Latest critical vulnerabilities
CVSS 9.0 and up.
- fortinet fortipam chrome extensionA improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome...9.1 Critical
- nvidia infrastructure controller, infra controller +1 moreNVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause...9.8 Critical
- sgl-project sglangCVE-2026-930889.8 Critical
- karel electronic industry and trade inc. karelipsSQLi in Karel Electronics' KarelIPS9.8 Critical
- d-link dap-1360D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface9.3 Critical
- check point multiple products, checkpoint multi-domain security management, quantum security management +2 moreDirectory Traversal and File upload allows execution of arbitrary script on the Management Server9.8 Critical
- zohocorp manageengine adselfservice plusRemote code execution vulnerability9.8 Critical
- apache software foundation tomcatApache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up9.1 Critical
- apache software foundation tomcatApache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled9.8 Critical
- apache software foundation tomcatApache Tomcat: Bypass of security constraints for WebSocket endpoints9.8 Critical
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch9.2 Critical
- qualcomm software center, qualcomm, inc. snapdragon +1 moreImproper authorization in Qualcomm Software Center9.8 Critical
- kompini tankuam placesDirect references to unsafe objects (IDOR) in Tankuam Places by Kompini9.3 Critical
- erlang otpTLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension9.3 Critical
- arista velocloud orchestrator, arista networks velocloud orchestrator (vco) on-prem +1 moreSecurity Advisory 01839.5 Critical
libnet-idn-encode-perlDebian,perl-Net-IDN-EncodeopenSUSE +1 moreNet::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode9.1 Criticallibnet-idn-encode-perlDebian,perl-Net-IDN-EncodeopenSUSE +1 moreNet::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode9.1 Criticallibnet-idn-encode-perlDebianNet::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode9.8 Critical- liquidweb give tributesGive Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter9.8 Critical
- meta box frontend submissionMeta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter9.8 Critical
- gigatech pdv5701Gigatech PDV5701 WebSocket Service index.html missing authentication10.0 Critical
- No product listedMissing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to...9.1 Critical
- No product listedMCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.9.8 Critical
- No product listedMCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint...9.8 Critical
webpyDebianwebpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session...9.8 Critical- moore threads mtt s80 driver packageMoore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges management9.3 Critical
- laurent22 joplinJoplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint9.1 Critical
- 1panel-dev maxkbMaxKB: Prompt-injectable agent can lead to command execution10.0 Critical
- moore threads mtt s80 driver packageMoore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140001000 heap-based overflow9.3 Critical
- 1panel-dev maxkbMaxKB AWS Bedrock model credential injection leads to remote code execution9.1 Critical
- openstack octaviaIn OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and...9.4 Critical
- openstack octaviaIn OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters...9.4 Critical
- warp-tech warpgateWarpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter9.3 Critical
- colorful igamecenterColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereference9.3 Critical
libemail-sender-perlUbuntu,perl-Email-SenderopenSUSE +1 moreEmail::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe9.8 Critical- ajentiAjenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task9.9 Critical
- fluent fluent-bitFluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler9.2 Critical
- mailu helm-charts, mailu +1 moreMailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust9.8 Critical
- apache software foundation minaApache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-2329.8 Critical
- apache airflowApache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry9.1 Critical
- eclipse foundation open vsxUrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no che…9.1 Critical
- biostar bios update utilityBioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where9.3 Critical
- unknown web to print online designerWooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- biostar temperature monitor utilityBioStar Temperature Monitor Utility IOCTL BS_HWMIO64_W10.sys sub_1105C write-what-where9.3 Critical
- biostar valkyrie auroraBioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-where9.3 Critical
- biostar vivid led djBioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-where9.3 Critical
- netcore nbr200v2Netcore NBR200V2 routerd vlan_load_form_uci buffer overflow9.4 Critical
- netcore nbr200v2Netcore NBR200V2 WAN VLAN Reconfiguration routerd wan_config_set_vlan buffer overflow9.4 Critical
- netcore nbr200v2Netcore NBR200V2 Backup Restore restore.cgi command injection9.4 Critical
- netcore nbr200v2Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection9.4 Critical
- Show moreLoading…