Latest critical vulnerabilities
CVSS 9.0 and up.
- d-link dir-895lD-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write9.4 Critical
- themefic ultra addons for contact form 7Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field9.8 Critical
- cyberlord92 miniorange otp login, verification and sms notificationsminiOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter9.8 Critical
- lomart up, lomart.fr up plugin for joomla +1 moreJoomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.299.2 Critical
- lomart up, lomart.fr up plugin for joomla +1 moreJoomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.2910.0 Critical
- lomart up, lomart.fr up plugin for joomla +1 moreJoomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.299.4 Critical
- acymailing, acymailing.com acymailing enterprise extension for joomla +1 moreJoomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.09.5 Critical
- joomlaboat youtube gallery, joomlaboat.com youtube gallery extension for joomla +1 moreJoomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.39.3 Critical
- froxlorFroxlor before 2.3.12 Stored XSS via SSL certificate issuer9.3 Critical
- froxlorFroxlor before 2.3.12 Privilege Escalation via Symlink9.4 Critical
- froxlorFroxlor before 2.3.12 Command Injection via letsencryptchallengepath9.4 Critical
- kyvernokyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath9.4 Critical
- budibase serverBudibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC9.2 Critical
- flowiseai flowiseFlowise through 3.1.4 Authentication Bypass via Email-Only SSO9.2 Critical
- flowiseai flowiseFlowise through 3.1.4 Authentication Bypass via SSO Email Match9.2 Critical
- addify request a quote for woocommerceRequest a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler9.8 Critical
- openclawOpenClaw iOS Control UI TLS Pin Enforcement Bypass9.0 Critical
- google chromeOut of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote...9.6 Critical
- google chromeUse after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a remote attacker...9.6 Critical
- google chromeBuffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote...9.6 Critical
- google chromeBuffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote...9.6 Critical
- google chromeUse after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote...9.6 Critical
- google chromeUse after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote attacker...9.6 Critical
- google chromeOut of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to...9.6 Critical
- google chromeOut of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a...9.6 Critical
- google chromeUse after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to...9.6 Critical
- google chromeBuffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to...9.6 Critical
- google chromeUse after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to...9.6 Critical
- google chromeFree of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote...9.6 Critical
- google chromeUse after free in AdFilter in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to...9.6 Critical
- google chromeUse after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to...9.6 Critical
- google chromeBuffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote...9.6 Critical
- google chromeBuffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote...9.6 Critical
- google chromeBuffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote...9.6 Critical
- google chromeUse after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to...9.6 Critical
- wikimedia foundation mediawiki - externaldata extensionUnauthenticated remote code execution through wikitext in ExternalData10.0 Critical
- tobychui zoraxyZoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv69.1 Critical
- gestsupGestSup before 3.2.62 Remote Code Execution via IMAP Attachment9.2 Critical
- glpi-project glpiGLPI: RCE via Form import9.4 Critical
- zammadZammad: Account takeover via unverified email matching during SSO auto-link9.1 Critical
- yzcheng90 x-springbootX-SpringBoot through 6.0 Authentication Bypass via Static Master Code9.3 Critical
- yzcheng90 x-springbootX-SpringBoot through 6.0 Authentication Bypass via Login Code9.3 Critical
- cordea oauthFriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider9.8 Critical
- piwigoPiwigo: Authenticated RCE via File Upload in Logo Upload Feature9.1 Critical
- piwigoPiwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`9.1 Critical
- invoiceplaneInvoicePlane: Remote Code Execution via Writable Templates Directory9.1 Critical
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite (zcs) +1 moreZimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address9.3 Critical
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite (zcs) +1 moreZimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request9.8 Critical
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite (zcs) +1 moreZimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation9.3 Critical
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite (zcs) +1 moreZimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation9.3 Critical
- Show moreLoading…