LiveActive security incident?Get immediate response
CVE archive

Critical CVE Archive

Browse critical-severity CVEs with CVSS, affected products, CWE, KEV, remediation priorities, and source-backed Glexia context.

Search all CVEsKnown exploited

Showing 50 of 24381 matching CVEs · Page 3 of 488.

Critical · CVSS 9.8

CVE-2026-93388: Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url

The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.

Published Oct 14, 2026 · Updated Oct 14, 2026

Critical · CVSS 9.9

CVE-2026-108390: HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.

Published Oct 14, 2026 · Updated Oct 14, 2026

Critical · CVSS 9.9

CVE-2026-108894: Linksys E1700 Static Route addStaticRoute os command injection

A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Published Oct 12, 2026 · Updated Oct 14, 2026

Critical · CVSS 9

CVE-2026-86002: Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.

Published Oct 14, 2026 · Updated Oct 14, 2026

Critical · CVSS 9.8

CVE-2026-110649: Stills before 25.24.2 OS Command Injection via Media File Names

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.

Published Oct 14, 2026 · Updated Oct 14, 2026

Critical · CVSS 9.3

CVE-2026-103415: When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHe...

When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate. Only the client path is affected.

Published Oct 14, 2026 · Updated Oct 14, 2026

Critical · CVSS 9.8

CVE-2026-110644: nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.

Published Oct 14, 2026 · Updated Oct 14, 2026

Critical · CVSS 9.8

CVE-2026-110639: @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.

Published Oct 14, 2026 · Updated Oct 14, 2026

Critical · CVSS 9.8

CVE-2026-110634: git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.

Published Oct 14, 2026 · Updated Oct 14, 2026

Critical · CVSS 9.8

CVE-2022-37434: zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a larg...

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Published Aug 5, 2022 · Updated Oct 14, 2026