| CVE / ID | Title | Severity | CVSS | Source | Date |
|---|
| CVE-2026-67282 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated attacker | CRITICAL | 10.0 | NVD | 2026-08-12 |
| CVE-2026-73299 | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks r | CRITICAL | 10.0 | NVD | 2026-08-12 |
| CVE-2024-27253 | IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform | CRITICAL | 10.0 | NVD | 2026-08-12 |
| CVE-2026-15413 | The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator- | CRITICAL | 10.0 | NVD | 2026-08-13 |
| CVE-2026-59500 | CWE-287: Improper Authentication | CRITICAL | 10.0 | NVD | 2026-08-13 |
| CVE-2026-27544 | Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | CRITICAL | 10.0 | NVD | 2026-08-13 |
| CVE-2026-61962 | Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions. | CRITICAL | 10.0 | NVD | 2026-08-13 |
| CVE-2026-19188 | A critical OS command injection vulnerability has been identified in the
Haiwell IoT Cloud HMI Gateway product. The vul | CRITICAL | 10.0 | NVD | 2026-08-14 |
| CVE-2026-73678 | MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that a | CRITICAL | 10.0 | NVD | 2026-08-14 |
| CVE-2026-72407 | In the Linux kernel, the following vulnerability has been resolved:
geneve: validate inner network offset in geneve_gro | CRITICAL | 10.0 | NVD | 2026-08-15 |
| CVE-2026-72408 | In the Linux kernel, the following vulnerability has been resolved:
geneve: gate GRO hint in geneve_gro_complete() on g | CRITICAL | 10.0 | NVD | 2026-08-15 |
| CVE-2026-72421 | In the Linux kernel, the following vulnerability has been resolved:
ipv4: fib: Don't ignore error route in local/main t | CRITICAL | 10.0 | NVD | 2026-08-15 |
| CVE-2026-74279 | In the Linux kernel, the following vulnerability has been resolved:
crypto: cavium/cpt - fix DMA cleanup using wrong lo | CRITICAL | 10.0 | NVD | 2026-08-15 |
| CVE-2026-74280 | In the Linux kernel, the following vulnerability has been resolved:
crypto: marvell/octeontx - fix DMA cleanup using wr | CRITICAL | 10.0 | NVD | 2026-08-15 |
| CVE-2026-74309 | In the Linux kernel, the following vulnerability has been resolved:
vdpa/octeon_ep: fix IRQ-to-ring mapping in interrup | CRITICAL | 10.0 | NVD | 2026-08-15 |
| CVE-2026-74475 | In the Linux kernel, the following vulnerability has been resolved:
vxlan: use neigh_ha_snapshot() in route_shortcircui | CRITICAL | 10.0 | NVD | 2026-08-15 |
| CVE-2026-74764 | Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted | CRITICAL | 10.0 | NVD | 2026-08-15 |
| CVE-2026-74253 | Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 14.0.0 - | CRITICAL | 10.0 | NVD | 2026-08-17 |
| CVE-2026-75874 | Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154. | CRITICAL | 10.0 | NVD | 2026-08-18 |
| CVE-2026-73343 | Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. | CRITICAL | 10.0 | NVD | 2026-08-18 |
| CVE-2026-61241 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Suppor | CRITICAL | 10.0 | NVD | 2026-08-18 |
| CVE-2026-70880 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and secu | CRITICAL | 10.0 | NVD | 2026-08-18 |
| CVE-2026-70921 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The suppor | CRITICAL | 10.0 | NVD | 2026-08-18 |
| CVE-2026-76008 | A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox- | CRITICAL | 10.0 | NVD | 2026-08-19 |
| GHSA-m5w8-4gq2-6f8x | vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host ( | CRITICAL | 10.0 | GitHub | 2026-08-17 |
| CVE-2026-55107 | kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service) | CRITICAL | 10.0 | GitHub | 2026-08-18 |
| CVE-2026-63508 | Microsoft Planetary Computer Pro Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-08-11 |
| CVE-2026-56162 | Azure SQL Database Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-08-11 |
| CVE-2026-65667 | Microsoft Teams Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-08-11 |
| CVE-2026-56163 | Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2026-56191 | Microsoft Exchange Online Tampering Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2026-57106 | Data Quality Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2026-62825 | Azure Key Vault Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2026-58630 | Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2026-58275 | Azure DNS Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2026-66803 | Azure Cosmos DB Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2026-42960 | Possible cache poisoning via promiscuous records for the authority section | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-46595 | Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-40412 | Azure Orbital Spatio Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |