Search
37,397 CVEs · Critical severity
CVEs (37,397, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 37,397 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-115812 | CRITICAL | 9.8 | 2026-10-23 | Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via… | |
| CVE-2026-55486 | CRITICAL | Patched | 9.3 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoin… |
| CVE-2026-53942 | CRITICAL | 9.9 | 2026-10-23 | Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain … | |
| CVE-2026-46652 | CRITICAL | Patched | 9.8 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.g… |
| CVE-2026-46651 | CRITICAL | Patched | 9.8 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint … |
| CVE-2026-53921 | CRITICAL | Patched | 9.8 | 2026-10-23 | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 51… |
| CVE-2026-114357 | CRITICAL | — | 2026-10-23 | Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to o… | |
| CVE-2026-57116 | CRITICAL | Patched | 9.8 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main… |
| CVE-2026-112859 | CRITICAL | 9.8 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16. | |
| CVE-2026-112858 | CRITICAL | 9.8 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3. | |
| CVE-2026-112857 | CRITICAL | 9.8 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8. | |
| CVE-2026-112856 | CRITICAL | 9.8 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10. | |
| CVE-2026-112855 | CRITICAL | 9.8 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5. | |
| CVE-2026-112854 | CRITICAL | 9.8 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6. | |
| CVE-2026-112853 | CRITICAL | 9.8 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1. | |
| CVE-2026-112851 | CRITICAL | 9.8 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9. | |
| CVE-2026-112848 | CRITICAL | 9.8 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0. | |
| CVE-2026-112847 | CRITICAL | 9.8 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13. | |
| CVE-2026-112846 | CRITICAL | 9.8 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14. | |
| CVE-2026-115727 | CRITICAL | 8.1 | 2026-10-23 | AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attac… | |
| CVE-2026-107685 | CRITICAL | Patched | — | 2026-10-23 | Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions… |
| CVE-2026-25784 | CRITICAL | Patched | 9.8 | 2026-10-23 | Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default … |
| CVE-2026-112862 | CRITICAL | 9.8 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Databa… | |
| CVE-2026-112860 | CRITICAL | 9.3 | 2026-10-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blin… | |
| CVE-2025-30054 | CRITICAL | — | 2026-10-23 | CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its … |