Latest critical vulnerabilities
CVSS 9.0 and up.
- msi radix axe6600MSI Radix AXE6600 v781521 Command Injection via alg function9.3 Critical
- msi radix axe6600MSI Radix AXE6600 v781521 Command Injection via dmz Function9.3 Critical
- msi radix axe6600MSI Radix AXE6600 v781521 Command Injection via accesscontrol Function9.3 Critical
- msi radix axe6600MSI Radix AXE6600 v781521 Command Injection via urlfilter9.3 Critical
- msi radix axe6600MSI Radix AXE6600 v781521 Command Injection via wps.cgi9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Buffer Overflow via quicksetup.cgi9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Buffer Overflow via app.cgi9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Command Injection via app.cgi9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Command Injection via /boafrm/formWsc9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Command Injection via /boafrm/formNtp9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Command Injection via /boafrm/formPinManageSetup9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Command Injection via /boafrm/formSmsManage9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom9.3 Critical
- d-link dwr-m961D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectel9.3 Critical
- linuxlibceph: fix two unsafe bare decodes in decode_lockers()9.8 Critical
- wupsales ai copilot – content generatorAI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route9.8 Critical
- openyakOpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution9.6 Critical
- kata-containersKata Containers: Config Path Annotation Arbitrary File Loading9.6 Critical
- hkuds lightragLightRAG: Missing Authentication for Critical API Functions in Default Configuration9.8 Critical
- brix crypto-jscrypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain9.0 Critical
- pleskImproper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated...9.9 Critical
- weaver network co., ltd. e-cology 9.0Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp9.3 Critical
- gitroomhq postiz-appUnauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover9.3 Critical
- seblod.com seblod extension for joomlaJoomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.19.2 Critical
- tobit laboratories ag teamdavidTeamDavid: Denial of Service via endpoint 'internalRestart'9.2 Critical
- tobit laboratories ag teamdavidTeamDavid: Buffer Overflow in JSON-parsing9.5 Critical
- tobit laboratories ag teamdavidTeamDavid: Buffer Overflow in multiple form data parameters9.5 Critical
- tobit laboratories ag teamdavidTeamDavid: Buffer Overflow in file names of file upload functionalities9.5 Critical
- tobit laboratories ag teamdavidTeamDavid: Memory Leak leaking sensitive information9.2 Critical
- apache foryApache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization9.8 Critical
- apache foryApache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path9.1 Critical
- unknown ajax search liteAjax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint9.8 Critical
- mstore api, unknown mstore api +1 moreMStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways9.1 Critical
- thimpress wp events managerWP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter9.8 Critical
- themetechmount truebooker – appointment booking and scheduler systemTrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'9.8 Critical
- themetechmount truebooker – appointment booking and scheduler systemTrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'9.8 Critical
- microsoft sharepoint onlineMicrosoft Office SharePoint Spoofing Vulnerability9.6 Critical
- microsoft 365 admin center, windows admin center +1 moreMicrosoft 365 Admin Center Elevation of Privilege Vulnerability9.8 Critical
- microsoft planetary computer, planetary computer pro (geocatalog) +1 moreMicrosoft Planetary Computer Pro Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure sql databaseAzure SQL Database Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure service busAzure Service Bus Remote Code Execution Vulnerability9.9 Critical
- microsoft teamsMicrosoft Teams Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure sre agentAzure SRE Agent Elevation of Privilege Vulnerability9.9 Critical
- microsoft azure logic appsAzure Logic Apps Information Disclosure Vulnerability9.6 Critical
- Show moreLoading…