Search
37,428 CVEs · Critical severity
CVEs (37,428, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 51–75 of 37,428 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-105216 | CRITICAL | Patched | 7.4 | 2026-10-04 | go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets Ins… |
| CVE-2026-105218 | CRITICAL | Patched | 7.4 | 2026-10-04 | gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider A… |
| CVE-2026-67404 | CRITICAL | Patched | 7.4 | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls back to [{ver… |
| CVE-2026-70452 | CRITICAL | Patched | 7.4 | 2026-08-13 | rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures dur… |
| CVE-2026-53793 | CRITICAL | Patched | 7.4 | 2026-08-13 | rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths th… |
| CVE-2026-60007 | CRITICAL | Patched | 7.4 | 2026-08-04 | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures… |
| CVE-2026-62232 | CRITICAL | Patched | 7.4 | 2026-07-17 | Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authoriza… |
| CVE-2026-35560 | CRITICAL | Patched | 7.4 | 2026-04-03 | Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to i… |
| CVE-2026-35561 | CRITICAL | Patched | 7.4 | 2026-04-03 | Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to inter… |
| CVE-2025-40800 | CRITICAL | 7.4 | 2025-12-09 | A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versi… | |
| CVE-2025-12383 | CRITICAL | 7.4 | 2025-11-18 | In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, … | |
| CVE-2026-102068 | CRITICAL | 7.5 | 2026-10-14 | A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a cra… | |
| CVE-2026-102070 | CRITICAL | 7.5 | 2026-10-14 | A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker … | |
| CVE-2026-28745 | CRITICAL | 7.5 | 2026-10-09 | Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious … | |
| CVE-2026-102167 | CRITICAL | 7.5 | 2026-10-06 | On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the… | |
| CVE-2026-21589 | CRITICAL | Patched | 7.5 | 2026-10-05 | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Cen… |
| CVE-2026-97161 | CRITICAL | Patched | 7.5 | 2026-09-26 | Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 |
| CVE-2026-43832 | CRITICAL | 7.5 | 2026-07-31 | A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature… | |
| CVE-2026-43831 | CRITICAL | 7.5 | 2026-07-31 | A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code execution. | |
| CVE-2026-43829 | CRITICAL | 7.5 | 2026-07-31 | A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature… | |
| CVE-2026-65886 | CRITICAL | Patched | 7.5 | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files. |
| CVE-2026-65889 | CRITICAL | Patched | 7.5 | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories. |
| CVE-2026-58161 | CRITICAL | Patched | 7.5 | 2026-07-29 | Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.… |
| CVE-2026-50736 | CRITICAL | Patched | 7.5 | 2026-07-28 | The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at t… |
| CVE-2026-50737 | CRITICAL | Patched | 7.5 | 2026-07-28 | When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because the … |