Latest critical vulnerabilities
CVSS 9.0 and up.
- ziroom zhome a0101Ziroom ZHOME A0101 firstSetup_wifi command injection9.4 Critical
- nginxproxymanager nginx-proxy-managerNginx Proxy Manager through 2.16.0 Missing Brute-Force Protection9.1 Critical
- ziroom zhome a0101Ziroom ZHOME A0101 firstLogin command injection9.4 Critical
- ziroom zhome a0101Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection9.4 Critical
- jpadilla pyjwtPyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard9.1 Critical
- authlibAuthlib library contains a signature‑verification bypass vulnerability9.8 Critical
- ordasoft book library, ordasoft.com book library (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.69.3 Critical
- ordasoft real estate manager, ordasoft.com real estate manager (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.99.3 Critical
- ordasoft vehicle manager, ordasoft.com vehicle manager (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.89.3 Critical
- dannymcc bluehoodBluehood: Missing authentication on Bluehood API routes when web auth is enabled9.1 Critical
- kevva decompress@xhmikosr/decompress: Path traversal via symlink chain9.1 Critical
- watchguard apWatchGuard AP Command Injection in Internal Management API Allows Command Execution9.3 Critical
- watchguard apWatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access9.3 Critical
- d-link di-8400D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow9.4 Critical
- suse rancherUnauthenticated update of public UI settings leading to stored cross-site scripting in Rancher9.6 Critical
- sailpoint technologies identityiqSailPoint IdentityIQ Improper Form Validation Vulnerability9.6 Critical
- netcore nr289-geNetcore NR289-GE boa_temp process_request missing authentication10.0 Critical
- netcore nr289-geNetcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection10.0 Critical
- netcore nr289-geNetcore NR289-GE Location Time location_time.cgi system os command injection10.0 Critical
- netcore nr289-geNetcore NR289-GE Authentication boa password-check stack-based overflow9.3 Critical
- innotim software, telecommunications and consultancy trade ltd. co. logsign siemDefault Admin Credentials in Innotim Software's Logsign SIEM9.8 Critical
- netcore nr289-geNetcore NR289-GE CGI ap_ip.cgi system os command injection10.0 Critical
- canonical lxdArbitrary file write on LXD host via symlink in migration stream9.9 Critical
- canonical lxdPath traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root9.6 Critical
- canonical lxdPath traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD9.9 Critical
- dayforce ess excelityPath Traversal in Dayforce ESS Excelity9.2 Critical
- dayforce ess excelityTime-based SQL Injection in Dayforce ESS Excelity9.3 Critical
- google cloud application integrationDeserialization of Untrusted Data in Application Integration allows Remote Code Execution9.4 Critical
- fast fac1900rFAST FAC1900R devdiscover Service copy_msg_element stack-based overflow10.0 Critical
- google cloud application integrationIncorrect Authorization in Application Integration allows Internal Stubby RPC Execution9.4 Critical
- fast fac1200rFAST FAC1200R MmtAtePrase stack-based overflow9.4 Critical
- fast fac1200rFAST FAC1200R devdiscover Service parse_advertisement_frame stack-based overflow9.4 Critical
- apache software foundation rollerApache Roller: Unauthenticated deserialization in the XML-RPC endpoint9.8 Critical
- apache software foundation rollerApache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers9.9 Critical
- apache software foundation rollerApache Roller: OAuth authorization endpoint trusts request-supplied identity9.0 Critical
- aapanel baotaaaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection9.3 Critical
- aapanel baotaaaPanel BaoTa File Merge files.py merge_split_file command injection9.4 Critical
- aapanel baotaaaPanel BaoTa Database Backup database.py InputSql os command injection9.3 Critical
- netcore nbr200v2Netcore NBR200V2 Tools Ping network_tools system os command injection9.4 Critical
- netcore nbr200v2Netcore NBR200V2 Web Management network_tools eval os command injection10.0 Critical
- netcore nbr100v2Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization10.0 Critical
- totolink n150rtTOTOLINK N150RT Web Management formWlSiteSurvey system os command injection9.4 Critical
- seetong t8108, t8108p, t8116 +1 more +3 moreSeetong T8108/T8108P/T8116/T8232 Debug Service improper authentication10.0 Critical
- obot-platform obotObot Quickstart Docker Deployment Unauthenticated Admin Access9.3 Critical
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 moreHTTP Request Smuggling9.3 Critical
- citrix netscaler, netscaler gateway, citrix netscaler adc +2 more +4 moreMemory overflow vulnerability leading to Remote Code Execution or Denial of Service9.5 Critical
- citrix netscaler, netscaler gateway, citrix netscaler adc +2 more +4 moreA remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands9.5 Critical
- progressive robot ltd hmailserverImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer9.8 Critical
- edgelesssys contrastContrast before 1.16.0 Remote Attestation Relay Attack9.1 Critical
- patriksimek vm2vm2 before 3.12.2 Authorization Bypass via Custom Resolver9.5 Critical
- Show moreLoading…