Latest critical vulnerabilities
CVSS 9.0 and up.
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreMicrosoft UxTheme Library (uxtheme.dll) Remote Code Execution Vulnerability9.8 Critical
- microsoft sql server 2017 (cu 31), sql server 2017 (gdr), sql server 2019 (cu 32) +9 more +11 moreMicrosoft SQL Server Remote Code Execution Vulnerability9.8 Critical
- microsoft entra id, entra +1 moreEntra ID Elevation of Privilege Vulnerability9.9 Critical
- deepseek harnessDeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing9.4 Critical
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass9.1 Critical
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup9.2 Critical
- bitfrost.io bifrostBifrost Unauthorized Channel Commission Attribution Allows Commission Diversion9.1 Critical
- grokability snipe-itSnipe-IT before 8.7.0 CSS Injection via Custom CSS9.3 Critical
- wwbn avideoWWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorize9.1 Critical
- ivanti neurons for itsmA Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote...9.9 Critical
- ivanti neurons for itsmA Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote...9.9 Critical
- ivanti neurons for itsmA Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote...9.9 Critical
- ivanti neurons for itsmA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows...9.9 Critical
- netis systems nx10Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint9.3 Critical
- ivanti neurons for itsmA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows...9.8 Critical
- ivanti neurons for itsmA Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows...9.8 Critical
- xenforoXenForo < 2.3.13 Refresh Token Replay via Expired Access Token9.1 Critical
- xenforoXenForo < 2.3.13 OAuth2 Authorization Code Reuse9.1 Critical
- xenforoXenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint9.1 Critical
- commvault, commvault cloud +1 moreCommand Center API Authentication Bypass9.3 Critical
- red hat build of apache camel - hawtio 4Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users9.9 Critical
- hitachi cosminexus component containerCommand Argument Injection Vulnerability in Cosminexus Component Container9.8 Critical
- siemens simove fleetmanager v3.1, simove fleetmanager v3.2, simove fleetmanager v3.3 +5 more +7 moreA vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE...9.2 Critical
- siemens reyrolle 7sr5A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number...9.3 Critical
- siemens reyrolle 7sr5A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier...9.1 Critical
- siemens reyrolle 7sr5A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is...9.3 Critical
- hitachi cosminexus component containerOS Command Injection Vulnerability in Cosminexus Component Container9.8 Critical
- hitachi cosminexus component containerDeserialization of Untrusted Data Vulnerability in Cosminexus Component Container9.8 Critical
- d-link dir-822aD-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write9.4 Critical
- d-link dir-895lD-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow9.4 Critical
- sap se cloud application programming model (cap)Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)9.4 Critical
- sap se netweaver (sap gui for java)Improper Access Control in SAP NetWeaver (SAP GUI for Java)9.0 Critical
- sap se netweaver (message server)Missing Authentication check in SAP NetWeaver (Message Server)9.8 Critical
- sap se extended passport (epp) processingMemory Corruption vulnerability in SAP Extended Passport (EPP) Processing10.0 Critical
- No product listedAn issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into...9.8 Critical
- No product listedAn issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers...9.8 Critical
- No product listedAn issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via...9.8 Critical
- No product listedIncorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0...9.1 Critical
- No product listedmfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName...9.8 Critical
- No product listedMovie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort...9.8 Critical
- No product listedUC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains a Universal...9.3 Critical
- knowns-dev knownsknowns before 0.30.0 Unauthenticated Management API Exposure9.3 Critical
- adobe commerce, commerce b2b, commerce and magento +3 more +5 moreAdobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)10.0 Critical
- jetbrains hubIn JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service...9.8 Critical
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack...9.8 Critical
- next4biz information technologies inc. csm (customer service management)Code Injection in Next4Biz's CSM (Customer Service Management)9.8 Critical
- red hat directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8, directory server 11.9 for rhel 8 +19 more +21 more389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property9.8 Critical
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...9.3 Critical
- librenmsLibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion9.2 Critical
- bahçelievler muncipality bihayat appOTP Bypass in Bahçelievler Muncipality's BiHayat App9.4 Critical
- Show moreLoading…