UpHeron
All posts

Critical vulnerabilities

63 critical vulnerabilities in 19 servers and applications

63 vulnerabilities rated critical (CVSS 9.0 or higher) found on 1 November 2026: Adobe Experience Manager (10), Adobe ColdFusion (9), Incus (8) and more.

  • 63 critical

Adobe Experience Manager

10 vulnerabilities · Servers and applications

  1. 10.0Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current…Up to 2026.9.28187CVE-2026-90532
  2. 10.0Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current…Up to 2026.9.28187CVE-2026-48383
  3. 10.0Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current…Up to 2026.9.28187CVE-2026-48382
  4. 9.9Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current…Up to 6.5.25.0CVE-2026-75732
  5. 9.9Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current…Up to 2026.9.28187CVE-2026-105895
Show 5 more
  1. 9.6Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege…Up to 2026.9.28187CVE-2026-90531
  2. 9.3Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious…Up to 2026.9.28187CVE-2026-83662
  3. 9.3Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into…Up to 6.5.25.0CVE-2026-106629
  4. 9.3Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into…Up to 6.5.25.0CVE-2026-106630
  5. 9.1Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current…Up to 2026.9.28187CVE-2026-106626

Adobe ColdFusion

9 vulnerabilities · Servers and applications

  1. 10.0ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not…Up to 2025-update14CVE-2026-106622
  2. 10.0ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the…Up to 2025-update14CVE-2026-106624
  3. 10.0ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the…Up to 2025-update14CVE-2026-105899
  4. 9.9ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…Up to 2025-update13CVE-2026-106612
  5. 9.9ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the…Up to 2025-update13CVE-2026-105903
Show 4 more
  1. 9.6ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An…Up to 2025-update14CVE-2026-75994
  2. 9.6ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage…Up to 2025-update14CVE-2026-106620
  3. 9.1ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the…Up to 2025-update14CVE-2026-106621
  4. 9.0ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An…Up to 2025-update14CVE-2026-106619

Incus

8 vulnerabilities · Servers and applications · most fixed in 7.6.0

  1. 10.0Authentication and authorization bypass through unverified client certificate chainsFixed in 7.6.0GHSA-xg75-xf37-cph9
  2. 9.9Container configuration injection through OCI image config and oci.* keysFixed in 7.6.0GHSA-3wxw-5gh2-j2x2
  3. 9.9Restricted clients can create and access resources in the default projectFixed in 7.6.0GHSA-5c64-j5m6-8433
  4. 9.9Path traversal, crash and storage pool restriction bypass through dependent volumes in migrationFixed in 7.6.0GHSA-q9fc-p923-6vp7
  5. 9.9Restricted project users can create resources in the default project, bypassing project isolation (host root via dnsmasq, host file read via mkfs)Fixed in 7.6.0GHSA-jcw9-v2ff-8m79
Show 3 more
  1. 9.9Restricted project users can read or overwrite host files through special files, hard links or symlinks in backup or image metadataFixed in 7.6.0GHSA-5pgx-q9xx-j3qv
  2. 9.6Token operations exposed through the event stream and cancellable by any clientFixed in 7.6.0GHSA-cwg9-8mc4-hf7j
  3. 9.6Path traversal through snapshot names in custom volume backupsFixed in 7.6.0GHSA-p45f-gqqj-6qq3

Remote code execution in servers and applications

5 vulnerabilities

  1. 10.0TeamCityIn JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possibleFixed in 2025.11.7, 2026.1.3CVE-2026-106218
  2. 9.8TeamCityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possibleFixed in 2025.11.8, 2026.1.4CVE-2026-111094
  3. 9.8Apache StrutsImproper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the…Fixed in 6.12.0, 7.4.0CVE-2026-104711
  4. 9.5ClickHouseUnauthenticated RCE vulnerability against ClickHouse ServerFixed in 26.9.27.3-stable, 26.10.3.7-stableCVE-2026-116366
  5. 9.0FlowiseFlowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStoreUp to 3.1.4CVE-2026-119978

Payload CMS

4 vulnerabilities · Servers and applications · most fixed in 3.90.0

  1. 10.0Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before…Fixed in 3.90.0CVE-2026-105857
  2. 9.8Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can…Fixed in 3.90.0CVE-2026-105859
  3. 9.3Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the…Fixed in 3.90.0CVE-2026-105851
  4. 9.2Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a…Fixed in 3.90.0CVE-2026-105863

Langflow

8 vulnerabilities · Servers and applications

  1. 9.8Langflow OSS is affected by multipleFixed in 1.12.5CVE-2026-18894
  2. 9.8Langflow OSS is affected by multipleFixed in 1.13.0CVE-2026-93680
  3. 9.8Langflow OSS is affected by multipleFixed in 1.12.4CVE-2026-104317
  4. 9.8Langflow OSS is affected by multipleFixed in 1.12.4CVE-2026-104339
  5. 9.8Langflow OSS is affected by multipleFixed in 1.13.0CVE-2026-110186
Show 3 more
  1. 9.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS…Fixed in 1.12.3CVE-2026-93674
  2. 9.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.Fixed in 1.12.3CVE-2026-93675
  3. 9.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.Fixed in 1.12.3CVE-2026-104334

Gitea

5 vulnerabilities · Servers and applications · most fixed in 28.0.0

  1. 9.8Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For…Fixed in 28.0.0CVE-2026-94205
  2. 9.8Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able…Fixed in 1.27.2CVE-2026-73278
  3. 9.1Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh…Fixed in 28.1.0CVE-2026-101023
  4. 9.1Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path…Fixed in 28.0.0CVE-2026-95106
  5. 9.1When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded…Fixed in 28.0.0CVE-2026-103059

Broken access control in servers and applications

3 vulnerabilities

  1. 9.1vsftpdvsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel HijackingUp to 3.0.5CVE-2026-119568
  2. 9.1IBM WebSphere Application ServerIBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect…Fixed in 26.0.0.11CVE-2026-95695
  3. 9.1IBM WebSphere Application ServerIBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on…Fixed in 26.0.0.11CVE-2026-93895

Authentication bypass in servers and applications

2 vulnerabilities

  1. 9.1ZITADELZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck CookieFixed in 4.19.5CVE-2026-119128
  2. 9.1IBM WebSphere Application ServerIBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is…Fixed in 26.0.0.11CVE-2026-93909

Other vulnerabilities in servers and applications

9 vulnerabilities

  1. 10.0LXDImproper certificate validation in the HTTPS listener in LXDFixed in 5.21.9, 6.10.1CVE-2026-112816
  2. 9.9pgAdminpgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifierFixed in 9.19CVE-2026-116241
  3. 9.8MOVEit TransferMissing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from…Fixed in 2025.1.6, 2026.0.4CVE-2026-89068
  4. 9.8MOVEit TransferInsufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before…Fixed in 2025.1.6, 2026.0.4CVE-2026-89073
  5. 9.8Splunk EnterpriseAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review…Fixed in 10.2.7, 10.4.3CVE-2026-76284
Show 4 more
  1. 9.8Splunk EnterpriseAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review…Fixed in 10.2.7, 10.4.3CVE-2026-76285
  2. 9.8Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST)…Fixed in 10.2.7, 10.4.3CVE-2026-76268
  3. 9.4Nginx UINginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit…Fixed in 2.5.0CVE-2026-107806
  4. 9.1Parse ServerCustom auth adapters that extend the AuthAdapter class accept any authDataFixed in 8.6.102, 9.10.5-alpha.2GHSA-rq3w-5c6f-p7wr

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.