| CVE / ID | Title | Severity | CVSS | Source | Date |
|---|
| CVE-2026-107594 | The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-cont | CRITICAL | 10.0 | NVD | 2026-10-14 |
| CVE-2026-55572 | e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authenticati | CRITICAL | 10.0 | NVD | 2026-10-14 |
| CVE-2026-94169 | Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command In | CRITICAL | 10.0 | NVD | 2026-10-16 |
| CVE-2026-95182 | An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supply | CRITICAL | 10.0 | NVD | 2026-10-16 |
| CVE-2026-78162 | Deserialization of Untrusted Data vulnerability in Apache Camel.
This issue affects Apache Camel: from 4.0.0 before 4 | CRITICAL | 10.0 | NVD | 2026-10-19 |
| CVE-2026-111057 | Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, | CRITICAL | 10.0 | NVD | 2026-10-19 |
| CVE-2026-101809 | Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported v | CRITICAL | 10.0 | NVD | 2026-10-20 |
| CVE-2026-81212 | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Red | CRITICAL | 10.0 | NVD | 2026-10-20 |
| CVE-2026-87337 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp | CRITICAL | 10.0 | NVD | 2026-10-20 |
| CVE-2026-91216 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions | CRITICAL | 10.0 | NVD | 2026-10-20 |
| CVE-2026-91221 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions | CRITICAL | 10.0 | NVD | 2026-10-20 |
| CVE-2026-91231 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions tha | CRITICAL | 10.0 | NVD | 2026-10-20 |
| CVE-2026-91299 | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator | CRITICAL | 10.0 | NVD | 2026-10-20 |
| CVE-2026-94603 | Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation | CRITICAL | 10.0 | GitHub | 2026-10-15 |
| CVE-2026-111057 | Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass | CRITICAL | 10.0 | GitHub | 2026-10-19 |
| CVE-2026-56162 | Azure SQL Database Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-08-11 |
| CVE-2026-63508 | Microsoft Planetary Computer Pro Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-08-11 |
| CVE-2026-65667 | Microsoft Teams Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-08-11 |
| CVE-2026-65770 | Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-08-11 |
| CVE-2026-65801 | Microsoft Exchange Online Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-08-11 |
| CVE-2026-65816 | Azure Arc Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-08-11 |
| CVE-2026-69502 | Azure SQL Database Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-08-11 |
| CVE-2026-69555 | Azure Arc Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-08-11 |
| CVE-2026-69836 | Microsoft Entra ID Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-08-11 |
| CVE-2026-96207 | Microsoft Partner Center Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-94603 | Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2025-53767 | Azure OpenAI Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2025-08-12 |
| CVE-2025-49752 | Azure Bastion Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2025-11-11 |
| CVE-2022-49043 | xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. | CRITICAL | 10.0 | Microsoft | 2025-01-14 |
| CVE-2026-62874 | Azure Billing Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-69399 | Azure Arc Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-69843 | Microsoft Fabric Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-69865 | Microsoft Container Registry Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-70200 | Azure Logic Apps Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-70352 | Azure AI Language Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-83711 | Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-83944 | Azure Logic Apps Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-85889 | Azure AI Foundry Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-56163 | Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |
| CVE-2026-56191 | Microsoft Exchange Online Tampering Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-07-14 |