Latest critical vulnerabilities
CVSS 9.0 and up.
- mistralai mistral-vibeAn arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command...10.0 Critical
- mistralai mistral-vibeAn arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command...10.0 Critical
- mistralai mistral-vibeAn arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an...9.3 Critical
- mistralai mistral-vibeAn arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an...9.2 Critical
- perforce akanaXML External Entity in Akana API Platform9.2 Critical
- progress software chef automatePrivilege Escalation in Progress Chef Automate10.0 Critical
- fortinet fortimonitoronsightA inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight...9.6 Critical
- sgl-project sglangCVE-2026-867939.8 Critical
- gohugoio hugoHugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS9.3 Critical
- gohugoio hugoHugo before v0.165.0 Symlink Confinement Bypass via resources.Get9.3 Critical
- wwbn avideoAVideo Bookmark Plugin Stored XSS via Chapter Names9.3 Critical
- wwbn avideoAVideo LoginControl Stored XSS via PGP Public Key9.3 Critical
- wwbn avideoAVideo CustomizeUser Stored XSS via field_name Parameter9.3 Critical
- wwbn avideoAVideo Stored XSS via donationLink in watch page button9.3 Critical
- wwbn avideoAVideo YPTWallet Stored XSS via CryptoWallet Configuration9.3 Critical
- wwbn avideoWWBN AVideo Stored XSS via UserGroups setGroup_name9.2 Critical
- cloud foundry foundation uaa, cloud foundry cf-deployment +1 moreFederated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin9.2 Critical
- unknown advanced-customized-promptsAdvanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover9.8 Critical
- unknown teddy-bear-customize-addonTeddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload10.0 Critical
- unknown teddy-bear-customize-addonTeddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover9.8 Critical
- mulika mipl grouped checkout fields for woocommerce. customize & organize checkout fields.MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload9.8 Critical
- No product listedUse of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837...9.8 Critical
- No product listedAn improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification...9.8 Critical
libdbi-perlDebian,perl-dbiAlpaquita,perl-DBI-debuginfoRed Hat +1 more +3 moreDBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM9.8 Critical- No product listedAn issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit...9.8 Critical
- No product listedSQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to...9.8 Critical
- ibm common licensingMultiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent9.1 Critical
- ibm contextforge, contextforge mcp gateway +1 moreIBM ContextForge MCP Gateway is affected by use of default credentials9.8 Critical
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards9.8 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software9.1 Critical
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards9.8 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software9.6 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software9.6 Critical
- lenovo health applicationA vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the...9.3 Critical
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards9.8 Critical
- forgejoForgejo before 16.0.4 allows remote code execution via a crafted template repository because...9.9 Critical
- diegosouzapw omnirouteOmniRoute ACP Custom-Agent Remote Code Execution (RCE)9.5 Critical
- krakenjs passport-saml-encryptedpassport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending9.1 Critical
- krakenjs passport-saml-encryptedpassport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification9.3 Critical
- pleskA Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in...9.9 Critical
- pleskPath traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated...9.9 Critical
- configserver security & firewall, webpros configserver security & firewall +1 moreOS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a...9.5 Critical
- configserver security & firewall, webpros configserver security & firewall +1 moreImproper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated...9.2 Critical
- rclonerclone: RC per-server auth-proxy bypass9.1 Critical
- rclonerclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass9.8 Critical
- dell thinos, thinos 10 +1 moreDell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure...9.4 Critical
- dell thinos, thinos 10 +1 moreDell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special...9.1 Critical
- dell thinos, thinos 10 +1 moreDell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special...9.8 Critical
- dell thinos, thinos 10 +1 moreDell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special...9.6 Critical
- knowns-dev knownsknowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header9.3 Critical
- Show moreLoading…