Search
4,542 CVEs · Critical severity
CVEs (4,542, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 4,542 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2023-54356 | CRITICAL | Patched | 3.7 | 2026-09-01 | Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS endpoints. These… |
| CVE-2026-75832 | CRITICAL | Patched | 4.3 | 2026-08-18 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPath… |
| CVE-2026-75835 | CRITICAL | Patched | 4.3 | 2026-08-18 | Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fa… |
| CVE-2026-72785 | CRITICAL | Patched | 4.3 | 2026-08-11 | Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategorie… |
| CVE-2026-72699 | CRITICAL | Patched | 5.3 | 2026-08-25 | The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exce… |
| CVE-2026-72702 | CRITICAL | Patched | 5.4 | 2026-08-25 | Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored… |
| CVE-2026-74890 | CRITICAL | Patched | 5.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CU… |
| CVE-2025-36939 | CRITICAL | 5.7 | 2026-08-24 | Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a… | |
| CVE-2026-102469 | CRITICAL | Patched | 5.9 | 2026-10-15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling co… |
| CVE-2025-71401 | CRITICAL | Patched | 5.9 | 2026-08-02 | better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make t… |
| CVE-2026-32645 | CRITICAL | 6.0 | 2026-10-09 | Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts. | |
| CVE-2026-53579 | CRITICAL | Patched | 6.1 | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text no… |
| CVE-2026-53578 | CRITICAL | Patched | 6.1 | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text no… |
| CVE-2026-48996 | CRITICAL | Patched | 6.1 | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, … |
| CVE-2026-68582 | CRITICAL | Patched | 6.5 | 2026-08-02 | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/vie… |
| CVE-2026-107806 | CRITICAL | Patched | 7.2 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controll… |
| CVE-2026-114219 | CRITICAL | 7.4 | 2026-10-22 | NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decryp… | |
| CVE-2026-89035 | CRITICAL | 7.4 | 2026-10-21 | MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured … | |
| CVE-2026-113682 | CRITICAL | Patched | 7.4 | 2026-10-20 | Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-de… |
| CVE-2026-112377 | CRITICAL | 7.4 | 2026-10-19 | CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from … | |
| CVE-2026-111691 | CRITICAL | 7.4 | 2026-10-16 | WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-U… | |
| CVE-2026-111675 | CRITICAL | 7.4 | 2026-10-16 | Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SM… | |
| CVE-2026-111356 | CRITICAL | 7.4 | 2026-10-15 | MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attacker… | |
| CVE-2026-110864 | CRITICAL | Patched | 7.4 | 2026-10-14 | Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as ot… |
| CVE-2026-63158 | CRITICAL | Patched | 7.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate… |