Search
4,542 CVEs · Critical severity
CVEs (4,542, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 426–450 of 4,542 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-109145 | CRITICAL | 9.8 | 2026-10-15 | The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered account… | |
| CVE-2026-101306 | CRITICAL | 9.8 | 2026-10-15 | SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor t… | |
| CVE-2026-108587 | CRITICAL | 9.8 | 2026-10-15 | The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and includin… | |
| CVE-2026-93483 | CRITICAL | — | 2026-10-15 | In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP… | |
| CVE-2026-110911 | CRITICAL | Patched | 9.8 | 2026-10-15 | Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's … |
| CVE-2026-110867 | CRITICAL | Patched | 8.5 | 2026-10-14 | Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. A… |
| CVE-2026-110864 | CRITICAL | Patched | 7.4 | 2026-10-14 | Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as ot… |
| CVE-2026-110862 | CRITICAL | Patched | 9.1 | 2026-10-14 | Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth… |
| CVE-2026-110858 | CRITICAL | Patched | 8.1 | 2026-10-14 | GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positi… |
| CVE-2026-108336 | CRITICAL | — | 2026-10-14 | When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to s… | |
| CVE-2026-108335 | CRITICAL | — | 2026-10-14 | When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting … | |
| CVE-2026-55684 | CRITICAL | Patched | 9.8 | 2026-10-14 | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded … |
| CVE-2026-55683 | CRITICAL | Patched | 9.8 | 2026-10-14 | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through ext… |
| CVE-2026-55680 | CRITICAL | Patched | 9.8 | 2026-10-14 | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL exp… |
| CVE-2026-85714 | CRITICAL | Patched | 9.1 | 2026-10-14 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 data… |
| CVE-2026-110770 | CRITICAL | 8.1 | 2026-10-14 | Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/us… | |
| CVE-2026-110536 | CRITICAL | 10.0 | 2026-10-14 | A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipu… | |
| CVE-2026-102748 | CRITICAL | Patched | — | 2026-10-14 | Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the admini… |
| CVE-2026-92152 | CRITICAL | Patched | — | 2026-10-14 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-… |
| CVE-2026-77371 | CRITICAL | Patched | — | 2026-10-14 | Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connect… |
| CVE-2026-55573 | CRITICAL | Patched | 9.8 | 2026-10-14 | e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file … |
| CVE-2026-55572 | CRITICAL | Patched | 10.0 | 2026-10-14 | e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username… |
| CVE-2026-108390 | CRITICAL | Patched | 9.9 | 2026-10-14 | Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escap… |
| CVE-2026-103415 | CRITICAL | — | 2026-10-14 | When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet.… | |
| CVE-2026-102476 | CRITICAL | — | 2026-10-14 | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache … |