High-severity CVEs (page 95)
Page 95 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-46176 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() mlx5_ib_dev_res_srq_… |
CVE-2026-46175 | High | 7.1 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency caused by FGGC of node block During FGGC node block migratio… |
CVE-2026-46174 | High | 8.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Make sure… |
CVE-2026-46173 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, m… |
CVE-2026-46166 | High | 8.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_ca… |
CVE-2026-46164 | High | 7.0 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info_sub_group() error path When kobject_init_and_… |
CVE-2026-46163 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: wifi: b43legacy: enforce bounds check on firmware key index in RX path Same fix as b43: t… |
CVE-2026-46162 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: ice: fix double free in ice_sf_eth_activate() error path When auxiliary_device_add() fail… |
CVE-2026-46157 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Currently the runtime.oss… |
CVE-2026-46154 | High | 7.0 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters scx_group_set_{weig… |
CVE-2026-46152 | High | 8.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is… |
CVE-2026-46150 | High | 7.1 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return fal… |
CVE-2026-46149 | High | 7.1 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_g… |
CVE-2026-46145 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a… |
CVE-2026-46140 | High | 7.1 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: validate WMT event SKB length before struct access btmtk_usb_hci_wmt_sy… |
CVE-2026-46138 | High | 8.1 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt hc… |
CVE-2026-46136 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix a potential clc buffer length underflow The buf_len is used to li… |
CVE-2026-46133 | High | 7.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 724449… |
CVE-2026-46130 | High | 7.1 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: dm-verity-fec: fix reading parity bytes split across blocks (take 3) fec_decode_bufs() as… |
CVE-2026-46129 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info() error path When kobject_init_and_add() fail… |
CVE-2026-46125 | High | 8.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails f… |
CVE-2026-46124 | High | 7.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: isofs: validate block number from NFS file handle in isofs_export_iget isofs_fh_to_dentry… |
CVE-2026-46123 | High | 7.7 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: clamp rx length before skb_put virtbt_rx_work() calls skb_put(skb… |
CVE-2026-46122 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: wifi: b43: enforce bounds check on firmware key index in b43_rx() The firmware-controlled… |
CVE-2026-46121 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Patch series "mm… |
CVE-2026-46120 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e72ce3e3980 ("net: ip… |
CVE-2026-46117 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Sashiko points ou… |
CVE-2026-46116 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-… |
CVE-2026-46114 | High | 7.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads atomic_write_reply() at drivers/infinib… |
CVE-2026-46113 | High | 8.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes… |
CVE-2026-46112 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Sashiko points out that hns_roce_qp_r… |
CVE-2026-46111 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in create_big_sync Add hci_conn_valid() check in c… |
CVE-2026-46110 | High | 7.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Prevent NULL deref when RX memory exhausted The CPU receives frames from the… |
CVE-2026-46107 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalan… |
CVE-2026-46105 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Limit NVMe request size to 2 MiB The HBA firmware reports NVMe MDTS values… |
CVE-2026-9804 | High | 7.7 | 2026-05-28 | A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the… |
CVE-2026-6226 | High | 8.8 | 2026-05-28 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due… |
CVE-2026-9227 | High | 8.8 | 2026-05-28 | The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.20.1 via the gutenbee_file_… |
CVE-2026-7862 | High | 8.6 | 2026-05-28 | The Eupago Gateway For Woocommerce WordPress plugin before 4.7.2 does not properly restrict access to its refund request handler, allowing unauthenticated atta… |
CVE-2026-7797 | High | 7.5 | 2026-05-28 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'ap… |
CVE-2026-7634 | High | 7.2 | 2026-05-28 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'User-Agent' header in all versions up to, and including, 5.4… |
CVE-2026-7052 | High | 7.2 | 2026-05-28 | The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file_upload' parameter… |
CVE-2026-6455 | High | 8.1 | 2026-05-28 | The WP Contact Form 7 DB Handler plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Deletion via SQL Injection and PHP… |
CVE-2026-44604 | High | 7.0 | 2026-05-28 | A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified d… |
CVE-2026-9009 | High | 8.8 | 2026-05-28 | The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via th… |
CVE-2026-9795 | High | 7.3 | 2026-05-28 | A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vu… |
CVE-2026-7802 | High | 8.8 | 2026-05-28 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.2. This is due to the pl… |
CVE-2026-32995 | High | 7.5 | 2026-05-28 | The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-su… |
CVE-2026-2374 | High | 7.2 | 2026-05-28 | The Login No Captcha reCAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `$_SERVER['PHP_SELF']` superglobal in all versions up… |
CVE-2026-8915 | High | 8.8 | 2026-05-28 | Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 36f5fb58366a67b713c02f6fd985e924fcc09e… |
CVE-2026-46414 | High | 8.8 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's WebSocket control plane trus… |
CVE-2026-46402 | High | 8.1 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO uses the user-controlled task_… |
CVE-2026-45322 | High | 7.8 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Microsoft UFO tagged releases up to and including v3.0.0 contain a… |
CVE-2026-9208 | High | 8.8 | 2026-05-27 | Tanium addressed an unauthorized code execution vulnerability in Connect. |
