Search
333 CVEs · Critical severity
CVEs (333)
Showing 1–25 of 333
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-111823 | CRITICAL | Patched | 9.8 | 2026-10-17 | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. |
| CVE-2026-110653 | CRITICAL | 9.1 | 2026-10-17 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versi… | |
| CVE-2026-104736 | CRITICAL | 9.8 | 2026-10-17 | The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout… | |
| CVE-2026-111911 | CRITICAL | Patched | 9.8 | 2026-10-17 | phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication o… |
| CVE-2026-109894 | CRITICAL | 9.3 | 2026-10-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Bo… | |
| CVE-2026-110372 | CRITICAL | 9.8 | 2026-10-18 | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40. | |
| CVE-2026-110886 | CRITICAL | 9.8 | 2026-10-18 | Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversatio… | |
| CVE-2026-111998 | CRITICAL | 9.8 | 2026-10-18 | Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admi… | |
| CVE-2026-112005 | CRITICAL | Patched | 7.7 | 2026-10-18 | WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functi… |
| CVE-2024-4457 | CRITICAL | 9.1 | 2026-10-18 | The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input… | |
| CVE-2026-108983 | CRITICAL | 9.8 | 2026-10-19 | A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . | |
| CVE-2026-102503 | CRITICAL | Patched | — | 2026-10-19 | Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) i… |
| CVE-2026-103091 | CRITICAL | Patched | — | 2026-10-19 | Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC r… |
| CVE-2026-110887 | CRITICAL | 9.9 | 2026-10-19 | Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a… | |
| CVE-2026-111406 | CRITICAL | 9.9 | 2026-10-19 | Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web … | |
| CVE-2026-90910 | CRITICAL | Patched | 9.8 | 2026-10-19 | Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content… |
| CVE-2026-71253 | CRITICAL | Patched | 9.8 | 2026-10-19 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker… |
| CVE-2026-78162 | CRITICAL | Patched | — | 2026-10-19 | Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazel… |
| CVE-2026-112292 | CRITICAL | 9.8 | 2026-10-19 | CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase co… | |
| CVE-2026-112296 | CRITICAL | 9.8 | 2026-10-19 | FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms a… | |
| CVE-2026-107081 | CRITICAL | 9.8 | 2026-10-19 | SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, adm… | |
| CVE-2026-109432 | CRITICAL | Patched | 9.8 | 2026-10-19 | Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query express… |
| CVE-2026-111057 | CRITICAL | Patched | 10.0 | 2026-10-19 | Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the… |
| CVE-2026-111058 | CRITICAL | Patched | 9.8 | 2026-10-19 | Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to cre… |
| CVE-2026-107083 | CRITICAL | 9.8 | 2026-10-19 | SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID. |