Search
37,428 CVEs · Critical severity
CVEs (37,428, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 226–250 of 37,428 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-93606 | CRITICAL | Patched | 10.0 | 2026-09-18 | vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rej… |
| CVE-2026-93605 | CRITICAL | Patched | 10.0 | 2026-09-18 | vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modu… |
| CVE-2026-93603 | CRITICAL | Patched | 10.0 | 2026-09-18 | vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code calls a host-p… |
| CVE-2026-93582 | CRITICAL | 9.4 | 2026-10-12 | The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environmen… | |
| CVE-2026-93577 | CRITICAL | Patched | 9.9 | 2026-09-24 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions coul… |
| CVE-2026-93483 | CRITICAL | — | 2026-10-15 | In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP… | |
| CVE-2026-93479 | CRITICAL | 8.1 | 2026-10-14 | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex c… | |
| CVE-2026-93475 | CRITICAL | — | 2026-10-20 | The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO… | |
| CVE-2026-93467 | CRITICAL | 9.8 | 2026-09-18 | The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending malicious… | |
| CVE-2026-93425 | CRITICAL | Patched | 9.9 | 2026-09-24 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from… |
| CVE-2026-93399 | CRITICAL | 9.1 | 2026-09-25 | The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_comple… | |
| CVE-2026-93388 | CRITICAL | 9.8 | 2026-10-14 | The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all version… | |
| CVE-2026-93374 | CRITICAL | Patched | 9.6 | 2026-09-17 | Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craft… |
| CVE-2026-93373 | CRITICAL | Patched | 9.6 | 2026-09-17 | Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension.… |
| CVE-2026-93372 | CRITICAL | Patched | 9.6 | 2026-09-17 | Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML pa… |
| CVE-2026-93352 | CRITICAL | Patched | 9.8 | 2026-09-23 | Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden_extensions blocklist in config/… |
| CVE-2026-93291 | CRITICAL | 9.4 | 2026-09-24 | Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code. | |
| CVE-2026-93228 | CRITICAL | 9.1 | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcou… | |
| CVE-2026-93207 | CRITICAL | 9.8 | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry svcauth_gss_decode_credbody() wr… | |
| CVE-2026-9319 | CRITICAL | Patched | 9.0 | 2026-06-01 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security. |
| CVE-2026-9311 | CRITICAL | Patched | 9.0 | 2026-06-01 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls. |
| CVE-2026-93088 | CRITICAL | 9.8 | 2026-09-22 | SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an… | |
| CVE-2026-93034 | CRITICAL | 9.8 | 2026-10-08 | SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _mayb… | |
| CVE-2026-93029 | CRITICAL | 9.0 | 2026-10-02 | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface. | |
| CVE-2026-93019 | CRITICAL | Patched | 9.1 | 2026-09-18 | Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. The reader unpacks the two-byte colour … |