CVE-2026-45152 | High | 7.8 | 2026-05-27 | uniget is a universal installer and updater for (container) tools. Prior to 0.27.1, a command injection vulnerability exists in uniget due to unsafe execution… |
CVE-2026-47269 | High | 7.4 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remote feature checks utmpx ut_addr_v6 to de… |
CVE-2026-45137 | High | 8.2 | 2026-05-27 | Anchor is a framework providing several convenient developer tools for writing Solana programs. From 1.0.0 to before 1.0.2, an logic error causes anchor progra… |
CVE-2026-45136 | High | 7.8 | 2026-05-27 | claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh (introduced in v3.5.0) interpolates… |
CVE-2026-44713 | High | 8.8 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, spli… |
CVE-2026-44712 | High | 8.2 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a crafted UUID such as $(id>/tmp/rce) in the config causes r… |
CVE-2026-44711 | High | 7.9 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authen… |
CVE-2026-44709 | High | 7.8 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, pamusb-pinentry reads the PINENTRY_FALLBACK_APP environment… |
CVE-2026-44660 | High | 7.5 | 2026-05-27 | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object a… |
CVE-2026-8361 | High | 7.5 | 2026-05-27 | A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path starting with /woshome |
CVE-2026-8360 | High | 7.5 | 2026-05-27 | Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWebDavModule.dll) can return a NULL point… |
CVE-2026-8359 | High | 7.5 | 2026-05-27 | When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patterns. The WOSBin_Lo… |
CVE-2026-48064 | High | 8.1 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with deny_remote=false in p… |
CVE-2026-47272 | High | 7.1 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, the pusb_pad_compare() function in src/pad.c only verified t… |
CVE-2026-45134 | High | 7.1 | 2026-05-27 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's promp… |
CVE-2026-45108 | High | 8.4 | 2026-05-27 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication… |
CVE-2026-45104 | High | 7.5 | 2026-05-27 | MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLay… |
CVE-2026-44724 | High | 7.8 | 2026-05-27 | systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in… |
CVE-2026-42197 | High | 8.7 | 2026-05-27 | RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 have a stored cross-site scripting vulnerability th… |
CVE-2026-4868 | High | 8.2 | 2026-05-27 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that, under certain c… |
CVE-2026-44635 | High | 7.5 | 2026-05-27 | Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters (… |
CVE-2026-5509 | High | 7.2 | 2026-05-27 | An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router that allows an administrator to execute arbitrary system co… |
CVE-2026-48153 | High | 8.5 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipp… |
CVE-2026-48152 | High | 8.1 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, the single-datasource GET and PUT routes are guarded by generic TABLE READ, not by Builder/Admin… |
CVE-2026-48151 | High | 7.5 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, the webhook schema-building endpoint is registered under builderRoutes, but the generic authoriz… |
CVE-2026-48149 | High | 8.1 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, the Budibase Text component renders markdown by assigning marked.parse(markdown) straight to inn… |
CVE-2026-48146 | High | 7.7 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, the OAuth2 token fetch function in packages/server/src/sdk/workspace/oauth2/utils.ts uses raw fe… |
CVE-2026-46427 | High | 7.7 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.3, removeSecrets at packages/server/src/sdk/workspace/datasources/datasources.ts masks only datasou… |
CVE-2026-46426 | High | 7.6 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.2, the file upload endpoint POST /api/attachments/process does not enforce active-content restricti… |
CVE-2026-45717 | High | 8.8 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.1, Budibase exposes a REST API for datasource management. The route PUT /api/datasources/:datasourc… |
CVE-2026-45716 | High | 8.8 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.1, the POST /api/global/users/onboard endpoint is protected by workspaceBuilderOrAdmin middleware… |
CVE-2026-45715 | High | 7.7 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.1, the REST datasource integration (packages/server/src/integrations/rest.ts) follows HTTP redirect… |
CVE-2026-45548 | High | 7.7 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automations/steps/ai/extract.ts uses fetch(fi… |
CVE-2026-45090 | High | 7.5 | 2026-05-27 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs tw… |
CVE-2026-45089 | High | 8.2 | 2026-05-27 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the output, output… |
CVE-2026-45088 | High | 7.5 | 2026-05-27 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload… |
CVE-2026-45061 | High | 7.7 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.35.10, the Plugin URL upload endpoint (POST /api/plugin) validates the submitted URL with a single sub… |
CVE-2026-45047 | High | 7.5 | 2026-05-27 | bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directl… |
CVE-2026-44521 | High | 8.8 | 2026-05-27 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.68, an authenticated SQL injection vulnerability in the el… |
CVE-2026-44460 | High | 7.4 | 2026-05-27 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.12.0, /api/totp_setup.php is callable from a… |
CVE-2026-44378 | High | 7.5 | 2026-05-27 | Botan is a C++ cryptography library. Prior to 3.12.0, certain patterns of indefinite length encodings in BER data could cause quadratic behavior in the parser… |
CVE-2026-44346 | High | 8.8 | 2026-05-27 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containi… |
CVE-2026-44345 | High | 8.8 | 2026-05-27 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/_internal/container/fro… |
CVE-2026-38807 | High | 8.8 | 2026-05-27 | Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate privileges via the UserController.java component |
CVE-2025-69600 | High | 7.8 | 2026-05-27 | Command injection in Raynet rvia RayVentory Scan Engine 12.6 Update 8 and previous versions allows adversaries to execute commands via getconfig, upload, inven… |
CVE-2026-44483 | High | 8.2 | 2026-05-27 | RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get… |