Latest critical vulnerabilities
CVSS 9.0 and up.
- trendnet tv-ip751wicTRENDnet TV-IP751WIC alphapd set_time.cgi stack-based overflow9.4 Critical
- termix-ssh termixTermix: Remote Code Execution via Tunnel Disconnect pkill Command Injection9.8 Critical
- termix-ssh termixTermix: Missing authorization in SSH host credential resolution exposes stored credentials9.6 Critical
- termix-ssh termixTermix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other users9.6 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.6 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ether etherpadEtherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite9.6 Critical
- ether etherpadEtherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint9.9 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.4 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- rdk rdk-b webuiRDK WebUI heap-based buffer overflow vulnerability9.8 Critical
- rdk rdk-b webuiRDK-B WebUI improper cryptographic signature verification vulnerability9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.3 Critical
- ozols grupa ozolsCritical flaw impacting OZOLS ERP's automatic update channel10.0 Critical
- ibm power systems firmware, power system e1080 \(9080-hex\) firmware, power system e1180 \(9080-heu\) firmware +7 more +9 morePower System Buffer Overflow9.6 Critical
- ibm power systems firmware, power system e1080 \(9080-hex\) firmware, power system e1180 \(9080-heu\) firmware +7 more +9 morePower System Improper Certificate Validation9.6 Critical
- themetechmount truebooker – appointment booking and scheduler systemTrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter9.8 Critical
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +4 more +6 moreSearch-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork9.9 Critical
- orval-labs orvalOrval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)9.3 Critical
- vsdeskAdmin Account Takeover via Path Traversal in vsDesk9.3 Critical
- orval-labs orvalOrval: Import-time RCE via schema default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: RCE via schema property name -> computed-property-key injection in the MSW mock generator9.3 Critical
- orval-labs orvalOrval: Import-time RCE via enum-typed default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli9.3 Critical
- orval-labs orvalOrval: Import-time RCE via array-items default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client9.3 Critical
- orval-labs orvalOrval: Import-time RCE via header-parameter default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: Import-time RCE via query-parameter default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)9.3 Critical
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreCluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route9.3 Critical
- orval-labs orvalOrval: Import-time RCE via schema property name -> computed-property-key injection in the zod client9.3 Critical
- elementor proWordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability9.0 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa9.1 Critical
- trueconf serverA remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server...9.5 Critical
- trueconf serverA remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server...9.3 Critical
- ffmpegFFmpeg Heap Buffer Overflow via RIST Protocol Reader9.3 Critical
- wazuhWazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager9.1 Critical
- cisco secure workloadCisco Secure Workload Software Security Hardening Release August 2026 - Improper Access Control Vulnerabilities10.0 Critical
- cisco secure workloadCisco Secure Workload Software Security Hardening Release August 2026 - Improper Authentication Vulnerabilities10.0 Critical
- cisco secure workloadCisco Secure Workload Software Security Hardening Release August 2026 - Improper Input Validation Vulnerabilities9.6 Critical
- Show moreLoading…