Search
333 CVEs · Critical severity
CVEs (333)
Showing 101–125 of 333
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-114575 | CRITICAL | 10.0 | 2026-10-22 | A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executin… | |
| CVE-2026-110264 | CRITICAL | Patched | 10.0 | 2026-10-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.… |
| CVE-2026-76531 | CRITICAL | 9.9 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a sof… | |
| CVE-2026-76302 | CRITICAL | 9.9 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a sof… | |
| CVE-2026-76299 | CRITICAL | 9.9 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a sof… | |
| CVE-2026-91403 | CRITICAL | 9.1 | 2026-10-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are aff… | |
| CVE-2026-114509 | CRITICAL | Patched | — | 2026-10-21 | Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credent… |
| CVE-2026-114383 | CRITICAL | 10.0 | 2026-10-21 | A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. T… | |
| CVE-2026-114382 | CRITICAL | 10.0 | 2026-10-21 | A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. T… | |
| CVE-2026-96639 | CRITICAL | Patched | 9.8 | 2026-10-21 | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame o… |
| CVE-2026-114139 | CRITICAL | Patched | — | 2026-10-21 | Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips applicatio… |
| CVE-2026-112408 | CRITICAL | Patched | 8.1 | 2026-10-21 | Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow… |
| CVE-2026-111811 | CRITICAL | Patched | 9.0 | 2026-10-21 | Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traf… |
| CVE-2026-111816 | CRITICAL | Patched | 9.3 | 2026-10-21 | Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the reje… |
| CVE-2026-111813 | CRITICAL | Patched | 10.0 | 2026-10-21 | Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This iss… |
| CVE-2026-105944 | CRITICAL | — | 2026-10-21 | Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authenticatio… | |
| CVE-2025-31699 | CRITICAL | Patched | 8.9 | 2026-10-21 | Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, inclu… |
| CVE-2026-89035 | CRITICAL | 7.4 | 2026-10-21 | MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured … | |
| CVE-2026-114493 | CRITICAL | 8.6 | 2026-10-21 | LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers… | |
| CVE-2026-111183 | CRITICAL | 9.8 | 2026-10-21 | GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected insta… | |
| CVE-2026-105869 | CRITICAL | Patched | — | 2026-10-21 | Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with… |
| CVE-2026-76475 | CRITICAL | 9.3 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisc… | |
| CVE-2026-76474 | CRITICAL | 9.8 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisc… | |
| CVE-2026-76473 | CRITICAL | 9.8 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisc… | |
| CVE-2026-76466 | CRITICAL | 9.8 | 2026-10-21 | A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device … |