Latest critical vulnerabilities
CVSS 9.0 and up.
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software9.9 Critical
- esphome device-builderESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade9.8 Critical
- crawlab-team crawlabCrawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret9.3 Critical
- casdoorCasdoor through 4.4.0 Private Key Exposure via Certificate Endpoints9.3 Critical
- cisco asyncos, secure email, secure email gateway +2 moreCisco Secure Email Gateway SQL Injection Vulnerability9.8 Critical
- cisco secure email, secure email and web manager +1 moreCisco Secure Email Gateway Security Hardening Release9.8 Critical
- cisco secure email and web managerCisco Secure Email Gateway Security Hardening Release9.8 Critical
- cisco secure email, secure email and web manager +1 moreCisco Secure Email Gateway Security Hardening Release9.8 Critical
- cisco secure emailCisco Secure Email Gateway Security Hardening Release9.8 Critical
- parallax filament-commentsparallax filament-comments through 3.0.0 Stored XSS via Comment Body9.3 Critical
- apache software foundation storm clientApache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users9.8 Critical
- apache software foundation storm client, storm nimbus +1 moreApache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs10.0 Critical
- apache software foundation storm workerApache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder9.8 Critical
- apache software foundation storm drpcApache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC9.8 Critical
- apache software foundation storm nimbusApache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys9.1 Critical
- mispMISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials9.3 Critical
- apache software foundation syncopeApache Syncope: Cross-Realm boundaries reconciliation bypass9.8 Critical
- eclipse foundation embedded cdt (c/c++ development tools)In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised...9.1 Critical
- apache software foundation syncopeApache Syncope: Delegating users can grant unowned Roles9.8 Critical
- apache software foundation syncopeApache Syncope: Non-recursive Any search could skip Realms restrictions9.8 Critical
- apache software foundation syncopeApache Syncope: Incomplete authorization checks for Group members deprovisioning9.8 Critical
- apache software foundation syncopeApache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search9.8 Critical
- apache software foundation syncopeApache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values9.8 Critical
- froxlorfroxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL9.4 Critical
- apache software foundation syncopeApache Syncope: ClientApp update entitlement not effective9.8 Critical
- apache software foundation syncopeApache Syncope: Privilege escalation for admin user via JWT authentication9.8 Critical
- hiperdino rest apiInadequate access control in the Hiperdino REST API9.2 Critical
- modeltc lightllmLightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization9.3 Critical
- ping identity pingamImproper Claim Validation in PingAM OIDC Provider9.5 Critical
- apache software foundation syncopeApache Syncope: SQL injection via sort parameter in Task search9.8 Critical
- apache software foundation syncopeApache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence9.8 Critical
- apache software foundation syncopeApache Syncope: JWT subject spoofing9.1 Critical
- apache software foundation syncopeApache Syncope: SRA OAuth2 JWT signature verification bypass9.1 Critical
- brokercap bifrostBifrost unauthenticated remote code execution via MCP stdio client registration9.8 Critical
- d-link dwr-m921D-Link DWR-M921 formDiskCreateShare system os command injection9.4 Critical
- d-link dwr-m921D-Link DWR-M921 formDiskFormat system os command injection9.4 Critical
- d-link dwr-m920D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection9.4 Critical
- d-link dir-878D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow9.4 Critical
- d-link dir-878D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow9.4 Critical
- regularlabs.com conditional content pro extension for joomlaJoomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.09.4 Critical
- d-link dir-823gD-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow9.4 Critical
- totolink a3002muTotolink A3002MU boa formPortFw buffer overflow9.4 Critical
- totolink a3002muTotolink A3002MU boa formNewSchedule buffer overflow9.4 Critical
- totolink a3002muTotolink A3002MU boa formIpv6Setup buffer overflow9.4 Critical
- totolink a3002muTotolink A3002MU boa formFilter buffer overflow9.4 Critical
- unknown cryptopayment gatewayCryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router10.0 Critical
- langbot-app langbotLangBot before 4.10.11 Authentication Bypass via Weak Recovery Key9.2 Critical
- strapiStrapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG9.3 Critical
- internetdownloadmanager internet download managerTonec Internet Download Manager Kernel Driver idmwfp.sys access control9.3 Critical
- kalkitech ase2000 v2 communication test setASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper...9.1 Critical
- Show moreLoading…