Search
37,428 CVEs · Critical severity
CVEs (37,428, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 26–50 of 37,428 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-97720 | CRITICAL | Patched | 9.1 | 2026-10-07 | Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources serve… |
| CVE-2026-97670 | CRITICAL | 9.1 | 2026-10-10 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly v… | |
| CVE-2026-97668 | CRITICAL | 9.8 | 2026-10-14 | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10… | |
| CVE-2026-97657 | CRITICAL | 9.8 | 2026-10-14 | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and i… | |
| CVE-2026-97637 | CRITICAL | 9.8 | 2026-10-02 | The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerab… | |
| CVE-2026-97631 | CRITICAL | — | 2026-10-22 | EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Su… | |
| CVE-2026-97468 | CRITICAL | Patched | 9.1 | 2026-10-09 | Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/ha… |
| CVE-2026-97413 | CRITICAL | 9.8 | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write usr_len is read from a network-… | |
| CVE-2026-97381 | CRITICAL | Patched | 9.9 | 2026-10-13 | Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermit… |
| CVE-2026-97360 | CRITICAL | 10.0 | 2026-09-24 | HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete file… | |
| CVE-2026-97359 | CRITICAL | 10.0 | 2026-09-24 | HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code exec… | |
| CVE-2026-9733 | CRITICAL | 9.1 | 2026-06-23 | Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, th… | |
| CVE-2026-97283 | CRITICAL | 9.8 | 2026-10-05 | Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Po… | |
| CVE-2026-97274 | CRITICAL | 9.8 | 2026-09-30 | Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions. | |
| CVE-2026-9726 | CRITICAL | Patched | 9.8 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This iss… |
| CVE-2026-9725 | CRITICAL | 9.1 | 2026-07-03 | The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is du… | |
| CVE-2026-97248 | CRITICAL | 9.8 | 2026-09-30 | Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions. | |
| CVE-2026-97230 | CRITICAL | 9.8 | 2026-09-24 | IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Python script s… | |
| CVE-2026-97229 | CRITICAL | Patched | 10.0 | 2026-10-13 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, co… |
| CVE-2026-97205 | CRITICAL | 8.1 | 2026-10-14 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing … | |
| CVE-2026-97196 | CRITICAL | 9.1 | 2026-09-30 | Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass. This issue affects GiveWP: from n/a through 4.16.9. | |
| CVE-2026-97163 | CRITICAL | Patched | 9.8 | 2026-09-26 | Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 |
| CVE-2026-97161 | CRITICAL | Patched | 7.5 | 2026-09-26 | Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 |
| CVE-2026-97160 | CRITICAL | Patched | 8.8 | 2026-09-26 | Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 |
| CVE-2026-9711 | CRITICAL | 9.8 | 2026-06-30 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versions up to, and… |