Search
1,463 CVEs · Critical severity
CVEs (1,463, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 1,463 (capped at 500)
| CVE ID ↑ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2016-20101 | CRITICAL | Patched | 8.1 | 2026-10-20 | Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the… |
| CVE-2017-20285 | CRITICAL | Patched | 9.1 | 2026-10-05 | YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names… |
| CVE-2020-37279 | CRITICAL | 8.1 | 2026-10-12 | easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source pa… | |
| CVE-2020-37281 | CRITICAL | 8.1 | 2026-10-14 | Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs… | |
| CVE-2020-37282 | CRITICAL | 9.8 | 2026-10-14 | office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or … | |
| CVE-2021-48014 | CRITICAL | 9.8 | 2026-10-22 | FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary fil… | |
| CVE-2021-48016 | CRITICAL | 9.8 | 2026-10-22 | DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauth… | |
| CVE-2022-51026 | CRITICAL | Patched | 9.8 | 2026-10-22 | Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting clien… |
| CVE-2023-54400 | CRITICAL | 9.8 | 2026-09-29 | Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through th… | |
| CVE-2023-54405 | CRITICAL | 9.8 | 2026-10-02 | H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload… | |
| CVE-2024-31026 | CRITICAL | 9.8 | 2026-09-29 | An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module. | |
| CVE-2024-34320 | CRITICAL | 9.8 | 2026-10-13 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints. | |
| CVE-2024-34323 | CRITICAL | 10.0 | 2026-10-13 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attac… | |
| CVE-2024-34324 | CRITICAL | 9.1 | 2026-10-13 | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionI… | |
| CVE-2024-4457 | CRITICAL | 9.1 | 2026-10-18 | The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input… | |
| CVE-2025-30046 | CRITICAL | — | 2026-10-23 | In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data … | |
| CVE-2025-30047 | CRITICAL | Patched | — | 2026-10-23 | CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, th… |
| CVE-2025-30050 | CRITICAL | Patched | — | 2026-10-23 | CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untruste… |
| CVE-2025-30054 | CRITICAL | — | 2026-10-23 | CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its … | |
| CVE-2025-31699 | CRITICAL | Patched | 8.9 | 2026-10-21 | Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, inclu… |
| CVE-2025-41753 | CRITICAL | 9.8 | 2026-10-01 | The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the inten… | |
| CVE-2025-64393 | CRITICAL | — | 2026-10-07 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server. | |
| CVE-2025-70516 | CRITICAL | 9.1 | 2026-10-07 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions gran… | |
| CVE-2025-70518 | CRITICAL | 10.0 | 2026-10-07 | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling … | |
| CVE-2025-70520 | CRITICAL | 9.8 | 2026-10-07 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions gran… |