High-severity CVEs (page 88)
Page 88 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-86199 | High | 7.5 | 2026-09-09 | PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger a… |
CVE-2026-86099 | High | 8.2 | 2026-09-09 | Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by… |
CVE-2026-79950 | High | 7.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-79740 | High | 7.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-79738 | High | 7.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner… |
CVE-2026-56711 | High | 7.0 | 2026-09-09 | VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user intera… |
CVE-2024-58382 | High | 7.5 | 2026-09-09 | league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service… |
CVE-2024-58381 | High | 7.5 | 2026-09-09 | PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sendi… |
CVE-2023-54393 | High | 7.5 | 2026-09-09 | PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper depende… |
CVE-2023-54390 | High | 7.5 | 2026-09-09 | PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arr… |
CVE-2023-54355 | High | 7.5 | 2026-09-09 | PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers… |
CVE-2026-87821 | High | 7.1 | 2026-09-09 | Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authen… |
CVE-2026-87819 | High | 7.5 | 2026-09-09 | GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fiel… |
CVE-2026-87817 | High | 8.8 | 2026-09-09 | GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like git… |
CVE-2026-87816 | High | 7.5 | 2026-09-09 | PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass e… |
CVE-2026-87815 | High | 8.7 | 2026-09-09 | SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An a… |
CVE-2026-87814 | High | 7.3 | 2026-09-09 | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before… |
CVE-2026-87813 | High | 7.3 | 2026-09-09 | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML wit… |
CVE-2026-87811 | High | 7.3 | 2026-09-09 | SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft maliciou… |
CVE-2026-87807 | High | 7.5 | 2026-09-09 | siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers ca… |
CVE-2026-87806 | High | 7.4 | 2026-09-09 | Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forward… |
CVE-2026-79972 | High | 7.2 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special E… |
CVE-2026-79963 | High | 7.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Download of Code Without Integrity Ch… |
CVE-2026-79695 | High | 7.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Handling of Highly Compress… |
CVE-2026-79692 | High | 7.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Pat… |
CVE-2026-79637 | High | 7.7 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vuln… |
CVE-2026-78492 | High | 7.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vuln… |
CVE-2026-78490 | High | 7.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Au… |
CVE-2026-78485 | High | 7.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to… |
CVE-2026-74761 | High | 7.5 | 2026-09-09 | Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can… |
CVE-2026-79641 | High | 7.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special E… |
CVE-2026-79635 | High | 7.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery (SSRF) vu… |
CVE-2026-73334 | High | 8.1 | 2026-09-09 | Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt… |
CVE-2026-65181 | High | 8.1 | 2026-09-09 | Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to exe… |
CVE-2026-57866 | High | 8.8 | 2026-09-09 | Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function… |
CVE-2026-41870 | High | 8.8 | 2026-09-09 | Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Con… |
CVE-2026-87795 | High | 8.2 | 2026-09-09 | zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attac… |
CVE-2026-87794 | High | 8.4 | 2026-09-09 | bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to t… |
CVE-2026-87766 | High | 8.8 | 2026-09-09 | A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot… |
CVE-2026-80122 | High | 7.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vuln… |
CVE-2026-80099 | High | 8.8 | 2026-09-09 | Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module… |
CVE-2026-78494 | High | 7.4 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vuln… |
CVE-2026-78491 | High | 8.2 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vuln… |
CVE-2026-14989 | High | 7.2 | 2026-09-09 | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_preference' paramet… |
CVE-2026-14359 | High | 8.8 | 2026-09-09 | The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the a… |
CVE-2026-80123 | High | 7.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery (SSRF) vu… |
CVE-2026-79636 | High | 7.0 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Validation of Certificate w… |
CVE-2026-75927 | High | 7.2 | 2026-09-09 | The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation… |
CVE-2026-84068 | High | 8.6 | 2026-09-09 | The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticate… |
CVE-2026-83593 | High | 7.2 | 2026-09-09 | The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation'… |
