Latest critical vulnerabilities
CVSS 9.0 and up.
- lavague-ai lavagueLaVague 0.2.35 Remote Code Execution via eval extraction9.2 Critical
- ten-frameworkTEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer9.3 Critical
- getomni-ai zeroxzerox 1.1.20 OS Command Injection via Document URL File Extension9.3 Critical
- teamwiseflow xiaobeixiaobei through 5.5.2 Unauthenticated Webhook Message Injection9.3 Critical
- aimhubio aimAim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch9.3 Critical
- haris-musa excel-mcp-serverexcel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode9.3 Critical
- mladensu cli-mcp-servercli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution9.2 Critical
- crcn sift.jssift 17.1.3 Prototype Pollution Remote Code Execution via $where9.2 Critical
- crystaldba postgres-mcpPostgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function9.2 Critical
- openpanel-dev openpanelOpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker9.2 Critical
- getgrav grav-plugin-formGrav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass9.3 Critical
- traefikTraefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth9.3 Critical
- unknown ai website builder (github build)AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes9.8 Critical
- @fastify/middie, fastify fastify\/middie +1 more@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target9.1 Critical
- apache software foundation alluraApache Allura: Server-side request forgery9.1 Critical
- xing inc. cptrans-me-xXING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of...9.3 Critical
- xing inc. cptrans-me-xXING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the...9.3 Critical
- xing inc. cptrans-me-xXING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be...9.3 Critical
- canvaThe Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged...9.6 Critical
- divi engine ajax filterDivi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter9.8 Critical
- freeipmiFreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru...9.8 Critical
- freeipmiipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in...9.8 Critical
- freeipmiipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in...9.8 Critical
- freeipmiipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in...9.8 Critical
- freeipmiFreeIPMI before 1.6.19 has a stack-based buffer overflow in...9.8 Critical
- lightstar smartit desktop managerLightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials9.3 Critical
- lightstar smartit desktop managerLightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials9.3 Critical
- asus control center enterprise (acc)Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard...10.0 Critical
- strukturag libheiflibheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items9.8 Critical
- No product listedNo authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client...9.8 Critical
- No product listedAn issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to...9.8 Critical
- No product listedPowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256...9.1 Critical
- No product listedPowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer...9.8 Critical
- No product listedPowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution...9.8 Critical
- No product listedAn issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID...9.8 Critical
- No product listedAn issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via...9.1 Critical
- No product listedAn issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the...9.8 Critical
- No product listedAn issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core...9.8 Critical
- No product listedeasyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the...9.8 Critical
- No product listedIn DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users...9.8 Critical
- No product listedSQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute...9.8 Critical
- configserver security & firewall, webpros configserver security & firewall +1 moreAn insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI...9.2 Critical
- microsoft entra id, entra +1 moreMicrosoft Entra ID Elevation of Privilege Vulnerability9.1 Critical
- microsoft azure active directory b2c, entra +1 moreMicrosoft Azure Active Directory B2C Elevation of Privilege Vulnerability10.0 Critical
- microsoft copilot studioCopilot Studio Elevation of Privilege Vulnerability9.3 Critical
- microsoft azure ai language authoringAzure AI Language Elevation of Privilege Vulnerability10.0 Critical
- themoos core-moosMOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet Length9.3 Critical
- mit moos-ivpMOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts9.3 Critical
- mit moos-ivpMOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders9.3 Critical
- mit moos-ivpMOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment9.3 Critical
- Show moreLoading…