Latest critical vulnerabilities
CVSS 9.0 and up.
- froxlorFroxlor: Credential and 2FA secret disclosure via Froxlor API endpoints9.0 Critical
- elct9620 kobakoKobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)10.0 Critical
- frangoteam fuxaFUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)9.2 Critical
- trendnet tv-ip751wicTRENDnet TV-IP751WIC alphapd FUN_0043372C stack-based overflow9.4 Critical
- nvidia triton inference serverNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause...9.8 Critical
- uber krakenKraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification Bypass9.1 Critical
- baresip relibre: Integer overflow in websock_decode() masked frame length check leads to heap buffer overflow9.3 Critical
- gbif integrated publishing toolkitAuthentication bypass in Integrated Publishing Toolkit9.1 Critical
- gbif integrated publishing toolkitAuthentication bypass in Integrated Publishing Toolkit9.2 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.15, build of keycloak 26.6 +11 more +13 moreKeycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass9.1 Critical
- goauthentik authentikauthentik: Account Takeover via SAML NameID Comment Truncation9.4 Critical
- fbeta-gmbh epa3-service-opensourceePA 3.x Integration: VAU Server Authentication Bypass via Circular Certificate Trust9.1 Critical
- dell powerstore 1000t, powerstore 1200t, powerstore 3000t +9 more +11 moreDell PowerStore SDNAS, contains an Out-of-bounds Write vulnerability in the SMB/CIFS. An...9.8 Critical
- mybbMyBB: Contact page reflected XSS9.3 Critical
- mybbMyBB: Installer database configuration RCE9.8 Critical
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf9.6 Critical
- gohugo hugoHugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant9.3 Critical
- hmbown codewhaleCodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU9.2 Critical
- merkulove readablerWordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability9.3 Critical
- masteriyo - lms, themegrill masteriyo - lms +1 moreWordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability9.8 Critical
- youzifyWordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability9.8 Critical
- supsystic popup by supsysticWordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability9.1 Critical
- supsystic popup by supsysticWordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability9.8 Critical
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability9.8 Critical
- supsystic easy google mapsWordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability9.8 Critical
- crocoblock. jetimpex inc. jetappointmentWordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability9.3 Critical
- mra13 affiliates managerWordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability9.3 Critical
- trendnet tew-wlc100TRENDnet TEW-WLC100 HTTP Header nginx FUN_0040da4c stack-based overflow10.0 Critical
- aresit wp compressWordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability10.0 Critical
- metagauss registrationmagicWordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability9.8 Critical
- webnus inc. modern events calendarWordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability9.3 Critical
- gingerplugins sticky chat widgetWordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability9.3 Critical
- edge22 studios ltd. gp premiumWordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability9.9 Critical
- wpwax templatiqWordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability9.9 Critical
- roxnor fundengineWordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability9.8 Critical
- kamlesh parmar sync post with other siteWordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability9.9 Critical
- cwiclyWordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability9.9 Critical
- piotnet addons for elementor proWordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability9.6 Critical
- trendnet tew-wlc100pTRENDnet TEW-WLC100P DHCP blobmsg netifd stack-based overflow9.4 Critical
- mozilla firefox, thunderbird +1 moreInternally found bugs fixed in Firefox 1549.8 Critical
- mozilla firefox, thunderbird +1 moreInternally found bugs fixed in Firefox ESR 153.1 and Firefox 1549.8 Critical
- mozilla firefox, thunderbird +1 moreSite isolation issue in the CSS Parsing and Computation component9.1 Critical
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Enterprise Policies component9.8 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Add-ons Manager component9.8 Critical
- mozilla firefox, thunderbird +1 moreSide-channel in the Web Audio component9.1 Critical
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the DOM: Service Workers component9.1 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape in the Remote Settings Client component10.0 Critical
- mozilla firefox, thunderbird +1 moreInternally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 1549.8 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the JavaScript: GC component9.1 Critical
- mozilla firefox, thunderbird +1 moreInternally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 1549.8 Critical
- Show moreLoading…