Latest critical vulnerabilities
CVSS 9.0 and up.
- iot-ecology rust-iot-platformrust-iot-platform Authentication Bypass via Non-Validated Authorization Header9.1 Critical
- openplc v3 v3, thiagoralves openplc v3 +1 moreOpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write9.9 Critical
- rxi microtarmicrotar Stack Buffer Overflow in mtar_write_file_header() and mtar_write_dir_header()9.8 Critical
- cwalter-at freemodbusFreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()9.1 Critical
- iotsharpIoTSharp BlobStorageController Missing Authentication and Path Traversal9.8 Critical
- libxfont2, suse container suse/kiosk/tigervnc-x11vnc:1.14-63.8, container suse/kiosk/xorg:21.1-83.7 +77 more +79 morefs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont29.2 Critical
- libxfont, suse container suse/kiosk/tigervnc-x11vnc:1.14-63.8, container suse/kiosk/xorg:21.1-83.7 +77 more +79 morefs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont29.5 Critical
- debevv nanomodbusnanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_id9.8 Critical
- debevv nanomodbusnanoMODBUS Server-Side Out-of-Bounds Write in handle_read_file_record()9.8 Critical
- harsh21patel inventory-management-system-phpInventory-Management-System-PHP - Unauthenticated SQL Injection in Login and Product Deletion9.8 Critical
- djangocrm django-crmDjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery9.1 Critical
- miantang iot-phpMiantang IoT-PHP - Unauthenticated SQL Injection in /userlogin9.8 Critical
- thebradleysanders iotsmarthomeIOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie9.8 Critical
- zbtlink cpe2801 firmware, we1026-5g-wd firmware, we1326 firmware +17 more +19 moreENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant9.3 Critical
- suse rancherCross-Cluster Impersonation Confused-Deputy Privilege Escalation9.1 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscription9.0 Critical
- red hat multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.6 +2 more +4 moreCluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token9.1 Critical
- linuxBluetooth: qca: fix NVM tag length underflow in TLV parser9.8 Critical
- linuxxfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()9.8 Critical
- themeruby easy post submission – frontend posting, guest publishing & submit content for wordpressEasy Post Submission <= 2.3.0 - Missing Authorization9.1 Critical
- nasa-ammos plandev (sequencing-server)NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server9.8 Critical
- typemilltypemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force9.1 Critical
- mrswapnilsahu stock-inventory-management-systemStock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass9.8 Critical
- pluck cms cms, pluck-cms pluck cms +1 morePluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE9.6 Critical
- apache lucyApache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input9.8 Critical
- apache lucyApache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS9.8 Critical
- sh1zen multi uploader for gravity formsMulti Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion9.1 Critical
- darren cooney ajax load moreAjax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args9.1 Critical
- glboy otp login with phone number, otp verificationLogin/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force9.1 Critical
- unknown custom fieldsCustom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal10.0 Critical
- stellarwp membership plugin – kadence membershipsMembership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover9.3 Critical
- No product listedA heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU...9.8 Critical
open62541DebianIn open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete...9.8 Critical- No product listedOpen Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The...9.8 Critical
- No product listedMy Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication...9.8 Critical
- opensipsOpenSIPS: Global Buffer Overflow in construct_uri9.1 Critical
- opensipsOpenSIPS: Buffer Overflow in Base64 Encode Transformation9.1 Critical
- cjcollier google::authGoogle::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call9.8 Critical
- opensipsOpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy9.8 Critical
- maxsite cmsMaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie9.3 Critical
- maxsite cmsMaxSite CMS Unauthenticated RCE via Install Endpoint9.3 Critical
- flowiseai flowiseFlowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service9.2 Critical
- flowiseai flowiseFlowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability9.5 Critical
- maxsite cmsMaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php9.3 Critical
- keysight ixchariot, hawkeye, ixbypass +2 more +4 moreKeysight IxChariot-related products stack-based buffer overflow9.3 Critical
- keysight ixchariotKeysight IxChariot Endpoint stack-based buffer overflow9.3 Critical
- keysight ixchariotKeysight IxChariot Endpoint heap-based buffer overflow9.3 Critical
- maximeamini atals-livreAtlas-Livre Unauthenticated Access via Admin Controllers Missing Exit9.3 Critical
- flowiseai flowiseFlowise: Pyodide validator Unicode homoglyph bypass leads to RCE9.5 Critical
- nvidia dynamoNVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an...9.8 Critical
- Show moreLoading…