06-17 | Use after free in Browser in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-12462 | High | 7.5 | 2026-06-17 | Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execute arbitrary code i… |
CVE-2026-12455 | High | 7.5 | 2026-06-17 | Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gestures to potent… |
CVE-2026-12454 | High | 8.3 | 2026-06-17 | Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-12452 | High | 8.8 | 2026-06-17 | Use after free in Downloads in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2026-12451 | High | 8.3 | 2026-06-17 | Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-12449 | High | 7.8 | 2026-06-17 | Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to perform OS-level privilege escalation via a malici… |
CVE-2026-12448 | High | 8.8 | 2026-06-17 | Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to perform privilege escalation via a cra… |
CVE-2026-12447 | High | 8.8 | 2026-06-17 | Heap buffer overflow in WebRTC in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… |
CVE-2026-12445 | High | 7.5 | 2026-06-17 | Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2026-12443 | High | 8.8 | 2026-06-17 | Use after free in Web Authentication in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chr… |
CVE-2026-12442 | High | 8.8 | 2026-06-17 | Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (C… |
CVE-2026-12441 | High | 8.8 | 2026-06-17 | Use after free in File Input in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2026-12439 | High | 8.8 | 2026-06-17 | Use after free in Digital Credentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2026-12438 | High | 8.3 | 2026-06-17 | Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-12437 | High | 8.3 | 2026-06-17 | Use after free in WebShare in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentiall… |
CVE-2026-12360 | High | 7.5 | 2026-06-17 | The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a fi… |
CVE-2026-12256 | High | 8.8 | 2026-06-17 | Contributor PHP Object Injection in Avada <= 3.15.3 versions. |
CVE-2026-12199 | High | 7.5 | 2026-06-17 | A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in i… |
CVE-2026-12165 | High | 8.8 | 2026-06-17 | The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in all versions up to… |
CVE-2026-11410 | High | 7.2 | 2026-06-17 | An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR940N v6 due to improper sanitization of… |
CVE-2026-11409 | High | 7.2 | 2026-06-17 | An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input… |
CVE-2026-0092 | High | 7.8 | 2026-06-17 | In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with… |
CVE-2026-0083 | High | 7.0 | 2026-06-17 | In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no addition… |
CVE-2026-0082 | High | 7.8 | 2026-06-17 | In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could… |
CVE-2026-0081 | High | 7.8 | 2026-06-17 | In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escalation of privilege with no additional ex… |
CVE-2026-0071 | High | 7.8 | 2026-06-17 | In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additio… |
CVE-2026-0068 | High | 7.8 | 2026-06-17 | In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync… |
CVE-2026-0063 | High | 7.8 | 2026-06-17 | In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the code. This could lead… |
CVE-2026-0019 | High | 7.8 | 2026-06-17 | In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no… |
CVE-2025-69178 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions. |
CVE-2025-69177 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions. |
CVE-2025-69176 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in ITactics <= 1.0 versions. |
CVE-2025-69173 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions. |
CVE-2025-69172 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Resurs <= 1.3 versions. |
CVE-2025-69171 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions. |
CVE-2025-69168 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Spike <= 1.2 versions. |
CVE-2025-69167 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Eros <= 1.3 versions. |
CVE-2025-69165 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Choreo <= 1.6 versions. |
CVE-2025-69163 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in WineShop <= 3.17 versions. |
CVE-2025-69162 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Grecko <= 5.17 versions. |
CVE-2025-69161 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Snowy <= 1.13 versions. |
CVE-2025-69160 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gita <= 1.11 versions. |
CVE-2025-69159 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Printo <= 1.11 versions. |
CVE-2025-69151 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions. |
CVE-2025-69150 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Medeus <= 1.14 versions. |
CVE-2025-69149 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions. |
CVE-2025-69148 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Quirky <= 1.23 versions. |
CVE-2025-69147 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Putter <= 1.17 versions. |
CVE-2025-69146 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Dom <= 1.24 versions. |
CVE-2025-69145 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gat <= 1.16 versions. |
CVE-2025-69143 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Mission <= 1.22 versions. |
CVE-2025-69142 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Abelle <= 1.22 versions. |
CVE-2025-69141 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions. |
CVE-2025-69139 | High | 8.6 | 2026-06-17 | Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions. |
CVE-2025-69138 | High | 8.8 | 2026-06-17 | Subscriber Privilege Escalation in Genemy <= 1.6.6 versions. |
CVE-2025-69136 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions. |
CVE-2025-69135 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions. |
CVE-2025-69131 | High | 7.5 | 2026-06-17 | Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions. |
CVE-2025-69125 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions. |
CVE-2025-69124 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Especio <= 1.0 versions. |
CVE-2025-69121 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions. |
CVE-2025-69119 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions. |
CVE-2025-69118 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions. |
CVE-2025-69117 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions. |
CVE-2025-69116 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions. |
CVE-2025-69114 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions. |
CVE-2025-69113 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions. |
CVE-2025-69112 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions. |
CVE-2025-69110 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions. |
CVE-2025-69109 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions. |
CVE-2025-69107 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions. |
CVE-2025-69105 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions. |
CVE-2025-69104 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions. |
CVE-2025-69103 | High | 7.5 | 2026-06-17 | Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions. |
CVE-2025-60223 | High | 7.7 | 2026-06-17 | Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot <= 13.6.5 versions. |
CVE-2025-60085 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions. |