# cve.now: critical entries

Entries rated critical (CVSS 9.0 or higher, or a critical rating from the source), newest first, 100 per page.

- [CVE-2026-82104](https://cve.now/CVE-2026-82104.md): API permission bypass via logic bug (CVSS 9.4, Teltonika Networks RUT · Teltonika Networks RUTX +12)
- [CVE-2026-103039](https://cve.now/CVE-2026-103039.md): Gravity Forms \<= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field (CVSS 9.8, Gravity Forms)
- [CVE-2026-76024](https://cve.now/CVE-2026-76024.md): Memory corruption in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially read memory inside the san (critical (no CVSS), Google Chrome)
- [CVE-2023-22793](https://cve.now/CVE-2023-22793.md): A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Exte (CVSS 9.3, Veeam Management Pack for Microsoft System Center)
- [CVE-2026-61707](https://cve.now/CVE-2026-61707.md): SOCFortress CoPilot: Stored case-report template injection permits backend code execution (CVSS 9.0, socfortress CoPilot)
- [CVE-2026-61645](https://cve.now/CVE-2026-61645.md): Docat has Arbitrary File Upload exists in Upload API (CVSS 9.1, docat-org docat)
- [CVE-2026-103093](https://cve.now/CVE-2026-103093.md): Sandbox Escape via Table Rotation in ServiceNow AI Platform (CVSS 9.4, ServiceNow AI Platform)
- [CVE-2026-118769](https://cve.now/CVE-2026-118769.md): Botan: Integer overflow when reporting block size in FFI can cause memory corruption (CVSS 9.2, randombit botan)
- [CVE-2026-118762](https://cve.now/CVE-2026-118762.md): Monkeytype: fork PR can execute code with elevated GITHUB\_TOKEN (CVSS 9.3, monkeytypegame monkeytype)
- [CVE-2026-119145](https://cve.now/CVE-2026-119145.md): Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload (CVSS 9.4, frappe)
- [CVE-2026-119128](https://cve.now/CVE-2026-119128.md): ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie (CVSS 9.1, zitadel)
- [CVE-2026-90868](https://cve.now/CVE-2026-90868.md): OS Command Injection in Progress WS\_FTP Server (CVSS 9.9, Progress Software WS\_FTP Server)
- [CVE-2026-90866](https://cve.now/CVE-2026-90866.md): Virtual Folder Path Confinement Bypass in Progress WS\_FTP Server (CVSS 9.1, Progress Software WS\_FTP Server)
- [CVE-2026-90865](https://cve.now/CVE-2026-90865.md): Command Injection via FTP Notification Variables in Progress WS\_FTP Server (CVSS 9.0, Progress Software WS\_FTP Server)
- [CVE-2026-90864](https://cve.now/CVE-2026-90864.md): Host Administrator Path Containment Bypass in Progress WS\_FTP Server (CVSS 9.1, Progress Software WS\_FTP Server)
- [CVE-2026-90863](https://cve.now/CVE-2026-90863.md): Privilege Escalation via Missing Authorization in WS\_FTP Manager (CVSS 9.1, Progress Software WS\_FTP Server)
- [CVE-2026-84295](https://cve.now/CVE-2026-84295.md): Improper Authentication in Progress WS\_FTP Server (CVSS 10.0, Progress Software WS\_FTP Server)
- [CVE-2026-111732](https://cve.now/CVE-2026-111732.md): Out-of-bounds write when parsing AR Vendor Block requests (CVSS 9.3, RT-Labs P-Net)
- [CVE-2026-112256](https://cve.now/CVE-2026-112256.md): Logon bypass (trust of attacker-controlled completed-methods list) (CVSS 9.2, OpenText Advanced Authentication Server)
- [CVE-2026-62131](https://cve.now/CVE-2026-62131.md): WordPress Zoho Flow plugin \<= 2.14.5 - PHP Object Injection vulnerability (CVSS 9.8, Zoho Flow)
- [CVE-2026-62018](https://cve.now/CVE-2026-62018.md): WordPress Gunslinger theme \<= 1.11 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Gunslinger)
- [CVE-2026-62017](https://cve.now/CVE-2026-62017.md): WordPress Good Homes theme \<= 1.3.13 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Good Homes)
- [CVE-2026-62016](https://cve.now/CVE-2026-62016.md): WordPress Gamic theme \<= 1.19 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Gamic)
- [CVE-2026-62015](https://cve.now/CVE-2026-62015.md): WordPress Gamezone theme \<= 1.1.11 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Gamezone)
- [CVE-2026-62014](https://cve.now/CVE-2026-62014.md): WordPress EmojiNation theme \<= 1.0.12 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX EmojiNation)
