Latest critical vulnerabilities
CVSS 9.0 and up.
- wikimedia foundation mediawiki - templatesandbox extensionTemplateSandbox does not check read permissions for the page being previewed9.1 Critical
- fumasoft fumeng cloudFumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname9.3 Critical
- webminWebmin: Reflected XSS in the Configuration module9.6 Critical
- evbee dc 80Weak root password in EVbee DC 809.3 Critical
- mozilla firefox, thunderbird +1 moreOther issue in the DevTools component9.8 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the Preferences: Backend component9.6 Critical
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the Graphics: WebGPU component9.1 Critical
- psyb0t docker-mailboxImproper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox9.4 Critical
- shenzhen dbit network equipment t-cpe301k 4g mini wifi routerMultiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment9.3 Critical
- mypresta google merchant center feedUnauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module9.3 Critical
- denx software engineering das u-bootOut-of-bounds write in Das U-Boot9.0 Critical
- hitachi energy rtu500 series cmu firmwareA directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500...9.1 Critical
- hitachi energy rtu500 series cmu firmwareAn authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500...9.1 Critical
- flowring technology corp agentflow 4.0Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type9.3 Critical
- apache karafApache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create9.8 Critical
- apache karafApache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation9.8 Critical
- flowring technology corp agentflow 4.0Flowring Agentflow 4.0 - SQL Injection9.3 Critical
- flowring technology corp agentflow 4.0Flowring Agentflow 4.0 - SQL Injection9.3 Critical
- dassault systèmes geovia geospatial data managerCode Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x9.9 Critical
- shell-quoteshell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token9.2 Critical
- netcore nap930Netcore NAP930 Network Tools CGI network_tools eval os command injection10.0 Critical
- fast fac1203rFAST FAC1203R MmtAtePrase _tWlanTask stack-based overflow9.4 Critical
- No product listedA stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK...9.8 Critical
- No product listedmetatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal...9.8 Critical
- No product listedmetatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP...9.1 Critical
- No product listedbytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql...9.1 Critical
- No product listedOpen GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other...9.8 Critical
- No product listedAn issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0...9.8 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Security component9.6 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Bookmarks & History component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to incorrect boundary conditions in the XPCOM component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the Widget: Gtk component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the DOM: Core & HTML component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the Disability Access APIs component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to incorrect boundary conditions in the Internationalization component9.6 Critical
- mozilla firefox, thunderbird +1 moreInvalid pointer in the JavaScript: WebAssembly component9.8 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape in the XUL component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the Graphics component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to incorrect boundary conditions in the Graphics: WebRender component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the DOM: Core & HTML component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape in the Graphics component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the DOM: Content Processes component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the DOM: Content Processes component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape in the Security: Process Sandboxing component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape in the DOM: Navigation component9.6 Critical
- No product listedAn issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote...9.8 Critical
- gz-yami mall4jmall4j through 4.0 Missing Authentication in Password Update Endpoint9.3 Critical
- ziroom zhome a0101Ziroom ZHOME A0101 set_passwd command injection9.4 Critical
- ziroom zhome a0101Ziroom ZHOME A0101 set_online_client command injection9.4 Critical
- ziroom zhome a0101Ziroom ZHOME A0101 set_online_client command injection9.4 Critical
- Show moreLoading…