Latest critical vulnerabilities
CVSS 9.0 and up.
- merit lilin v1, tp-link dr3150 firmware, dr3220v-4g firmware +34 more +36 morePre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways9.3 Critical
- red hat advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +1 moreLighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label9.9 Critical
- comfast cf-n1-sComfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow9.4 Critical
- vsdesk) Missing Server-Side File Extension Validation in vsDesk9.4 Critical
- automattic mongooseMongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching9.1 Critical
- automattic mongooseMongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE9.1 Critical
- automattic mongooseMongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification9.3 Critical
- automattic mongooseMongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling9.1 Critical
- dropbox samlyMissing one-time-use enforcement in Samly allows replay of SAML bearer assertions9.1 Critical
- comfast cf-n1-sComfast CF-N1-S SSID Configuration mbox-config sub_44B438 stack-based overflow9.4 Critical
- unstructured-io unstructuredunstructured: Server-Side Request Forgery in the URL-based partitioning9.3 Critical
- t8y2 dbxdbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)9.8 Critical
- osnexus quantastorOSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability9.8 Critical
- apache inlongApache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService9.8 Critical
- apache inlongApache InLong: SQL Injection via String Concatenation Vulnerability Report9.8 Critical
- apache inlongApache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.1 Critical
- baylan measuring instruments industry and trade inc. smart meter management application (bms)Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS9.8 Critical
- hashthemes easy elementor addonsWordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability9.6 Critical
- klarso gmbh neo-mjsCVE-2026-184829.8 Critical
- themagnifico52 warehouse cargoWordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability9.9 Critical
- themagnifico52 smart cleaningWordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability9.9 Critical
- indithemes it residenceWordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability9.9 Critical
- wpeverest user registration & membership proWordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability9.8 Critical
- roxnor fundengineWordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability9.8 Critical
- jonathan daggerhart query wranglerWordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability9.9 Critical
- repute infosystems bookingpress appointment booking proWordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability9.3 Critical
- tyche softwares abandoned cart pro for woocommerceWordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability9.8 Critical
- plainware locatoraid store locatorWordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability9.3 Critical
- monkeysan flatasticWordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability9.8 Critical
- e-plugins directory proWordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability9.3 Critical
- codexthemes thegem (elementor)WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability9.3 Critical
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability9.1 Critical
- cleantalk security & malware scan by cleantalkWordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability9.3 Critical
- rtcamp rtmedia for wordpress, buddypress and bbpressWordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability9.3 Critical
- wpmu dev forminatorWordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability9.8 Critical
- themegoods capellaWordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerability9.8 Critical
- themegoods capellaWordPress Capella theme <= 2.5.5 - SQL Injection vulnerability9.3 Critical
cap-primitivescrates.ioPaths or symlinks ending in a slash escape the sandbox9.0 Critical- freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreFreeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships9.6 Critical
- frauscher sensortechnik fds 102Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session Expiration due to flawed session expiration logic9.2 Critical
- unknown json optionsJSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Update9.8 Critical
- trendnet tew-755apTRENDnet TEW-755AP ssi wan.cgi stack-based overflow9.4 Critical
- internlm lmdeployLMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector9.3 Critical
- splunk mcp server app, model context protocol server +1 moreRemote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app9.1 Critical
- splunk, splunk enterprise +1 moreImproper Access Control through Embedded Reports in Splunk Enterprise9.4 Critical
- splunk, splunk enterprise +1 moreImproper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise9.4 Critical
- splunk, splunk enterprise +1 moreImproper Access Control through Embedded Report REST API Requests in Splunk Enterprise9.4 Critical
- trendnet tew-755apTRENDnet TEW-755AP mycli FUN_401000 stack-based overflow9.4 Critical
- nettyNetty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext9.1 Critical
- Show moreLoading…