By severity

High-severity vulnerabilities

CVEs rated High by CVSS, with SEC.co remediation and prioritization guidance.

4140 published vulnerabilities · page 10 of 42

• CVE-2026-22335HIGH 8.5

  A SQL injection vulnerability has been discovered in WooCommerce Frontend Manager – Ultimate plugin versions before 6.7.7. The vulnerability allows authenticated users (those with subscriber-level access or higher) to inject malicious SQL commands through the plugin interface. This could enable attackers to read sensitive data from the website's database, though the vulnerability does not appear to enable direct modification of data. An attacker would need valid login credentials to exploit this issue.

• CVE-2026-24260HIGH 8.5

  NVIDIA Container Toolkit for Linux has a race condition vulnerability that could allow an authenticated attacker to execute arbitrary code, gain elevated privileges, or modify data on affected systems. The vulnerability stems from a time-of-check time-of-use (TOCTOU) flaw, where an attacker can exploit the window between a security check and the actual operation to bypass protections. While this requires valid credentials to initiate, the potential impact is severe across container infrastructure environments.

• CVE-2026-26231HIGH 8.5

  Gitea, a self-hosted Git service, contains a permission logic flaw that allows authenticated users to bypass write restrictions on repositories. Specifically, the "Allow edits from maintainers" permission setting can be misused to authorize commits to repositories the attacker can only read. This means a user with read-only access could potentially modify code they should not be allowed to change, undermining code integrity and access control.

• CVE-2026-35563HIGH 8.5

  A flaw in Apache Directory LDAP API version 2.1.7 allows an attacker with network interception capability to impersonate an LDAP server. The library validates that a certificate is signed by a trusted authority but fails to confirm that the certificate was actually issued for the LDAP server being connected to. An attacker positioned between a client and server can present any valid certificate from their trust store, hijacking the connection and accessing sensitive authentication and directory data.

• CVE-2026-39581HIGH 8.5

  A SQL injection vulnerability exists in WP Sessions Time Monitoring Full Automatic plugin version 1.1.4 and earlier. An authenticated attacker with subscriber-level permissions can inject malicious SQL commands through the plugin's input validation, potentially exposing sensitive database information. The vulnerability requires an existing user account but no additional interaction, making it a meaningful risk in multi-user WordPress environments.

• CVE-2026-44797HIGH 8.5

  Nautobot, a network automation and source-of-truth platform, contains a webhook configuration vulnerability that allows authenticated users to craft requests to internal hosts and IP addresses they should not be able to reach. This is functionally similar to server-side request forgery (SSRF) attacks, where the application itself becomes a proxy for malicious requests. An attacker with sufficient access could abuse this to scan internal networks, access restricted services, or exfiltrate data. The issue affects Nautobot versions prior to 2.4.33 and 3.1.2.

• CVE-2026-44850HIGH 8.5

  Portainer Community Edition versions 2.33.0 through 2.33.7, 2.39.0–2.39.1, and 2.40.x contain a security bypass in their bind-mount restriction feature. Organizations using Portainer to enforce a policy that prevents regular users from mounting host directories into containers can be circumvented. An authenticated user with container-creation rights can work around the restriction by using an alternative API field (HostConfig.Mounts) that the security check failed to inspect, allowing them to mount sensitive host paths into containers they control. This bypasses intended access controls and exposes host data to authenticated container users.

• CVE-2026-45549HIGH 8.5

  Roxy-WI, a web management tool for load balancers and web servers, contains a privilege escalation vulnerability in versions 8.2.6.4 and earlier. Any user logged into the system—even those with minimal "guest" privileges—can remotely start, stop, or restart the monitoring agent service on any server managed by Roxy-WI. Because the underlying systemd commands execute with root privileges, an attacker can disrupt critical infrastructure services or cause denial of service across your entire load-balanced environment. Authentication is required, but the lack of role or permission checks makes this a significant lateral movement and sabotage risk.

• CVE-2026-45687HIGH 8.5

  Rocket.Chat versions prior to specific patch releases contain a file upload vulnerability that allows authenticated users to manipulate their own uploaded file records in ways the application never intended. When a user uploads a file, the application fails to validate which fields can be modified, allowing an attacker to rewrite metadata about where files are stored and how they're referenced in the system. This could lead to unauthorized access to file storage systems or manipulation of file locations, though the vulnerability requires an existing user account to exploit.

• CVE-2026-46372HIGH 8.5

  SillyTavern, a local application for interacting with AI language models and voice services, contains a server-side request forgery (SSRF) vulnerability in its search API endpoint. An authenticated user with low privileges can manipulate the baseUrl parameter to force the server to make requests to internal or loopback services, then view the responses. This allows attackers to probe or exfiltrate data from systems that should only be accessible internally. The flaw affects all versions before 1.18.0 and has been patched in that release.

• CVE-2026-46820HIGH 8.5

  A vulnerability in Oracle Financials Common Modules allows attackers with basic user credentials to gain unauthorized access to sensitive financial data. An attacker with low-level access and network connectivity can trigger a flaw that lets them read critical data, modify records, or access information across multiple Oracle E-Business Suite systems. This is particularly dangerous because it requires no additional tricks or user interaction—just ordinary network access. The vulnerability affects Oracle Financials versions 12.2.3 through 12.2.15 and poses a material risk to organizations storing financial records in Oracle systems.

• CVE-2026-46870HIGH 8.5

  CVE-2026-46870 is a privilege escalation and system compromise vulnerability in Oracle MySQL Shell for VS Code (version 2026.2.0+9.6.1). An attacker with low-level network access and basic system credentials can exploit this issue through multiple network protocols to gain full control over the MySQL Shell application. The vulnerability is difficult to exploit but has severe impact: successful attacks lead to complete compromise of confidentiality, integrity, and availability. Critically, compromising MySQL Shell can enable attacks on other systems it connects to or manages, expanding the blast radius beyond the tool itself.

