Latest critical vulnerabilities
CVSS 9.0 and up.
- wbolt.com spider analyser – wordpress搜索引擎蜘蛛分析插件WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability10.0 Critical
- qlstudio export user dataWordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability9.8 Critical
- muffingroup bethemeWordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability9.9 Critical
- qode toursWordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability9.3 Critical
- miniorange wp oauth serverWordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability9.3 Critical
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability9.3 Critical
- sergey aiwuWordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability9.8 Critical
- wpdreams ajax search liteWordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability9.8 Critical
- nexcess kadence woocommerce email designerWordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability9.8 Critical
- bohdan triapitsyn openchamberOpenChamber 1.11.7 Path Traversal File Read via allowOutsideWorkspace Parameter9.3 Critical
- bohdan triapitsyn openchamberOpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec9.3 Critical
- dell virtual storage integrator for vmware vsphere client, virtual storage integrator +1 moreDell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s...9.1 Critical
- dell virtual storage integrator for vmware vsphere client, virtual storage integrator +1 moreDell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s...9.8 Critical
- loca software informatics technology ltd. co. cmsSQLi in Loca Software's CMS9.8 Critical
- eclipse glassfishIn Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources...9.6 Critical
- apache cxfApache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation9.1 Critical
- apache cxfApache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters9.1 Critical
- apache cxfApache CXF: Self-issued ID token claims validation skipped9.1 Critical
- apache cxfApache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay9.8 Critical
- apache cxfApache CXF: Unsafe deserialization of inbound JMS ObjectMessage9.8 Critical
- wso2 api control plane, api manager, multiple products +3 more +5 moreAuthentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover10.0 Critical
- wso2 api control plane, api manager, traffic manager +3 more +5 morePrivilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover9.8 Critical
- wso2 api control plane, api manager, identity server +7 more +9 moreAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products9.4 Critical
- linuxsmb: client: fix double-free in SMB2_close() replay9.8 Critical
- arni cinco wpcargo track & traceWPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number9.1 Critical
- glenwpcoder drag and drop multiple file upload for woocommerceDrag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle9.1 Critical
- No product listedSQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code...9.8 Critical
- No product listedICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in...9.8 Critical
- agentfront frontmcpFrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool9.3 Critical
- nuxt devtoolsNuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution9.6 Critical
- rclonerclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect9.3 Critical
- mervinpraison praisonaiPraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name10.0 Critical
- jenkins project jenkins, remoting +1 moreIn Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2...9.0 Critical
- cisco catalyst sd-wan controller, catalyst sd-wan manager +1 moreCisco SD-WAN Software Security Hardening Release - Improper Link Resolution Before File Access9.1 Critical
- cisco catalyst sd-wan controller, catalyst sd-wan manager +1 moreCisco Catalyst SD-WAN Security Hardening Release - Input Validation Vulnerabilities9.9 Critical
- cisco catalyst sd-wan controller, catalyst sd-wan manager +1 moreCisco Catalyst SD-WAN Security Hardening Release - Access Control Vulnerabilities9.9 Critical
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software Security Hardening Release9.8 Critical
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software Security Hardening Release9.0 Critical
- progress marklogic serverCross-site scripting in Progress MarkLogic Server Query Console9.3 Critical
- progress marklogic serverPrivilege escalation in Progress MarkLogic Server Hadoop integration9.9 Critical
- progress marklogic serverAuthentication bypass in Progress MarkLogic Server ODBC App Server9.8 Critical
- progress marklogic serverHTTP request smuggling in Progress MarkLogic Server9.1 Critical
- progress marklogic serverPrivilege escalation in Progress MarkLogic Server REST document patch operation9.9 Critical
- progress marklogic serverSAML authentication bypass in Progress MarkLogic Server9.1 Critical
- progress marklogic serverPrivilege escalation in Progress MarkLogic Server REST query interfaces9.9 Critical
- apache answerApache Answer: Residual Administrative API Key Access After Role or Account Revocation9.1 Critical
- google cloud secops (chronicle soar)Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header9.4 Critical
- flarum frameworkFlarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset9.2 Critical
- nasa-ammos anmsNASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution via Exposed AMP Manager REST API9.8 Critical
- iot-ecology rust-iot-platformrust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation9.8 Critical
- Show moreLoading…