High-severity CVEs (page 83)
Page 83 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-78175 | High | 8.8 | 2026-09-12 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via… |
CVE-2026-16482 | High | 7.5 | 2026-09-12 | The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versi… |
CVE-2026-87888 | High | 8.0 | 2026-09-12 | The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the sub… |
CVE-2026-87842 | High | 7.5 | 2026-09-12 | The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allow… |
CVE-2026-87759 | High | 8.8 | 2026-09-12 | The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carry… |
CVE-2026-84099 | High | 8.1 | 2026-09-12 | The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input withou… |
CVE-2026-84047 | High | 8.6 | 2026-09-12 | The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticate… |
CVE-2026-81742 | High | 8.8 | 2026-09-12 | The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted… |
CVE-2026-81429 | High | 7.1 | 2026-09-12 | The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise t… |
CVE-2026-81090 | High | 7.2 | 2026-09-12 | The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing at… |
CVE-2026-80494 | High | 8.6 | 2026-09-12 | The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint tha… |
CVE-2026-80491 | High | 8.6 | 2026-09-12 | The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated action… |
CVE-2026-77752 | High | 7.2 | 2026-09-12 | The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights… |
CVE-2026-77705 | High | 7.2 | 2026-09-12 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitle… |
CVE-2026-89266 | High | 8.2 | 2026-09-12 | stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. At… |
CVE-2026-90456 | High | 8.1 | 2026-09-11 | An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment… |
CVE-2026-90444 | High | 8.8 | 2026-09-11 | A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process… |
CVE-2026-54241 | High | 7.4 | 2026-09-11 | libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offse… |
CVE-2026-54240 | High | 7.4 | 2026-09-11 | libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a… |
CVE-2026-50013 | High | 7.5 | 2026-09-11 | Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `… |
CVE-2026-49846 | High | 7.5 | 2026-09-11 | libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose… |
CVE-2026-81907 | High | 7.1 | 2026-09-11 | Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST /index.php/dashboard/system/expre… |
CVE-2026-54174 | High | 8.3 | 2026-09-11 | melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified… |
CVE-2026-54166 | High | 7.1 | 2026-09-11 | Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the `asset:import` permission can trigger server-side HTTP… |
CVE-2026-49464 | High | 8.1 | 2026-09-11 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizatio… |
CVE-2026-89771 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers trace_buffer subbuf_size is… |
CVE-2026-89769 | High | 7.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path When cpuhp_setu… |
CVE-2026-89767 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating() on the casefold-mismatch path ovl_create_real() releases t… |
CVE-2026-89764 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition wh… |
CVE-2026-89763 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference… |
CVE-2026-89762 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begin_current_label_crit_section() AppArmor's begin_curr… |
CVE-2026-89761 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aa_vec_unique() null… |
CVE-2026-89760 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm, swap: don't free a hibernation slot that is in the swap cache A slot with a folio in… |
CVE-2026-89758 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-… |
CVE-2026-89755 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale mapping after freeing swapcache __migrate_device_pages() r… |
CVE-2026-89754 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->action escaping walk_pmd_range() If ->pmd_entry() sets walk-… |
CVE-2026-89750 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Clear copied tracing state before fork duplication dup_task_struct()… |
CVE-2026-89748 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simple_ring_buffer_swap_r… |
CVE-2026-89747 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Writing to buff… |
CVE-2026-89746 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on diffe… |
CVE-2026-89744 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over chil… |
CVE-2026-89743 | High | 7.7 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm_sendrecv_msg_locked() stores the… |
CVE-2026-89742 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mut… |
CVE-2026-89741 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-dev: fix error handling in __video_register_device()" This reverts co… |
CVE-2026-89738 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mo… |
CVE-2026-89736 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix use-after-free on sound card disconnect g_audio_cleanup() invok… |
CVE-2026-89733 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() … |
CVE-2026-89731 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read cxl_rch_get_aer_info(… |
CVE-2026-89729 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature sensor_hub_get_feature… |
