Latest critical vulnerabilities
CVSS 9.0 and up.
- mozilla firefox, thunderbird +1 moreInteger overflow in the Graphics component9.8 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Storage: Cache API component9.1 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the DOM: Core & HTML component9.8 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the Graphics: ImageLib component9.8 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the Graphics: Text component9.8 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript: WebAssembly component9.8 Critical
- arcadedata arcadedbArcadeDB Redis Wire-Protocol Plugin Missing Authentication9.3 Critical
- arcadedata arcadedbArcadeDB MongoDB wire protocol authentication bypass cross-database9.3 Critical
- arcadedata arcadedbArcadeDB before 26.8.1 Authentication Bypass via Async Command9.4 Critical
- arcadedata arcadedbArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction9.4 Critical
- getgrav gravGrav before 2.0.14 Privilege Escalation via Group Access Field9.3 Critical
- getgrav gravGrav API Plugin before 1.0.14 Missing Authorization9.3 Critical
- getgrav gravGrav API Plugin before 1.0.14 Authorization Bypass9.3 Critical
- getgrav gravGrav before 2.0.15 Stored XSS via detectXss() Quote Bypass9.3 Critical
- getgrav gravGrav before 2.0.15 Arbitrary File Write via error_log9.3 Critical
- siyuan-note siyuanSiYuan before v3.7.4 XSS-to-RCE via malicious filename upload9.3 Critical
- bastillion-io bastillionBastillion Authentication Bypass via Path-Prefix Routing Mismatch9.3 Critical
- smicallef spiderfootSpiderFoot Stored Cross-Site Scripting via Correlation Titles9.3 Critical
- apache skywalking mcpApache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server9.8 Critical
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration9.8 Critical
- comfast cf-n1-sCOMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection9.4 Critical
- No product listedCross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the...9.3 Critical
- No product listedAn arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote...9.1 Critical
- No product listedAn incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated...9.8 Critical
- No product listedAn issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector...9.8 Critical
- No product listedVerification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1...9.8 Critical
- dep0we atomic-agents-stackatomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP9.2 Critical
- onyx-dot-app onyxOnyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers9.6 Critical
- lfprojects mlflowMLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)9.3 Critical
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreManagedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)9.9 Critical
- frappe erpnextERPNext: Server-Side Template Injection leading to Remote Code Execution9.9 Critical
- memtensor memosMemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET9.3 Critical
- jhumanj opnformOpnForm Editable Submission Secret Derivation via Empty Hashids Salt9.3 Critical
- gitlabImproper Control of Generation of Code ('Code Injection') in GitLab9.4 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem9.1 Critical
- red hat multicluster global hub 1.4.9, multicluster global hub 1.5.8, multicluster global hub 1.6.6 +9 more +11 moreMulticloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters9.9 Critical
- patriksimek vm2vm2 before 3.11.6 Process-wide State Exposure via os and dns10.0 Critical
- patriksimek vm2vm2: Sandbox Breakout Using Dangerous Host Proto Mutators9.8 Critical
- patriksimek vm2vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE9.9 Critical
- regularlabs.com sourcerer extension for joomlaJoomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.010.0 Critical
- joomlack.fr page builder ck extension for joomlaJoomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.59.3 Critical
- quantumnous new-apiNew API: Integer overflow in quota billing yields negative charges (self-crediting)9.1 Critical
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated...9.1 Critical
- quantumnous new-apiNew API: User List API Leaks Root User Access Token Leading to Privilege Escalation9.1 Critical
- discourseDiscourse: Cache poisoning/XSS via color scheme cookies9.3 Critical
- openshift-metal3 fakefishKubeVirt backend is not authenticated9.3 Critical
- wktk conflibotConflibot: Command injection via crafted pull request branch names under pull_request_target9.1 Critical
- innotim software telecommunications and consulting trade ltd. co. logsign siemSensitive Data Exposure in Innotim Software's Logsign SIEM9.0 Critical
- wavlink wn531p3, wn535m1 +1 moreWavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow10.0 Critical
- jahlives openssl encryptopenssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback9.3 Critical
- Show moreLoading…