Search
37,428 CVEs · Critical severity
CVEs (37,428, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 326–350 of 37,428 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-111998 | CRITICAL | 9.8 | 2026-10-18 | Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admi… | |
| CVE-2026-110886 | CRITICAL | 9.8 | 2026-10-18 | Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversatio… | |
| CVE-2026-110372 | CRITICAL | 9.8 | 2026-10-18 | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40. | |
| CVE-2026-109894 | CRITICAL | 9.3 | 2026-10-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Bo… | |
| CVE-2026-111911 | CRITICAL | Patched | 9.8 | 2026-10-17 | phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication o… |
| CVE-2026-104736 | CRITICAL | 9.8 | 2026-10-17 | The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout… | |
| CVE-2026-110653 | CRITICAL | 9.1 | 2026-10-17 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versi… | |
| CVE-2026-111823 | CRITICAL | Patched | 9.8 | 2026-10-17 | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. |
| CVE-2026-110759 | CRITICAL | Patched | 9.8 | 2026-10-16 | Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends… |
| CVE-2026-110757 | CRITICAL | Patched | 9.8 | 2026-10-16 | Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a fi… |
| CVE-2026-110756 | CRITICAL | Patched | 9.8 | 2026-10-16 | Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record con… |
| CVE-2026-110753 | CRITICAL | Patched | 9.8 | 2026-10-16 | Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns… |
| CVE-2026-96620 | CRITICAL | Patched | — | 2026-10-16 | Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading … |
| CVE-2026-68573 | CRITICAL | Patched | 9.8 | 2026-10-16 | Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly expose… |
| CVE-2026-108709 | CRITICAL | Patched | 9.8 | 2026-10-16 | Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house … |
| CVE-2026-102608 | CRITICAL | Patched | 9.0 | 2026-10-16 | ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes ins… |
| CVE-2026-111711 | CRITICAL | 9.8 | 2026-10-16 | Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames … | |
| CVE-2026-111708 | CRITICAL | 9.8 | 2026-10-16 | WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST… | |
| CVE-2026-111704 | CRITICAL | 9.8 | 2026-10-16 | LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token … | |
| CVE-2026-111693 | CRITICAL | 9.8 | 2026-10-16 | DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the buil… | |
| CVE-2026-111692 | CRITICAL | 9.8 | 2026-10-16 | DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcode… | |
| CVE-2026-111691 | CRITICAL | 7.4 | 2026-10-16 | WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-U… | |
| CVE-2026-111690 | CRITICAL | 9.8 | 2026-10-16 | Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-… | |
| CVE-2026-111687 | CRITICAL | 9.8 | 2026-10-16 | WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GE… | |
| CVE-2026-111675 | CRITICAL | 7.4 | 2026-10-16 | Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SM… |