| CVE / ID | Title | Severity | CVSS | Source | Date |
|---|
| CVE-2026-96349 | Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions. | CRITICAL | 10.0 | NVD | 2026-09-30 |
| CVE-2026-76570 | Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The fron | CRITICAL | 10.0 | NVD | 2026-09-30 |
| CVE-2026-102427 | Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader. | CRITICAL | 10.0 | NVD | 2026-09-30 |
| CVE-2026-55107 | Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted | CRITICAL | 10.0 | NVD | 2026-09-30 |
| CVE-2026-101148 | The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, tre | CRITICAL | 10.0 | NVD | 2026-10-01 |
| CVE-2026-55393 | Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLo | CRITICAL | 10.0 | NVD | 2026-10-01 |
| CVE-2026-103956 | Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remot | CRITICAL | 10.0 | NVD | 2026-10-02 |
| CVE-2026-100103 | Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented de | CRITICAL | 10.0 | NVD | 2026-10-05 |
| CVE-2026-105484 | A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the functio | CRITICAL | 10.0 | NVD | 2026-10-06 |
| CVE-2026-32579 | Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions. | CRITICAL | 10.0 | NVD | 2026-10-06 |
| CVE-2026-39770 | Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions. | CRITICAL | 10.0 | NVD | 2026-10-06 |
| CVE-2026-39773 | Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions. | CRITICAL | 10.0 | NVD | 2026-10-06 |
| CVE-2026-63688 | Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function | CRITICAL | 10.0 | NVD | 2026-10-06 |
| CVE-2026-63692 | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vuln | CRITICAL | 10.0 | NVD | 2026-10-06 |
| CVE-2026-105857 | Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before | CRITICAL | 10.0 | NVD | 2026-10-06 |
| CVE-2026-106102 | Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getH | CRITICAL | 10.0 | NVD | 2026-10-06 |
| CVE-2026-69085 | SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with | CRITICAL | 10.0 | GitHub | 2026-10-01 |
| GHSA-v2f8-6655-7grj | Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain | CRITICAL | 10.0 | GitHub | 2026-10-02 |
| GHSA-jqmf-mx4f-hfr6 | Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF | CRITICAL | 10.0 | GitHub | 2026-10-02 |
| CVE-2026-100721 | vm2: NodeVM custom resolution bypasses external path boundaries | CRITICAL | 10.0 | GitHub | 2026-10-05 |
| CVE-2026-92955 | vm2: Sandbox Escape (NodeVM) | CRITICAL | 10.0 | GitHub | 2026-10-05 |
| CVE-2026-92953 | vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix | CRITICAL | 10.0 | GitHub | 2026-10-05 |
| CVE-2026-92946 | vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RC | CRITICAL | 10.0 | GitHub | 2026-10-05 |
| CVE-2026-92947 | vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool | CRITICAL | 10.0 | GitHub | 2026-10-05 |
| CVE-2026-92956 | vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass | CRITICAL | 10.0 | GitHub | 2026-10-05 |
| CVE-2026-92940 | vm2 exposes host HTTPS credentials and TLS traffic through globalAgent | CRITICAL | 10.0 | GitHub | 2026-10-01 |
| CVE-2026-92937 | vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection | CRITICAL | 10.0 | GitHub | 2026-10-01 |
| CVE-2026-92941 | vm2 NodeVM can replace the host process TLS trust store | CRITICAL | 10.0 | GitHub | 2026-10-01 |
| CVE-2026-56163 | Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2026-56191 | Microsoft Exchange Online Tampering Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2026-57106 | Data Quality Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2026-58275 | Azure DNS Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2026-58630 | Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2026-62825 | Azure Key Vault Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2026-66803 | Azure Cosmos DB Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2025-54914 | Azure Networking Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2025-09-09 |
| CVE-2025-55241 | Azure Entra ID Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2025-09-09 |
| CVE-2025-29813 | Azure DevOps Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2025-05-13 |
| CVE-2022-49043 | xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. | CRITICAL | 10.0 | Microsoft | 2025-01-14 |
| CVE-2024-56719 | net: stmmac: fix TSO DMA API usage causing oops | CRITICAL | 10.0 | Microsoft | 2024-12-10 |