Search
4,542 CVEs · Critical severity
CVEs (4,542, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 401–425 of 4,542 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-55240 | CRITICAL | Patched | 9.1 | 2026-10-15 | Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTempla… |
| CVE-2026-47218 | CRITICAL | Patched | — | 2026-10-15 | runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directl… |
| CVE-2026-111235 | CRITICAL | Patched | 9.1 | 2026-10-15 | An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requ… |
| CVE-2026-102946 | CRITICAL | Patched | 9.1 | 2026-10-15 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() a… |
| CVE-2026-84731 | CRITICAL | 9.8 | 2026-10-15 | An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal m… | |
| CVE-2026-110812 | CRITICAL | Patched | 9.9 | 2026-10-15 | Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permi… |
| CVE-2026-57155 | CRITICAL | Patched | 9.9 | 2026-10-15 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnse… |
| CVE-2026-110958 | CRITICAL | 10.0 | 2026-10-15 | A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buff… | |
| CVE-2026-105474 | CRITICAL | — | 2026-10-15 | A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root. | |
| CVE-2026-47168 | CRITICAL | Patched | 9.1 | 2026-10-15 | EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is… |
| CVE-2026-110957 | CRITICAL | 10.0 | 2026-10-15 | A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Proc… | |
| CVE-2026-104586 | CRITICAL | 9.8 | 2026-10-15 | AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi. | |
| CVE-2026-99999 | CRITICAL | 9.3 | 2026-10-15 | In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets i… | |
| CVE-2026-109686 | CRITICAL | 9.8 | 2026-10-15 | Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a th… | |
| CVE-2026-109694 | CRITICAL | 9.8 | 2026-10-15 | Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5. | |
| CVE-2026-108497 | CRITICAL | 9.3 | 2026-10-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Ameli… | |
| CVE-2026-50619 | CRITICAL | — | 2026-10-15 | A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or … | |
| CVE-2026-50612 | CRITICAL | — | 2026-10-15 | An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerabil… | |
| CVE-2026-47786 | CRITICAL | — | 2026-10-15 | An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary comm… | |
| CVE-2026-34006 | CRITICAL | — | 2026-10-15 | A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to g… | |
| CVE-2026-19863 | CRITICAL | — | 2026-10-15 | An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused … | |
| CVE-2026-16438 | CRITICAL | — | 2026-10-15 | Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions… | |
| CVE-2026-16436 | CRITICAL | — | 2026-10-15 | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS… | |
| CVE-2026-102469 | CRITICAL | Patched | 5.9 | 2026-10-15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling co… |
| CVE-2026-101287 | CRITICAL | — | 2026-10-15 | Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application sto… |