Search
37,428 CVEs · Critical severity
CVEs (37,428, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 201–225 of 37,428 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-93927 | CRITICAL | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0. | |
| CVE-2026-93909 | CRITICAL | Patched | 9.1 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled. |
| CVE-2026-9390 | CRITICAL | Patched | 9.1 | 2026-08-03 | XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the Si… |
| CVE-2026-93895 | CRITICAL | Patched | 9.1 | 2026-10-13 | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods. |
| CVE-2026-9388 | CRITICAL | 9.8 | 2026-05-24 | A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of the componen… | |
| CVE-2026-9387 | CRITICAL | 9.8 | 2026-05-24 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the compo… | |
| CVE-2026-9386 | CRITICAL | 9.8 | 2026-05-24 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component Web Manage… | |
| CVE-2026-9385 | CRITICAL | 9.8 | 2026-05-24 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component W… | |
| CVE-2026-9384 | CRITICAL | 9.8 | 2026-05-24 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component… | |
| CVE-2026-93839 | CRITICAL | 9.8 | 2026-09-18 | LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary no… | |
| CVE-2026-93765 | CRITICAL | Patched | 9.1 | 2026-09-18 | Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenti… |
| CVE-2026-93762 | CRITICAL | Patched | 9.8 | 2026-09-18 | Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-mem… |
| CVE-2026-93742 | CRITICAL | 9.9 | 2026-09-19 | A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the a… | |
| CVE-2026-93741 | CRITICAL | 10.0 | 2026-09-19 | A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manip… | |
| CVE-2026-93740 | CRITICAL | 10.0 | 2026-09-18 | A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the argu… | |
| CVE-2026-93739 | CRITICAL | 9.9 | 2026-09-18 | A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argum… | |
| CVE-2026-93738 | CRITICAL | 9.9 | 2026-09-18 | A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the a… | |
| CVE-2026-93698 | CRITICAL | 9.9 | 2026-10-02 | Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. | |
| CVE-2026-93697 | CRITICAL | 9.0 | 2026-10-02 | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface. | |
| CVE-2026-93674 | CRITICAL | Patched | 9.8 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. |
| CVE-2026-93647 | CRITICAL | 9.3 | 2026-09-25 | An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing th… | |
| CVE-2026-93643 | CRITICAL | 9.8 | 2026-09-25 | When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fie… | |
| CVE-2026-93642 | CRITICAL | 9.3 | 2026-09-25 | An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to acc… | |
| CVE-2026-93641 | CRITICAL | 9.3 | 2026-09-25 | An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to ac… | |
| CVE-2026-93616 | CRITICAL | Patched | 9.8 | 2026-09-22 | A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server. |