CVE-2026-89725 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32_rx_done() appends eac… |
CVE-2026-89724 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidioc_s_fmt_vid_out() sizes the… |
CVE-2026-89723 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Shuangpeng Bai… |
CVE-2026-89720 | High | 7.7 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifs_sb_verify_signature() bound… |
CVE-2026-89711 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check The header for commit e75b23f9e323… |
CVE-2026-89709 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by nfsd_lockd_init()… |
CVE-2026-89707 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow_down() error nfsd_cross_mnt() initializes a local struc… |
CVE-2026-89706 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn->writev… |
CVE-2026-89705 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths nfsd_dispatch()… |
CVE-2026-89704 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop _nfsd_copy_file_range() sample… |
CVE-2026-89699 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4_decode_create() accepts an unb… |
CVE-2026-89696 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIG_NFSD_V4_… |
CVE-2026-89695 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4_decode_posixacl() reads a u32… |
CVE-2026-89692 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACK_RUNNING on failed delegation recall queue nfsd_break_one_deleg() set… |
CVE-2026-89691 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4_release_compoundargs(… |
CVE-2026-89690 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_status UAF The rpc_status netlink dumpit wal… |
CVE-2026-89687 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file ->atomic_open is permi… |
CVE-2026-89685 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clients_still_reclaiming() clients_still_reclaiming()… |
CVE-2026-89684 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_state nfs4_alloc_init_cpntf_state() publishe… |
CVE-2026-89682 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net nfsd_file_dispose_l… |
CVE-2026-89680 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd_file leak on inter-server COPY setup failure When nfsd4_setup_inter_ssc()… |
CVE-2026-89679 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs When a SETATTR requ… |
CVE-2026-89678 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsd_direct_write nfsd_direct_write() walks a list o… |
CVE-2026-89670 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsd_file objects are freed via call_rcu (fil… |
CVE-2026-89668 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() nfsd_debugfs_init(… |
CVE-2026-89667 | High | 8.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC w… |
CVE-2026-89665 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder conver… |
CVE-2026-89664 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via op_release nfsd4_decode_createhow4() calls nfsd… |
CVE-2026-89663 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids li… |
CVE-2026-89657 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osd_client.c:osd_sparse_… |
CVE-2026-89648 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in ceph_parse_deleg_inos() ceph_parse_deleg_inos() decode… |
CVE-2026-89647 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat ceph_trim_dentries() if no progress possible ceph_cap_reclaim_work()… |
CVE-2026-89646 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount ceph_dirty_folio() takes a… |
CVE-2026-89641 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() When the else branch of… |
CVE-2026-89640 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 With len == 0 (clone… |
CVE-2026-89639 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC cifs_do_truncate() is… |
CVE-2026-89638 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions W… |
CVE-2026-89632 | High | 8.2 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() reparse_buf_p… |
CVE-2026-89626 | High | 8.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hid_sensor_custom_add_attri… |
CVE-2026-89624 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universal_pidff_prob… |
CVE-2026-89622 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp_i2c_smbus_read() stores… |
CVE-2026-89620 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy write_cmd_to_txdma()… |
CVE-2026-89619 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer quicks… |
CVE-2026-89617 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIR_PAGE_ENTRY ends in a page_lcns… |
CVE-2026-89616 | High | 7.5 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() ni_read_frame() dec… |
CVE-2026-89615 | High | 8.4 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page_lcns[] index by the log record The copy_lcns loop and the redo short… |
CVE-2026-89609 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfs_exorcise_daemon() dr… |
CVE-2026-89608 | High | 7.1 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfs_parse_packet_set() receives a po… |
CVE-2026-89607 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet parse_tag_3_packet()… |
CVE-2026-89606 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfs_parse_tag_70_packet() subtracts fixed… |
CVE-2026-89605 | High | 7.8 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ecryptfs: release message context on send failure ecryptfs_send_message_locked() moves a… |