Browse critical-severity CVEs with CVSS, affected products, CWE, KEV, remediation priorities, and source-backed Glexia context.
Showing 50 of 24849 matching CVEs · Page 33 of 497.
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.
Published Apr 3, 2023 · Updated Oct 8, 2026
An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the rr_decode function's return value is not checked, leading to a double free that could be exploited to execute arbitrary code. An attacker can send an mDNS message to trigger this vulnerability.
Published Mar 24, 2020 · Updated Oct 8, 2026
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
Published May 28, 2026 · Updated Oct 8, 2026
A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.
Published Jun 16, 2025 · Updated Oct 8, 2026
SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled with a non-loopback --dist-init-addr setting.
Published Oct 8, 2026 · Updated Oct 8, 2026
A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.
Published Oct 8, 2026 · Updated Oct 8, 2026
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
Published Jul 20, 2026 · Updated Oct 8, 2026
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.
Published Sep 30, 2026 · Updated Oct 8, 2026
IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting (XSS) in the Quick Search results grid. An unauthenticated attacker who can influence monitored database traffic could execute malicious script in the browser of an authenticated Guardium user.
Published Oct 8, 2026 · Updated Oct 8, 2026
@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges.
Published Oct 8, 2026 · Updated Oct 8, 2026
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.
Published Oct 8, 2026 · Updated Oct 8, 2026
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
Published Jan 3, 2020 · Updated Oct 8, 2026
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
Published Mar 2, 2020 · Updated Oct 8, 2026
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
Published Jul 24, 2026 · Updated Oct 8, 2026
Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
Published Jul 24, 2026 · Updated Oct 8, 2026
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
Published Jul 24, 2026 · Updated Oct 8, 2026
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.
Published Jul 24, 2026 · Updated Oct 8, 2026
Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.
Published Jul 24, 2026 · Updated Oct 8, 2026
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
Published Jul 24, 2026 · Updated Oct 8, 2026
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
Published Jul 24, 2026 · Updated Oct 8, 2026
Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
Published Jul 30, 2026 · Updated Oct 8, 2026
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Published Jul 3, 2026 · Updated Oct 8, 2026
Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.
Published Jul 14, 2026 · Updated Oct 8, 2026
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.
Published Jul 23, 2026 · Updated Oct 8, 2026
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.
Published Jul 23, 2026 · Updated Oct 8, 2026
Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.
Published Jul 23, 2026 · Updated Oct 8, 2026
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
Published Jul 24, 2026 · Updated Oct 8, 2026
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.
Published Jul 2, 2026 · Updated Oct 8, 2026
Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
Published Jul 2, 2026 · Updated Oct 8, 2026
Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.
Published Jul 2, 2026 · Updated Oct 8, 2026
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.
Published Jul 14, 2026 · Updated Oct 8, 2026
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attackers can submit arbitrary SQL through these exposed endpoints to invoke xp_cmdshell and xp_read_file, achieving pre-authentication remote code execution as LocalSystem via a single HTTP request.
Published Oct 8, 2026 · Updated Oct 8, 2026
