Search
37,428 CVEs · Critical severity
CVEs (37,428, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 76–100 of 37,428 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-96587 | CRITICAL | 10.0 | 2026-09-29 | The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform s… | |
| CVE-2026-96560 | CRITICAL | 9.8 | 2026-09-23 | LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPy… | |
| CVE-2026-9648 | CRITICAL | 9.1 | 2026-06-11 | The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside… | |
| CVE-2026-9645 | CRITICAL | 9.9 | 2026-05-28 | Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system comp… | |
| CVE-2026-96408 | CRITICAL | 9.4 | 2026-10-07 | A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query… | |
| CVE-2026-96355 | CRITICAL | 9.1 | 2026-10-22 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0… | |
| CVE-2026-96350 | CRITICAL | 9.8 | 2026-09-30 | Subscriber Privilege Escalation in Estatik <= 4.3.5 versions. | |
| CVE-2026-96349 | CRITICAL | 10.0 | 2026-09-30 | Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions. | |
| CVE-2026-96331 | CRITICAL | 9.3 | 2026-10-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.Th… | |
| CVE-2026-96330 | CRITICAL | 9.3 | 2026-10-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injectio… | |
| CVE-2026-96328 | CRITICAL | 9.3 | 2026-10-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injectio… | |
| CVE-2026-96327 | CRITICAL | Patched | 9.3 | 2026-10-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue af… |
| CVE-2026-96320 | CRITICAL | Patched | 9.8 | 2026-10-13 | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96257 | CRITICAL | 10.0 | 2026-09-23 | A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a… | |
| CVE-2026-96252 | CRITICAL | Patched | 9.1 | 2026-10-13 | Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-96219 | CRITICAL | Patched | 9.8 | 2026-10-13 | Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96207 | CRITICAL | 10.0 | 2026-10-08 | Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-96119 | CRITICAL | Patched | 9.9 | 2026-10-13 | IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data saniti… |
| CVE-2026-96113 | CRITICAL | Patched | 9.8 | 2026-10-13 | Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96096 | CRITICAL | Patched | 9.8 | 2026-10-13 | Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96012 | CRITICAL | 9.9 | 2026-10-12 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorizati… | |
| CVE-2026-9589 | CRITICAL | — | 2026-10-20 | Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud de… | |
| CVE-2026-9586 | CRITICAL | Patched | 9.8 | 2026-07-17 | An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> … |
| CVE-2026-95848 | CRITICAL | Patched | 9.1 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Serv… |
| CVE-2026-95699 | CRITICAL | 9.6 | 2026-09-24 | Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data an… |