High-severity CVEs (page 98)

Page 98 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.

All high-severity CVEs — newest first (page 98 of 100)
CVESeverityScorePublishedSummary
CVE-2026-73312High7.42026-09-08XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to…
CVE-2026-73311High7.42026-09-08XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previo…
CVE-2026-73309High7.42026-09-08XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token…
CVE-2026-33389High7.52026-09-08An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target…
CVE-2026-33388High7.42026-09-08An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticat…
CVE-2026-79602High8.82026-09-08A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.
CVE-2026-77106High8.82026-09-08Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update…
CVE-2026-77105High8.82026-09-08CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Up…
CVE-2026-77104High7.52026-09-08CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
CVE-2026-77103High7.52026-09-08CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenanc…
CVE-2026-77102High7.52026-09-08CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommS…
CVE-2026-77101High7.52026-09-08CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Comm…
CVE-2026-77097High8.22026-09-08Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade…
CVE-2026-77091High7.82026-09-08DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Ex…
CVE-2026-75021High8.12026-09-08fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a bro…
CVE-2026-86713High7.12026-09-08PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and…
CVE-2026-86712High8.82026-09-08SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the No…
CVE-2026-86711High7.42026-09-08electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Ren…
CVE-2026-77968High8.22026-09-08A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator us…
CVE-2026-74860High8.52026-09-08A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document cont…
CVE-2026-3174High7.52026-09-08The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAut…
CVE-2026-16502High8.82026-09-08The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via…
CVE-2026-9331High7.12026-09-08The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due…
CVE-2026-67367High8.62026-09-08A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager…
CVE-2026-62650High8.82026-09-08A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not pro…
CVE-2026-62649High7.52026-09-08A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resources when processing…
CVE-2026-62648High7.52026-09-08A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained in pre-authenticated HTTP messages is no…
CVE-2026-62647High7.42026-09-08A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as se…
CVE-2026-62646High7.42026-09-08A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an algorithm with insufficient randomness…
CVE-2026-34223High8.22026-09-08A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All ver…
CVE-2026-84820High7.12026-09-08Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions.
CVE-2026-84818High7.12026-09-08Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.
CVE-2026-84817High7.12026-09-08Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.
CVE-2026-81806High7.22026-09-08Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from…
CVE-2026-81798High7.12026-09-08Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affec…
CVE-2026-81790High7.52026-09-08Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Se…
CVE-2026-81781High7.12026-09-08Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This…
CVE-2026-76561High7.22026-09-08A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uplo…
CVE-2026-71375High7.42026-09-08Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from…
CVE-2026-48888High7.52026-09-08Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before…
CVE-2026-76967High7.82026-09-08SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with l…
CVE-2026-76958High8.52026-09-08SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privile…
CVE-2026-66767High7.72026-09-08SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a p…
CVE-2026-86544High8.12026-09-07knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Att…
CVE-2026-86541High8.32026-09-07knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files out…
CVE-2026-86540High7.82026-09-07knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary…
CVE-2026-86539High7.22026-09-07knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to cal…
CVE-2026-86538High7.52026-09-07knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read…
CVE-2026-86439High8.82026-09-07knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside t…
CVE-2026-86438High7.22026-09-07Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install mo…
CVE-2026-86437High7.22026-09-07Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin a…
CVE-2026-86287High7.52026-09-07Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers o…
CVE-2026-16028High7.52026-09-07Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table. Whe…
CVE-2026-86504High7.82026-09-07In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution
CVE-2026-86502High8.42026-09-07In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts
CVE-2026-86498High7.72026-09-07In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission
CVE-2026-86494High7.72026-09-07In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues
CVE-2026-86492High8.52026-09-07In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
CVE-2026-86482High8.82026-09-07In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation
CVE-2026-86479High8.12026-09-07In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR
CVE-2026-80166High7.82026-09-07Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Privilege Management vulner…
CVE-2026-79639High7.62026-09-07Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vuln…
CVE-2026-80127High7.22026-09-07Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special E…
CVE-2026-79691High7.32026-09-07Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vuln…
CVE-2026-79643High7.32026-09-07Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Incorrect Operator vulnerabil…
CVE-2026-79645High8.22026-09-07Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical F…
CVE-2026-79644High7.42026-09-07Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vuln…
CVE-2026-78480High7.52026-09-07Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical F…
CVE-2026-6377High7.52026-09-07Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Ma…
CVE-2026-19843High8.42026-09-07A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) in…
CVE-2026-18453High7.52026-09-07A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attac…
CVE-2026-18355High7.52026-09-07A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read fr…
CVE-2026-86452High7.52026-09-07Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting…
CVE-2026-80164High7.42026-09-07Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vuln…
CVE-2026-80131High7.42026-09-07Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to…
CVE-2026-80130High7.12026-09-07Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability…
CVE-2026-76560High7.52026-09-07A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stor…
CVE-2026-14444High7.52026-09-07The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient autho…
CVE-2026-86435High7.52026-09-07commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions…
CVE-2026-86434High7.52026-09-07league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restar…
CVE-2026-86433High7.52026-09-07commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirect…
CVE-2026-86431High7.22026-09-07league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an…
CVE-2026-86430High7.52026-09-07league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emp…
CVE-2026-86429High7.52026-09-07The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and A…
CVE-2026-86428High7.52026-09-07commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes…
CVE-2026-86427High8.82026-09-07LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtoo…
CVE-2026-86306High7.32026-09-07A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part…
CVE-2026-86305High7.32026-09-07A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue…
CVE-2026-86303High7.32026-09-07A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. E…
CVE-2026-80135High7.52026-09-07Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Check or Handling of Except…
CVE-2026-80134High7.72026-09-07Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulner…
CVE-2026-80133High7.42026-09-07Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability…
CVE-2026-80132High8.12026-09-07ell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Fu…
CVE-2026-79678High8.12026-09-07A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corr…
CVE-2026-6431High7.22026-09-07The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin…
CVE-2026-61409High7.32026-09-07Dell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command…
CVE-2022-51017High7.52026-09-07PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 327…
CVE-2026-86404High8.82026-09-07EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implemen…
CVE-2026-86300High7.32026-09-07A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes impro…
CVE-2026-86298High7.32026-09-07A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /delete_subject.php. P…