High-severity CVEs (page 80)
Page 80 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-92009 | High | 8.8 | 2026-09-15 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115… |
CVE-2026-92008 | High | 8.8 | 2026-09-15 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115… |
CVE-2026-92007 | High | 8.8 | 2026-09-15 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115… |
CVE-2026-92006 | High | 8.8 | 2026-09-15 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115… |
CVE-2026-14805 | High | 8.8 | 2026-09-15 | The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (… |
CVE-2026-91996 | High | 7.5 | 2026-09-15 | lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system… |
CVE-2026-91925 | High | 8.8 | 2026-09-15 | Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticate… |
CVE-2026-91924 | High | 8.5 | 2026-09-15 | pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary d… |
CVE-2026-91923 | High | 7.7 | 2026-09-15 | KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-suppl… |
CVE-2026-57137 | High | 8.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generate… |
CVE-2026-57136 | High | 8.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the f… |
CVE-2026-57135 | High | 7.6 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts… |
CVE-2026-57134 | High | 8.2 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured cr… |
CVE-2026-57133 | High | 8.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell() helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the f… |
CVE-2026-57112 | High | 8.3 | 2026-09-15 | PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-a… |
CVE-2026-1758 | High | 8.3 | 2026-09-15 | Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. … |
CVE-2026-45048 | High | 8.5 | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ow… |
CVE-2026-19515 | High | 7.0 | 2026-09-15 | The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untru… |
CVE-2026-80217 | High | 8.8 | 2026-09-15 | Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to ex… |
CVE-2026-77853 | High | 8.8 | 2026-09-15 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in t… |
CVE-2026-75092 | High | 7.3 | 2026-09-15 | A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the… |
CVE-2026-91087 | High | 7.3 | 2026-09-15 | A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Co… |
CVE-2026-75983 | High | 7.5 | 2026-09-15 | The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, an… |
CVE-2026-91004 | High | 7.3 | 2026-09-15 | A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete_faculty1… |
CVE-2026-90880 | High | 7.4 | 2026-09-15 | A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of t… |
CVE-2026-90879 | High | 7.3 | 2026-09-15 | A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Pu… |
CVE-2026-90877 | High | 7.3 | 2026-09-15 | A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requi… |
CVE-2026-90876 | High | 7.3 | 2026-09-15 | A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /d… |
CVE-2026-90858 | High | 7.3 | 2026-09-15 | A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the fun… |
CVE-2026-90856 | High | 7.3 | 2026-09-15 | A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts an unknown function of the file signup.p… |
CVE-2026-90855 | High | 7.3 | 2026-09-15 | A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown function of the file /web/order.php. Thi… |
CVE-2026-90854 | High | 7.3 | 2026-09-15 | A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /we… |
CVE-2026-90852 | High | 7.3 | 2026-09-15 | A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.j… |
CVE-2026-91771 | High | 8.8 | 2026-09-15 | Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Atta… |
CVE-2026-90849 | High | 7.3 | 2026-09-15 | A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown function… |
CVE-2026-91752 | High | 7.5 | 2026-09-15 | GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array… |
CVE-2026-91751 | High | 8.3 | 2026-09-15 | Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or… |
CVE-2026-90846 | High | 7.3 | 2026-09-15 | A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manip… |
CVE-2026-90844 | High | 7.3 | 2026-09-15 | A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the compone… |
CVE-2026-90843 | High | 8.3 | 2026-09-15 | A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the function nmap_newscan of t… |
CVE-2026-90841 | High | 7.3 | 2026-09-15 | A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ap… |
CVE-2026-90840 | High | 7.3 | 2026-09-15 | A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of the file /application/controllers/admin… |
CVE-2026-91200 | High | 8.8 | 2026-09-14 | DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can… |
CVE-2026-91145 | High | 7.1 | 2026-09-14 | Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers… |
CVE-2026-91144 | High | 7.5 | 2026-09-14 | ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can… |
CVE-2026-91143 | High | 7.2 | 2026-09-14 | goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requireme… |
CVE-2026-12756 | High | 7.1 | 2026-09-14 | IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote a… |
CVE-2026-90819 | High | 7.3 | 2026-09-14 | A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file s… |
CVE-2026-86917 | High | 7.8 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may b… |
CVE-2026-86904 | High | 7.5 | 2026-09-14 | A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be… |
