| CVE / ID | Title | Severity | CVSS | Source | Date |
|---|
| CVE-2026-121489 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau.
The micr | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-73098 | Improper control of dynamically-loaded code vulnerability in Apache Juneau.
When Apache Juneau parses a value into a pr | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-73099 | Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau.
The REST server accepts a "content" query parameter t | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-73100 | Insertion of Sensitive Information into Log File vulnerability in Apache Juneau.
The default REST server call logger re | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-73101 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau.
The REST server sends the | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-73116 | Insufficiently Protected Credentials vulnerability in Apache Juneau.
The Apache Juneau RestClient followed HTTP redirec | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-73117 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau.
T | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-96677 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau.
HT | CRITICAL | 10.0 | NVD | 2026-11-05 |
| CVE-2026-118423 | The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, al | CRITICAL | 10.0 | NVD | 2026-11-06 |
| CVE-2026-71495 | Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANC | CRITICAL | 10.0 | NVD | 2026-11-06 |
| CVE-2026-109469 | Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate | CRITICAL | 10.0 | NVD | 2026-11-06 |
| CVE-2026-123551 | OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers | CRITICAL | 10.0 | NVD | 2026-11-08 |
| CVE-2026-115252 | The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks befo | CRITICAL | 10.0 | NVD | 2026-11-09 |
| CVE-2026-110468 | WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a clien | CRITICAL | 10.0 | NVD | 2026-11-09 |
| CVE-2026-110469 | WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled per | CRITICAL | 10.0 | NVD | 2026-11-09 |
| CVE-2026-120017 | SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions u | CRITICAL | 10.0 | NVD | 2026-11-10 |
| CVE-2026-124600 | GV-Face transmits sensitive user credentials and
related authentication data over unencrypted HTTP connections. The HTTP | CRITICAL | 10.0 | NVD | 2026-11-10 |
| CVE-2026-76964 | SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal comp | CRITICAL | 10.0 | NVD | 2026-11-10 |
| CVE-2026-89103 | SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker | CRITICAL | 10.0 | NVD | 2026-11-10 |
| CVE-2026-89126 | SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthent | CRITICAL | 10.0 | NVD | 2026-11-10 |
| CVE-2017-20230 | Storable versions before 3.05 for Perl has a stack overflow | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-32186 | Microsoft Bing Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-32213 | Azure AI Foundry Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-33105 | Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-33107 | Azure Databricks Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-33819 | Microsoft Bing Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-35431 | Microsoft Entra ID Entitlement Management Spoofing Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-110264 | Integer Overflow or Wraparound in GitLab | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-97229 | Integer Overflow or Wraparound in GitLab | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-110063 | VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-83938 | Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-96207 | Microsoft Partner Center Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-97785 | AAD App Proxy Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-94603 | Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation | CRITICAL | 10.0 | Microsoft | 2026-10-13 |
| CVE-2026-62874 | Azure Billing Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-69843 | Microsoft Fabric Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-69865 | Microsoft Container Registry Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-70200 | Azure Logic Apps Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-70352 | Azure AI Language Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |
| CVE-2026-83711 | Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-09-08 |