Search
4,542 CVEs · Critical severity
CVEs (4,542, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 376–400 of 4,542 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-111391 | CRITICAL | 8.1 | 2026-10-16 | SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbo… | |
| CVE-2026-111472 | CRITICAL | — | 2026-10-16 | An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database … | |
| CVE-2026-94388 | CRITICAL | Patched | 9.3 | 2026-10-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection… |
| CVE-2026-94169 | CRITICAL | 10.0 | 2026-10-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1. | |
| CVE-2026-104730 | CRITICAL | 9.8 | 2026-10-16 | The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and incl… | |
| CVE-2026-89079 | CRITICAL | 9.8 | 2026-10-16 | The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not pr… | |
| CVE-2026-103768 | CRITICAL | 9.8 | 2026-10-16 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the init… | |
| CVE-2026-109515 | CRITICAL | 9.8 | 2026-10-16 | The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,… | |
| CVE-2026-109219 | CRITICAL | 9.8 | 2026-10-16 | The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validati… | |
| CVE-2026-104798 | CRITICAL | 9.8 | 2026-10-16 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET para… | |
| CVE-2026-111444 | CRITICAL | Patched | 9.8 | 2026-10-16 | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline… |
| CVE-2026-94134 | CRITICAL | Patched | 9.1 | 2026-10-15 | The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it ac… |
| CVE-2026-111356 | CRITICAL | 7.4 | 2026-10-15 | MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attacker… | |
| CVE-2026-111329 | CRITICAL | 9.8 | 2026-10-15 | JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090.… | |
| CVE-2026-111322 | CRITICAL | 9.8 | 2026-10-15 | Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 … | |
| CVE-2026-111312 | CRITICAL | 7.7 | 2026-10-15 | OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by… | |
| CVE-2026-111283 | CRITICAL | Patched | 9.0 | 2026-10-15 | BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local adm… |
| CVE-2026-111281 | CRITICAL | Patched | 9.8 | 2026-10-15 | Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands… |
| CVE-2026-110916 | CRITICAL | Patched | 9.6 | 2026-10-15 | Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craft… |
| CVE-2026-105039 | CRITICAL | 9.6 | 2026-10-15 | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve … | |
| CVE-2026-105038 | CRITICAL | 9.8 | 2026-10-15 | The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote atta… | |
| CVE-2026-105037 | CRITICAL | 9.9 | 2026-10-15 | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying a… | |
| CVE-2026-105032 | CRITICAL | 9.1 | 2026-10-15 | The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain… | |
| CVE-2026-102764 | CRITICAL | Patched | 9.8 | 2026-10-15 | The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it receiv… |
| CVE-2026-57496 | CRITICAL | Patched | 9.6 | 2026-10-15 | NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8,… |