Search
37,428 CVEs · Critical severity
CVEs (37,428, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 126–150 of 37,428 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-109422 | CRITICAL | 8.1 | 2026-10-12 | NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge … | |
| CVE-2026-109373 | CRITICAL | Patched | 8.1 | 2026-10-12 | ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens b… |
| CVE-2026-109357 | CRITICAL | Patched | 8.1 | 2026-10-12 | LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters … |
| CVE-2026-109399 | CRITICAL | 8.1 | 2026-10-12 | SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedd… | |
| CVE-2026-109391 | CRITICAL | 8.1 | 2026-10-12 | Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/sy… | |
| CVE-2026-108549 | CRITICAL | 8.1 | 2026-10-10 | cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated update… | |
| CVE-2026-108157 | CRITICAL | Patched | 8.1 | 2026-10-09 | Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing au… |
| CVE-2026-33367 | CRITICAL | 8.1 | 2026-10-09 | SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader… | |
| CVE-2026-39460 | CRITICAL | 8.1 | 2026-10-09 | Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file… | |
| CVE-2026-107910 | CRITICAL | Patched | 8.1 | 2026-10-09 | An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execut… |
| CVE-2026-7827 | CRITICAL | Patched | 8.1 | 2026-10-09 | A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.4 allows… |
| CVE-2026-107183 | CRITICAL | 8.1 | 2026-10-07 | llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap … | |
| CVE-2026-82531 | CRITICAL | Patched | 8.1 | 2026-10-06 | Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template… |
| CVE-2026-77226 | CRITICAL | Patched | 8.1 | 2026-10-05 | Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly det… |
| CVE-2026-105293 | CRITICAL | 8.1 | 2026-10-05 | Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalida… | |
| CVE-2026-105211 | CRITICAL | Patched | 8.1 | 2026-10-04 | ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the… |
| CVE-2026-104467 | CRITICAL | Patched | 8.1 | 2026-10-02 | YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when p… |
| CVE-2026-103473 | CRITICAL | 8.1 | 2026-09-30 | Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Att… | |
| CVE-2026-94132 | CRITICAL | Patched | 8.1 | 2026-09-26 | Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming email… |
| CVE-2026-100684 | CRITICAL | Patched | 8.1 | 2026-09-26 | Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches t… |
| CVE-2026-90456 | CRITICAL | 8.1 | 2026-09-11 | An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies … | |
| CVE-2026-85427 | CRITICAL | Patched | 8.1 | 2026-09-03 | MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing … |
| CVE-2026-84189 | CRITICAL | Patched | 8.1 | 2026-09-01 | LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the de… |
| CVE-2026-70460 | CRITICAL | Patched | 8.1 | 2026-08-13 | rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree… |
| CVE-2026-53790 | CRITICAL | Patched | 8.1 | 2026-08-13 | rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through … |