Search
1,463 CVEs · Critical severity
CVEs (1,463, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 1,463 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-102469 | CRITICAL | Patched | 5.9 | 2026-10-15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling co… |
| CVE-2026-32645 | CRITICAL | 6.0 | 2026-10-09 | Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts. | |
| CVE-2026-107806 | CRITICAL | Patched | 7.2 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controll… |
| CVE-2026-114219 | CRITICAL | 7.4 | 2026-10-22 | NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decryp… | |
| CVE-2026-89035 | CRITICAL | 7.4 | 2026-10-21 | MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured … | |
| CVE-2026-113682 | CRITICAL | Patched | 7.4 | 2026-10-20 | Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-de… |
| CVE-2026-112377 | CRITICAL | 7.4 | 2026-10-19 | CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from … | |
| CVE-2026-111691 | CRITICAL | 7.4 | 2026-10-16 | WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-U… | |
| CVE-2026-111675 | CRITICAL | 7.4 | 2026-10-16 | Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SM… | |
| CVE-2026-111356 | CRITICAL | 7.4 | 2026-10-15 | MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attacker… | |
| CVE-2026-110864 | CRITICAL | Patched | 7.4 | 2026-10-14 | Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as ot… |
| CVE-2026-63158 | CRITICAL | Patched | 7.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate… |
| CVE-2026-63159 | CRITICAL | Patched | 7.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computi… |
| CVE-2026-63160 | CRITICAL | Patched | 7.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to … |
| CVE-2026-63149 | CRITICAL | Patched | 7.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Tx… |
| CVE-2026-53997 | CRITICAL | Patched | 7.4 | 2026-10-12 | Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/crea… |
| CVE-2026-109423 | CRITICAL | 7.4 | 2026-10-12 | NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent… | |
| CVE-2026-109394 | CRITICAL | 7.4 | 2026-10-12 | Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered… | |
| CVE-2026-107781 | CRITICAL | 7.4 | 2026-10-08 | Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save… | |
| CVE-2026-16516 | CRITICAL | Patched | 7.4 | 2026-10-07 | wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/inte… |
| CVE-2026-105835 | CRITICAL | 7.4 | 2026-10-06 | PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication… | |
| CVE-2026-105223 | CRITICAL | Patched | 7.4 | 2026-10-05 | maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-autho… |
| CVE-2026-105294 | CRITICAL | 7.4 | 2026-10-05 | Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.… | |
| CVE-2026-105221 | CRITICAL | Patched | 7.4 | 2026-10-04 | The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in … |
| CVE-2026-105222 | CRITICAL | 7.4 | 2026-10-04 | The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which… |