• CVE-2026-46915HIGH 8.5

  Oracle's Complex Maintenance, Repair and Overhaul (CMRO) component within E-Business Suite contains a privilege escalation vulnerability that allows attackers with low-level network access to compromise the system. An attacker would need valid credentials or low privileges to initiate an attack via HTTP, but exploitation is complex and not trivial. If successful, the attacker could gain complete control over CMRO and potentially affect other connected Oracle systems due to the scope change.

• CVE-2026-47201HIGH 8.5

  authentik, an open-source identity provider used to manage user authentication and authorization, contains a vulnerability in how it validates SAML responses from upstream identity providers. The flaw allows an attacker who has any valid account at an upstream IdP to reuse a legitimately signed authentication assertion to impersonate other federated users. This works because authentik doesn't properly validate XML signatures, making it vulnerable to XML Signature Wrapping attacks—a technique where attackers manipulate the structure of signed XML data without invalidating the signature itself. An attacker needs valid credentials at the upstream IdP but can then gain unauthorized access as arbitrary other users in systems relying on authentik for federation.

• CVE-2026-48882HIGH 8.5

  A SQL injection vulnerability has been discovered in WP Time Slots Booking Form plugin versions 1.2.50 and earlier. An authenticated user with subscriber-level permissions can execute arbitrary SQL queries against the WordPress database. This allows attackers to read sensitive data such as user credentials, plugin configurations, and other database records without requiring administrative access.

• CVE-2026-48964HIGH 8.5

  ELEX WordPress HelpDesk & Customer Ticketing System versions 3.3.6 and earlier contain a SQL injection vulnerability that allows authenticated users with subscriber-level permissions to execute arbitrary SQL queries against the database. An attacker with a subscriber account could extract sensitive data, including customer information and internal ticketing records, without needing administrator access. This is a significant risk for organizations using this plugin to manage customer support tickets and sensitive communications.

• CVE-2026-49073HIGH 8.5

  A blind SQL injection vulnerability exists in wpWax Directorist Booking that allows authenticated users to execute arbitrary SQL queries against the underlying database without seeing direct results. An attacker with login credentials can exploit this flaw to extract sensitive information, bypass authentication mechanisms, or degrade system availability. The vulnerability affects versions up to and including 3.0.3.

• CVE-2026-49120HIGH 8.5

  Medplum versions before 5.1.14 contain a vulnerability that allows authenticated users to make the server reach out to internal network addresses and systems that should be isolated. An attacker with valid credentials can create subscription configurations that trick the system into fetching or sending data to sensitive internal targets like cloud credential stores or databases. This enables attackers to steal credentials and patient health information that would normally only be accessible to administrators.

• CVE-2026-49444HIGH 8.5

  n8n is a popular workflow automation platform that lets teams build integrations and automations without extensive coding. A vulnerability in versions before 1.123.48, 2.21.8, and 2.22.4 allows authenticated users who can create or modify workflows to bypass Python Code Node sandbox protections and execute arbitrary code directly on the task runner container. This requires valid credentials but no special privileges beyond workflow creation rights, making it a significant risk in shared or multi-tenant environments.

• CVE-2026-49489HIGH 8.5

  OpenCATS, a recruitment and applicant tracking software, contains a SQL injection flaw in its data grid sorting feature. An authenticated user can manipulate the sortDirection parameter to inject malicious SQL commands, allowing them to extract sensitive information from the application's database. The vulnerability requires valid login credentials but poses significant risk because attacker queries execute without user interaction and can retrieve confidential candidate, recruiter, and business data.

• CVE-2026-49824HIGH 8.5

  Fission, an open-source serverless framework for Kubernetes, contains a namespace validation gap in its Function admission webhook. The webhook correctly validates that Secrets and ConfigMaps referenced by a function must belong to the same namespace as the function itself—a security boundary enforcement mechanism. However, it failed to apply the same check to environment specifications, allowing authenticated users to reference environments from other namespaces. This cross-namespace access could enable privilege escalation or unauthorized data exposure in multi-tenant Kubernetes clusters. The issue affects all versions prior to 1.24.0.

• CVE-2026-50570HIGH 8.5

  Fission, a Kubernetes-native serverless framework, has a flaw in how it validates which Linux capabilities tenants are allowed to add to containers. The framework maintains a denylist of dangerous capabilities to prevent privilege escalation, but the list was incomplete—it missed CAP_SYS_TIME and others. This means a tenant could create a Function or Environment and request CAP_SYS_TIME, which would pass validation and allow their code to run with the ability to modify system time. This is a privilege escalation vulnerability that affects multi-tenant Fission clusters where untrusted users can define workloads.

• CVE-2026-52797HIGH 8.5

  Gogs, a self-hosted Git platform, contains a path traversal vulnerability affecting versions before 0.14.0. An authenticated user can manipulate input passed to the git diff command to write comparison results to arbitrary file locations outside the intended repository directory. This allows an attacker with valid credentials to overwrite or create files on the server, potentially compromising system integrity and availability.

• CVE-2026-54008HIGH 8.5

  Open WebUI, a self-hosted AI platform designed for offline operation, contains a server-side request forgery (SSRF) vulnerability in its OAuth profile picture handling. An attacker with valid credentials to an OAuth identity provider can exploit the application's unsafe HTTP redirect handling to make Open WebUI fetch content from internal network addresses and expose that data through the attacker's profile image URL. The flaw exists because the application validates the initial URL but then allows HTTP redirects without restriction, enabling an attacker to point a public URL at their target, redirect the application to an internal service, and read the response.

