Critical CVEs – Page 2 – CyberSecurityBoard

Critical CVEs

CVE-2026-116214 — Critical vulnerability brief

CVSS 9.3

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares…

critical Critical CVE CVE-2026-116214

October 26, 2026

Critical CVEs

CVE-2026-109618 — PHP Memory Corruption Vulnerability

CVSS 9.2

PHP Memory Corruption Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on…

CISA KEV CVE-2026-109618 PHP PHP Group

October 26, 2026

Critical CVEs

CVE-2026-109619 — PHP Stale Internal Request-State Vulnerability

PHP Stale Internal Request-State Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based…

CISA KEV CVE-2026-109619 PHP PHP Group

October 26, 2026

Critical CVEs

CVE-2026-114625 — Arista VeloCloud Orchestrator SQL Injection Vulnerability

Arista VeloCloud Orchestrator SQL Injection Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates…

Arista CISA KEV CVE-2026-114625 VeloCloud Orchestrator

October 23, 2026

Critical CVEs

CVE-2026-110447 — Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

CVSS 9.2

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD…

CISA KEV Collabora Collabora Online – Built-in CODE Server CVE-2026-110447

October 23, 2026

Critical CVEs

CVE-2026-115375 — Critical vulnerability brief

CVSS 9.4

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write…

critical Critical CVE CVE-2026-115375

October 22, 2026

Critical CVEs

CVE-2021-48016 — Critical vulnerability brief

CVSS 9.3

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string…

critical Critical CVE CVE-2021-48016

October 22, 2026

Critical CVEs

CVE-2026-91225 — Critical vulnerability brief

CVSS 9.1

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0.…

critical Critical CVE CVE-2026-91225

October 20, 2026

Critical CVEs

CVE-2026-91230 — Critical vulnerability brief

CVSS 9.3

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and…

critical Critical CVE CVE-2026-91230

October 20, 2026

Critical CVEs

CVE-2026-91231 — Critical vulnerability brief

CVSS 10

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0.…

critical Critical CVE CVE-2026-91231

October 20, 2026