Critical this week

CVSS 9.0 and above, published in the last 7 days.

209 critical CVEs were published in the last 7 days. Highest priority: CVE-2026-114625 (Arista VeloCloud Orchestrator SQL Injection Vulnerability), score 77/100.

• CVE-2026-114625 CRITICAL 9.9 EXPLOITED UPGRADE Arista VeloCloud Orchestrator SQL Injection Vulnerability
• CVE-2026-109618 CRITICAL 9.8 UPGRADE MITIGATE PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques
• CVE-2021-48014 CRITICAL 9.8 FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operatio
• CVE-2026-110063 CRITICAL 10.0 Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allo
• CVE-2026-105944 CRITICAL 10.0 Apache Pulsar Manager is a web console for administering Apache Pulsar clusters
• CVE-2026-79857 CRITICAL 9.8 There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of
• CVE-2026-53921 CRITICAL 9.8 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt
• CVE-2026-105014 CRITICAL 9.1 Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows
• CVE-2026-79846 CRITICAL 10.0 Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated
• CVE-2026-83938 CRITICAL 10.0 Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized
• CVE-2026-115812 CRITICAL 9.8 Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and e
• CVE-2026-113390 CRITICAL 9.9 A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218
• CVE-2026-79861 CRITICAL 9.8 There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution
• CVE-2026-79851 CRITICAL 10.0 Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated r
• CVE-2026-79847 CRITICAL 10.0 Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code
• CVE-2026-97785 CRITICAL 10.0 Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-110264 CRITICAL 10.0 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0
• CVE-2026-77930 CRITICAL 9.8 EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host sh
• CVE-2026-112370 CRITICAL 9.9 A vulnerability was found in H3C Magic NX15 100R017
• CVE-2026-109444 CRITICAL 9.8 OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute
• CVE-2026-79850 CRITICAL 10.0 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass ex
• CVE-2026-79849 CRITICAL 10.0 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct S
• CVE-2026-79848 CRITICAL 10.0 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct S
• CVE-2026-79844 CRITICAL 10.0 Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remot
• CVE-2026-46652 CRITICAL 9.8 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser
• CVE-2026-102785 CRITICAL 10.0 Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOthem
• CVE-2026-92559 CRITICAL 9.8 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive informa
• CVE-2026-111813 CRITICAL 10.0 Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert
• CVE-2026-115806 CRITICAL 9.8 The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versi
• CVE-2026-79855 CRITICAL 9.8 An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to
• CVE-2026-112857 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This is
• CVE-2026-112853 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.T
• CVE-2026-111183 CRITICAL 9.8 GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
• CVE-2026-79856 CRITICAL 9.8 A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remot
• CVE-2026-79854 CRITICAL 9.8 A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct
• CVE-2026-79852 CRITICAL 9.8 A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to
• CVE-2026-111497 CRITICAL 9.2 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through
• CVE-2026-101809 CRITICAL 10.0 Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer)
• CVE-2026-101521 CRITICAL 9.8 Vulnerability in Oracle APEX (component: General)
• CVE-2026-114119 CRITICAL 9.8 Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative pass
• CVE-2026-46651 CRITICAL 9.8 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser
• CVE-2026-111812 CRITICAL 10.0 Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request h
• CVE-2026-101484 CRITICAL 9.8 Vulnerability in Oracle Secure Backup (component: Backup and Restore)
• CVE-2026-94075 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Obje
• CVE-2026-114196 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This
• CVE-2026-112859 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object
• CVE-2026-112858 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issu
• CVE-2026-112856 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.
• CVE-2026-112855 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue af
• CVE-2026-112854 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object I
• CVE-2026-112851 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This
• CVE-2026-112848 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This
• CVE-2026-112847 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue
• CVE-2026-112846 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.
• CVE-2026-79860 CRITICAL 9.8 Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated rem
• CVE-2026-79859 CRITICAL 9.8 Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated re
• CVE-2026-79853 CRITICAL 9.8 Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenti
• CVE-2022-51026 CRITICAL 9.8 Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attac
• CVE-2026-91665 CRITICAL 9.8 DOWNGRADE Vulnerability in Oracle Essbase (component: Security)
• CVE-2022-51022 CRITICAL 9.1 YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability
• CVE-2026-96639 CRITICAL 9.8 Pillow is a Python imaging library
• CVE-2026-79864 CRITICAL 9.6 Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticate
• CVE-2026-63244 CRITICAL 9.8 An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow
• CVE-2026-57116 CRITICAL 9.8 PraisonAI is a multi-agent teams system
• CVE-2026-91299 CRITICAL 10.0 Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orc
• CVE-2026-111815 CRITICAL 10.0 Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certific
• CVE-2026-111814 CRITICAL 10.0 Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated w
• CVE-2026-76466 CRITICAL 9.8 A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, rem
• CVE-2026-9814 CRITICAL 9.1 An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s)
• CVE-2026-10138 CRITICAL 9.1 A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOL
• CVE-2026-10135 CRITICAL 9.1 A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X200
• CVE-2026-10131 CRITICAL 9.1 An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s):
• CVE-2026-115893 CRITICAL 9.9 Wasmtime is a runtime for WebAssembly
• CVE-2026-19677 CRITICAL 9.3 An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows
• CVE-2026-114357 CRITICAL 9.3 Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS6
• CVE-2026-76474 CRITICAL 9.8 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco E