- [CVE-2026-62013](https://cve.now/CVE-2026-62013.md): WordPress Edge Decor theme \<= 2.9 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Edge Decor)
- [CVE-2026-62012](https://cve.now/CVE-2026-62012.md): WordPress Coinpress theme \<= 1.0.15 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Coinpress)
- [CVE-2026-62011](https://cve.now/CVE-2026-62011.md): WordPress Bonbon theme \<= 1.11 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Bonbon)
- [CVE-2026-62010](https://cve.now/CVE-2026-62010.md): WordPress Avventure theme \<= 1.1.12 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Avventure)
- [CVE-2026-62009](https://cve.now/CVE-2026-62009.md): WordPress Filmax theme \<= 1.1.11 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Filmax)
- [CVE-2026-62008](https://cve.now/CVE-2026-62008.md): WordPress Orpheus theme \<= 1.8 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Orpheus)
- [CVE-2026-62006](https://cve.now/CVE-2026-62006.md): WordPress Nuts theme \<= 1.12 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Nuts)
- [CVE-2026-62005](https://cve.now/CVE-2026-62005.md): WordPress Muzicon theme \<= 1.15 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Muzicon)
- [CVE-2026-62004](https://cve.now/CVE-2026-62004.md): WordPress Motorix theme \<= 1.11 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Motorix)
- [CVE-2026-62003](https://cve.now/CVE-2026-62003.md): WordPress Mission theme \<= 1.22 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Mission)
- [CVE-2026-62002](https://cve.now/CVE-2026-62002.md): WordPress Meals & Wheels theme \<= 1.1.13 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Meals & Wheels)
- [CVE-2026-62001](https://cve.now/CVE-2026-62001.md): WordPress Marcell theme \<= 1.2.14 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Marcell)
- [CVE-2026-61998](https://cve.now/CVE-2026-61998.md): WordPress Le Truffe theme \<= 1.1.7 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Le Truffe)
- [CVE-2026-61997](https://cve.now/CVE-2026-61997.md): WordPress Legal Stone theme \<= 1.2.11 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Legal Stone)
- [CVE-2026-61992](https://cve.now/CVE-2026-61992.md): WordPress GEO my WordPress plugin \<= 4.5.5.4 - PHP Object Injection vulnerability (CVSS 9.8, Von Eyal Fitoussi GEO my WordPress)
- [CVE-2026-61991](https://cve.now/CVE-2026-61991.md): WordPress AjaxLoadMore Cache plugin \<= 3.1.1 - Remote Code Execution (RCE) vulnerability (CVSS 10.0, Ajax Load More AjaxLoadMore Cache)
- [CVE-2026-54860](https://cve.now/CVE-2026-54860.md): WordPress Ozisti theme \<= 1.1.10 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Ozisti)
- [CVE-2026-54859](https://cve.now/CVE-2026-54859.md): WordPress Preservation theme \<= 1.15 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Preservation)
- [CVE-2026-54858](https://cve.now/CVE-2026-54858.md): WordPress Printy theme \<= 1.13.0 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Printy)
- [CVE-2026-54857](https://cve.now/CVE-2026-54857.md): WordPress Quirky theme \<= 1.23 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Quirky)
- [CVE-2026-54856](https://cve.now/CVE-2026-54856.md): WordPress RexCoin theme \<= 1.2.6 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX RexCoin)
- [CVE-2026-93680](https://cve.now/CVE-2026-93680.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-104339](https://cve.now/CVE-2026-104339.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-107327](https://cve.now/CVE-2026-107327.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 9.9, IBM Langflow OSS)
- [CVE-2026-107328](https://cve.now/CVE-2026-107328.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 9.9, IBM Langflow OSS)
- [CVE-2026-107329](https://cve.now/CVE-2026-107329.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 9.9, IBM Langflow OSS)
