Search
333 CVEs · Critical severity
CVEs (333)
Showing 1–25 of 333
| CVE ID ↑ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2016-20101 | CRITICAL | Patched | 8.1 | 2026-10-20 | Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the… |
| CVE-2021-48014 | CRITICAL | 9.8 | 2026-10-22 | FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary fil… | |
| CVE-2021-48016 | CRITICAL | 9.8 | 2026-10-22 | DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauth… | |
| CVE-2022-51026 | CRITICAL | Patched | 9.8 | 2026-10-22 | Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting clien… |
| CVE-2024-4457 | CRITICAL | 9.1 | 2026-10-18 | The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input… | |
| CVE-2025-30046 | CRITICAL | — | 2026-10-23 | In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data … | |
| CVE-2025-30047 | CRITICAL | Patched | — | 2026-10-23 | CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, th… |
| CVE-2025-30050 | CRITICAL | Patched | — | 2026-10-23 | CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untruste… |
| CVE-2025-30054 | CRITICAL | — | 2026-10-23 | CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its … | |
| CVE-2025-31699 | CRITICAL | Patched | 8.9 | 2026-10-21 | Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, inclu… |
| CVE-2026-101296 | CRITICAL | Patched | — | 2026-10-20 | A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed att… |
| CVE-2026-10131 | CRITICAL | 9.1 | 2026-10-20 | An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafte… | |
| CVE-2026-10132 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially craf… | |
| CVE-2026-10133 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP … | |
| CVE-2026-10135 | CRITICAL | 9.1 | 2026-10-20 | A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request… | |
| CVE-2026-101356 | CRITICAL | Patched | 9.1 | 2026-10-20 | Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between… |
| CVE-2026-10136 | CRITICAL | 9.1 | 2026-10-20 | A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafte… | |
| CVE-2026-10137 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially craft… | |
| CVE-2026-10138 | CRITICAL | 9.1 | 2026-10-20 | A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP… | |
| CVE-2026-10139 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP requ… | |
| CVE-2026-10141 | CRITICAL | 9.1 | 2026-10-20 | A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firm… | |
| CVE-2026-101420 | CRITICAL | 9.6 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Easily exploitabl… | |
| CVE-2026-101446 | CRITICAL | 9.9 | 2026-10-20 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.9. Easi… | |
| CVE-2026-101484 | CRITICAL | 9.8 | 2026-10-20 | Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerabili… | |
| CVE-2026-101499 | CRITICAL | 9.8 | 2026-10-20 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1… |