• CVE-2026-54312HIGH 8.5

  n8n, a popular open source workflow automation platform, contains a prototype pollution vulnerability in its Microsoft SQL node that allows authenticated users to corrupt the JavaScript prototype chain across the entire application. When a user with permission to create or modify workflows supplies a malicious value in the table parameter, it permanently poisons Object.prototype for the running process, breaking validation logic application-wide and rendering the n8n instance unusable until restart. The vulnerability affects versions before 2.24.0 and requires an authenticated account but no additional user interaction.

• CVE-2026-54353HIGH 8.5

  Budibase, an open-source low-code platform, contains a server-side request forgery (SSRF) vulnerability that allows authenticated users with automation permissions to access internal services and cloud metadata endpoints. The flaw exploits a time-of-check-to-time-of-use (TOCTOU) weakness: the platform validates a hostname against a blacklist before sending a request, but the underlying network library performs a fresh DNS lookup during the actual connection. An attacker can craft a malicious hostname that resolves to a public IP address during validation (passing the blacklist check) and then resolves to an internal IP address (like 127.0.0.1 or cloud metadata services) when the real connection attempt occurs. This bypass gives attackers non-blind SSRF access to services only reachable from the Budibase server itself. The vulnerability was introduced prior to version 3.39.9 and has been patched in that release.

• CVE-2026-54765HIGH 8.5

  Traefik versions 3.7.0 through 3.7.5 contain a filter application bug in the Kubernetes Gateway API provider that can cause requests intended for one HTTPRoute to be processed using a different route's security filters. An attacker with the ability to create HTTPRoutes in a Kubernetes cluster can exploit this to apply their own filter rules (such as injected headers) to legitimate traffic, potentially escalating privileges or accessing data they shouldn't see. The vulnerability requires existing cluster access but can cross namespace boundaries if ReferenceGrants permit it.

• CVE-2026-54813HIGH 8.5

  A SQL injection vulnerability exists in Brainstorm Force SureDash through version 1.8.0 that allows authenticated users to execute blind SQL injection attacks. An attacker with valid login credentials can inject malicious SQL commands into application input fields, potentially extracting sensitive data from the underlying database without seeing direct query results. The vulnerability requires user authentication, which limits but does not eliminate risk in environments where account compromise or insider threats are concerns.

• CVE-2026-54818HIGH 8.5

  Slimstat Analytics, a WordPress plugin for visitor tracking and analytics, contains a blind SQL injection vulnerability that allows authenticated users to execute arbitrary database queries. An attacker with login access can extract sensitive data from the WordPress database without triggering obvious error messages, since blind SQL injection works through time-based or boolean-based inference rather than direct output. Versions up to and including 5.4.11 are affected.

• CVE-2026-55999HIGH 8.5

  A heap buffer overflow vulnerability exists in X.Org's X server and XWayland that allows local attackers with X connection access to crash the server or potentially execute code by providing specially crafted PCX font files. The flaw stems from insufficient validation of glyph boundaries during font handling, enabling memory corruption when the SetFont operation processes malicious font data.

• CVE-2026-56001HIGH 8.5

  A heap buffer overflow exists in libXfont2, a font rendering library used by X Server. The vulnerability occurs when the BitmapScaleBitmaps function processes specially crafted font data with oversized 32-bit values that exceed buffer boundaries. An authenticated attacker who can communicate with the X Server could exploit this flaw to execute arbitrary code with X Server privileges. The vulnerability affects libXfont2 versions prior to 2.0.8.

• CVE-2026-56002HIGH 8.5

  A memory corruption flaw in libXfont2 allows authenticated X clients to crash the X server or execute arbitrary code within it. The vulnerability exists in the font file parsing function pcfReadFont(), which fails to validate glyph boundary data before writing to heap memory. An attacker with valid X client credentials can trigger this condition by supplying a malformed font file, potentially compromising the entire X display session and any services relying on it.

• CVE-2026-56003HIGH 8.5

  A heap buffer overflow exists in libXfont2, the font library used by X servers. When processing specially crafted PCF (Portable Compiled Font) files, the ComputeScaledProperties() function fails to validate buffer sizes properly, allowing an authenticated X client to trigger memory corruption and execute arbitrary code with X server privileges. The vulnerability requires an authenticated connection to an X server and careful exploitation, but succeeds regardless of memory protections on vulnerable systems.

• CVE-2026-56012HIGH 8.5

  CVE-2026-56012 is a SQL injection vulnerability in David Lingren Media Library Assistant that allows authenticated attackers to extract sensitive data through blind SQL injection techniques. An attacker with valid login credentials can craft malicious database queries that bypass application validation, enabling unauthorized access to confidential information without leaving obvious traces of tampering. Versions 3.35 and earlier are affected.

• CVE-2026-56663HIGH 8.5

  AutoGPT, a workflow automation platform for AI agents, has a critical security flaw that allows authenticated users to bypass built-in protections designed to prevent access to internal network services. The vulnerability exists because the application fails to properly validate certain types of IP addresses—specifically IPv4-mapped IPv6 addresses and special-use ranges like carrier-grade NAT (CGNAT) addresses. An attacker with valid credentials could exploit this to reach internal services that should be off-limits, potentially compromising sensitive infrastructure. The issue has been fixed in version 0.6.52.

• CVE-2026-56690HIGH 8.5

  Dell PowerFlex Manager versions before 5.1.0.1 contain a SQL injection flaw that allows attackers with low-level user credentials and network access to query the database directly. An attacker could extract sensitive data, modify information, or gain unauthorized access to storage infrastructure management functions without requiring special privileges or user interaction.