- [CVE-2026-110186](https://cve.now/CVE-2026-110186.md): Langflow OSS is affected by multiple vulnerabilities (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-119050](https://cve.now/CVE-2026-119050.md): Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection (CVSS 9.2, agno-agi agno)
- [CVE-2026-97854](https://cve.now/CVE-2026-97854.md): Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. (CVSS 9.8, Yamaha NWR100)
- [CVE-2026-115964](https://cve.now/CVE-2026-115964.md): WordPress Motors plugin \<= 1.4.126 - SQL Injection vulnerability (CVSS 9.3, StylemixThemes Motors)
- [CVE-2026-114358](https://cve.now/CVE-2026-114358.md): SQL Injection Vulnerability in Radius Xenia M2M Platform (CVSS 9.3, Radius Synergies Radius Xenia M2M Platform)
- [CVE-2026-115245](https://cve.now/CVE-2026-115245.md): Chat AI with Dispatcher \< 2.4 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Chat AI with Dispatcher)
- [CVE-2026-113617](https://cve.now/CVE-2026-113617.md): Automated Import Products to Cart \< 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal (CVSS 9.9, Automated Import Products to Cart)
- [CVE-2026-113616](https://cve.now/CVE-2026-113616.md): LogixFast Auth \< 1.0.4 - Unauthenticated Account Takeover via Password Reset (CVSS 9.8, LogixFast Auth)
- [CVE-2026-103693](https://cve.now/CVE-2026-103693.md): Frontend Dashboard \< 3.0.5 and ProfileGrid \< 6.0.0.5 - Unauthenticated PHP Object Injection (CVSS 9.0, Frontend Dashboard · ProfileGrid)
- [CVE-2026-109516](https://cve.now/CVE-2026-109516.md): Bot for Telegram on WooCommerce \<= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token (CVSS 9.8, guruteam Bot for Telegram on WooCommerce)
- [CVE-2026-42922](https://cve.now/CVE-2026-42922.md): A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). (CVSS 9.8, Frangoteam)
- [CVE-2026-66088](https://cve.now/CVE-2026-66088.md): Unrestricted Command Execution via system.execute (CVSS 9.4, Apereo Foundation openEQUELLA)
- [CVE-2026-107015](https://cve.now/CVE-2026-107015.md): Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note dat (CVSS 9.1)
- [CVE-2026-107032](https://cve.now/CVE-2026-107032.md): Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, l (CVSS 9.1)
- [CVE-2026-107058](https://cve.now/CVE-2026-107058.md): An issue in Shelter versionCode 445 allows attackers to register their own auth\_key and execute a takeover of another user's binder service (CVSS 9.8)
- [CVE-2026-118579](https://cve.now/CVE-2026-118579.md): D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor (CVSS 9.3, D-Link DIR-505)
- [CVE-2026-61567](https://cve.now/CVE-2026-61567.md): AVideo-Encoder: unauthenticated command execution through streamer login trust (CVSS 10.0, WWBN AVideo-Encoder)
- [CVE-2026-61564](https://cve.now/CVE-2026-61564.md): AVideo-Encoder: unauthenticated installer PHP code injection (CVSS 10.0, WWBN AVideo-Encoder)
- [CVE-2026-118690](https://cve.now/CVE-2026-118690.md): Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs (CVSS 9.3, signalk-server)
- [CVE-2026-117574](https://cve.now/CVE-2026-117574.md): Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization (CVSS 9.1, Red Hat OpenShift AI)
- [CVE-2026-63190](https://cve.now/CVE-2026-63190.md): FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS (CVSS 9.4, fearlessgeekmedia FearlessCMS)
- [CVE-2026-118264](https://cve.now/CVE-2026-118264.md): Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls (CVSS 9.1, labstack echo · github.com/labstack/echo/v4 +1)
- [CVE-2026-103409](https://cve.now/CVE-2026-103409.md): Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed (CVSS 9.8, Juniper Networks Session Smart Router)
- [CVE-2026-103406](https://cve.now/CVE-2026-103406.md): Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management. (CVSS 9.8, Juniper Networks Session Smart Conductor)
- [CVE-2026-44179](https://cve.now/CVE-2026-44179.md): XWiki Pro Macros: excerpt-include title and content injection executes code (CVSS 9.9, xwikisas xwiki-pro-macros · com.xwiki.pro:xwiki-pro-macros)
- [CVE-2026-115968](https://cve.now/CVE-2026-115968.md): WordPress Ultimate Member plugin \<= 2.13.1 - PHP Object Injection vulnerability (CVSS 9.8, Ultimate Member)
