Search
4,542 CVEs · Critical severity
CVEs (4,542, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 4,542 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-99999 | CRITICAL | 9.3 | 2026-10-15 | In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets i… | |
| CVE-2026-9869 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially cr… | |
| CVE-2026-98365 | CRITICAL | 9.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access mr_check_range() validates th… | |
| CVE-2026-98323 | CRITICAL | 9.8 | 2026-10-06 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended… | |
| CVE-2026-9827 | CRITICAL | 9.1 | 2026-10-20 | A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HT… | |
| CVE-2026-9817 | CRITICAL | 9.1 | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially cra… | |
| CVE-2026-9814 | CRITICAL | 9.1 | 2026-10-20 | An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially craft… | |
| CVE-2026-97816 | CRITICAL | Patched | 9.8 | 2026-10-13 | Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97815 | CRITICAL | Patched | 9.8 | 2026-10-13 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97814 | CRITICAL | Patched | 9.8 | 2026-10-13 | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97805 | CRITICAL | Patched | 9.8 | 2026-10-13 | Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97785 | CRITICAL | 10.0 | 2026-10-22 | Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-97749 | CRITICAL | 9.8 | 2026-10-13 | Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-97720 | CRITICAL | Patched | 9.1 | 2026-10-07 | Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources serve… |
| CVE-2026-97670 | CRITICAL | 9.1 | 2026-10-10 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly v… | |
| CVE-2026-97668 | CRITICAL | 9.8 | 2026-10-14 | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10… | |
| CVE-2026-97657 | CRITICAL | 9.8 | 2026-10-14 | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and i… | |
| CVE-2026-97637 | CRITICAL | 9.8 | 2026-10-02 | The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerab… | |
| CVE-2026-97631 | CRITICAL | — | 2026-10-22 | EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Su… | |
| CVE-2026-97468 | CRITICAL | Patched | 9.1 | 2026-10-09 | Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/ha… |
| CVE-2026-97413 | CRITICAL | 9.8 | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write usr_len is read from a network-… | |
| CVE-2026-97381 | CRITICAL | Patched | 9.9 | 2026-10-13 | Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermit… |
| CVE-2026-97360 | CRITICAL | 10.0 | 2026-09-24 | HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete file… | |
| CVE-2026-97359 | CRITICAL | 10.0 | 2026-09-24 | HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code exec… | |
| CVE-2026-97283 | CRITICAL | 9.8 | 2026-10-05 | Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Po… |