High-severity CVEs (page 9)
Page 9 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-61932 | High | 7.8 | 2026-08-11 | Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2026-61930 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-61929 | High | 7.0 | 2026-08-11 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-61927 | High | 7.0 | 2026-08-11 | Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-61926 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-61925 | High | 7.8 | 2026-08-11 | Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-61923 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-61367 | High | 7.8 | 2026-08-11 | Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-61366 | High | 7.0 | 2026-08-11 | Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally. |
CVE-2026-61365 | High | 7.8 | 2026-08-11 | Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-61364 | High | 7.8 | 2026-08-11 | Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-61363 | High | 7.5 | 2026-08-11 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2026-61361 | High | 7.0 | 2026-08-11 | Use after free in Windows DHCP Client allows an authorized attacker to execute code locally. |
CVE-2026-61359 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. |
CVE-2026-61358 | High | 7.8 | 2026-08-11 | Improper link resolution before file access ('link following') in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate… |
CVE-2026-61357 | High | 7.8 | 2026-08-11 | Use after free in Application Information Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-61356 | High | 7.8 | 2026-08-11 | Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-61355 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-61353 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Telephony Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-61352 | High | 7.5 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute… |
CVE-2026-61349 | High | 7.8 | 2026-08-11 | Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-61348 | High | 7.0 | 2026-08-11 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-61346 | High | 7.0 | 2026-08-11 | Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-59134 | High | 7.5 | 2026-08-11 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2026-59133 | High | 8.8 | 2026-08-11 | Execution with unnecessary privileges in Microsoft High Performance Computing (HPC) Pack allows an authorized attacker to elevate privileges over a network. |
CVE-2026-59132 | High | 7.5 | 2026-08-11 | Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network. |
CVE-2026-59127 | High | 7.8 | 2026-08-11 | Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-59126 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Event Logging Service allows an authorized attacker to e… |
CVE-2026-59125 | High | 7.0 | 2026-08-11 | Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-59122 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to eleva… |
CVE-2026-59119 | High | 7.3 | 2026-08-11 | Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally. |
CVE-2026-59113 | High | 8.8 | 2026-08-11 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2026-58651 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-58650 | High | 7.8 | 2026-08-11 | Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-58641 | High | 7.8 | 2026-08-11 | Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-58612 | High | 7.4 | 2026-08-11 | Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network. |
CVE-2026-57105 | High | 8.0 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-57104 | High | 8.8 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privi… |
CVE-2026-56179 | High | 8.3 | 2026-08-11 | Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network. |
CVE-2026-56174 | High | 7.8 | 2026-08-11 | Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally. |
CVE-2026-54984 | High | 7.8 | 2026-08-11 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally. |
CVE-2026-54981 | High | 7.8 | 2026-08-11 | Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature… |
CVE-2026-54113 | High | 7.5 | 2026-08-11 | Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network. |
CVE-2026-50472 | High | 7.0 | 2026-08-11 | Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally. |
CVE-2026-49179 | High | 8.8 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code… |
CVE-2026-48442 | High | 7.1 | 2026-08-11 | CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a A… |
CVE-2026-48440 | High | 8.1 | 2026-08-11 | ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48439 | High | 7.5 | 2026-08-11 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-48438 | High | 7.5 | 2026-08-11 | CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploi… |
CVE-2026-48386 | High | 7.5 | 2026-08-11 | ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could… |
CVE-2026-48385 | High | 7.7 | 2026-08-11 | ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in a Se… |
CVE-2026-47299 | High | 7.2 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges… |
CVE-2026-42976 | High | 7.8 | 2026-08-11 | Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally. |
CVE-2026-34635 | High | 8.4 | 2026-08-11 | is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage thi… |
CVE-2026-25652 | High | 7.8 | 2026-08-11 | is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability t… |
CVE-2026-21279 | High | 8.2 | 2026-08-11 | is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypa… |
CVE-2026-21273 | High | 8.7 | 2026-08-11 | is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability… |
CVE-2026-20349 | High | 8.6 | 2026-08-11 | A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defe… |
CVE-2026-73079 | High | 8.5 | 2026-08-11 | Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys i… |
CVE-2026-6726 | High | 7.9 | 2026-08-11 | An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a cred… |
CVE-2026-67180 | High | 8.4 | 2026-08-11 | Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/n… |
CVE-2026-67179 | High | 7.8 | 2026-08-11 | Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reac… |
CVE-2026-56721 | High | 8.8 | 2026-08-11 | CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-p… |
CVE-2026-53416 | High | 7.1 | 2026-08-11 | Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access. |
CVE-2026-53415 | High | 8.3 | 2026-08-11 | Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network ac… |
CVE-2026-53413 | High | 8.3 | 2026-08-11 | Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution… |
CVE-2026-48766 | High | 7.6 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys b… |
CVE-2026-48495 | High | 7.1 | 2026-08-11 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the emb… |
CVE-2026-42142 | High | 7.1 | 2026-08-11 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace member… |
CVE-2026-19546 | High | 8.8 | 2026-08-11 | A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation pl… |
CVE-2026-18640 | High | 7.1 | 2026-08-11 | The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record out… |
CVE-2026-18639 | High | 7.3 | 2026-08-11 | When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email… |
CVE-2026-72922 | High | 8.2 | 2026-08-11 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogpt_p… |
CVE-2026-72921 | High | 8.1 | 2026-08-11 | SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix… |
CVE-2026-18860 | High | 8.7 | 2026-08-11 | Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants withi… |
CVE-2026-18635 | High | 7.2 | 2026-08-11 | Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling… |
CVE-2026-18129 | High | 8.1 | 2026-08-11 | Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MI… |
CVE-2026-18127 | High | 7.7 | 2026-08-11 | External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an… |
CVE-2026-18125 | High | 7.5 | 2026-08-11 | An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service. |
CVE-2026-51583 | High | 8.5 | 2026-08-11 | An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook validation mechanism… |
CVE-2026-72781 | High | 8.8 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Becau… |
CVE-2026-72778 | High | 8.8 | 2026-08-11 | Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control pa… |
CVE-2026-72747 | High | 7.2 | 2026-08-11 | AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the datab… |
CVE-2026-69109 | High | 7.5 | 2026-08-11 | A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path traversal vulnerabi… |
CVE-2026-64629 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Parasolid V38.0 (All versions < V38.0.235), Parasolid V38.1 (All versions < V38.1.230). The affected applications contai… |
CVE-2026-59701 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability whil… |
CVE-2026-59700 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability whil… |
CVE-2026-59086 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Simcenter Femap (All versions < V2606), Simcenter Nastran (All versions < V2606). The affected applications contain a st… |
CVE-2026-50064 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected ap… |
CVE-2026-50063 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected ap… |
CVE-2026-50062 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected ap… |
CVE-2026-50061 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected ap… |
CVE-2026-50060 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected ap… |
CVE-2026-50059 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected ap… |
CVE-2026-50058 | High | 7.8 | 2026-08-11 | A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected ap… |
CVE-2026-72609 | High | 7.1 | 2026-08-11 | An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive perm… |
CVE-2026-72607 | High | 7.1 | 2026-08-11 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod per… |
CVE-2026-72606 | High | 7.5 | 2026-08-11 | A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary… |
CVE-2026-72605 | High | 7.5 | 2026-08-11 | A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profil… |
CVE-2026-72602 | High | 7.5 | 2026-08-11 | A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arb… |