Latest critical vulnerabilities
CVSS 9.0 and up.
- issabel foundation frameworkIssabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate9.3 Critical
- bookstackapp bookstackBookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion9.1 Critical
- doyensec safeurlSSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts9.0 Critical
- doyensec safeurlsafeurl validated address is not bound to the request, allowing DNS rebinding9.0 Critical
- freerdpFreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass9.2 Critical
- flowiseai flowiseFlowise before 3.1.4 Remote Code Execution via cwd Parameter9.0 Critical
- flowiseai flowiseFlowise before 3.1.4 Remote Code Execution via Custom MCP npx9.0 Critical
- dell smartfabric os10 softwareDell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without...9.1 Critical
- dell smartfabric os10 softwareDell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Session Fixation...9.8 Critical
- artifex ghostscriptGhostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter9.3 Critical
- docker sandboxesDocker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback9.4 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Widget: Win32 component9.1 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Networking component9.1 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to incorrect boundary conditions in the Widget: Win32 component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape in the Profile Backup component9.8 Critical
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the Security: Process Sandboxing component9.8 Critical
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the DOM: Editor component9.3 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Enterprise Policies component9.1 Critical
- mozilla firefox, thunderbird +1 moreSpoofing issue due to invalid pointer in the Graphics component9.1 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to race condition in the XPConnect component9.1 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to incorrect boundary conditions in the Widget: Win32 component9.0 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to incorrect boundary conditions in the WebRTC component9.6 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Networking component9.1 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Remote Settings Client component9.1 Critical
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the DOM: Animation component9.8 Critical
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the Networking: HTTP component9.8 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to incorrect boundary conditions in the Graphics component9.6 Critical
- mozilla firefox, thunderbird +1 moreSite isolation issue in the Graphics component9.1 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to invalid pointer in the Graphics component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape in the DOM: Core & HTML component9.6 Critical
- trexom trxtimeattendanceArbitrary command execution in TrxTimeATTENDANCE9.3 Critical
- casdoorCasdoor through 4.4.0 Cross-Organization User Administration via /api/mcp9.4 Critical
- pig-mesh pigpig before 4.1.0 Unverified Password Change via /register/password9.3 Critical
- proxy-addrproxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet9.1 Critical
- d-link di-8300D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow9.4 Critical
- d-link di-8400D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow9.4 Critical
- efm iptime c200eEFM ipTIME C200E System Setup iux_set.cgi os command injection9.4 Critical
- No product listedSmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This...9.8 Critical
- No product listedkaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements...9.9 Critical
- No product listedTOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root...9.8 Critical
- ibm langflow oss, langflow +1 moreIncomplete Security Scanner Blocklist Enables Network-Based Code Execution9.6 Critical
- webpros whmcsDeserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows...9.3 Critical
- apple ipados, macos, tvos +4 more +6 moreAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in...9.8 Critical
- apple macosA validation issue existed in the entitlement verification. This issue was addressed with...10.0 Critical
- apple macosThe issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate...9.1 Critical
- apple ipados, macos, tvos +4 more +6 moreA permissions issue was addressed with improved path validation. This issue is fixed in iOS 27...9.8 Critical
- apple macosA buffer overflow was addressed with improved size validation. This issue is fixed in macOS...9.8 Critical
- apple ipados, macos, tvos +4 more +6 moreA double free issue was addressed with improved memory management. This issue is fixed in iOS 26...9.8 Critical
- apple ipados, macos, visionos +3 more +5 moreA permissions issue was addressed with additional sandbox restrictions. This issue is fixed in...9.1 Critical
- apple ipados, macos, tvos +4 more +6 moreA certificate validation issue was addressed with improved certificate validation. This issue is...9.1 Critical
- Show moreLoading…