Search
37,428 CVEs · Critical severity
CVEs (37,428, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 426–450 of 37,428 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-9093 | CRITICAL | 9.8 | 2026-05-28 | In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function… | |
| CVE-2026-90924 | CRITICAL | Patched | 9.8 | 2026-09-28 | Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Pass… |
| CVE-2026-90920 | CRITICAL | 9.8 | 2026-10-12 | IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | |
| CVE-2026-9092 | CRITICAL | 9.1 | 2026-05-28 | Casdoor versions 2.362.0 and earlier contain a vulnerability involving unverified email binding that may enable account takeover. The getExistUserByBindingRule function mat… | |
| CVE-2026-90919 | CRITICAL | 9.8 | 2026-09-14 | LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes the first clien… | |
| CVE-2026-90910 | CRITICAL | Patched | 9.8 | 2026-10-19 | Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content… |
| CVE-2026-9090 | CRITICAL | 9.1 | 2026-05-28 | Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCert… | |
| CVE-2026-90898 | CRITICAL | 9.8 | 2026-09-14 | Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. … | |
| CVE-2026-90847 | CRITICAL | 9.1 | 2026-09-15 | A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulati… | |
| CVE-2026-90823 | CRITICAL | 9.8 | 2026-09-17 | FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unaut… | |
| CVE-2026-90822 | CRITICAL | 9.8 | 2026-09-17 | FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An una… | |
| CVE-2026-9082 | CRITICAL | Patched | 9.8 | 2026-05-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal co… |
| CVE-2026-90817 | CRITICAL | 9.8 | 2026-09-20 | An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potenti… | |
| CVE-2026-9079 | CRITICAL | Patched | 9.8 | 2026-07-03 | libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent tra… |
| CVE-2026-9074 | CRITICAL | Patched | 9.1 | 2026-07-08 | IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality. |
| CVE-2026-90711 | CRITICAL | Patched | 9.1 | 2026-09-15 | proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through… |
| CVE-2026-90703 | CRITICAL | 9.1 | 2026-09-14 | A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShare. Such manipulation of the argu… | |
| CVE-2026-90702 | CRITICAL | 9.1 | 2026-09-14 | A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partition causes os c… | |
| CVE-2026-90699 | CRITICAL | 9.9 | 2026-09-14 | A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argumen… | |
| CVE-2026-90693 | CRITICAL | 9.9 | 2026-09-14 | A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary… | |
| CVE-2026-90692 | CRITICAL | 9.9 | 2026-09-14 | A vulnerability was detected in D-Link DIR-878 120B05. This affects the function SetDynamicDNSIPv6Settings of the component Dynamic DNS IPv6 Settings. The manipulation of t… | |
| CVE-2026-90680 | CRITICAL | 9.9 | 2026-09-14 | A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207. The impacted element is the function strcpy of the file /HNAP1/SetStaticRouteSettings of the compo… | |
| CVE-2026-9067 | CRITICAL | Patched | 9.1 | 2026-06-10 | The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the … |
| CVE-2026-90608 | CRITICAL | 9.9 | 2026-09-14 | A flaw has been found in Totolink A3002MU Hh-B20211125.1046. The affected element is the function formPortFw of the file /boafrm/formPortFw of the component boa. This manip… | |
| CVE-2026-90607 | CRITICAL | 9.9 | 2026-09-14 | A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The m… |