Latest critical vulnerabilities
CVSS 9.0 and up.
- chamilo chamilo-lmsChamilo LMS CStudio upload flow allows unauthenticated remote code execution9.8 Critical
- chamilo chamilo-lmsChamilo LMS: Student-to-admin stored XSS in private messages via v-html9.0 Critical
- open-reception appointment-booking-softwareOpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover9.8 Critical
- netbox-community devicetype-libraryNetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request9.6 Critical
- happyseafox sailSAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)9.8 Critical
- happyseafox sailSAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)9.8 Critical
- jimprosser obsidian-web-mcpObsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user9.4 Critical
- aws awsiotpythonsdkImproper validation of certificate with host mismatch in AWS IoT Device SDK for Python9.2 Critical
- brufdev many-notesMany Notes: Path Traversal via ZIP import allows arbitrary file write and stored XSS in other users' vaults9.6 Critical
- linuxcsky: Fix a4/a5 restoration in syscall trace path9.8 Critical
- linuxRDMA/rvt: Return NULL after port allocation failure9.8 Critical
- linuxRDMA/hfi1: Preserve unit 0 on allocation failure9.8 Critical
- linuxxfrm: Fix skb double-free in xfrm_dev_direct_output()9.8 Critical
- linuxIB/isert: reject PDUs declaring more data than was received9.1 Critical
- linuxIB/isert: reject login PDUs declaring more data than was received9.1 Critical
- linuxsunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE9.8 Critical
- linuxnvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()9.1 Critical
- linuxASoC: xilinx: formatter_pcm: fix stream_data leak on open error9.8 Critical
- linuxsmb: smbdirect: free completion queues with ib_free_cq()9.8 Critical
- linuxNFSv4: remove callback IDR entry on client allocation failure9.8 Critical
- linuxALSA: mtpav: shut down output timer before card teardown9.8 Critical
- linuxinetpeer: randomize RB-tree node comparison using SipHash9.4 Critical
- linuxNFSv4.1: zero referring call lists before decoding9.8 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode9.3 Critical
- team-alembic ash authenticationdynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover9.1 Critical
- b2evolution cmsb2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key9.2 Critical
- cakephpCakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection9.2 Critical
- vendurehq vendureVendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification9.1 Critical
- team-alembic ash authenticationOAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication9.1 Critical
- patriksimek vm2vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix9.4 Critical
- patriksimek vm2vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming10.0 Critical
- patriksimek vm2vm2 before 3.11.8 Sandbox Escape via NodeVM10.0 Critical
- patriksimek vm2vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise9.2 Critical
- patriksimek vm2vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray9.3 Critical
- patriksimek vm2vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver9.4 Critical
- patriksimek vm2vm2 before 3.11.7 Sandbox Escape via CLI require9.3 Critical
- patriksimek vm2vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test9.4 Critical
- patriksimek vm2vm2 before 3.11.7 Memory Disclosure via Buffer Pool10.0 Critical
- patriksimek vm2vm2 before 3.11.7 Remote Code Execution via require.external10.0 Critical
- patriksimek vm2vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector9.3 Critical
- patriksimek vm2vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation10.0 Critical
- patriksimek vm2vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent10.0 Critical
- patriksimek vm2vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine9.4 Critical
- patriksimek vm2vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite9.4 Critical
- patriksimek vm2vm2 3.11.6 Remote Code Execution via Promise call/apply10.0 Critical
- patriksimek vm2vm2 NodeVM Remote Code Execution via Array-Shaped Require9.5 Critical
- patriksimek vm2vm2 before 3.11.8 Sandbox Escape RCE via AggregateError9.5 Critical
- miniorange headless single sign onWordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability9.8 Critical
- superweby migratico liteWordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability10.0 Critical
- chris gårdenberg, multinet interactive ab eduadmin bookingWordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability9.8 Critical
- Show moreLoading…