Latest critical vulnerabilities
CVSS 9.0 and up.
- cisco crosswork planningCisco Crosswork Security Hardening Release: August 20269.9 Critical
- cisco crosswork planningCisco Crosswork Security Hardening Release: August 202610.0 Critical
- cisco crosswork planningCisco Crosswork Security Hardening Release: August 202610.0 Critical
- cisco secure workloadCisco Secure Workload Software Security Hardening Release August 2026 - Improper Neutralization of Special Elements Vulnerabilities9.9 Critical
- cisco crosswork planningCisco Crosswork Security Hardening Release: August 202610.0 Critical
- wazuhWazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager9.1 Critical
- wazuhWazuh: cluster peer can read arbitrary master files and forge offline REST API administrator tokens via DAPI tmp_file path injection in Wazuh manager9.1 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.9 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- sgoudelis ground-stationGround Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code execution9.8 Critical
- cmsjunkie.com j-businessdirectory extension for joomlaJoomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.39.3 Critical
- cmsjunkie.com j-businessdirectory extension for joomlaJoomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.310.0 Critical
- poxenstudio talebookMyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File9.4 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.9 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.1 Critical
- shenzhen cudy technology co., ltd. wr3000 2.0, p5 v1.1 +1 moreCudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT9.3 Critical
- phpmyfaqphpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge9.1 Critical
- phpmyfaqphpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle9.1 Critical
- siyuan-note siyuanSiYuan before v3.7.4 XSS-to-RCE via pathName.ts9.3 Critical
- siyuan-note siyuanSiYuan XSS-to-RCE via unescaped block metadata in hint popup9.3 Critical
- faydam innovation inc. dataloggerSQL Injection in Faydam Innovation's FAYDAM Datalogger9.8 Critical
- yootheme.com zoo extension for joomlaJoomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.6410.0 Critical
- yootheme.com zoo extension for joomlaJoomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.649.3 Critical
- balbooa.com balbooa forms extension for joomlaJoomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.210.0 Critical
- citrix netscaler, netscaler gateway, netscaler adc +2 more +4 moreNetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-194909.3 Critical
- binti76 total donationsWordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability9.3 Critical
- binti76 total donationsWordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability9.8 Critical
- the4 kalles addonsWordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability9.8 Critical
- teconcetheme nikstore coreWordPress Nikstore Core plugin <= 1.5 - SQL Injection vulnerability9.3 Critical
- wpdesk flexible subscriptionsWordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability9.8 Critical
- themetechmount truebookerWordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability9.8 Critical
- wpo-hr ngg smart image searchWordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerability9.3 Critical
- get maps marker pro maps marker proWordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability9.3 Critical
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability9.8 Critical
- apache tomcatApache Tomcat: Redirect after FORM auth may bypass method specific constraints9.1 Critical
- apache tomcatApache Tomcat: Limited replay attack possible with DIGEST authentication9.8 Critical
- apache tomcatApache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete9.8 Critical
- apache tomcatApache Tomcat: Bypass longest prefix security constraint9.1 Critical
- freebsdStack based buffer overflow in iconv(3)9.8 Critical
- freebsdHeap based buffer overflow in iconv(3)9.8 Critical
- unknown broken link checkerBroken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection9.0 Critical
- themetechmount truebookerTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions9.8 Critical
- boldgrid w3 total cacheW3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key10.0 Critical
- unknown tabapay gatewayTabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback9.8 Critical
- comfast cf-n1-sComfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow10.0 Critical
- utt hiper 1250gwUTT HiPER 1250GW HTTP aspApBasicConfigUrcp strcpy stack-based overflow9.4 Critical
- utt hiper 1200gwUTT HiPER 1200GW formGroupConfig strcpy stack-based overflow9.4 Critical
- line corporation armeriaA vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed u…9.1 Critical
libnet-oauth-perlDebian,perl-Net-OAuthMageia +1 moreNet::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify9.8 Critical- No product listedSQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker...9.9 Critical
- Show moreLoading…