| CVE / ID | Title | Severity | CVSS | Source | Date |
|---|
| CVE-2026-61738 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, | CRITICAL | 10.0 | NVD | 2026-10-30 |
| CVE-2026-112816 | Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11 | CRITICAL | 10.0 | NVD | 2026-10-30 |
| CVE-2026-61826 | Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/a | CRITICAL | 10.0 | NVD | 2026-10-30 |
| CVE-2026-120338 | Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno | CRITICAL | 10.0 | NVD | 2026-11-01 |
| CVE-2026-121489 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau.
The micr | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-73098 | Improper control of dynamically-loaded code vulnerability in Apache Juneau.
When Apache Juneau parses a value into a pr | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-73099 | Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau.
The REST server accepts a "content" query parameter t | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-73100 | Insertion of Sensitive Information into Log File vulnerability in Apache Juneau.
The default REST server call logger re | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-73101 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau.
The REST server sends the | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-73116 | Insufficiently Protected Credentials vulnerability in Apache Juneau.
The Apache Juneau RestClient followed HTTP redirec | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-73117 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau.
T | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-96677 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau.
HT | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2025-65041 | Microsoft Partner Center Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2025-12-09 |
| CVE-2025-65037 | Azure Container Apps Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2025-12-09 |
| CVE-2026-110264 | Integer Overflow or Wraparound in GitLab | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-97229 | Integer Overflow or Wraparound in GitLab | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-110063 | VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-83938 | Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-96207 | Microsoft Partner Center Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-97785 | AAD App Proxy Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-94603 | Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-62874 | Azure Billing Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-69843 | Microsoft Fabric Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-69865 | Microsoft Container Registry Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-70200 | Azure Logic Apps Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-70352 | Azure AI Language Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-83711 | Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-83944 | Azure Logic Apps Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-85889 | Azure AI Foundry Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-42960 | Possible cache poisoning via promiscuous records for the authority section | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-23652 | Microsoft Power Pages Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-40412 | Azure Orbital Spatio Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-41104 | Microsoft Planetary Computer Pro Information Disclosure Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-42822 | Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-42826 | Azure DevOps Information Disclosure Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-42901 | Microsoft Entra ID Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-47280 | Azure Resource Manager Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-46595 | Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-45480 | Azure Active Directory Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-06-09 |