• CVE-2026-56769HIGH 8.5

  Huly Platform versions up to 0.7.423 contain a server-side request forgery (SSRF) flaw in the import endpoint that authenticated workspace users can exploit to make the server fetch arbitrary URLs. An attacker with valid workspace credentials can supply malicious URLs, causing the server to request internal services, leak response data, and potentially use captured credentials to attack backend systems. The vulnerability requires authentication, limiting the immediate exposure pool, but poses significant risk to organizations running vulnerable Huly deployments with privileged backend architectures.

• CVE-2026-56771HIGH 8.5

  NewsBlur versions before 14.5.0 contain a server-side request forgery (SSRF) vulnerability in the add_url endpoint. An authenticated user can trick the server into making requests to arbitrary internal network addresses, including localhost and cloud metadata services. This allows attackers to scan internal networks, access sensitive services running on the same machine or network, and potentially exfiltrate confidential data. The vulnerability requires authentication to exploit, but the damage scope extends beyond the user's normal access level due to the server acting on the attacker's behalf.

• CVE-2026-57315HIGH 8.5

  Blocksy Companion Pro, a WordPress plugin used to extend theme functionality, contains a critical remote code execution vulnerability affecting versions 2.1.45 and earlier. An authenticated contributor—someone with legitimate but limited access to a WordPress site—can exploit this flaw to execute arbitrary code on the server, potentially compromising the entire website and underlying infrastructure. This is a privilege-escalation attack that transforms a low-privilege account into a tool for complete system compromise.

• CVE-2026-57663HIGH 8.5

  A SQL injection vulnerability exists in the Zip Recipes WordPress plugin (Recipe Maker For Your Food Blog) in versions 8.2.7 and earlier. The flaw allows authenticated contributors—users with the ability to create and edit recipe content—to inject malicious SQL commands through the plugin's interface. An attacker with contributor-level access could query, modify, or delete sensitive database records, though direct denial of service is also possible. This is a server-side vulnerability requiring valid WordPress credentials, which limits exposure to internal threats or compromised contributor accounts.

• CVE-2026-57947HIGH 8.5

  Pinpoint versions up to 3.1.0 have a server-side request forgery (SSRF) vulnerability in their webhook registration feature. Authenticated users can register webhooks pointing to internal network addresses that the server will then contact. By triggering alarm threshold breaches, attackers can force the Pinpoint server to send POST requests to internal hosts, metadata endpoints, or other sensitive infrastructure on the internal network. This bypasses network segmentation and enables reconnaissance or unauthorized access to systems that should only be reachable internally.

• CVE-2026-57955HIGH 8.5

  SigNoz, an open-source observability platform, contains a SQL injection flaw in its alert history API endpoints. Authenticated users can inject malicious code through the rule ID parameter to run arbitrary database queries against ClickHouse, the underlying data store. Attackers can extract all stored traces, logs, and metrics, or leverage database functions to reach external systems. The vulnerability affects versions through 0.130.1 and requires valid login credentials to exploit.

• CVE-2026-9330HIGH 8.5

  IBM WebSphere Application Server versions 8.5 and 9.0 contain a flaw in how they validate incoming data during user authentication via SAML (Security Assertion Markup Language) web single sign-on. An attacker with valid login credentials can send a specially crafted request that, when processed through a vulnerable deserialization pathway, may execute arbitrary code on the server. This risk is elevated because it requires only basic authentication and can impact systems across an organization's trust boundary.

• CVE-2018-25383HIGH 8.4

  Free MP3 CD Ripper version 2.8 contains a critical flaw in how it processes WMA audio files. When a user opens a specially crafted malicious WMA file through the application's Convert function, the software fails to properly validate the file structure, causing a memory overflow. This overflow allows an attacker to inject and execute malicious code on the affected computer. The vulnerability is particularly serious because it can circumvent Windows DEP (Data Execution Prevention) protection—a core OS security feature—by leveraging exception handling tricks to execute arbitrary commands with the same privileges as the user running the application.

• CVE-2018-25432HIGH 8.4

  Arm Whois version 3.11 contains a buffer overflow flaw that allows attackers with local access to execute arbitrary code. The vulnerability stems from insufficient bounds checking when processing input, allowing an attacker to craft a specially crafted file that overwrites critical memory structures used by Windows exception handling. This hijacking of the structured exception handler (SEH) gives the attacker the ability to run malicious code with the privileges of the user running the application.

• CVE-2019-25718HIGH 8.4

  The Dräger Infinity Explorer C700, a patient monitor interface device, contains a vulnerability that allows an attacker with local access to break out of its restricted kiosk environment and gain full control of the underlying operating system. Once escaped from kiosk mode, an attacker can manipulate the device's display, causing it to show incorrect patient data or no data at all—a serious concern in clinical settings where accurate vital sign monitoring is critical to patient safety.

• CVE-2019-25733HIGH 8.4

  NetShareWatcher version 1.5.8.0 contains a memory safety flaw that lets a local attacker run malicious code on an affected system. The vulnerability exists in how the application handles user-supplied text in its Restrictions custom filter field. When a specially crafted filter is supplied and the Find function is triggered, the application's exception handling mechanism can be hijacked to execute arbitrary commands with the privileges of the user running NetShareWatcher. This is a local-only attack—the attacker must have access to the machine running the application.

