Latest critical vulnerabilities
CVSS 9.0 and up.
- traefikTraefik HTTP/3 Backend NTLM Connection Reuse9.1 Critical
- netreviews sas verified reviews (avis vérifiés)WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability9.3 Critical
- mend mend-renovate-enterprise-edition, renovatebot renovate, mend mend-renovate-ce +3 more +5 moreRenovate before 44.11.2 Credential Exfiltration via Link Header9.2 Critical
- mend mend-renovate-enterprise-edition, renovatebot renovate, mend mend-renovate-ce +3 more +5 moreRenovate before 44.11.2 Credential Exfiltration via Link Header9.2 Critical
- mend mend-renovate-ce, mend-renovate-enterprise-edition, renovate-ce +3 more +5 moreRenovate before 44.11.3 Credential Exfiltration via Link Header9.2 Critical
- renovatebot renovate, mend mend-renovate-ce, mend-renovate-enterprise-edition +3 more +5 moreRenovate before 44.11.3 Credential Exfiltration via Link Header9.2 Critical
- traefikTraefik v3.7.0 Authentication Bypass via from-to-www-redirect9.3 Critical
- wwbn avideoAVideo AD_Server Stored XSS via log.php label parameter9.3 Critical
- wwbn avideoAVideo LiveLinks Stored XSS via title and description fields9.3 Critical
- wwbn avideoWWBN AVideo Stored XSS via Category Name and Icon Class9.3 Critical
- wwbn avideoWWBN AVideo LoginControl Stored XSS via User-Agent Header9.3 Critical
- cap-go capgo.appCapgo SSO Provider Authentication Bypass via PostgREST Direct Write9.3 Critical
- cap-go capgo.appCapgo Authorization Bypass via Stale Channel Permission Overrides9.3 Critical
- gis informatics gislab laboratory management systemSQLi in GIS Informatics' GisLab Laboratory Management System9.8 Critical
- appsup-dart joseIn the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only...9.1 Critical
- joomshaper.com sp property extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.49.3 Critical
- armiya information technologies ltd. co. access control systemOpen Redirect in Armiya Information Technologies' Access Control System9.3 Critical
- geovision inc. gv-lpc2011/lpc2211GV-LPC2011/LPC2211 - Unauthenticated PTZ Control Service9.4 Critical
- geovision inc. gv-lpclpc2011/2211GV-LPCLPC2011/2211 - ONVIF WS-Security PasswordDigest Replay9.8 Critical
- armiya information technologies ltd. co. access control systemSQLi in Armiya Information Technologies' Access Control System9.8 Critical
- apache camel, apache software foundation camel k +1 moreApache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod9.8 Critical
- apache camel, apache software foundation camel k +1 moreApache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects9.8 Critical
- unknown zipmoney(zip co) payments plugin for woocommercezipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion9.1 Critical
- unknown miniorange 2faminiOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator10.0 Critical
- apache freemarkerApache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks9.1 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers9.1 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment9.8 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion9.1 Critical
- rapid7 velociraptorVelociraptor Required Permissions bypass by using client monitoring queries9.9 Critical
- add-ons.org drag and drop file upload for elementor formsDrag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter9.8 Critical
- No product listedAn issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit...9.1 Critical
pumaDebian,ansible-coreRed Hat,ansible-testRed Hat +38 more +40 moreAn issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the...9.1 Critical- flowiseai flowiseAn issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1...9.8 Critical
- No product listedGarlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories...9.8 Critical
- behavioral technology group pavlok behavioral conditioning wearableBehavioral Technology Group Pavlok Behavioral Conditioning Wearable Apple Notification Center Service Event buffer overflow9.4 Critical
- pandora-analysis pandoraPath traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis9.3 Critical
- aws labs postgres mcp serverRead-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server9.0 Critical
- nationalsecurityagency skills-serviceNationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover9.6 Critical
- maxsite cmsMaxSite CMS through 109.6 PHP Object Injection via ci_session9.2 Critical
- maxsite cmsMaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key9.3 Critical
- sage ar automationCash Collect contains an improper authorization vulnerability in the Sage AR Automation API....9.0 Critical
- sage ar automationCash Collect contains an improper authorization vulnerability in the Sage AR Automation API....9.0 Critical
- webpros cpanelA vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root...9.9 Critical
- eprosima fast-ddsFast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG sampleSize / fragmentsInSubmessage9.1 Critical
- checkpoint quantum security gateway, quantum security management +1 moreHeap-based Buffer Overflow in VPN Certificate ASN.1 Decoding9.8 Critical
- checkpoint quantum security gateway, check point multiple products, checkpoint gaia embedded +1 more +3 moreImproper Certificate Validation in Quantum Security Gateway9.8 Critical
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...9.8 Critical
- parse-community parse-serverParse Server 9.0.0 Authentication Bypass via LDAP Empty Password9.1 Critical
- kguard firmwareKGUARD DVR unauthenticated remote command execution vulnerability10.0 Critical
- apache nutchApache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)9.8 Critical
- Show moreLoading…