High-severity CVEs (page 82)
Page 82 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-90949 | High | 7.8 | 2026-09-14 | A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mi… |
CVE-2026-90948 | High | 7.8 | 2026-09-14 | A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation… |
CVE-2026-90787 | High | 7.3 | 2026-09-14 | A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of… |
CVE-2026-73236 | High | 7.5 | 2026-09-14 | Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix match… |
CVE-2026-73195 | High | 7.3 | 2026-09-14 | Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own pla… |
CVE-2026-90938 | High | 8.6 | 2026-09-14 | LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated… |
CVE-2026-90933 | High | 7.1 | 2026-09-14 | laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overw… |
CVE-2026-90932 | High | 7.2 | 2026-09-14 | LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService… |
CVE-2026-90929 | High | 8.1 | 2026-09-14 | File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go)… |
CVE-2026-90715 | High | 7.3 | 2026-09-14 | A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity_json.c of the co… |
CVE-2026-78336 | High | 7.5 | 2026-09-14 | Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers… |
CVE-2026-73178 | High | 7.5 | 2026-09-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can get access via RES… |
CVE-2024-58383 | High | 7.3 | 2026-09-14 | Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/… |
CVE-2026-90710 | High | 7.3 | 2026-09-14 | A vulnerability was determined in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of the file com/tarzan/cms/modules/admin/service/biz/… |
CVE-2026-90708 | High | 7.3 | 2026-09-14 | A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Hand… |
CVE-2026-90707 | High | 8.3 | 2026-09-14 | A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf_nnrf_try_old_amf_discovery_fallback of the file src/amf/nnrf-handler.c… |
CVE-2026-8821 | High | 7.1 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during play… |
CVE-2026-89180 | High | 7.5 | 2026-09-14 | EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands… |
CVE-2026-87779 | High | 7.5 | 2026-09-14 | Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length (not 16/24/32 bytes) is configured, Sy… |
CVE-2026-90894 | High | 7.8 | 2026-09-14 | Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accept… |
CVE-2026-90701 | High | 7.3 | 2026-09-14 | A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is an unknown… |
CVE-2026-72524 | High | 8.8 | 2026-09-14 | Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized… |
CVE-2026-90691 | High | 8.3 | 2026-09-14 | A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is the function FileOpera… |
CVE-2026-90690 | High | 7.3 | 2026-09-14 | A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of t… |
CVE-2026-90689 | High | 8.8 | 2026-09-14 | A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation of… |
CVE-2026-82794 | High | 8.8 | 2026-09-14 | SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OS command may be ex… |
CVE-2026-82793 | High | 7.2 | 2026-09-14 | Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is… |
CVE-2026-82791 | High | 8.8 | 2026-09-14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Con… |
CVE-2026-82789 | High | 8.8 | 2026-09-14 | An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS). If exploited, arbitrary co… |
CVE-2026-82780 | High | 8.8 | 2026-09-14 | Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series. If a specially crafted file is uploaded by a remote authenticated attacker… |
CVE-2026-82779 | High | 8.8 | 2026-09-14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series. If this vulnerability is exploi… |
CVE-2026-82777 | High | 8.8 | 2026-09-14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series. If this vulnerability is explo… |
CVE-2026-82774 | High | 8.8 | 2026-09-14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Contr… |
CVE-2026-82772 | High | 8.8 | 2026-09-14 | Buffer overflow vulnerability exists in Contec EC1000 series. If a remote attacker sends a specially crafted request to the product's web service, an arbitrary… |
CVE-2026-82770 | High | 8.8 | 2026-09-14 | Buffer overflow vulnerability exists in Contec RP-WAH-SR Series. If a remote attacker sends a specially crafted request to the product's web service, an arbitr… |
CVE-2026-82768 | High | 8.1 | 2026-09-14 | Path traversal vulnerability exists in SGA1000. If this vulnerability is exploited, arbitrary files on the server may be viewed and/or altered by an attacker w… |
CVE-2026-82766 | High | 8.8 | 2026-09-14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000. If this vulnerability is exploited, an arbi… |
CVE-2026-82765 | High | 8.1 | 2026-09-14 | Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, arbitrary files on the serve… |
CVE-2026-82762 | High | 8.8 | 2026-09-14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 series, and FX3000 seri… |
CVE-2026-68955 | High | 7.8 | 2026-09-14 | The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory w… |
CVE-2023-50461 | High | 8.8 | 2026-09-14 | An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an aut… |
CVE-2023-46273 | High | 8.8 | 2026-09-14 | Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_send. |
CVE-2023-45858 | High | 8.6 | 2026-09-14 | A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files. |
CVE-2023-32803 | High | 7.5 | 2026-09-14 | The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the r… |
CVE-2023-28148 | High | 7.2 | 2026-09-14 | A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520. |
CVE-2026-90620 | High | 7.3 | 2026-09-14 | A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file he… |
CVE-2026-90619 | High | 7.3 | 2026-09-14 | A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrike_serv… |
