Search
333 CVEs · Critical severity
CVEs (333)
Showing 26–50 of 333
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-112862 | CRITICAL | 9.8 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Databa… | |
| CVE-2026-112860 | CRITICAL | 9.3 | 2026-10-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blin… | |
| CVE-2025-30054 | CRITICAL | — | 2026-10-23 | CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its … | |
| CVE-2025-30050 | CRITICAL | Patched | — | 2026-10-23 | CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untruste… |
| CVE-2025-30047 | CRITICAL | Patched | — | 2026-10-23 | CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, th… |
| CVE-2025-30046 | CRITICAL | — | 2026-10-23 | In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data … | |
| CVE-2026-63244 | CRITICAL | 9.8 | 2026-10-23 | An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authenti… | |
| CVE-2026-55981 | CRITICAL | 9.6 | 2026-10-23 | A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an … | |
| CVE-2026-94267 | CRITICAL | Patched | 9.0 | 2026-10-23 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability c… |
| CVE-2026-54630 | CRITICAL | Patched | 9.6 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the… |
| CVE-2026-115547 | CRITICAL | 9.1 | 2026-10-23 | An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator c… | |
| CVE-2026-19677 | CRITICAL | — | 2026-10-23 | An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbit… | |
| CVE-2026-110243 | CRITICAL | 9.9 | 2026-10-22 | The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configurat… | |
| CVE-2026-107861 | CRITICAL | 9.9 | 2026-10-22 | The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted… | |
| CVE-2026-97785 | CRITICAL | 10.0 | 2026-10-22 | Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-83938 | CRITICAL | 10.0 | 2026-10-22 | Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-111594 | CRITICAL | 8.1 | 2026-10-22 | InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device. | |
| CVE-2026-110063 | CRITICAL | 10.0 | 2026-10-22 | Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-109122 | CRITICAL | 9.1 | 2026-10-22 | The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An a… | |
| CVE-2026-105014 | CRITICAL | 9.1 | 2026-10-22 | Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-114625 | CRITICAL | Patched | 9.9 | 2026-10-22 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. … |
| CVE-2026-79876 | CRITICAL | 9.3 | 2026-10-22 | A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. S… | |
| CVE-2026-79875 | CRITICAL | 9.3 | 2026-10-22 | A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication co… | |
| CVE-2026-79874 | CRITICAL | 9.3 | 2026-10-22 | An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allo… | |
| CVE-2026-79873 | CRITICAL | 9.3 | 2026-10-22 | Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Succes… |