• CVE-2019-25735HIGH 8.4

  AllPlayer version 7.4 contains a buffer overflow flaw in how it processes URLs. When a user opens the application's URL dialog and pastes an unusually long URL string, the application fails to validate the input length properly. This allows an attacker to overwrite critical memory structures called structured exception handlers (SEH pointers), which Windows uses to manage error handling. By crafting a malicious URL, an attacker can hijack this process to execute arbitrary commands on the affected system with the same privileges as the logged-in user.

• CVE-2019-25736HIGH 8.4

  LabF nfsAxe 3.7 Ping Client is vulnerable to a buffer overflow flaw that allows an unauthenticated attacker with local system access to run arbitrary code. An attacker can craft a malicious input file and submit it through the Host IP field to overwrite memory and execute commands with the privileges of the user running the application.

• CVE-2025-26240HIGH 8.4

  JazzCore's python-pdfkit version 1.0.0 contains a flaw in its from_string method that allows attackers to execute arbitrary JavaScript code on the server and steal local files. An attacker with local access can exploit this without special privileges or user interaction, making it a serious threat to any application using this library to convert HTML or strings to PDF. The vulnerability affects the confidentiality, integrity, and availability of the affected system.

• CVE-2026-12411HIGH 8.4

  CVE-2026-12411 is a broken access control flaw in Canonical LXD's devLXDInstancePatchHandler that allows a guest container to access and modify storage volumes belonging to other guest containers. An attacker with local access to a container can send a specially crafted request through the /dev/lxd interface to read or overwrite another container's custom storage volume, but only when the security.devlxd.management.volumes feature is enabled. This breaks the isolation that containerization is designed to provide.

• CVE-2026-24066HIGH 8.4

  Slate Digital Connect version 1.37.0 for macOS contains a critical flaw in how it validates connections to a privileged system service. The application installs a helper tool that runs with elevated privileges, but when other programs attempt to connect to it, the helper only checks one field of the requesting program's digital certificate—specifically, the organizational unit—without verifying that the certificate actually comes from a trusted authority. An attacker on the same Mac can create a fake certificate with the correct organizational unit value and trick the helper into granting them privileged access, potentially allowing them to escalate their permissions to admin-level capabilities.

• CVE-2026-24067HIGH 8.4

  Slate Digital Connect 1.37.0 for macOS contains a privilege escalation vulnerability stemming from how it validates connections to a system-level helper tool. The application uses a process identifier (PID) to confirm that only trusted programs can access elevated functions, but PIDs can be recycled by the operating system when processes end. An attacker on the same Mac can create a race condition by timing a connection request so that a malicious process reuses the PID of a legitimate, trusted process after validation has checked but before the privileged action executes. This timing gap allows the attacker to execute privileged operations they should not have access to, potentially gaining administrative control of the system.

• CVE-2026-26422HIGH 8.4

  A flaw in clash-verge-service-ipc versions prior to 2.3.0 exposes an inter-process communication endpoint that is accessible to any local user on the system. An attacker with local access can exploit this to escalate their privileges to a higher level, potentially gaining full control of the affected system. This is a local-only attack that does not require any special user privileges or interaction to trigger.

• CVE-2026-35272HIGH 8.4

  Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 contain a local privilege escalation vulnerability in the Deployment Package component. An attacker with legitimate access to the infrastructure hosting PeopleSoft can exploit this flaw without authentication to gain complete control over the PeopleSoft system, compromising confidentiality, integrity, and availability. The vulnerability carries a CVSS score of 8.4 (HIGH severity).

• CVE-2026-39118HIGH 8.4

  Kandji Agent versions before 4.7.5(5374) contain a privilege escalation vulnerability that allows an attacker with local access to bypass client-side validation checks and invoke functionality that should be restricted. An unauthenticated local user can exploit this weakness to gain higher privileges on the affected system without user interaction.

• CVE-2026-41098HIGH 8.4

  Azure Stack Edge contains a cross-site scripting (XSS) vulnerability that allows an authorized administrator to inject malicious scripts into the web interface. When other authorized users interact with the compromised interface, those scripts execute in their browsers, enabling the attacker to spoof content, steal session tokens, or perform actions on their behalf. This is a high-severity issue because it affects a privileged management interface and can lead to widespread compromise within an organization's edge infrastructure.

• CVE-2026-44810HIGH 8.4

  A flaw in Windows Cryptographic Services fails to properly authenticate certain operations, allowing an attacker with local access to bypass security controls and gain elevated system privileges. The vulnerability affects multiple versions of Windows 11 and Windows Server 2022/2025. An attacker with standard user access could exploit this to run code with administrative rights, potentially compromising the entire system.

• CVE-2026-44941HIGH 8.4

  A flaw in how openSUSE's libzypp library processes repository metadata (repomd.xml files) allows attackers who control a malicious repository to execute arbitrary file operations on target systems with root privileges. The vulnerability exists in the handling of the 'keyhint' option and stems from insufficient validation of file paths, enabling an attacker to inject or overwrite sensitive files. Exploitation requires that a user or system add and use the attacker's crafted repository, but once that happens, the impact is severe.

• CVE-2026-45456HIGH 8.4

  A type confusion flaw in Microsoft Office allows an attacker with local access to execute arbitrary code on a machine without requiring user interaction or elevated privileges. The vulnerability stems from improper handling of incompatible data types in memory, which an attacker can exploit to gain full system compromise including reading, modifying, or deleting files. This is a local-only attack—the attacker must already have a foothold on the system, but once exploited, the impact is severe.

• CVE-2026-45458HIGH 8.4

  A use-after-free memory vulnerability in Microsoft Office allows an unauthorized attacker to execute arbitrary code on a local system. The vulnerability affects multiple Office products and versions, including Office 2019, 2021, 2024, Microsoft 365 Apps, Word, and SharePoint Server. Exploitation requires local access but does not require user interaction or elevated privileges, making it a significant local privilege escalation and code execution risk.

