Search
333 CVEs · Critical severity
CVEs (333)
Showing 301–325 of 333
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-112393 | CRITICAL | Patched | — | 2026-10-19 | Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data … |
| CVE-2026-112780 | CRITICAL | Patched | 8.8 | 2026-10-19 | Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with … |
| CVE-2026-112779 | CRITICAL | Patched | 9.8 | 2026-10-19 | Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/tran… |
| CVE-2026-112776 | CRITICAL | Patched | 9.8 | 2026-10-19 | Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllow… |
| CVE-2026-109437 | CRITICAL | Patched | 9.8 | 2026-10-19 | Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authe… |
| CVE-2026-112377 | CRITICAL | 7.4 | 2026-10-19 | CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from … | |
| CVE-2026-111862 | CRITICAL | 9.8 | 2026-10-19 | Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC… | |
| CVE-2026-107188 | CRITICAL | 9.6 | 2026-10-19 | A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can brow… | |
| CVE-2026-107083 | CRITICAL | 9.8 | 2026-10-19 | SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID. | |
| CVE-2026-111058 | CRITICAL | Patched | 9.8 | 2026-10-19 | Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to cre… |
| CVE-2026-111057 | CRITICAL | Patched | 10.0 | 2026-10-19 | Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the… |
| CVE-2026-109432 | CRITICAL | Patched | 9.8 | 2026-10-19 | Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query express… |
| CVE-2026-107081 | CRITICAL | 9.8 | 2026-10-19 | SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, adm… | |
| CVE-2026-112296 | CRITICAL | 9.8 | 2026-10-19 | FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms a… | |
| CVE-2026-112292 | CRITICAL | 9.8 | 2026-10-19 | CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase co… | |
| CVE-2026-78162 | CRITICAL | Patched | — | 2026-10-19 | Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazel… |
| CVE-2026-71253 | CRITICAL | Patched | 9.8 | 2026-10-19 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker… |
| CVE-2026-90910 | CRITICAL | Patched | 9.8 | 2026-10-19 | Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content… |
| CVE-2026-111406 | CRITICAL | 9.9 | 2026-10-19 | Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web … | |
| CVE-2026-110887 | CRITICAL | 9.9 | 2026-10-19 | Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a… | |
| CVE-2026-103091 | CRITICAL | Patched | — | 2026-10-19 | Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC r… |
| CVE-2026-102503 | CRITICAL | Patched | — | 2026-10-19 | Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) i… |
| CVE-2026-108983 | CRITICAL | 9.8 | 2026-10-19 | A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . | |
| CVE-2024-4457 | CRITICAL | 9.1 | 2026-10-18 | The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input… | |
| CVE-2026-112005 | CRITICAL | Patched | 7.7 | 2026-10-18 | WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functi… |