• CVE-2026-76473 CRITICAL 9.8 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco E
• CVE-2021-48016 CRITICAL 9.8 DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer hea
• CVE-2026-79858 CRITICAL 9.8 An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8
• CVE-2026-35499 CRITICAL 9.1 An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TO
• CVE-2026-112862 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database
• CVE-2026-113263 CRITICAL 9.6 UPGRADE Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-105869 CRITICAL 9.2 Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of i
• CVE-2026-115931 CRITICAL 9.9 Postiz lets a signed-in user ask the backend to run a function on one of their connected channels
• CVE-2026-99079 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer relea
• CVE-2026-99078 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer relea
• CVE-2026-98959 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xa
• CVE-2026-98548 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a
• CVE-2026-98490 CRITICAL 9.8 In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper U
• CVE-2026-9827 CRITICAL 9.1 A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOT
• CVE-2026-10139 CRITICAL 9.1 A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X
• CVE-2026-10137 CRITICAL 9.1 A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s)
• CVE-2026-10136 CRITICAL 9.1 A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s):
• CVE-2026-10133 CRITICAL 9.1 A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLI
• CVE-2026-10132 CRITICAL 9.1 A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s
• CVE-2026-115889 CRITICAL 9.9 Wasmtime is a runtime for WebAssembly
• CVE-2026-79872 CRITICAL 9.4 A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenti
• CVE-2026-114607 CRITICAL 9.1 Better Auth is an authentication and authorization library for TypeScript
• CVE-2026-91403 CRITICAL 9.1 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-113678 CRITICAL 9.9 Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that all
• CVE-2026-91305 CRITICAL 9.1 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Secu
• CVE-2026-91265 CRITICAL 9.1 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infras
• CVE-2026-101590 CRITICAL 9.1 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security)
• CVE-2026-97631 CRITICAL 9.5 EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, a
• CVE-2026-112866 CRITICAL 9.3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactor
• CVE-2026-111402 CRITICAL 9.3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulan
• CVE-2026-9869 CRITICAL 9.1 A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version
• CVE-2026-9817 CRITICAL 9.1 A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(
• CVE-2026-9660 CRITICAL 9.1 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of
• CVE-2026-42026 CRITICAL 9.1 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns funct
• CVE-2026-42025 CRITICAL 9.1 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns funct
• CVE-2026-42024 CRITICAL 9.1 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configurati
• CVE-2026-42023 CRITICAL 9.1 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configurati
• CVE-2026-111816 CRITICAL 9.3 Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, beca
• CVE-2026-25784 CRITICAL 9.8 Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container i
• CVE-2026-111811 CRITICAL 9.0 Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletio
• CVE-2026-96355 CRITICAL 9.1 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows C
• CVE-2026-112403 CRITICAL 9.2 Pillow is a Python imaging library
• CVE-2026-112398 CRITICAL 9.2 Pillow is a Python imaging library
• CVE-2026-114108 CRITICAL 9.8 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthe
• CVE-2026-114509 CRITICAL 9.2 Laravel is a web application framework
• CVE-2026-42022 CRITICAL 9.1 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configurati
• CVE-2026-42021 CRITICAL 9.1 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configurati
• CVE-2026-71195 CRITICAL 9.9 In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the call
• CVE-2026-114139 CRITICAL 9.1 Sentry-Javascript is an official Sentry SDKs for JavaScript
• CVE-2026-111809 CRITICAL 9.3 Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encodin
• CVE-2026-110956 CRITICAL 9.8 The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor b
• CVE-2026-53942 CRITICAL 9.9 Conda Organization Infrastructure is a centralized location for infrastructure codes
• CVE-2026-113788 CRITICAL 9.4 Lagoon is an application delivery platform for Kubernetes
• CVE-2026-113342 CRITICAL 9.6 UPGRADE Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbi
• CVE-2026-113336 CRITICAL 9.6 UPGRADE Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentia
• CVE-2026-113328 CRITICAL 9.6 UPGRADE Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-113300 CRITICAL 9.6 UPGRADE Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially
• CVE-2026-113283 CRITICAL 9.6 UPGRADE Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote
• CVE-2026-113270 CRITICAL 9.6 UPGRADE Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbit
• CVE-2026-113261 CRITICAL 9.6 UPGRADE Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentia
• CVE-2026-113252 CRITICAL 9.6 UPGRADE Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote atta
• CVE-2026-113235 CRITICAL 9.6 UPGRADE Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to po
• CVE-2026-113189 CRITICAL 9.6 UPGRADE Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary
• CVE-2026-113186 CRITICAL 9.6 UPGRADE Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arb
• CVE-2026-113089 CRITICAL 9.6 UPGRADE Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113072 CRITICAL 9.6 UPGRADE Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially exec
• CVE-2026-113023 CRITICAL 9.6 UPGRADE Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to p
• CVE-2026-113014 CRITICAL 9.6 UPGRADE Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potenti
• CVE-2026-110243 CRITICAL 9.9 The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network inte
• CVE-2026-107861 CRITICAL 9.9 The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname paramet
• CVE-2026-107685 CRITICAL 9.1 Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an
• CVE-2026-115377 CRITICAL 9.9 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability
• CVE-2026-115375 CRITICAL 9.9 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients ab
• CVE-2026-113222 CRITICAL 9.6 UPGRADE Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute

FAQ

What makes a CVE critical?

A CVSS score of 9.0 or higher, usually remote exploitation with no login and high impact.

Is every critical CVE urgent?

Not always. Priority combines exploitation, exploit likelihood and reach, so check the score and the exploited flag.