Latest critical vulnerabilities
CVSS 9.0 and up.
- quanovate tech inc. (operating as mira / mira care) mira android app, mira firmware +1 moreMira Hormone Monitor, Mira Android App Use of Hard-coded Credentials9.3 Critical
- quanovate tech inc. (operating as mira / mira care) mira android app, mira firmware +1 moreMira Hormone Monitor, Mira Android App Weak Authentication9.3 Critical
- baptistearno typebot.ioTypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding9.9 Critical
- apache httpclient, apache software foundation httpcomponents client +1 moreApache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)9.1 Critical
- sonicwall gmsAn unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service...9.4 Critical
- sonicwall gmsAn unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510...9.1 Critical
- strategy11 formidable digital signaturesFormidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field9.8 Critical
- eosphoros-ai db-gptDB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header9.3 Critical
- papersgpt papersgpt-for-zoteroPapersGPT for Zotero 0.6.1 RCE via Unsanitized LLM Response eval()9.4 Critical
- stanford nlp dspyDSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing9.2 Critical
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure9.0 Critical
- dromara maxkeyMaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust9.3 Critical
- adobe commerce, commerce b2b, commerce and magento +3 more +5 moreAdobe Commerce | Incorrect Authorization (CWE-863)9.1 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)9.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)10.0 Critical
- chocobozzz peertubePeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()9.8 Critical
- chocobozzz peertubePeerTube: Cross-origin remote video takeover via Update activity9.3 Critical
- baptistearno typebot.ioTypeBot vulnerable to CSV injection in result export9.6 Critical
- microsoft azure kubernetes serviceMicrosoft Azure Kubernetes Service Elevation of Privilege Vulnerability9.4 Critical
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 moreMicrosoft Office SharePoint Spoofing Vulnerability9.3 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 moreWindows iSCSI Target Service Remote Code Execution Vulnerability9.8 Critical
- microsoft windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 +10 more +12 moreWindows Deployment Services TFTP Server Remote Code Execution Vulnerability9.8 Critical
- microsoft windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 +10 more +12 moreWindows DNS Server Remote Code Execution Vulnerability9.8 Critical
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +8 more +10 moreMicrosoft QUIC Remote Code Execution Vulnerability9.8 Critical
- microsoft hpc pack 2019, windows app +1 moreMicrosoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability9.8 Critical
- apache alluraApache Allura: Server-side request forgery9.1 Critical
- zohocorp manageengine ddi centralAuthentication Bypass Leading to Account Takeover9.8 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)10.0 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Incorrect Authorization (CWE-863)9.6 Critical
- seaweedfsSeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle9.3 Critical
- lllyasviel fooocusFooocus webui vulnerable to Remote Code Execution9.3 Critical
- twentyhq twentyTwenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution9.1 Critical
- seaweedfsSeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control9.8 Critical
- dassault systèmes simulia execution engineDeserialization of Untrusted Data Vulnerability in SIMULIA Execution Engine from Release 2023 through Release 202610.0 Critical
- baptistearno typebot.ioTypeBot API tokens stored in plaintext9.1 Critical
- truelockmc streambertStreambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler10.0 Critical
- truelockmc streambertStreambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler9.3 Critical
- rapid7 velociraptorVelociraptor authenticated identity-spoofing vulnerability9.6 Critical
- siemens simatic iot2050 advanced (6es7647-0ba00-1ya2), simatic iot2050 basic (6es7647-0ba00-0ya2), simatic iot2050 m.2 (6es7647-0bb00-1ya2) +1 more +3 moreA vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All...10.0 Critical
- wg-easywg-easy wg-easy - OS Command Injection9.9 Critical
- e107e107 e107 - SQL Injection9.8 Critical
- friendicaFriendica Friendica - SQL Injection9.8 Critical
- commvault, commvault cloud +1 moreImproper Authorization Validation9.2 Critical
- commvault, commvault cloud +1 moreCommand Restriction Bypass9.2 Critical
- sap se commerce cloud (data hub adapter)Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)10.0 Critical
- red hat jboss enterprise application platform 7, jboss enterprise application platform 7.4 els on rhel 7, jboss enterprise application platform 7.4.25 +1 more +3 morePicketlink-federation: auth bypass in picketlink saml unsolicited-response9.8 Critical
- arcadia technology, llc crafty controllerPath Traversal: '.../...//' in Crafty Controller9.1 Critical
- grafana mcp-grafana, mcp server +1 moreCVE-2026-19516 CVE Record9.1 Critical
- win men intermational travel agency management systemWin Men Intermational｜Travel Agency Management System - SQL Injection9.3 Critical
- Show moreLoading…