Latest critical vulnerabilities
CVSS 9.0 and up.
- lxc incusIncus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge9.9 Critical
- lxc incusIncus has a project restriction bypass via instance migration config override9.9 Critical
- lxc incusIncus has an argument injection in storage volume block.create_options that leads to arbitrary command execution9.9 Critical
- dji air 3, air 3s, avata 2 +13 more +15 moreCleartext Exposure of DJI Drone Wi-Fi Credentials via BLE9.4 Critical
- spipSPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as...9.8 Critical
- headroom labs headroomHeadroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity9.3 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Path Traversal via packageName9.4 Critical
- comfast cf-n1-sComfast CF-N1-S mbox-config system command injection9.4 Critical
- apache cloudstackApache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module9.1 Critical
- apache cloudstackApache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI9.1 Critical
- apache cloudstackApache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation9.1 Critical
- 101gen automation web platform – notifications and otp for woocommerce, advanced country codeAutomation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure9.8 Critical
- datiphy inc. data management centerDatiphy Data Management Center - External Control of File Name or Path9.3 Critical
- datiphy inc. data management centerDatiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command9.4 Critical
- datiphy inc. data management centerDatiphy Data Management Center - Use of Default Credentials9.3 Critical
- droundy arrayrefThe arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a...9.8 Critical
- droundy append-only-vecThe append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a...9.8 Critical
- droundy internmentThe internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a...9.8 Critical
- spipSPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as...9.8 Critical
- ptc flexplm, windchill pdmlink +1 moreCritical Remote Code Execution (RCE) vulnerability reported in Windchill9.2 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.9 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.3 Critical
- evershopcommerce evershopEverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover9.3 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ptc windchill risk and reliability enterprise edition (formerly relex)Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition9.3 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- microsoft azure arcAzure Arc Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure logic appsAzure Logic Apps Elevation of Privilege Vulnerability9.6 Critical
- microsoft azure sql databaseAzure SQL Database Elevation of Privilege Vulnerability9.9 Critical
- microsoft azure sql databaseAzure SQL Database Elevation of Privilege Vulnerability9.1 Critical
- microsoft azure web appsAzure Arc Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure managed instance for apache cassandraAzure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability10.0 Critical
- microsoft fabricMicrosoft Fabric Elevation of Privilege Vulnerability9.9 Critical
- microsoft entra id, entra +1 moreMicrosoft Entra ID Elevation of Privilege Vulnerability9.9 Critical
- microsoft entra id, entra +1 moreMicrosoft Entra ID Remote Code Execution Vulnerability10.0 Critical
- microsoft azure sql databaseAzure SQL Database Elevation of Privilege Vulnerability9.9 Critical
- microsoft exchange online, microsoft exchange online +1 moreMicrosoft Exchange Online Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure data factoryAzure Data Factory Elevation of Privilege Vulnerability9.3 Critical
- apple swift-nio-ssh, swiftnio ssh +1 moreA single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulne…9.8 Critical
- centrifugal centrifugoCentrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends9.1 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction9.9 Critical
- wintercms winterWinter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy9.3 Critical
- Show moreLoading…