Latest critical vulnerabilities
CVSS 9.0 and up.
- eclipse foundation mnestix Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures 9.2 Critical
- axxonsoft axxon one Default Administrator Password Change Not Enforced in Axxon One Web Client 9.2 Critical
- wso2 api manager, api control plane, identity server key manager connector (apim-km-wso2is) +2 more Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager) 9.8 Critical
- zohocorp eventlog analyzer, log360 +1 more Improper Access Control vulnerability 9.1 Critical
- acf extended advanced custom fields: extended pro Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type 9.8 Critical
- alex githatu buddypress xprofile custom image field BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler 9.1 Critical
- clavaque s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptions s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter 9.8 Critical
- absolute security secure access Authentication bypass in Secure Access Servers 9.3 Critical
- absolute security secure access CSRF in Secure Access Server v14.60 9.4 Critical
- themefic ultra addons for contact form 7 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field 9.8 Critical
- joomlaboat.com custom tables extension for joomla Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 9.5 Critical
- dj-extensions.com dj-classifieds extension for joomla Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 9.3 Critical
- dj-extensions.com dj-classifieds extension for joomla Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 9.4 Critical
- aws virtual-engineering-workbench Template injection in the publishing component of awslabs Virtual Engineering Workbench 9.4 Critical
- chainguard kaniko kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts 9.3 Critical
- suse rancher Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy 9.1 Critical
- suse rancher Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller 9.1 Critical
- control web panel web panel Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory 9.3 Critical
- control web panel web panel Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex 9.3 Critical
- mpdavis python-jose python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key 9.1 Critical
- bufanyun hotgo HotGo through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code 9.2 Critical
- xianhc ape-volo-admin ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass 9.3 Critical
- barracuda networks email security gateway (esg) Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway 9.3 Critical
- @fastify/http-proxy @fastify/http-proxy vulnerable to prefix escape via decoded route parameters 9.1 Critical
- wso2 api manager, api control plane, carbon api manager rest api common functions +6 more +8 more Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions 9.4 Critical
- wavlink wn551x3-a WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection 10.0 Critical
- wavlink wn551x3-a WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection 10.0 Critical
- termix-ssh termix Termix-SSH Termix transferToHost path traversal 9.4 Critical
- linksys e8450 Linksys E8450 portal.cgi strcpy stack-based overflow 10.0 Critical
- wavlink wn536ax6-a WAVLINK WN536AX6-A protocol.csp host_black os command injection 9.4 Critical
- wavlink wn536ax6-a WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow 10.0 Critical
- wavlink wn536ax6-a WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection 10.0 Critical
- wavlink wn536ax6-a WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection 10.0 Critical
- wavlink wn536ax6-a WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection 10.0 Critical
- wavlink wn536ax6-a WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection 10.0 Critical
- wavlink wn553x1-b WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection 9.4 Critical
- wavlink wn553x1-b WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection 9.4 Critical
- wavlink wn553x1-b WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection 9.4 Critical
- liquid web / stellarwp bookit WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability 9.3 Critical
- prefecthq prefab-ui Prefab UI Pyodide sandbox escape to host RCE 10.0 Critical
- horizon datasys reboot restore standard Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption 9.3 Critical
- wavlink wn553x1-b WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection 9.4 Critical
- wavlink wn701ae WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection 9.4 Critical
- wavlink wn553x1-b WAVLINK WN553X1-B ioos sub_416B50 os command injection 9.4 Critical
- wavlink wn553x1-b WAVLINK WN553X1-B ioos Service sub_416D88 os command injection 9.4 Critical
- beam-cloud beta9 gateway, beta9 worker +1 more Beta9 host filesystem exposure via volume path traversal 9.9 Critical
- beam-cloud beta9 worker Beta9 container escape via unvalidated sandbox file paths 9.9 Critical
- beam-cloud beta9 worker Beta9 build sandbox escape via chroot-only isolation 9.9 Critical
- wavlink wn701ae WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection 9.4 Critical
- oray pugongying x5 pro Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal 9.4 Critical
- Show olderLoading…