Search
37,428 CVEs · Critical severity
CVEs (37,428, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 326–350 of 37,428 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-92034 | CRITICAL | Patched | 9.1 | 2026-09-15 | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92032 | CRITICAL | Patched | 9.6 | 2026-09-15 | Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunde… |
| CVE-2026-9202 | CRITICAL | Patched | 9.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true (documented … |
| CVE-2026-92018 | CRITICAL | Patched | 9.6 | 2026-09-15 | Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, T… |
| CVE-2026-91998 | CRITICAL | 9.9 | 2026-09-15 | Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain… | |
| CVE-2026-91995 | CRITICAL | Patched | 9.1 | 2026-09-15 | pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as… |
| CVE-2026-9198 | CRITICAL | Patched | 9.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code… |
| CVE-2026-9195 | CRITICAL | Patched | 9.3 | 2026-08-05 | A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administ… |
| CVE-2026-91949 | CRITICAL | Patched | 9.3 | 2026-09-15 | FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite serv… |
| CVE-2026-91939 | CRITICAL | 9.8 | 2026-09-15 | Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary … | |
| CVE-2026-9193 | CRITICAL | Patched | 9.9 | 2026-08-05 | An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privi… |
| CVE-2026-9192 | CRITICAL | Patched | 9.8 | 2026-08-05 | An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass pass… |
| CVE-2026-9191 | CRITICAL | Patched | 9.6 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC … |
| CVE-2026-9190 | CRITICAL | Patched | 9.1 | 2026-08-05 | An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and a… |
| CVE-2026-91881 | CRITICAL | 9.0 | 2026-10-14 | Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated … | |
| CVE-2026-91843 | CRITICAL | 9.8 | 2026-09-16 | A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges. | |
| CVE-2026-9182 | CRITICAL | Patched | 9.8 | 2026-07-06 | Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endp… |
| CVE-2026-9181 | CRITICAL | Patched | 9.8 | 2026-07-06 | Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by se… |
| CVE-2026-9177 | CRITICAL | — | 2026-07-29 | A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This … | |
| CVE-2026-91749 | CRITICAL | Patched | 9.6 | 2026-09-15 | Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML pag… |
| CVE-2026-91738 | CRITICAL | Patched | 9.6 | 2026-09-15 | Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… |
| CVE-2026-91729 | CRITICAL | Patched | 9.6 | 2026-09-15 | Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the s… |
| CVE-2026-91728 | CRITICAL | Patched | 9.6 | 2026-09-15 | Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium sec… |
| CVE-2026-91718 | CRITICAL | Patched | 9.6 | 2026-09-15 | Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium se… |
| CVE-2026-91716 | CRITICAL | Patched | 9.6 | 2026-09-15 | Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium se… |