Critical CVEs

CVSS 9.0 and above, newest first.

• CVE-2026-115806 CRITICAL 9.8 The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versi
• CVE-2026-115931 CRITICAL 9.9 Postiz lets a signed-in user ask the backend to run a function on one of their connected channels
• CVE-2026-115893 CRITICAL 9.9 Wasmtime is a runtime for WebAssembly
• CVE-2026-115889 CRITICAL 9.9 Wasmtime is a runtime for WebAssembly
• CVE-2026-115812 CRITICAL 9.8 Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and e
• CVE-2026-55486 CRITICAL 9.3 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser
• CVE-2026-53942 CRITICAL 9.9 Conda Organization Infrastructure is a centralized location for infrastructure codes
• CVE-2026-46652 CRITICAL 9.8 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser
• CVE-2026-46651 CRITICAL 9.8 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser
• CVE-2026-53921 CRITICAL 9.8 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt
• CVE-2026-114357 CRITICAL 9.3 Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS6
• CVE-2026-57116 CRITICAL 9.8 PraisonAI is a multi-agent teams system
• CVE-2026-112859 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object
• CVE-2026-112858 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issu
• CVE-2026-112857 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This is
• CVE-2026-112856 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.
• CVE-2026-112855 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue af
• CVE-2026-112854 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object I
• CVE-2026-112853 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.T
• CVE-2026-112851 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This
• CVE-2026-112848 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This
• CVE-2026-112847 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue
• CVE-2026-112846 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.
• CVE-2026-107685 CRITICAL 9.1 Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an
• CVE-2026-25784 CRITICAL 9.8 Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container i
• CVE-2026-112862 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database
• CVE-2026-112860 CRITICAL 9.3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau web
• CVE-2025-30054 CRITICAL 9.3 CGM CLININET is vulnerable to local privilege escalation
• CVE-2025-30050 CRITICAL 9.4 CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module
• CVE-2025-30047 CRITICAL 9.4 CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data
• CVE-2025-30046 CRITICAL 9.0 In the CGM CLININET application server, multiple processes responsible for HL7 communication with external sys
• CVE-2026-63244 CRITICAL 9.8 An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow
• CVE-2026-55981 CRITICAL 9.6 A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a leg
• CVE-2026-94267 CRITICAL 9.0 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor
• CVE-2026-54630 CRITICAL 9.6 Part-DB is an open source inventory management system for electronic components
• CVE-2026-115547 CRITICAL 9.1 An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially fo
• CVE-2026-19677 CRITICAL 9.3 An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows
• CVE-2026-110243 CRITICAL 9.9 The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network inte
• CVE-2026-107861 CRITICAL 9.9 The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname paramet
• CVE-2026-97785 CRITICAL 10.0 Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-83938 CRITICAL 10.0 Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized
• CVE-2026-110063 CRITICAL 10.0 Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allo
• CVE-2026-109122 CRITICAL 9.1 The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used w
• CVE-2026-105014 CRITICAL 9.1 Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows
• CVE-2026-114625 CRITICAL 9.9 EXPLOITED UPGRADE Arista VeloCloud Orchestrator SQL Injection Vulnerability
• CVE-2026-79876 CRITICAL 9.3 A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauth
• CVE-2026-79875 CRITICAL 9.3 A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthentica
• CVE-2026-79874 CRITICAL 9.3 An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existi
• CVE-2026-79873 CRITICAL 9.3 Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent a
• CVE-2026-79872 CRITICAL 9.4 A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenti
• CVE-2026-79871 CRITICAL 9.6 A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauth
• CVE-2026-79870 CRITICAL 9.6 An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent a
• CVE-2026-79869 CRITICAL 9.6 Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjac
• CVE-2026-79868 CRITICAL 9.6 Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjace
• CVE-2026-79867 CRITICAL 9.6 Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjace
• CVE-2026-79866 CRITICAL 9.6 An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8
• CVE-2026-79865 CRITICAL 9.6 A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent
• CVE-2026-79864 CRITICAL 9.6 Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticate
• CVE-2026-79863 CRITICAL 9.6 Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated ad
• CVE-2026-79862 CRITICAL 9.6 Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated ad
• CVE-2026-79861 CRITICAL 9.8 There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution
• CVE-2026-79860 CRITICAL 9.8 Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated rem
• CVE-2026-79859 CRITICAL 9.8 Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated re
• CVE-2026-79858 CRITICAL 9.8 An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8
• CVE-2026-79857 CRITICAL 9.8 There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of
• CVE-2026-79856 CRITICAL 9.8 A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remot
• CVE-2026-79855 CRITICAL 9.8 An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to
• CVE-2026-79854 CRITICAL 9.8 A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct
