Latest critical vulnerabilities
CVSS 9.0 and up.
- wpmanageninja ninja tables proNinja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build9.3 Critical
- rsyncproject rsyncrsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure9.1 Critical
- rsyncproject rsyncrsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink9.2 Critical
- rsyncproject rsyncrsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode9.1 Critical
- rsyncproject rsyncrsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header9.1 Critical
- rsyncproject rsyncrsync < 3.5.0 Command Injection via Multiple Code Paths9.2 Critical
- scriptsbundle nokriWordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability9.8 Critical
- andy moyle church adminWordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability9.3 Critical
- everestthemes everest backupWordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability9.3 Critical
- agnihd cartifyWordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability9.8 Critical
- thimpress realpressWordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability9.3 Critical
- dimitri grassi salon booking systemWordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability9.8 Critical
- if-so dynamic content personalization, unknown if-so dynamic content personalization +1 moreWordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability9.3 Critical
- realmag777 active products tables for woocommerceWordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability9.3 Critical
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability9.8 Critical
- webilia inc. listdomWordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability9.3 Critical
- miniorange otp verificationWordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability9.8 Critical
- denishua wpjam basicWordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability9.3 Critical
- hakan ozevin wp base bookingWordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability10.0 Critical
- rtcamp log in with googleWordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability9.8 Critical
- miniorange headless single sign onWordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability9.8 Critical
- miniorange headless single sign onWordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability9.8 Critical
- shamalli web directory freeWordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability9.3 Critical
- cyberlord92 oauth single sign on – sso (oauth client)WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability9.8 Critical
- wpdirectorykit wp directory kitWordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability9.3 Critical
- quarka qa analyticsWordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability10.0 Critical
- smewebify weberpmesv2WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)9.8 Critical
- siyuan-note siyuanSiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget9.2 Critical
- flowiseai flowiseFlowise before 3.1.3 Sandbox Escape to RCE9.0 Critical
- flowiseai flowiseFlowise before 3.1.3 Remote Code Execution via Custom MCP9.0 Critical
- flowiseai flowiseFlowise before 3.1.3 Prompt Injection RCE via CSV Agent9.0 Critical
- flowiseai flowiseFlowise before 3.1.3 Code Injection via CSV Agent customReadCSV9.0 Critical
- flowiseai flowiseFlowise before 3.1.3 Remote Code Execution via Airtable Agent9.0 Critical
- flowiseai flowiseFlowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore9.0 Critical
- flowiseai flowiseFlowise before 3.1.3 Sandbox Escape via Puppeteer9.4 Critical
- priority portal generator addon to priority erp (developed by soft solutions)Priority – CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control9.3 Critical
- priority portal generator addon to priority erp (developed by soft solutions)Priority – CWE-306: Missing Authentication for Critical Function9.3 Critical
- priority portal generator addon to priority erp (developed by soft solutions)Priority – CWE-602: Client-Side Enforcement of Server-Side Security9.1 Critical
- priority portal generator addon to priority erp (developed by soft solutions)Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor9.1 Critical
- priority portal generator addon to priority erp (developed by soft solutions)Priority - CWE-287: Improper Authentication10.0 Critical
- spring framework, vmware spring framework +1 moreSpring Framework Header Predicate Bypass in WebFlux Functional Endpoints9.8 Critical
- unknown link factoryLink Factory - Backdoor10.0 Critical
- unknown customer email verification for woocommerceCustomer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass9.8 Critical
- seriousm4x upsnapUpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd9.8 Critical
- mithaldu pdf::webkitPDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document9.8 Critical
- seriousm4x upsnapUpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd9.6 Critical
- openstack designateIn OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the...9.6 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image9.0 Critical
- ibm doors nextIBM Engineering Requirements Management DOORS Next is impacted by vulnerability in Reviews delete request10.0 Critical
- wolfsoftwaresystemsltd wolfstackWolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret9.3 Critical
- Show moreLoading…