CVE-2026-90618 | High | 7.3 | 2026-09-14 | A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This issue affects the function LocalRuntime.execute_command of… |
CVE-2026-90617 | High | 7.3 | 2026-09-14 | A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function run_task of the… |
CVE-2026-33963 | High | 7.5 | 2026-09-14 | An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. A stack-based buffer overflow occurs w… |
CVE-2026-31278 | High | 7.7 | 2026-09-14 | An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Di… |
CVE-2026-23789 | High | 7.8 | 2026-09-14 | An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600… |
CVE-2026-90603 | High | 7.3 | 2026-09-13 | A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/uplo… |
CVE-2026-90601 | High | 7.3 | 2026-09-13 | A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph_service/main.py of the component REST API… |
CVE-2026-15891 | High | 7.5 | 2026-09-13 | The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invo… |
CVE-2026-90593 | High | 7.3 | 2026-09-13 | A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of the file src/image/image_raw.rs. Executi… |
CVE-2026-88802 | High | 7.5 | 2026-09-13 | The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or… |
CVE-2026-88793 | High | 8.8 | 2026-09-13 | The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on… |
CVE-2026-85129 | High | 8.8 | 2026-09-13 | The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data sub… |
CVE-2026-74933 | High | 8.8 | 2026-09-13 | The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values be… |
CVE-2026-37008 | High | 8.1 | 2026-09-13 | CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-… |
CVE-2026-36453 | High | 7.4 | 2026-09-13 | Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables. |
CVE-2026-29811 | High | 7.7 | 2026-09-13 | CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias")… |
CVE-2026-90579 | High | 7.3 | 2026-09-13 | A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http_key of the file core/cat/factory/custo… |
CVE-2026-90566 | High | 7.3 | 2026-09-13 | A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the fu… |
CVE-2026-90526 | High | 7.3 | 2026-09-13 | A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/save_c… |
CVE-2026-90524 | High | 7.3 | 2026-09-13 | A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The impacted element is an unkn… |
CVE-2026-90523 | High | 7.3 | 2026-09-13 | A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown f… |
CVE-2026-90783 | High | 7.8 | 2026-09-13 | MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic… |
CVE-2026-90522 | High | 7.3 | 2026-09-13 | A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass o… |
CVE-2026-90780 | High | 7.5 | 2026-09-13 | SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content… |
CVE-2026-90779 | High | 7.5 | 2026-09-13 | SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm… |
CVE-2026-90778 | High | 7.5 | 2026-09-13 | SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more… |
CVE-2026-90777 | High | 8.8 | 2026-09-13 | ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-suppli… |
CVE-2026-90776 | High | 7.5 | 2026-09-13 | Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC… |
CVE-2026-90516 | High | 7.3 | 2026-09-13 | A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/pay_r… |
CVE-2026-90515 | High | 7.3 | 2026-09-13 | A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/… |
CVE-2026-90774 | High | 7.5 | 2026-09-13 | rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape… |
CVE-2026-90772 | High | 7.6 | 2026-09-13 | Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem c… |
CVE-2026-90770 | High | 8.8 | 2026-09-13 | Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into sh… |
CVE-2026-90769 | High | 7.7 | 2026-09-13 | Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to… |
CVE-2026-90768 | High | 8.1 | 2026-09-13 | CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by oth… |
CVE-2026-90562 | High | 8.1 | 2026-09-13 | LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoin… |
CVE-2026-90561 | High | 8.7 | 2026-09-13 | Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component t… |
CVE-2026-90514 | High | 7.3 | 2026-09-13 | A vulnerability has been found in SourceCodester School Registration and Fee System 1.0. Impacted is an unknown function of the file /bilal/normal/save_stud.ph… |
CVE-2026-90510 | High | 8.3 | 2026-09-13 | A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-… |
CVE-2026-90509 | High | 7.3 | 2026-09-13 | A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApi… |
CVE-2026-90504 | High | 7.3 | 2026-09-13 | A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The… |
CVE-2026-90498 | High | 7.3 | 2026-09-13 | A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to u… |
CVE-2026-89080 | High | 7.5 | 2026-09-13 | The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor en… |
CVE-2026-86406 | High | 7.5 | 2026-09-13 | The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate… |
CVE-2026-80071 | High | 7.2 | 2026-09-13 | The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attac… |
CVE-2026-90678 | High | 7.5 | 2026-09-13 | An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with Q… |
CVE-2026-90495 | High | 7.3 | 2026-09-13 | A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models… |
CVE-2026-90493 | High | 8.8 | 2026-09-13 | A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp… |
CVE-2026-90668 | High | 7.5 | 2026-09-13 | The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial… |
CVE-2026-90651 | High | 8.1 | 2026-09-13 | Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verif… |
CVE-2026-90647 | High | 7.4 | 2026-09-12 | ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 T… |
CVE-2026-90616 | High | 7.4 | 2026-09-12 | In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code e… |
CVE-2026-90560 | High | 8.2 | 2026-09-12 | zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments… |