CVE-2026-76009 | High | 8.1 | 2026-09-09 | The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `N… |
CVE-2026-16960 | High | 7.5 | 2026-09-09 | The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthent… |
CVE-2026-14962 | High | 8.6 | 2026-09-09 | The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing u… |
CVE-2026-87734 | High | 7.5 | 2026-09-09 | An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service. |
CVE-2026-21100 | High | 7.1 | 2026-09-09 | Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity. |
CVE-2026-21094 | High | 8.8 | 2026-09-09 | Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory. |
CVE-2026-21091 | High | 7.8 | 2026-09-09 | Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21090 | High | 7.8 | 2026-09-09 | Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21089 | High | 7.8 | 2026-09-09 | Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21088 | High | 7.8 | 2026-09-09 | Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memor… |
CVE-2026-21087 | High | 7.8 | 2026-09-09 | Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege. |
CVE-2026-21086 | High | 7.8 | 2026-09-09 | Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration. |
CVE-2026-84293 | High | 7.2 | 2026-09-09 | The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versio… |
CVE-2026-6485 | High | 8.2 | 2026-09-09 | UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts. |
CVE-2026-49315 | High | 7.1 | 2026-09-09 | DoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-49314 | High | 7.3 | 2026-09-09 | OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-49310 | High | 8.6 | 2026-09-09 | Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-17553 | High | 7.2 | 2026-09-09 | The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_defaul… |
CVE-2026-12855 | High | 8.2 | 2026-09-09 | Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects. |
CVE-2026-87088 | High | 7.0 | 2026-09-09 | Tanium addressed an unauthorized code execution vulnerability in Enforce. |
CVE-2026-87084 | High | 7.7 | 2026-09-09 | Tanium addressed a server-side request forgery vulnerability in Enforce. |
CVE-2026-87075 | High | 8.1 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87072 | High | 7.1 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87036 | High | 8.1 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87034 | High | 8.3 | 2026-09-09 | Tanium addressed a SQL injection vulnerability in Comply. |
CVE-2026-87030 | High | 8.5 | 2026-09-09 | Tanium addressed a path traversal vulnerability in Comply. |
CVE-2026-87023 | High | 8.5 | 2026-09-09 | Tanium addressed a path traversal vulnerability in Comply. |
CVE-2026-87021 | High | 7.2 | 2026-09-09 | Tanium addressed an unauthorized code execution vulnerability in Comply. |
CVE-2026-76801 | High | 8.8 | 2026-09-09 | The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all v… |
CVE-2026-15667 | High | 7.5 | 2026-09-09 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up… |
CVE-2026-15406 | High | 7.5 | 2026-09-09 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up… |
CVE-2026-13359 | High | 7.2 | 2026-09-09 | The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrm_c… |
CVE-2026-87648 | High | 8.3 | 2026-09-09 | Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-87644 | High | 8.3 | 2026-09-09 | Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and l… |
CVE-2026-87639 | High | 8.3 | 2026-09-09 | Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execut… |
CVE-2026-87636 | High | 8.8 | 2026-09-09 | Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted… |
CVE-2026-87633 | High | 8.6 | 2026-09-09 | Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via UI Interaction. (Chr… |
CVE-2026-87628 | High | 8.3 | 2026-09-09 | Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to potentially execute arbitrary code outside the sandbox via craft… |
CVE-2026-87625 | High | 8.8 | 2026-09-09 | Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandb… |
CVE-2026-87618 | High | 8.3 | 2026-09-09 | Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proc… |
CVE-2026-87617 | High | 8.8 | 2026-09-09 | Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the… |
CVE-2026-87616 | High | 8.3 | 2026-09-09 | Improper initialization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and l… |
CVE-2026-87612 | High | 8.8 | 2026-09-09 | Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-87608 | High | 7.5 | 2026-09-09 | Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin p… |
CVE-2026-87606 | High | 8.1 | 2026-09-09 | Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass sit… |
CVE-2026-87604 | High | 8.3 | 2026-09-09 | Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute a… |
CVE-2026-87601 | High | 7.5 | 2026-09-09 | Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-87588 | High | 8.8 | 2026-09-09 | Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… |
CVE-2026-87587 | High | 8.8 | 2026-09-09 | Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-87585 | High | 8.8 | 2026-09-09 | Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox… |