Search
37,428 CVEs · Critical severity
CVEs (37,428, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 76–100 of 37,428 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-56292 | CRITICAL | Patched | 7.5 | 2026-07-09 | Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Expl… |
| CVE-2026-55203 | CRITICAL | Patched | 7.5 | 2026-06-18 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI re… |
| CVE-2025-15623 | CRITICAL | 7.5 | 2026-04-17 | Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sparx Syste… | |
| CVE-2025-15624 | CRITICAL | 7.5 | 2026-04-17 | Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authentication to … | |
| CVE-2025-14813 | CRITICAL | Patched | 7.5 | 2026-04-15 | : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associate… |
| CVE-2025-68428 | CRITICAL | Patched | 7.5 | 2026-01-05 | jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file … |
| CVE-2025-65015 | CRITICAL | Patched | 7.5 | 2025-11-18 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from … |
| CVE-2025-12601 | CRITICAL | Patched | 7.5 | 2025-11-01 | Denial of Service Due to SlowLoris.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2025-12423 | CRITICAL | Patched | 7.5 | 2025-10-28 | Protocol manipulation might lead to denial of service.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
| CVE-2025-12363 | CRITICAL | Patched | 7.5 | 2025-10-27 | Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2025-34234 | CRITICAL | Patched | 7.5 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain two hardcoded… |
| CVE-2025-5777 | CRITICAL | Patched | 7.5 | 2025-06-17 | Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server |
| CVE-2026-112005 | CRITICAL | Patched | 7.7 | 2026-10-18 | WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functi… |
| CVE-2026-102551 | CRITICAL | Patched | 7.7 | 2026-10-16 | Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third… |
| CVE-2026-111312 | CRITICAL | 7.7 | 2026-10-15 | OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by… | |
| CVE-2026-102490 | CRITICAL | Patched | 7.8 | 2026-09-30 | Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service acc… |
| CVE-2026-28659 | CRITICAL | 7.8 | 2026-09-08 | In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege with no additi… | |
| CVE-2025-12425 | CRITICAL | Patched | 7.8 | 2025-10-28 | Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
| CVE-2025-11462 | CRITICAL | Patched | 7.8 | 2025-10-07 | Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges. Insufficient… |
| CVE-2025-34235 | CRITICAL | Patched | 7.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (Windows client deployments) contain a regi… |
| CVE-2025-59158 | CRITICAL | Patched | 8.0 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable… |
| CVE-2026-115727 | CRITICAL | 8.1 | 2026-10-23 | AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attac… | |
| CVE-2026-111594 | CRITICAL | 8.1 | 2026-10-22 | InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device. | |
| CVE-2026-115324 | CRITICAL | Patched | 8.1 | 2026-10-22 | mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory conte… |
| CVE-2026-112408 | CRITICAL | Patched | 8.1 | 2026-10-21 | Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow… |