Latest critical vulnerabilities
CVSS 9.0 and up.
- agronholm anyioAnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing9.3 Critical
- mongodb mongoidData deletion and attribute disclosure via field-name method injection in in-memory queries9.2 Critical
- ultravioletrs cocosCocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path9.1 Critical
- internlm lmdeployLMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py9.8 Critical
- ultravioletrs cocosCocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path9.1 Critical
- arnasdon wacrmWACRM: Database-layer authorization bypasses9.9 Critical
- carecam hmt.cm2507 firmwareCareCam CM2507 Cleartext Storage of Sensitive Information9.3 Critical
- carecam hmt.cm2507 firmwareCareCam CM2507 Use of Password Hash With Insufficient Computational Effort9.3 Critical
- kcp-dev kcpkcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace9.9 Critical
- ibm mq for hpe nonstopIBM MQ for HPE NonStop is vulnerable to a denial of service attack9.9 Critical
- ibm mq applianceIBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing10.0 Critical
- ibm common licensingMultiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent10.0 Critical
- interchangeIn the interchange/interchange project, a critical remote code execution (RCE) vulnerability was...9.8 Critical
- xwiki xwiki-renderingorg.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue9.9 Critical
libimager-perlDebian,perl-ImagerMageia +1 moreImager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read9.1 Critical- patriksimek vm2vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species10.0 Critical
- patriksimek vm2vm2 NodeVM before 3.12.1 Remote Code Execution via child_process10.0 Critical
- patriksimek vm2vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function10.0 Critical
- abb freelance controller ac700, freelance controller ac800, freelance controller ac900 +1 more +3 moreMissing Length Check9.2 Critical
- cohesity netbackup flex osPrivilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell9.4 Critical
- cohesity netbackup flex osPrivilege Escalation via Argument Injection in NetBackup Flex OS Shell9.4 Critical
- synology diskstation manager (dsm)An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before...9.8 Critical
- synology diskstation manager (dsm)An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager ...9.8 Critical
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.9.8 Critical
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.9.3 Critical
- unknown af companionAF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE9.1 Critical
- hgiga oaklouds-custom page-2.0, oaklouds-custom page-3.0, oaklouds-custom page-4.0 +2 moreHGiga｜OAKlouds - Insecure Deserialization9.3 Critical
- microsoft fabricMicrosoft Fabric Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure horizondbAzure Database for PostgreSQL Elevation of Privilege Vulnerability9.9 Critical
- microsoft azure billingAzure Billing Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure ai foundryAzure AI Foundry Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure logic appsAzure Logic Apps Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure cosmos dbAzure Cosmos DB Elevation of Privilege Vulnerability9.6 Critical
- microsoft azure logic appsAzure Logic Apps Elevation of Privilege Vulnerability10.0 Critical
- microsoft 365 copilotMicrosoft 365 Copilot Elevation of Privilege Vulnerability9.9 Critical
- microsoft dataverseMicrosoft Dataverse Elevation of Privilege Vulnerability9.0 Critical
- microsoft azure arcAzure Arc Elevation of Privilege Vulnerability9.9 Critical
- microsoft azure arcAzure Arc Elevation of Privilege Vulnerability9.3 Critical
- microsoft azure container registryMicrosoft Container Registry Elevation of Privilege Vulnerability10.0 Critical
- prebid prebid-server-javaPrebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction10.0 Critical
- team-alembic ash authenticationRemember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement9.1 Critical
- labredescefetrj wegiaWeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php9.1 Critical
- labredescefetrj wegiaWeGIA: Unauthenticated Auth Bypass + Local File Inclusion9.1 Critical
libimager-perlDebianImager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct89.1 Critical- google chromeUse after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to...9.6 Critical
- google chromeBuffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote...9.6 Critical
- google chromeUse after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote...9.6 Critical
- mongodb c driverHeap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream9.2 Critical
- webrecorder browsertrixBrowsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors9.4 Critical
- wavelogWavelog: Unauthenticated Remote Code Execution9.3 Critical
- Show moreLoading…