CVE-2026-86901 | High | 7.1 | 2026-09-14 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT vol… |
CVE-2026-86895 | High | 7.5 | 2026-09-14 | An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. A… |
CVE-2026-86894 | High | 7.5 | 2026-09-14 | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox. |
CVE-2026-84632 | High | 7.3 | 2026-09-14 | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequo… |
CVE-2026-84631 | High | 7.8 | 2026-09-14 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to gain root privileges. |
CVE-2026-84629 | High | 7.5 | 2026-09-14 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able… |
CVE-2026-84623 | High | 7.5 | 2026-09-14 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An app may be able… |
CVE-2026-84620 | High | 7.3 | 2026-09-14 | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27… |
CVE-2026-84611 | High | 7.3 | 2026-09-14 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden G… |
CVE-2026-84607 | High | 7.8 | 2026-09-14 | A race condition was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, mac… |
CVE-2026-84606 | High | 7.5 | 2026-09-14 | A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may… |
CVE-2026-84598 | High | 7.5 | 2026-09-14 | A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with phy… |
CVE-2026-84584 | High | 8.4 | 2026-09-14 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox. |
CVE-2026-84581 | High | 8.4 | 2026-09-14 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a ma… |
CVE-2026-84580 | High | 8.4 | 2026-09-14 | The issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to break ou… |
CVE-2026-84578 | High | 8.8 | 2026-09-14 | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to brea… |
CVE-2026-84577 | High | 8.2 | 2026-09-14 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7. An app may be able to bypass… |
CVE-2026-84575 | High | 7.8 | 2026-09-14 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8… |
CVE-2026-84572 | High | 7.1 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app ma… |
CVE-2026-84568 | High | 7.8 | 2026-09-14 | A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attac… |
CVE-2026-84566 | High | 7.8 | 2026-09-14 | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequo… |
CVE-2026-84565 | High | 7.1 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processin… |
CVE-2026-84563 | High | 7.5 | 2026-09-14 | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to caus… |
CVE-2026-84553 | High | 7.5 | 2026-09-14 | A resource exhaustion issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A… |
CVE-2026-84549 | High | 7.5 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connectin… |
CVE-2026-84548 | High | 7.1 | 2026-09-14 | An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing… |
CVE-2026-84546 | High | 8.4 | 2026-09-14 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden G… |
CVE-2026-84544 | High | 7.5 | 2026-09-14 | An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting… |
CVE-2026-84543 | High | 7.5 | 2026-09-14 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. C… |
CVE-2026-84535 | High | 8.2 | 2026-09-14 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app… |
CVE-2026-84516 | High | 8.1 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processin… |
CVE-2026-84515 | High | 7.8 | 2026-09-14 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Co… |
CVE-2026-84512 | High | 8.8 | 2026-09-14 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a ma… |
CVE-2026-84511 | High | 7.8 | 2026-09-14 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8… |
CVE-2026-84507 | High | 7.8 | 2026-09-14 | A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS… |
CVE-2026-84506 | High | 7.8 | 2026-09-14 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app… |
CVE-2026-84505 | High | 7.8 | 2026-09-14 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An… |
CVE-2026-84497 | High | 7.8 | 2026-09-14 | A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, mac… |
CVE-2026-81902 | High | 8.1 | 2026-09-14 | Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attacker could craft a r… |
CVE-2026-81901 | High | 8.7 | 2026-09-14 | In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-typ… |
CVE-2026-65415 | High | 8.1 | 2026-09-14 | A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27… |
CVE-2026-65410 | High | 7.5 | 2026-09-14 | The issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tv… |
CVE-2026-65398 | High | 7.8 | 2026-09-14 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS… |
CVE-2026-65391 | High | 8.8 | 2026-09-14 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6… |
CVE-2026-65390 | High | 8.8 | 2026-09-14 | An integer overflow was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS… |
CVE-2026-65378 | High | 7.5 | 2026-09-14 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app… |
CVE-2026-65375 | High | 7.5 | 2026-09-14 | The issue was addressed with improved authentication. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.6. An app may be able to… |
CVE-2026-65374 | High | 8.8 | 2026-09-14 | A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting… |
CVE-2026-65364 | High | 7.5 | 2026-09-14 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote… |
CVE-2026-65362 | High | 7.8 | 2026-09-14 | This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain ro… |