Search
37,428 CVEs · Critical severity
CVEs (37,428, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 151–175 of 37,428 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-43631 | CRITICAL | Patched | 8.1 | 2026-08-06 | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enable… |
| CVE-2026-43632 | CRITICAL | Patched | 8.1 | 2026-08-06 | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /infil… |
| CVE-2026-43629 | CRITICAL | Patched | 8.1 | 2026-08-06 | llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write siz… |
| CVE-2026-39923 | CRITICAL | Patched | 8.1 | 2026-08-05 | Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting … |
| CVE-2026-67192 | CRITICAL | Patched | 8.1 | 2026-07-29 | Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending ma… |
| CVE-2026-58179 | CRITICAL | Patched | 8.1 | 2026-07-29 | The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.1… |
| CVE-2026-55200 | CRITICAL | Patched | 8.1 | 2026-06-17 | libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. R… |
| CVE-2026-48906 | CRITICAL | Patched | 8.1 | 2026-05-27 | The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites. |
| CVE-2026-48242 | CRITICAL | Patched | 8.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php. The credentials are em… |
| CVE-2026-8178 | CRITICAL | Patched | 8.1 | 2026-05-08 | An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC c… |
| CVE-2026-34759 | CRITICAL | Patched | 8.1 | 2026-04-02 | OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middl… |
| CVE-2025-40938 | CRITICAL | Patched | 8.1 | 2025-12-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could allow an attack… |
| CVE-2025-40801 | CRITICAL | 8.1 | 2025-12-09 | A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional Translator for STEP (All versions), NX … | |
| CVE-2025-14307 | CRITICAL | 8.1 | 2025-12-09 | An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create tempor… | |
| CVE-2025-11899 | CRITICAL | 8.1 | 2025-10-17 | Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate ver… | |
| CVE-2025-34199 | CRITICAL | Patched | 8.1 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 (VA and SaaS deployments) contain insecu… |
| CVE-2026-102667 | CRITICAL | 8.3 | 2026-10-01 | Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access… | |
| CVE-2026-100551 | CRITICAL | Patched | 8.3 | 2026-09-26 | OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerpri… |
| CVE-2026-101158 | CRITICAL | 8.4 | 2026-10-06 | A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (X… | |
| CVE-2026-79774 | CRITICAL | Patched | 8.4 | 2026-08-25 | Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users … |
| CVE-2025-11957 | CRITICAL | Patched | 8.4 | 2025-10-22 | Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temp… |
| CVE-2025-59974 | CRITICAL | Patched | 8.4 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Junos Space Security Director allows an attacker to inject maliciou… |
| CVE-2026-115372 | CRITICAL | Patched | 8.5 | 2026-10-22 | Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move o… |
| CVE-2026-114661 | CRITICAL | Patched | 8.5 | 2026-10-22 | OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway … |
| CVE-2026-110867 | CRITICAL | Patched | 8.5 | 2026-10-14 | Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. A… |