• CVE-2026-45461HIGH 8.4

  A use-after-free memory flaw in Microsoft Office could allow an attacker with local access to run malicious code on your system with the same privileges as the logged-in user. The vulnerability requires no special permissions or user interaction beyond having access to the machine, making it a serious risk in environments where multiple users or untrusted software might run on the same device.

• CVE-2026-45463HIGH 8.4

  CVE-2026-45463 is a high-severity vulnerability in Microsoft Office products that allows an attacker to execute arbitrary code on a local system without requiring any special privileges or user interaction. The flaw stems from an integer underflow bug—a condition where a numerical calculation wraps around to an unexpectedly large value, corrupting memory and enabling code execution. Because no credentials or user action are needed to trigger the vulnerability, any user with local access to an affected system is at immediate risk.

• CVE-2026-45472HIGH 8.4

  Microsoft Office contains a use-after-free memory vulnerability that allows an attacker with local access to execute arbitrary code without requiring special user privileges or interaction. This is a serious flaw because it affects multiple versions of Office across both subscription (Microsoft 365) and perpetual licensing models. The vulnerability stems from improper memory management when handling certain Office objects, creating a window where freed memory is accessed, potentially leading to full system compromise.

• CVE-2026-45474HIGH 8.4

  A use-after-free vulnerability in Microsoft Office allows an attacker to execute arbitrary code on a local system without requiring user interaction or special privileges. This is a memory safety issue where the application references memory that has already been freed, potentially enabling complete system compromise through malicious Office documents or crafted input.

• CVE-2026-45482HIGH 8.4

  A path traversal vulnerability in GitHub Copilot and Visual Studio Code allows an attacker to bypass a local security feature by manipulating file paths. An unauthorized party can exploit this flaw on a compromised or shared machine without requiring special privileges or user interaction, potentially gaining unauthorized access to sensitive files or directories that should be restricted.

• CVE-2026-45607HIGH 8.4

  CVE-2026-45607 is a high-severity vulnerability in Windows Hyper-V that allows an attacker with local access to read memory outside intended boundaries and execute arbitrary code. The flaw requires no special privileges or user interaction to trigger, making it a direct path to system compromise on affected machines. This is not yet listed on the CISA Known Exploited Vulnerabilities catalog, but the combination of local access and code execution capability makes it a meaningful risk for organizations running Hyper-V infrastructure.

• CVE-2026-45641HIGH 8.4

  CVE-2026-45641 is a type confusion vulnerability in Windows Hyper-V that allows an attacker with local system access to execute arbitrary code with full privileges. The flaw stems from the hypervisor incorrectly handling resource access when different data types are confused during processing, leading to memory corruption and code execution. This is a serious local privilege escalation vector affecting multiple Windows 10 and Windows 11 versions, as well as Windows Server 2022 and 2025.

• CVE-2026-46251HIGH 8.4

  A vulnerability in the Linux kernel's Btrfs filesystem corrupts internal list structures when certain filesystem features are enabled. When the EXTENT_TREE_V2 compatibility flag is set, the kernel incorrectly manages the block group tree's tracking list during transaction commits. This causes the list's internal pointers to become invalid, leading to filesystem panics, transaction failures, and potential data loss. The issue manifests when the filesystem performs allocation operations on machines where this feature flag is active.

• CVE-2026-46270HIGH 8.4

  A use-after-free vulnerability exists in the Linux kernel's RT9455 power supply driver. The bug stems from improper resource cleanup ordering during driver removal: an interrupt handler can fire after the power supply device has been deallocated but before the interrupt itself is disabled, causing the handler to reference freed memory. This can crash the system or corrupt kernel memory. The vulnerability can also manifest during driver initialization if an interrupt fires before the power supply is fully registered.

• CVE-2026-46288HIGH 8.4

  CVE-2026-46288 is a use-after-free memory safety bug in the Linux kernel's device tree unit testing code. The vulnerability occurs because the code releases memory for a data structure but then continues to access that same memory through another variable pointing to the same location. This can lead to crashes, information disclosure, or potentially arbitrary code execution with local access. The issue is confined to kernel test infrastructure rather than production device tree handling, limiting its practical exposure, but it demonstrates a common class of memory management errors that merit fixing.

• CVE-2026-46326HIGH 8.4

  A memory initialization flaw has been found in the Linux kernel's industrial I/O (IIO) pressure sensor driver for the MPRLS0025PA device. The driver fails to properly initialize a critical data structure (spi_transfer struct) before use, leaving it containing uninitialized memory. An attacker with local access could exploit this to read sensitive kernel memory, modify kernel state, or trigger a denial of service. This is a local privilege escalation risk primarily affecting embedded systems and IoT devices that use this specific pressure sensor.

• CVE-2026-46788HIGH 8.4

  A vulnerability in Oracle WebCenter Content version 14.1.2.0.0 allows an attacker with administrative privileges to compromise the system through specially crafted HTTP requests. The vulnerability requires an administrator to interact with malicious content, but once exploited, can lead to complete control of the WebCenter Content instance. Because WebCenter Content often integrates with other enterprise systems, a successful attack may cascade to affect additional products in your Oracle Fusion Middleware environment.

• CVE-2026-47635HIGH 8.4

  A heap-based buffer overflow vulnerability exists in Microsoft Office 2024 that allows an attacker with local access to execute arbitrary code with the privileges of the user running Office. The vulnerability requires no user interaction or special privileges to trigger, making it a direct local code execution risk for anyone with system access to an affected machine.

