Critical severity vulnerabilities

23,847 CVEs scored 9.0 to 10.0 on CVSS. Critical vulnerabilities can usually be exploited remotely, without a login, to take over the affected system. Patch these first.

• 10.0 Critical severity

  W3 Total Cache: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-18051Aug 19, 2026W3 Total CacheEPSS 2.01%

  The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overw

• 9.8 Critical severity

  TabaPay Gateway: Improper Authentication

  CVE-2026-18031Aug 19, 2026TabaPay Gateway

  The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an admi

• 10.0 Critical severity

  CF-N1-S: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-76008Aug 19, 2026ComfastEPSS 1.02%

  A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack

• 9.9 Critical severity

  HiPER 1250GW: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-76004Aug 19, 2026UTT

  A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApBasicConfigUrcp of the component HTTP Handler. The manipulation of the argument pvid leads

• 9.9 Critical severity

  HiPER 1200GW: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-76003Aug 19, 2026UTT

  A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of the argument timestart can lead to stack-based buffer overflow. The attack may be performed

• 9.9 Critical severity

  TEW-823DRU: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-75976Aug 19, 2026TRENDnet

  A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of the argument wan_l2tp_password causes stack-based buffer overflow. The attack can be init

• 9.3 Critical severity

  Confluence Data Center: Improper Neutralization of Input During Web Page Generation

  CVE-2026-21580Aug 18, 2026Atlassian

  This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10

• 9.6 Critical severity

  Chrome: Heap-based Buffer Overflow

  CVE-2026-76036Aug 18, 2026Google

  Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

• 9.6 Critical severity

  Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169…

  CVE-2026-76035Aug 18, 2026Google

  Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

• 9.9 Critical severity

  Helidon: Improper Access Control

  CVE-2026-73930Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.19 and 4.0.0-4.5.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via

• 9.1 Critical severity

  Helidon: Improper Access Control

  CVE-2026-73924Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 1.0.0-1.4.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to comprom

• 9.1 Critical severity

  Helidon: Improper Access Control

  CVE-2026-73922Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 1.0.0-1.4.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to comprom

• 9.8 Critical severity

  Helidon: Improper Access Control

  CVE-2026-73921Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 1.0.0-1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to comprom

• 9.4 Critical severity

  Helidon: Improper Access Control

  CVE-2026-73920Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi

• 9.1 Critical severity

  Helidon: Improper Access Control

  CVE-2026-73917Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi

• 9.1 Critical severity

  Helidon: Improper Access Control

  CVE-2026-73916Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to comprom

• 9.8 Critical severity

  Helidon: Improper Access Control

  CVE-2026-73912Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi

• 9.8 Critical severity

  Helidon: Improper Access Control

  CVE-2026-73905Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi

• 9.1 Critical severity

  Helidon: Improper Access Control

  CVE-2026-73866Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi

• 9.1 Critical severity

  Helidon: Improper Access Control

  CVE-2026-73865Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to comprom

• 9.4 Critical severity

  Helidon: Improper Access Control

  CVE-2026-71167Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi

• 9.4 Critical severity

  Helidon: Improper Access Control

  CVE-2026-71166Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to comprom

• 9.8 Critical severity

  Helidon: Improper Access Control

  CVE-2026-71164Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to comprom

• 9.8 Critical severity

  Helidon: Improper Access Control

  CVE-2026-71152Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17 and 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via

• 9.1 Critical severity

  Oracle Database Server: Improper Access Control

  CVE-2026-71102Aug 18, 2026Oracle

  Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to

• 9.8 Critical severity

  Helidon: Improper Access Control

  CVE-2026-71074Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 1.0.0-1.4.19 and 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access vi

• 9.3 Critical severity

  Helidon: Improper Access Control

  CVE-2026-71065Aug 18, 2026Oracle

  Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to comprom

• 9.6 Critical severity

  Oracle Database Server: Improper Access Control

  CVE-2026-71064Aug 18, 2026Oracle

  Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical comm

• 9.6 Critical severity

  Oracle Database Server: Improper Access Control

  CVE-2026-71063Aug 18, 2026Oracle

  Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical comm

• 9.9 Critical severity

  Oracle BI Publisher: Improper Access Control

  CVE-2026-71059Aug 18, 2026Oracle

  Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0 and 26.1.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP t

• 9.8 Critical severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-71040Aug 18, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agil

• 9.3 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-71037Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attack

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Privilege Management

  CVE-2026-71036Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attack

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-71026Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthentic

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Missing Authentication for Critical Functionality

  CVE-2026-71015Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthentic

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-71014Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthentic

• 9.3 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-70998Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthentic

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-70997Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attack

• 9.8 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-70995Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthentic

• 9.1 Critical severity

  Oracle Commerce Guided Search / Oracle…: Improper Access Control

  CVE-2026-70994Aug 18, 2026Oracle

  Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthentic