LiveActive security incident?Get immediate response
CVE archive

Critical CVE Archive

Browse critical-severity CVEs with CVSS, affected products, CWE, KEV, remediation priorities, and source-backed Glexia context.

Search all CVEsKnown exploited

Showing 50 of 24870 matching CVEs · Page 39 of 498.

Critical · CVSS 9.3

CVE-2026-85153: Information Disclosure Vulnerability in Schmooze dating mobile Application

This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials and cryptographic keys. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to backend and cloud resources and forge client requests on the targeted system.

Published Oct 6, 2026 · Updated Oct 6, 2026

Critical · CVSS 9.3

CVE-2026-103355: WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

Published Oct 4, 2026 · Updated Oct 6, 2026

Critical · CVSS 9.8

CVE-2026-51915: TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller.

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_id and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{tool_id} and /tools/update/{tool_id}.

Published Oct 2, 2026 · Updated Oct 6, 2026

Critical · CVSS 9.6

CVE-2026-56662: GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that auto-submits a forged POST to the update endpoint; when an authenticated administrator visits it, the server performs an attacker-directed download-and-deploy operation in the administrator's session — with no further interaction. Because the deployed content is executed (see the related ZIP-extraction advisory), this yields remote code execution. The url field is additionally written into the form unescaped, providing a secondary HTML-injection sink via a malicious upgrade.json. This issue has been patched in version 1.5.

Published Oct 1, 2026 · Updated Oct 6, 2026

Critical · CVSS 9.8

CVE-2026-51886: langflow-ai langflow v1.9.3 is affected by: Code Injection.

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.

Published Oct 1, 2026 · Updated Oct 5, 2026

Critical · CVSS 9.8

CVE-2026-73819: Ebyte NA111-M Weak Authentication

The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials, potentially preventing legitimate administrators from managing the device.

Published Aug 31, 2026 · Updated Oct 5, 2026

Critical · CVSS 9.8

CVE-2026-76133: Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm

The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate unauthorized access.

Published Aug 31, 2026 · Updated Oct 5, 2026

Critical · CVSS 9.8

CVE-2026-71187: Ebyte NA111-M Use of Client-Side Authentication

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device.

Published Aug 27, 2026 · Updated Oct 5, 2026

Critical · CVSS 9.8

CVE-2026-76179: Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session information to obtain and reuse a valid token. Successful exploitation could allow an attacker to impersonate an authenticated user and gain unauthorized access to device management functionality.

Published Aug 27, 2026 · Updated Oct 5, 2026

Critical · CVSS 9.8

CVE-2026-73125: Ebyte NA111-M Missing Authentication for Critical Function

Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability.

Published Aug 27, 2026 · Updated Oct 5, 2026

Critical · CVSS 9.6

CVE-2026-105637: Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query with project_id from the URL. A workspace Guest can provide asset UUIDs from another project in the same workspace and reassign their issue_id, comment_id, page_id, draft_issue_id, or project_id to an entity the attacker controls. Plane then treats the attacker's project as the new owner and provides a presigned download URL for the hijacked file. This issue is fixed in 1.4.0.

Published Oct 5, 2026 · Updated Oct 5, 2026

Critical · CVSS 9.8

CVE-2026-51904: SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller.

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id and fail to verify that the referenced agent belongs to the authenticated user's organization. A remote authenticated attacker from one organization can create or start execution records for agents owned by another organization through /agentexecutions/add or /agentexecutions/add_run.

Published Oct 2, 2026 · Updated Oct 5, 2026

Critical · CVSS 9.1

CVE-2026-105638: Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF's APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware. This vulnerability is fixed in 1.4.0.

Published Oct 5, 2026 · Updated Oct 5, 2026

Critical · CVSS 9.1

CVE-2026-51883: The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable...

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences (such as `..\`) into the `knowledge_base_name` parameter to write knowledge base content to arbitrary locations outside the configured knowledge base root directory.

Published Oct 1, 2026 · Updated Oct 5, 2026

Critical · CVSS 9.1

CVE-2026-105640: Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0.

Published Oct 5, 2026 · Updated Oct 5, 2026

Critical · CVSS 9.8

CVE-2026-104056: CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.

Published Oct 1, 2026 · Updated Oct 5, 2026