Search
1,463 CVEs · Critical severity
CVEs (1,463, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 476–500 of 1,463 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-101950 | CRITICAL | 9.8 | 2026-10-14 | A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of s… | |
| CVE-2026-91881 | CRITICAL | 9.0 | 2026-10-14 | Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated … | |
| CVE-2026-86002 | CRITICAL | Patched | 9.0 | 2026-10-14 | Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options comman… |
| CVE-2026-102893 | CRITICAL | Patched | — | 2026-10-14 | Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active a… |
| CVE-2026-97205 | CRITICAL | 8.1 | 2026-10-14 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing … | |
| CVE-2026-93479 | CRITICAL | 8.1 | 2026-10-14 | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex c… | |
| CVE-2026-59774 | CRITICAL | 9.8 | 2026-10-14 | Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated … | |
| CVE-2026-15176 | CRITICAL | 8.1 | 2026-10-14 | A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive r… | |
| CVE-2026-110650 | CRITICAL | 9.8 | 2026-10-14 | The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell… | |
| CVE-2026-110649 | CRITICAL | Patched | 9.8 | 2026-10-14 | Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can na… |
| CVE-2026-110646 | CRITICAL | Patched | 8.1 | 2026-10-14 | Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. … |
| CVE-2026-110645 | CRITICAL | Patched | 9.8 | 2026-10-14 | Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into… |
| CVE-2026-110644 | CRITICAL | 9.8 | 2026-10-14 | nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file … | |
| CVE-2026-110643 | CRITICAL | 9.8 | 2026-10-14 | transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeA… | |
| CVE-2026-110640 | CRITICAL | 9.8 | 2026-10-14 | Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language… | |
| CVE-2026-110639 | CRITICAL | Patched | 9.8 | 2026-10-14 | @mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or ta… |
| CVE-2026-110638 | CRITICAL | 9.8 | 2026-10-14 | doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). At… | |
| CVE-2026-110636 | CRITICAL | 9.8 | 2026-10-14 | pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied … | |
| CVE-2026-110635 | CRITICAL | Patched | 9.8 | 2026-10-14 | webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attack… |
| CVE-2026-110634 | CRITICAL | Patched | 9.8 | 2026-10-14 | git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attack… |
| CVE-2026-110632 | CRITICAL | 8.1 | 2026-10-14 | Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking t… | |
| CVE-2026-110631 | CRITICAL | 9.8 | 2026-10-14 | Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty… | |
| CVE-2026-110628 | CRITICAL | 8.6 | 2026-10-14 | Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-3… | |
| CVE-2026-110616 | CRITICAL | 8.1 | 2026-10-14 | NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token f… | |
| CVE-2026-110612 | CRITICAL | 9.8 | 2026-10-14 | vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. … |