Search
37,428 CVEs · Critical severity
CVEs (37,428, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 76–100 of 37,428 (capped at 500)
| CVE ID | Severity ↑ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-79846 | CRITICAL | 10.0 | 2026-10-22 | Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying h… | |
| CVE-2026-79847 | CRITICAL | 10.0 | 2026-10-22 | Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected… | |
| CVE-2026-79848 | CRITICAL | 10.0 | 2026-10-22 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Succe… | |
| CVE-2026-115384 | CRITICAL | Patched | 9.9 | 2026-10-22 | Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via un… |
| CVE-2026-115375 | CRITICAL | Patched | 9.9 | 2026-10-22 | Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw st… |
| CVE-2026-115377 | CRITICAL | Patched | 9.9 | 2026-10-22 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by… |
| CVE-2026-115372 | CRITICAL | Patched | 8.5 | 2026-10-22 | Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move o… |
| CVE-2026-115353 | CRITICAL | Patched | 8.6 | 2026-10-22 | Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute pa… |
| CVE-2026-114612 | CRITICAL | Patched | 9.9 | 2026-10-22 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reus… |
| CVE-2022-51026 | CRITICAL | Patched | 9.8 | 2026-10-22 | Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting clien… |
| CVE-2026-114611 | CRITICAL | 9.1 | 2026-10-22 | OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollme… | |
| CVE-2026-97631 | CRITICAL | — | 2026-10-22 | EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Su… | |
| CVE-2026-114607 | CRITICAL | Patched | 9.1 | 2026-10-22 | Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, … |
| CVE-2026-111497 | CRITICAL | — | 2026-10-22 | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attack… | |
| CVE-2026-102785 | CRITICAL | — | 2026-10-22 | Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incom… | |
| CVE-2026-115324 | CRITICAL | Patched | 8.1 | 2026-10-22 | mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory conte… |
| CVE-2026-112832 | CRITICAL | 9.8 | 2026-10-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File … | |
| CVE-2021-48014 | CRITICAL | 9.8 | 2026-10-22 | FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary fil… | |
| CVE-2021-48016 | CRITICAL | 9.8 | 2026-10-22 | DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauth… | |
| CVE-2026-112241 | CRITICAL | 9.8 | 2026-10-22 | Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5. | |
| CVE-2026-112327 | CRITICAL | 9.3 | 2026-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Ameli… | |
| CVE-2026-114220 | CRITICAL | 9.1 | 2026-10-22 | NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle at… | |
| CVE-2026-114219 | CRITICAL | 7.4 | 2026-10-22 | NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decryp… | |
| CVE-2026-96355 | CRITICAL | 9.1 | 2026-10-22 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0… | |
| CVE-2026-114661 | CRITICAL | Patched | 8.5 | 2026-10-22 | OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway … |