Search
37,428 CVEs · Critical severity
CVEs (37,428, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 51–75 of 37,428 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-97064 | CRITICAL | 9.1 | 2026-09-25 | X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenti… | |
| CVE-2026-97063 | CRITICAL | 9.1 | 2026-09-25 | X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them… | |
| CVE-2026-97016 | CRITICAL | 9.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-9701 | CRITICAL | 9.8 | 2026-07-08 | The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of th… | |
| CVE-2026-9698 | CRITICAL | Patched | 9.8 | 2026-06-09 | DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were writt… |
| CVE-2026-9695 | CRITICAL | 9.8 | 2026-07-08 | An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to the server. | |
| CVE-2026-96934 | CRITICAL | Patched | 9.8 | 2026-10-13 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96924 | CRITICAL | Patched | 9.8 | 2026-10-13 | Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network. |
| CVE-2026-9691 | CRITICAL | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions. | |
| CVE-2026-96909 | CRITICAL | Patched | 9.8 | 2026-10-13 | Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96891 | CRITICAL | 9.8 | 2026-09-24 | A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the … | |
| CVE-2026-96864 | CRITICAL | 9.8 | 2026-10-13 | Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-96822 | CRITICAL | 9.3 | 2026-09-30 | Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions. | |
| CVE-2026-96809 | CRITICAL | Patched | 9.3 | 2026-10-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind… |
| CVE-2026-96760 | CRITICAL | 9.8 | 2026-09-28 | Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object an… | |
| CVE-2026-96759 | CRITICAL | Patched | 9.8 | 2026-09-23 | orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrar… |
| CVE-2026-96758 | CRITICAL | Patched | 9.8 | 2026-09-23 | orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template lite… |
| CVE-2026-96757 | CRITICAL | Patched | 9.8 | 2026-09-23 | orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaS… |
| CVE-2026-96755 | CRITICAL | 9.8 | 2026-09-23 | orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Att… | |
| CVE-2026-96754 | CRITICAL | Patched | 9.8 | 2026-09-23 | orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. A… |
| CVE-2026-96659 | CRITICAL | Patched | 9.1 | 2026-10-01 | A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting re… |
| CVE-2026-96639 | CRITICAL | Patched | 9.8 | 2026-10-21 | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame o… |
| CVE-2026-96620 | CRITICAL | Patched | — | 2026-10-16 | Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading … |
| CVE-2026-9660 | CRITICAL | 9.1 | 2026-10-20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).… | |
| CVE-2026-9659 | CRITICAL | 9.1 | 2026-10-20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).… |