• CVE-2026-47929HIGH 8.4

  ColdFusion versions 2023.19, 2025.8 and earlier contain an authorization flaw that allows high-privileged attackers to execute arbitrary code within the context of the current user without requiring any user interaction. The vulnerability crosses trust boundaries, meaning an attacker with elevated permissions could escalate access or take control of affected accounts and sessions. This is a serious issue for organizations running vulnerable versions of ColdFusion.

• CVE-2026-47931HIGH 8.4

  Adobe ColdFusion versions 2023.19, 2025.8 and earlier contain a flaw that allows attackers with high-level privileges to run malicious code on affected systems without requiring any user to click a link or take action. The vulnerability stems from the application not properly validating input data before processing it. While the attacker needs elevated access to the system, once they exploit this flaw, they can execute arbitrary code with the same permissions as the ColdFusion application itself, potentially compromising data and system integrity.

• CVE-2026-49238HIGH 8.4

  Canonical Multipass before version 1.16.3 contains a path validation flaw that allows a user with root access inside a guest virtual machine to escape the sandbox and read files on the host system. The vulnerability exists in the SFTP server component that bridges file sharing between the guest and host. An attacker can craft specially formatted file access requests containing path traversal sequences that bypass the intended directory boundaries, giving them access to sensitive files on the host machine with the privileges of the root process managing the file share.

• CVE-2026-53091HIGH 8.4

  A vulnerability exists in how the Linux kernel handles network packets during transmission, specifically in code that processes Generic Segmentation Offload (GSO) packets. The kernel wasn't properly ensuring that packet headers were moved into the correct memory location before passing them to network drivers. This could allow a local user to craft malicious packets that crash the system or potentially cause other kernel instability. The issue has been addressed by ensuring headers are properly validated and moved into place, with the kernel now detecting and dropping obviously malformed GSO packets.

• CVE-2026-54096HIGH 8.4

  File Browser versions prior to 2.63.7 contain a logic flaw that allows authenticated users to pre-stage public share links for files that don't yet exist. When those files are later created at the predicted path, they are automatically exposed through the public share mechanism, bypassing normal access controls. An attacker with valid credentials can exploit this to gain unauthorized read access to files created by others in predictable locations.

• CVE-2026-54320HIGH 8.4

  Daytona, an infrastructure runtime for AI code execution, contains a flaw in how it validates organization invitations. Before version 0.184.0, a user could accept an organization invitation—potentially gaining Owner-level access—without verifying their email address, as long as the email matched the invitation target. This circumvents a security control that normally requires email verification before granting organization membership. The vulnerability requires an attacker to have registered an account and received a session from their identity provider, but does not require prior authorization within Daytona itself.

• CVE-2026-54424HIGH 8.4

  Unity Parsec, a remote desktop and cloud gaming platform, contains a privilege escalation vulnerability on Windows systems. An attacker can manipulate environment variables to cause the Parsec daemon process (parsecd.exe) to run with system-level privileges while pointing to attacker-controlled directories. This allows an unprivileged user to execute code with NT AUTHORITY\SYSTEM privileges, effectively taking complete control of the affected computer. The vulnerability requires local access but no user interaction, making it a straightforward path to full system compromise.

• CVE-2026-58302HIGH 8.4

  LinuxCNC's rtapi_app component, which runs with root privileges, loads software modules based on user input without properly validating the file path. An attacker without special privileges can exploit path traversal techniques to point the application toward a malicious library file they control, causing the privileged process to load and execute it. This results in immediate root-level compromise of the system. The vulnerability affects LinuxCNC versions before 2.9.9.

• CVE-2026-6824HIGH 8.4

  A stored cross-site scripting (XSS) vulnerability affects certain 1xxx series network video recorder (NVR) devices. Attackers with high-level administrative access can inject malicious JavaScript into the device through specific functional modules that fail to properly validate user input. Unlike reflected XSS attacks that require a user to click a malicious link, this vulnerability persists on the NVR backend—meaning when any administrator or authorized user logs in and views the compromised pages, the attacker's scripts run automatically in their browser session without additional user interaction beyond normal login. This could enable an attacker to impersonate users, perform unauthorized actions on the device or connected systems, or exfiltrate sensitive data like recordings or credentials.

• CVE-2024-32949HIGH 8.3

  CVE-2024-32949 is a missing authorization flaw in the Prince Integrate Google Drive plugin that allows attackers to bypass access controls and perform unauthorized actions. An unauthenticated remote attacker can exploit misconfigured security levels to read data, make changes, or disrupt availability without needing valid credentials or user interaction. The vulnerability affects all versions of Integrate Google Drive up to and including 1.3.8.

• CVE-2024-52011HIGH 8.3

  CVE-2024-52011 is a command injection vulnerability in the launch-editor library, a Node.js utility that opens files in text editors with specified line numbers. Before version 2.9.0, the library failed to properly sanitize filename input on Windows systems, allowing an attacker to inject and execute arbitrary commands by crafting a malicious filename. An attacker would need to trick a user into opening a specially crafted file—typically through a development workflow, build process, or IDE integration—to trigger code execution with the privileges of the affected user.

• CVE-2025-2902HIGH 8.3

  Hitachi Virtual Storage Platform systems contain an authorization flaw in a maintenance utility that allows authenticated users to perform actions they should not be permitted to carry out. An attacker with valid credentials can exploit this weakness to make unauthorized changes to storage configurations or access sensitive data. The vulnerability requires an existing user account but no special privileges to trigger, making it a meaningful risk in environments where storage access is shared across teams or where former employees retain credentials.

