Latest critical vulnerabilities
CVSS 9.0 and up.
- arubanetworks analytics and location engine, hewlett packard enterprise (hpe) ale +1 moreUnauthenticated Remote Unauthorized Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)9.8 Critical
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted Remote Code Execution Vulnerability9.8 Critical
- home-assistant coreHome Assistant: XSS in Statistics Graph Card9.3 Critical
- plone plone.app.portletsplone.app.portlets Vulnerable to Remote Code Execution via TALES Injection9.9 Critical
- adobe aem 6.5 forms jee, aem 6.5 lts forms jee +1 moreAdobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918)9.6 Critical
- adobe aem 6.5 forms jee, aem 6.5 lts forms jee +1 moreAdobe Experience Manager Forms JEE | Incorrect Authorization (CWE-863)10.0 Critical
- adobe aem 6.5 forms jee, aem 6.5 lts forms jee +1 moreAdobe Experience Manager Forms JEE | Improper Input Validation (CWE-20)9.1 Critical
- adobe connect, connect android mobile app, connect for mobile +2 moreAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)9.3 Critical
- adobe connect, connect android mobile app, connect for mobile +2 moreAdobe Connect | Improper Input Validation (CWE-20)9.3 Critical
- adobe connect, connect android mobile app, connect for mobile +2 moreAdobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)9.9 Critical
- adobe connect, connect android mobile app, connect for mobile +2 moreAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)9.3 Critical
- adobe connect, connect android mobile app, connect for mobile +2 moreAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)9.3 Critical
- adobe connect, connect android mobile app, connect for mobile +2 moreAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)9.3 Critical
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials9.1 Critical
- softaculous virtualizorSoftaculous Virtualizor PHP Object Injection via Billing Module Handler9.2 Critical
- softaculous virtualizorSoftaculous Virtualizor OS Command Injection via Billing Module Handler9.3 Critical
- rti connext professionalUse of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection.9.2 Critical
- rti connext professionalStack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.10.0 Critical
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 more[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)9.9 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)9.9 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)9.9 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)9.1 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)9.6 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)9.1 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Input Validation (CWE-20)9.9 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)9.1 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)9.9 Critical
- hkuds lightragLightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks9.1 Critical
- dokployDokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one9.6 Critical
- gitroomhq postiz-appUnauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys9.1 Critical
- david-crty databasementDatabasement before 1.7.14 Authorization Bypass via Stale Invitation Token9.1 Critical
- lantronix emg7500, emg8500, slb882 +4 more +6 moreLantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass9.4 Critical
- lantronix emg7500, emg8500, slb882 +4 more +6 moreLantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation10.0 Critical
- lantronix emg7500, emg8500, slb882 +4 more +6 moreLantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule9.4 Critical
- lantronix emg7500, emg8500, slb882 +4 more +6 moreLantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download9.4 Critical
- lantronix emg7500, emg8500, slb882 +4 more +6 moreLantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write9.4 Critical
- lantronix emg7500, emg8500, slb882 +4 more +6 moreLantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read9.4 Critical
- vectordotdev vectorVector: Arbitrary file write in the file sink via templated path (path traversal).9.3 Critical
- lantronix emg7500, emg8500, slb882 +4 more +6 moreLantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password9.4 Critical
- lantronix emg7500, emg8500, slb882 +4 more +6 moreLantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write9.4 Critical
- lantronix emg7500, emg8500, slb882 +4 more +6 moreLantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read9.4 Critical
- f5 big-ip, big-ip apm, big-ip access policy manager +2 moreBIG-IP APM OAuth vulnerability9.3 Critical
- Show moreLoading…