• CVE-2026-79853 CRITICAL 9.8 Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenti
• CVE-2026-79852 CRITICAL 9.8 A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to
• CVE-2026-79851 CRITICAL 10.0 Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated r
• CVE-2026-79850 CRITICAL 10.0 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass ex
• CVE-2026-79849 CRITICAL 10.0 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct S
• CVE-2026-79848 CRITICAL 10.0 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct S
• CVE-2026-79847 CRITICAL 10.0 Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code
• CVE-2026-79846 CRITICAL 10.0 Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated
• CVE-2026-79844 CRITICAL 10.0 Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remot
• CVE-2026-115377 CRITICAL 9.9 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability
• CVE-2026-115375 CRITICAL 9.9 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients ab
• CVE-2026-114612 CRITICAL 9.9 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
• CVE-2022-51026 CRITICAL 9.8 Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attac
• CVE-2026-114611 CRITICAL 9.1 OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and m
• CVE-2026-114607 CRITICAL 9.1 Better Auth is an authentication and authorization library for TypeScript
• CVE-2026-111497 CRITICAL 9.2 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through
• CVE-2021-48014 CRITICAL 9.8 FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operatio
• CVE-2026-96355 CRITICAL 9.1 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows C
• CVE-2026-110264 CRITICAL 10.0 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0
• CVE-2026-115384 CRITICAL 9.9 Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that all
• CVE-2026-114220 CRITICAL 9.1 NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability
• CVE-2022-51022 CRITICAL 9.1 YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability
• CVE-2021-48016 CRITICAL 9.8 DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer hea
• CVE-2026-97631 CRITICAL 9.5 EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, a
• CVE-2026-102785 CRITICAL 10.0 Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOthem
• CVE-2026-91403 CRITICAL 9.1 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac
• CVE-2026-111815 CRITICAL 10.0 Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certific
• CVE-2026-111814 CRITICAL 10.0 Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated w
• CVE-2026-111812 CRITICAL 10.0 Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request h
• CVE-2026-111811 CRITICAL 9.0 Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletio
• CVE-2026-111816 CRITICAL 9.3 Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, beca
• CVE-2026-111813 CRITICAL 10.0 Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert
• CVE-2026-105944 CRITICAL 10.0 Apache Pulsar Manager is a web console for administering Apache Pulsar clusters
• CVE-2026-111183 CRITICAL 9.8 GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
• CVE-2026-113788 CRITICAL 9.4 Lagoon is an application delivery platform for Kubernetes
• CVE-2026-109618 CRITICAL 9.8 UPGRADE MITIGATE PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques
• CVE-2026-76474 CRITICAL 9.8 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco E
• CVE-2026-76473 CRITICAL 9.8 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco E
• CVE-2026-76466 CRITICAL 9.8 A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, rem
• CVE-2026-20043 CRITICAL 9.0 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source S
• CVE-2026-114119 CRITICAL 9.8 Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative pass
• CVE-2026-114108 CRITICAL 9.8 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthe
• CVE-2026-71195 CRITICAL 9.9 In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the call
• CVE-2026-114509 CRITICAL 9.2 Laravel is a web application framework
• CVE-2026-114139 CRITICAL 9.1 Sentry-Javascript is an official Sentry SDKs for JavaScript
• CVE-2026-87095 CRITICAL 9.1 Sensitive information disclosure and manipulation due to improper authorization checks
• CVE-2026-76302 CRITICAL 9.9 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh
• CVE-2026-76531 CRITICAL 9.9 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh
• CVE-2026-76299 CRITICAL 9.9 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a compreh
• CVE-2026-105869 CRITICAL 9.2 Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of i
• CVE-2026-111809 CRITICAL 9.3 Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encodin
• CVE-2026-96639 CRITICAL 9.8 Pillow is a Python imaging library
• CVE-2026-92559 CRITICAL 9.8 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive informa
• CVE-2026-91663 CRITICAL 9.9 DOWNGRADE Vulnerability in Oracle Essbase (component: Security)
• CVE-2026-91658 CRITICAL 9.9 DOWNGRADE Vulnerability in Oracle Essbase (component: Security)
• CVE-2026-91656 CRITICAL 9.1 DOWNGRADE Vulnerability in Oracle Essbase (component: Federated Partitions)
• CVE-2026-91655 CRITICAL 9.1 DOWNGRADE Vulnerability in Oracle Essbase (component: Security)
• CVE-2026-91644 CRITICAL 9.3 DOWNGRADE Vulnerability in Oracle Essbase (component: Security)
• CVE-2026-91638 CRITICAL 9.9 DOWNGRADE Vulnerability in Oracle Essbase (component: Security)
• CVE-2026-91637 CRITICAL 9.9 DOWNGRADE Vulnerability in Oracle Essbase (component: Security)
• CVE-2026-91299 CRITICAL 10.0 Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orc
• CVE-2026-101809 CRITICAL 10.0 Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer)
• CVE-2026-9869 CRITICAL 9.1 A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version
• CVE-2026-9827 CRITICAL 9.1 A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOT
• CVE-2026-9817 CRITICAL 9.1 A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(
• CVE-2026-9814 CRITICAL 9.1 An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s)
