Search
4,542 CVEs · Critical severity
CVEs (4,542, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 4,542 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-97785 | CRITICAL | 10.0 | 2026-10-22 | Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-83938 | CRITICAL | 10.0 | 2026-10-22 | Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-110063 | CRITICAL | 10.0 | 2026-10-22 | Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-79849 | CRITICAL | 10.0 | 2026-10-22 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Succe… | |
| CVE-2026-79850 | CRITICAL | 10.0 | 2026-10-22 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on t… | |
| CVE-2026-79851 | CRITICAL | 10.0 | 2026-10-22 | Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an a… | |
| CVE-2026-79844 | CRITICAL | 10.0 | 2026-10-22 | Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if… | |
| CVE-2026-79846 | CRITICAL | 10.0 | 2026-10-22 | Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying h… | |
| CVE-2026-79847 | CRITICAL | 10.0 | 2026-10-22 | Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected… | |
| CVE-2026-79848 | CRITICAL | 10.0 | 2026-10-22 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Succe… | |
| CVE-2026-102785 | CRITICAL | — | 2026-10-22 | Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incom… | |
| CVE-2026-114575 | CRITICAL | 10.0 | 2026-10-22 | A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executin… | |
| CVE-2026-110264 | CRITICAL | Patched | 10.0 | 2026-10-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.… |
| CVE-2026-114383 | CRITICAL | 10.0 | 2026-10-21 | A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. T… | |
| CVE-2026-114382 | CRITICAL | 10.0 | 2026-10-21 | A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. T… | |
| CVE-2026-111813 | CRITICAL | Patched | 10.0 | 2026-10-21 | Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This iss… |
| CVE-2026-105944 | CRITICAL | — | 2026-10-21 | Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authenticatio… | |
| CVE-2026-111832 | CRITICAL | 10.0 | 2026-10-21 | Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailste… | |
| CVE-2026-113744 | CRITICAL | 10.0 | 2026-10-21 | A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the comp… | |
| CVE-2026-91299 | CRITICAL | 10.0 | 2026-10-20 | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are… | |
| CVE-2026-91231 | CRITICAL | 10.0 | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easil… | |
| CVE-2026-91216 | CRITICAL | 10.0 | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. E… | |
| CVE-2026-91221 | CRITICAL | 10.0 | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. E… | |
| CVE-2026-87337 | CRITICAL | 10.0 | 2026-10-20 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and … | |
| CVE-2026-81212 | CRITICAL | 10.0 | 2026-10-20 | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platfo… |