- [CVE-2026-105420](https://cve.now/CVE-2026-105420.md): Path Traversal in Wing WFTP Server leading to Remote Code Execution (CVSS 9.4, Wing Soft Technology Wing FTP Server)
- [CVE-2026-111411](https://cve.now/CVE-2026-111411.md): WordPress FunnelKit Automations plugin \<= 3.8.5.2 - SQL Injection vulnerability (CVSS 9.3, Aman FunnelKit Automations)
- [CVE-2026-115607](https://cve.now/CVE-2026-115607.md): WordPress DXP ToolKit plugin \<= 2.0.1 - SQL Injection vulnerability (CVSS 9.3, Crowd Favorite DXP ToolKit)
- [CVE-2026-115904](https://cve.now/CVE-2026-115904.md): Topluyo Desktop for Linux has an OS Command Injection issue (CVSS 9.6, topluyo App)
- [CVE-2026-67074](https://cve.now/CVE-2026-67074.md): HCL BigFix AEX is affected by multiple security vulnerabilities. (CVSS 9.1, HCL Software BigFix AEX)
- [CVE-2026-114278](https://cve.now/CVE-2026-114278.md): Unauthenticated Command Injection via kubeconfig Username in che-machine-exec (CVSS 9.8, Eclipse Foundation Eclipse Che)
- [CVE-2026-103792](https://cve.now/CVE-2026-103792.md): Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 (CVSS 9.6, Dell PowerProtect Data Domain Management Center)
- [CVE-2026-103799](https://cve.now/CVE-2026-103799.md): Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 (CVSS 9.6, Dell PowerProtect Data Domain Management Center)
- [CVE-2026-112197](https://cve.now/CVE-2026-112197.md): Missing Authentication for Critical Function in Tactis' NoviGest Desktop App (CVSS 9.4, Tactis NoviGest Desktop App)
- [CVE-2026-103780](https://cve.now/CVE-2026-103780.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 9.8, Dell PowerProtect Data Domain)
- [CVE-2026-86384](https://cve.now/CVE-2026-86384.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 9.8, Dell PowerProtect Data Domain)
- [CVE-2026-14571](https://cve.now/CVE-2026-14571.md): SQL injection (SQLi) in the user authentication module of Futurum Software (CVSS 9.1, Futurum Software User Authentication Module)
- [CVE-2026-86397](https://cve.now/CVE-2026-86397.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 9.8, Dell PowerProtect Data Domain)
- [CVE-2026-86400](https://cve.now/CVE-2026-86400.md): Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re (CVSS 9.8, Dell PowerProtect Data Domain)
- [CVE-2026-90717](https://cve.now/CVE-2026-90717.md): Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 (CVSS 9.1, Dell PowerProtect Data Domain Management Center)
- [CVE-2026-109218](https://cve.now/CVE-2026-109218.md): Contact Manager \<= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass (CVSS 9.8, kleor Contact Manager)
- [CVE-2026-103688](https://cve.now/CVE-2026-103688.md): Checkout Files Upload for WooCommerce \< 2.4.0 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Checkout Files Upload for WooCommerce)
- [CVE-2026-104383](https://cve.now/CVE-2026-104383.md): Code injection in EagleCloud Aquila on-premises version (CVSS 9.4, EagleCloud Aquila)
- [CVE-2026-84999](https://cve.now/CVE-2026-84999.md): Pie Register Premium \<= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg\_file\_upload AJAX Handler (CVSS 9.8, Pie Register Premium)
- [CVE-2026-118375](https://cve.now/CVE-2026-118375.md): llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma\_recv() (CVSS 9.2, ggml-org llama.cpp)
- [CVE-2026-106013](https://cve.now/CVE-2026-106013.md): Jupiter X Core \<= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth\_verifier Parameter (CVSS 9.8, artbees Jupiter X Core)
- [CVE-2026-110879](https://cve.now/CVE-2026-110879.md): jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) (CVSS 9.8, FasterXML jackson-databind)
- [CVE-2026-118312](https://cve.now/CVE-2026-118312.md): Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside t (CVSS 9.6, Google Chrome)

[Next page](https://cve.now/critical.md?cursor=WyIyMDI2LTEwLTI3VDIzOjAzOjIwLjkxOFoiLCJDVkUtMjAyNi0xMTgzMTIiXQ)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/vulnerabilities?filter=critical
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.