Latest critical vulnerabilities
CVSS 9.0 and up.
- tophive ultimateaiWordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability9.9 Critical
- microsoft boostWordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability9.3 Critical
- wbw woobewoo product filter proWordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability9.3 Critical
- cakephp authenticationCakePHP: Potential Authentication bypass with CookieAuthenticator9.1 Critical
- cakephp, cakephp cakephp/database +1 moreCakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver9.2 Critical
- ransomlookRansomLook API Key Disclosure Through /admin/apikeys HTML Source9.4 Critical
- ibm mcp-context-forgeMCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server10.0 Critical
- combodo itopCombodo iTop: Remote code execution using external auth variable value9.4 Critical
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi9.3 Critical
- draytek corporation vigorap 1060c, vigorap 903, vigorap 906 +3 more +5 moreDrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm9.3 Critical
- google nest, nest wifi point firmware, nest wifi pro firmware +1 more +3 moreMultiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker...10.0 Critical
- apache camelApache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes9.8 Critical
- apache camelApache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection9.8 Critical
- apache camelApache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir9.1 Critical
- rconfigrConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php9.3 Critical
- netis systems nc63Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter9.3 Critical
- netis systems nc63Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter9.3 Critical
- konami metal gear online 3Konami's Metal Gear Online 3 contains a heap-based buffer overflow9.1 Critical
- ransomlookRansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification9.4 Critical
- phpipamphpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache9.3 Critical
- zscaler client connectorRemote Code Execution9.1 Critical
- zscaler client connectorAuthentication bypass between ZCC and client connector portal9.1 Critical
- ransomlookRansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data9.2 Critical
- miniorange.com login with keycloak oauth single sign-on (sso) (free) extension for joomla, miniorange oauth client (free) extension for joomla, oauth single sign-on – oidc sso | login with azure ad (free) extension for joomla +1 more +3 moreJoomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Sing…10.0 Critical
- ransomlookRansomLook Unauthenticated Database Export Exposes Private Data9.2 Critical
- roskus prospero flow crmIDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification9.3 Critical
- theme-rex freightcoWordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability9.8 Critical
- mvpthemes jawnWordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability9.8 Critical
- themewinter wp cafe proWordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability9.8 Critical
- redefiningtheweb affiliate pro - affiliate program for woocommerce & wordpressWordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability9.8 Critical
- divinext woo essentialWordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability9.3 Critical
- unitedover, llc digitsWordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability9.8 Critical
- canonical lxdInstance template path traversal allows arbitrary host file write as root9.9 Critical
- joomlack.fr page builder ck extension for joomlaJoomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.59.3 Critical
- dji air 3, air 3s, avata 2 +13 more +15 moreDJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory9.3 Critical
- 4mosan security technology gcb doctor4MOSAn Security Technology｜4MOSAn GCB Doctor - OS Command Injection9.3 Critical
- utt hiper 1250gwUTT HiPER 1250GW HTTP Request aspRemoteApConfTempSend strcpy stack-based overflow9.4 Critical
- efm iptime t24000mEFM ipTIME T24000M Session Validation httpcon_check_session_url improper authentication9.3 Critical
- efm iptime t16000mEFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication10.0 Critical
- exceljsexceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization9.3 Critical
libtiffAlmaLinux,tiffAlpaquita,libtiff-debuginfoRed Hat +6 more +8 moreAn issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute...9.8 Criticallibdbd-pg-perlUbuntu,perl-DBD-PgopenSUSE +1 moreDBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float9.8 Critical- ongres stackgresUntrusted Search Path in StackGres9.9 Critical
- unknown restrictmateRestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator9.8 Critical
- comfast cf-n1-sComfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflow9.4 Critical
- linuxNFS: Pin the 'struct nfs_server' during a FREE_STATEID call9.8 Critical
- linuxovpn: skip rehash for peers already removed from by_id9.8 Critical
- linuxbtrfs: lzo: reject inline extents without valid headers9.8 Critical
- linuxvdpa/mlx5: Fix buffer length in create_direct_keys()9.3 Critical
- linuxudp: fix potential use-after-free in tunnel segmentation10.0 Critical
- Show moreLoading…