Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
v.26.4.2314

Critical Severity Vulnerabilities

Found 1632 vulnerabilities at Critical severity.

Vulnerability Name
CVE
CWE
Severity
Grafana Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2026-27876)
CVE-2026-27876
CWE-94
Critical
Jboss EAP Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Vulnerability (CVE-2026-28367)
CVE-2026-28367
-
Critical
Jboss EAP Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Vulnerability (CVE-2026-28368)
CVE-2026-28368
-
Critical
Jboss EAP Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Vulnerability (CVE-2026-28369)
CVE-2026-28369
-
Critical
OpenSSL Out-of-bounds Read Vulnerability (CVE-2026-28386)
CVE-2026-28386
CWE-125
Critical
Chamilo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-28430)
CVE-2026-28430
CWE-138
Critical
Craft CMS Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (CVE-2026-28697)
CVE-2026-28697
CWE-138
Critical
Apache HTTP Server Heap-based Buffer Overflow Vulnerability (CVE-2026-28780)
CVE-2026-28780
CWE-122
Critical
Craft CMS Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2026-28783)
CVE-2026-28783
CWE-94
Critical
Apache Tomcat Improper Authentication Vulnerability (CVE-2026-29145)
CVE-2026-29145
CWE-287
Critical
Apache HTTP Server Use After Free Vulnerability (CVE-2026-29167)
CVE-2026-29167
CWE-416
Critical
Jetty Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Vulnerability (CVE-2026-2332)
CVE-2026-2332
-
Critical
OpenSSL Out-of-bounds Write Vulnerability (CVE-2026-31789)
CVE-2026-31789
CWE-787
Critical
Craft CMS Incorrect Authorization Vulnerability (CVE-2026-32267)
CVE-2026-32267
CWE-863
Critical
Ruby on Rails Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2026-33195)
CVE-2026-33195
CWE-22
Critical
Ruby on Rails Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2026-33202)
CVE-2026-33202
CWE-138
Critical
XWikiplatform Missing Authorization Vulnerability (CVE-2026-33229)
CVE-2026-33229
CWE-862
Critical
EspoCRM Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2026-33656)
CVE-2026-33656
CWE-22
Critical
Chamilo Files or Directories Accessible to External Parties Vulnerability (CVE-2026-33698)
CVE-2026-33698
CWE-552
Critical
Chamilo Weak Password Recovery Mechanism for Forgotten Password Vulnerability (CVE-2026-33707)
CVE-2026-33707
CWE-640
Critical
Handlebars Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2026-33937)
CVE-2026-33937
CWE-94
Critical
CubeCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-34018)
CVE-2026-34018
CWE-138
Critical
OpenSSL Improper Validation of Integrity Check Value Vulnerability (CVE-2026-34182)
CVE-2026-34182
CWE-354
Critical
Joomla Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-35221)
CVE-2026-35221
CWE-138
Critical
Joomla Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-35222)
CVE-2026-35222
CWE-138
Critical
Joomla CVE-2026-35223 Vulnerability (CVE-2026-35223)
CVE-2026-35223
-
Critical
WebLogic Improper Access Control Vulnerability (CVE-2026-35263)
CVE-2026-35263
CWE-284
Critical
WebLogic Missing Authentication for Critical Function Vulnerability (CVE-2026-35292)
CVE-2026-35292
CWE-306
Critical
WebLogic Improper Access Control Vulnerability (CVE-2026-35298)
CVE-2026-35298
CWE-284
Critical
WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2026-35300)
CVE-2026-35300
CWE-502
Critical
WebLogic Missing Authentication for Critical Function Vulnerability (CVE-2026-35301)
CVE-2026-35301
CWE-306
Critical
Joomla Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2026-40383)
CVE-2026-40383
CWE-22
Critical
Apache Tomcat Improper Input Validation Vulnerability (CVE-2026-41293)
CVE-2026-41293
CWE-20
Critical
axios Permissive List of Allowed Inputs Vulnerability (CVE-2026-42043)
CVE-2026-42043
CWE-183
Critical
axios Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability (CVE-2026-42044)
CVE-2026-42044
CWE-915
Critical
axios Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Vulnerability (CVE-2026-42264)
CVE-2026-42264
CWE-1321
Critical
Apache HTTP Server Exposure of Resource to Wrong Sphere Vulnerability (CVE-2026-42535)
CVE-2026-42535
CWE-668
Critical
Apache Tomcat DEPRECATED: Authentication Bypass Issues Vulnerability (CVE-2026-43512)
CVE-2026-43512
CWE-592
Critical
Apache Tomcat Improper Authorization Vulnerability (CVE-2026-43515)
CVE-2026-43515
CWE-285
Critical
Apache HTTP Server Buffer Underwrite ('Buffer Underflow') Vulnerability (CVE-2026-44631)
CVE-2026-44631
CWE-124
Critical
Oracle Database Server CVE-2026-46833 Vulnerability (CVE-2026-46833)
CVE-2026-46833
-
Critical
Joomla CVE-2026-48898 Vulnerability (CVE-2026-48898)
CVE-2026-48898
-
Critical
Joomla CVE-2026-48899 Vulnerability (CVE-2026-48899)
CVE-2026-48899
-
Critical
Joomla CVE-2026-48902 Vulnerability (CVE-2026-48902)
CVE-2026-48902
-
Critical
Joomla CVE-2026-48904 Vulnerability (CVE-2026-48904)
CVE-2026-48904
-
Critical
Perl Other Vulnerability (CVE-2026-4176)
CVE-2026-4176
-
Critical
Django Missing Authorization Vulnerability (CVE-2026-4277)
CVE-2026-4277
CWE-862
Critical
Lodash Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2026-4800)
CVE-2026-4800
CWE-94
Critical
PHP Out-of-bounds Read Vulnerability (CVE-2026-6104)
CVE-2026-6104
CWE-125
Critical
PHP Use After Free Vulnerability (CVE-2026-6722)
CVE-2026-6722
CWE-416
Critical
Python Insufficient Entropy Vulnerability (CVE-2026-7210)
CVE-2026-7210
CWE-331
Critical
PHP Use After Free Vulnerability (CVE-2026-7261)
CVE-2026-7261
CWE-416
Critical
Perl Integer Overflow to Buffer Overflow Vulnerability (CVE-2026-8376)
CVE-2026-8376
CWE-680
Critical
IBMHttpServer Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2026-8855)
CVE-2026-8855
CWE-94
Critical
IBMHttpServer Uncontrolled Resource Consumption Vulnerability (CVE-2026-8856)
CVE-2026-8856
CWE-400
Critical
Drupal Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-9082)
CVE-2026-9082
CWE-138
Critical
WordPress Plugin WordPress Plugin ACF Extended: Privilege Escalation (0.9.2.1)
CVE-2025-14533
CWE-269
Critical