Security Risk Severity
High Security Risks — Page 10
Published vulnerability pages grouped by high severity. Use this page to review risks that need similar prioritization.
872 published high risks
High severity
Showing 325–360 of 872 published risks.
CVE-2026-48337 illustrator vulnerability
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Updated Jul 17, 2026
CVE-2026-48351 c2pa vulnerability
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
Updated Jul 17, 2026
CVE-2026-48352 c2pa vulnerability
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
Updated Jul 17, 2026
CVE-2026-48806 twig vulnerability
Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed(). This issue is fixed in version 3.27.0.
Updated Jul 17, 2026
CVE-2026-48807 twig vulnerability
Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.
Updated Jul 17, 2026
CVE-2026-54572 rclone vulnerability
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.
Updated Jul 17, 2026
CVE-2026-59733 rclone vulnerability
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user's private repository on backends that clean path components. This issue is fixed in version 1.74.4.
Updated Jul 17, 2026
CVE-2025-56362 matter vulnerability
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is sent and immediately followed by a write of OperationMode=2 (in the Pump Configuration and Control cluster), the server tick function violates the assertion `currentLevel < maxLevel`, resulting in a crash. This can be exploited remotely without authentication to cause denial of service. Affected versions include 1.3 and 1.4 (commit ab3d5ae).
Updated Jul 17, 2026
CVE-2025-56363 matter vulnerability
A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service). This issue has been confirmed in SDK version v1.4 (commit ab3d5ae).
Updated Jul 17, 2026
CVE-2025-56364 matter vulnerability
A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `GetDestinationGroupId().Value()` method is called without first checking whether a value exists. This leads to a crash when an InvokeCommand is sent without initializing the destination group ID. The issue affects all versions before commit 0360cc3 (Dec 5, 2024) and leads to denial of service through SIGABRT. It is fixed by adding a .HasValue() check before access.
Updated Jul 17, 2026
CVE-2025-56365 matter vulnerability
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster (e.g., 0x34), the code incorrectly treats the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke. This causes a VerifyOrDie failure in ProcessCommandDataIB and results in a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).
Updated Jul 17, 2026
CVE-2026-56398 open webui vulnerability
Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with inline disposition and no default security headers, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.
Updated Jul 17, 2026
CVE-2026-52865 nginx ingress controller vulnerability
When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the NGINX Ingress Controller process to terminate. Impact: The NGINX Ingress Controller control plane process terminates and enters a persistent crash loop while the malformed Ingress or TransportServer resource remains in the cluster. This vulnerability allows a remote, authenticated attacker with at least Ingress or TransportServer resource write access to cause a denial-of-service (DoS) on the NGINX Ingress Controller system. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Updated Jul 17, 2026
CVE-2026-55723 nginx ingress controller vulnerability
When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these CRDs or annotations may craft values that inject arbitrary NGINX configuration directives. Impact: An authenticated attacker granted write access to NGINX Ingress Controller CRDs or Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Updated Jul 17, 2026
CVE-2026-33445 secure access vulnerability
CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can create a persistent DoS against the server.
Updated Jul 17, 2026
CVE-2026-38753 busybox vulnerability
A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
Updated Jul 17, 2026
CVE-2026-36590 nanomq vulnerability
An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component
Updated Jul 17, 2026
CVE-2026-38752 busybox vulnerability
A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
Updated Jul 17, 2026
CVE-2026-38754 busybox vulnerability
A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
Updated Jul 17, 2026
CVE-2026-38755 busybox vulnerability
A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
Updated Jul 17, 2026
CVE-2025-53379 in Fortinet FortiAuthenticator
A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request.
Updated Jul 16, 2026
CVE-2026-50675 in Microsoft 365 Apps
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Updated Jul 16, 2026
CVE-2026-50697 in Microsoft Windows
Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Updated Jul 16, 2026
CVE-2026-54107 in Microsoft Windows
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
Updated Jul 16, 2026
CVE-2026-54109 in Microsoft Windows
Integer overflow or wraparound in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
Updated Jul 16, 2026
CVE-2026-54111 in Microsoft Windows
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
Updated Jul 16, 2026
CVE-2026-54112 in Microsoft Windows
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
Updated Jul 16, 2026
CVE-2026-54131 in Microsoft 365 Apps
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Updated Jul 16, 2026
CVE-2026-55024 in Microsoft 365 Apps
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Updated Jul 16, 2026
CVE-2026-55025 in Microsoft 365 Apps
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Updated Jul 16, 2026
CVE-2026-55029 in Microsoft 365 Apps
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Updated Jul 16, 2026
CVE-2026-55031 in Microsoft 365 Apps
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Updated Jul 16, 2026
CVE-2026-55048 in Microsoft 365 Apps
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Updated Jul 16, 2026
CVE-2026-55053 in Microsoft 365 Apps
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Updated Jul 16, 2026
CVE-2026-55058 in Microsoft 365 Apps
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Updated Jul 16, 2026
CVE-2026-55120 in Microsoft 365 Apps
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
Updated Jul 16, 2026