• CVE-2026-9660 CRITICAL 9.1 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of
• CVE-2026-42026 CRITICAL 9.1 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns funct
• CVE-2026-42025 CRITICAL 9.1 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns funct
• CVE-2026-42024 CRITICAL 9.1 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configurati
• CVE-2026-42023 CRITICAL 9.1 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configurati
• CVE-2026-42022 CRITICAL 9.1 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configurati
• CVE-2026-42021 CRITICAL 9.1 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configurati
• CVE-2026-35499 CRITICAL 9.1 An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TO
• CVE-2026-10141 CRITICAL 9.1 A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOL
• CVE-2026-10139 CRITICAL 9.1 A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X
• CVE-2026-10138 CRITICAL 9.1 A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOL
• CVE-2026-10137 CRITICAL 9.1 A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s)
• CVE-2026-10136 CRITICAL 9.1 A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s):
• CVE-2026-10135 CRITICAL 9.1 A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X200
• CVE-2026-10133 CRITICAL 9.1 A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLI
• CVE-2026-10132 CRITICAL 9.1 A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s
• CVE-2026-10131 CRITICAL 9.1 An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s):
• CVE-2026-101420 CRITICAL 9.6 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR)
• CVE-2026-113678 CRITICAL 9.9 Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that all
• CVE-2026-91665 CRITICAL 9.8 DOWNGRADE Vulnerability in Oracle Essbase (component: Security)
• CVE-2026-91305 CRITICAL 9.1 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Secu
• CVE-2026-91265 CRITICAL 9.1 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infras
• CVE-2026-113342 CRITICAL 9.6 UPGRADE Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbi
• CVE-2026-113336 CRITICAL 9.6 UPGRADE Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentia
• CVE-2026-113328 CRITICAL 9.6 UPGRADE Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-113300 CRITICAL 9.6 UPGRADE Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially
• CVE-2026-113283 CRITICAL 9.6 UPGRADE Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote
• CVE-2026-113270 CRITICAL 9.6 UPGRADE Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbit
• CVE-2026-113263 CRITICAL 9.6 UPGRADE Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-113261 CRITICAL 9.6 UPGRADE Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentia
• CVE-2026-113252 CRITICAL 9.6 UPGRADE Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote atta
• CVE-2026-113235 CRITICAL 9.6 UPGRADE Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to po
• CVE-2026-113222 CRITICAL 9.6 UPGRADE Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute
• CVE-2026-113211 CRITICAL 9.6 UPGRADE Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potent
• CVE-2026-113189 CRITICAL 9.6 UPGRADE Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary
• CVE-2026-113186 CRITICAL 9.6 UPGRADE Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arb
• CVE-2026-113171 CRITICAL 9.6 UPGRADE Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker t
• CVE-2026-113169 CRITICAL 9.6 UPGRADE Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote att
• CVE-2026-113138 CRITICAL 9.6 UPGRADE Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to poten
• CVE-2026-113126 CRITICAL 9.6 UPGRADE Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-113116 CRITICAL 9.6 UPGRADE Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially ex
• CVE-2026-113089 CRITICAL 9.6 UPGRADE Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113084 CRITICAL 9.6 UPGRADE Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113078 CRITICAL 9.6 Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113072 CRITICAL 9.6 UPGRADE Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially exec
• CVE-2026-113056 CRITICAL 9.6 UPGRADE Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-113023 CRITICAL 9.6 UPGRADE Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to p
• CVE-2026-113014 CRITICAL 9.6 UPGRADE Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potenti
• CVE-2026-113007 CRITICAL 9.6 UPGRADE Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentia
• CVE-2026-112992 CRITICAL 9.6 UPGRADE Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially e
• CVE-2026-101590 CRITICAL 9.1 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security)
• CVE-2026-101521 CRITICAL 9.8 Vulnerability in Oracle APEX (component: General)
• CVE-2026-101484 CRITICAL 9.8 Vulnerability in Oracle Secure Backup (component: Backup and Restore)
• CVE-2026-77930 CRITICAL 9.8 EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host sh
• CVE-2026-113390 CRITICAL 9.9 A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218
• CVE-2026-109444 CRITICAL 9.8 OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute
• CVE-2026-112380 CRITICAL 9.9 Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of
• CVE-2026-112403 CRITICAL 9.2 Pillow is a Python imaging library
• CVE-2026-112370 CRITICAL 9.9 A vulnerability was found in H3C Magic NX15 100R017
• CVE-2026-112398 CRITICAL 9.2 Pillow is a Python imaging library
• CVE-2026-111693 CRITICAL 9.8 DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthe
• CVE-2026-111643 CRITICAL 9.8 Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated
• CVE-2026-109219 CRITICAL 9.8 The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_u
• CVE-2026-102764 CRITICAL 9.8 EXPLOITED UPGRADE BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
• CVE-2026-76519 CRITICAL 9.8 EXPLOITED UPGRADE Cisco Secure Email Gateway Relative Path Traversal Vulnerability
• CVE-2026-110447 CRITICAL 9.2 EXPLOITED MITIGATE Collabora Online – Built-in CODE Server OS Command Injection Vulnerability