• CVE-2025-5088HIGH 8.3

  CVE-2025-5088 is a privilege escalation vulnerability in CVX clusters that allows an authenticated attacker with Redis access to gain root-level control across all servers in the cluster. The exploit requires two prerequisites: network connectivity to the Redis service and possession of the Redis password. Currently, Redis communication—including password authentication—occurs in plaintext, making credentials vulnerable to interception on the network. This is a significant insider threat and network-access risk for organizations running CVX infrastructure.

• CVE-2025-71328HIGH 8.3

  Flowise, a low-code AI workflow platform, contains a password change vulnerability affecting versions before 3.0.10. An authenticated attacker can reset a user's account password without providing the current password or undergoing additional verification. This means if an attacker gains access to an active session—through phishing, social engineering, or session hijacking—they can silently change the password and permanently lock out the legitimate user, achieving full account takeover.

• CVE-2025-71337HIGH 8.3

  Flowise versions 3.0.7 and earlier contain a flaw that lets any logged-in user change their account email address without verifying the change with the original email or re-entering their password. Since email serves as both the login identifier and the channel for password recovery, an attacker with account access can silently redirect recovery emails to an attacker-controlled address, enabling complete account takeover. This is a high-severity issue because it removes critical safeguards that normally protect email changes—the two most common identity verification methods in web applications.

• CVE-2026-10000HIGH 8.3

  A use-after-free memory vulnerability exists in Google Chrome's password management system on Windows. An attacker who has already compromised Chrome's renderer process (the sandboxed component that displays web pages) could exploit this flaw through a malicious HTML page to escape the sandbox and gain system-level access. This is a multi-stage attack: the attacker must first achieve renderer compromise, then leverage this vulnerability to break out of Chrome's security boundary.

• CVE-2026-10001HIGH 8.3

  A use-after-free flaw in Chrome's PerformanceManager could let an attacker escape the browser sandbox if they've already compromised the rendering engine. The attack requires a specially crafted web page and user interaction, but success could grant full system access. This affects Chrome versions before 148.0.7778.216.

• CVE-2026-10012HIGH 8.3

  A use-after-free flaw in Chrome's Skia graphics library allows an attacker who controls the browser's renderer process to escape the sandbox and execute arbitrary code on the underlying system. The attack requires a malicious HTML page and user interaction, but once the renderer is compromised, the vulnerability enables full system compromise. This is particularly dangerous because renderer exploits are common entry points; this flaw raises the stakes by providing a bridge from that compromised renderer to the host OS.

• CVE-2026-10014HIGH 8.3

  A use-after-free memory flaw in Chrome's WebMIDI implementation on Android allows an attacker who has already compromised Chrome's renderer process to escape the sandbox through a specially crafted web page. This is a privilege escalation attack: the attacker must first breach the renderer sandbox, then exploit this vulnerability to break out and gain full device access.

• CVE-2026-10017HIGH 8.3

  A memory read vulnerability exists in Google Chrome's Headless mode that could allow an attacker to escape the browser's security sandbox. If an attacker first compromises the renderer process—the part of Chrome that interprets web pages—they could craft a malicious HTML page to trigger an out-of-bounds read, potentially breaking out of the sandbox and gaining broader system access. This vulnerability requires the renderer to already be compromised, which is a significant precondition, but the consequence of successful exploitation is severe.

• CVE-2026-10020HIGH 8.3

  A flaw in Chrome's Skia graphics library on Android allows an attacker who has already compromised Chrome's renderer process to escape the security sandbox and gain full device access. The vulnerability requires the user to visit a specially crafted webpage, but the heavy lifting—compromising the renderer first—means this is a two-stage attack. Chrome versions before 148.0.7778.216 on Android are affected.

• CVE-2026-10105HIGH 8.3

  Agno version 2.6.5 contains a SQL injection flaw in its ClickHouse vector database integration. An authenticated attacker can inject malicious SQL commands through the delete_by_metadata() function by crafting specially formatted metadata keys and values. This allows an attacker to delete database records, steal sensitive data, or manipulate stored information. The vulnerability requires valid credentials to exploit, but once authenticated, an attacker has significant control over the database.

• CVE-2026-10884HIGH 8.3

  A use-after-free memory vulnerability exists in Google Chrome's Chromecast component that could allow an attacker to escape the browser's sandbox if the attacker has already compromised the renderer process. The vulnerability requires user interaction and specific browser conditions, but successful exploitation could grant an attacker unauthorized access to the host system. Google has assigned this a Critical severity rating within Chromium's threat model.

• CVE-2026-10889HIGH 8.3

  A memory reading flaw in Chrome's ANGLE graphics library can let an attacker who has already gained control of the browser's rendering process break out of the Chrome sandbox and access the underlying system. The attack requires a specially crafted web page and user interaction, but once the renderer is compromised, this vulnerability opens a direct path to full system compromise. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-10894HIGH 8.3

  A use-after-free flaw in Chrome's printing subsystem on Linux could allow an attacker who already controls the browser's renderer process to break out of Chrome's sandbox protections and gain full system access. The vulnerability is triggered by a specially crafted web page and affects Chrome versions before 149.0.7827.53. While this requires initial compromise of the renderer process, it represents a critical escalation path from web content to system privileges.

• CVE-2026-10898HIGH 8.3

  A stack buffer overflow vulnerability exists in the GPU component of Google Chrome versions prior to 149.0.7827.53. An attacker who has already compromised Chrome's renderer process can exploit this flaw through a malicious HTML page to break out of the browser sandbox and gain system-level code execution. While the attacker must first compromise the renderer—typically through a separate browser vulnerability or social engineering—the sandbox escape itself represents a critical escalation path that transforms a contained compromise into full system compromise.