Latest critical vulnerabilities
CVSS 9.0 and up.
- No product listeddeeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket...9.8 Critical
- No product listeddeeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live...9.8 Critical
- No product listeddeeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in...9.1 Critical
- No product listedDeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An...9.1 Critical
- No product listedIn Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal...9.1 Critical
- es iperf3iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a...9.2 Critical
- es iperf3iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's...9.2 Critical
- meta platforms, inc horizon osPrior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a...9.1 Critical
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway server-side request forgery9.1 Critical
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway improper authentication9.1 Critical
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Authentication Bypass in the Password Reset Workflow9.8 Critical
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway server-side request forgery9.1 Critical
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway server-side request forgery9.1 Critical
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway server-side request forgery9.1 Critical
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway Improper Access Control9.4 Critical
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)9.3 Critical
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway server-side request forgery9.1 Critical
- piscinajs piscinapiscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env9.2 Critical
- openbsdIn ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication...9.2 Critical
- hook & filter nested pagesWordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability9.8 Critical
- yii2-starter-kityii2-starter-kit through 4.2.0 Debug and Gii Module Exposure9.3 Critical
- denoland denoDeno 2.7.0 through 2.9.7 Command Injection via node:child_process9.2 Critical
- quenary tugtainerTugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint9.1 Critical
- quenary tugtainerTugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset9.8 Critical
- quenary tugtainerTugtainer: OIDC login remains accessible when OIDC_ENABLED is false9.4 Critical
- embysupport securitySoft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token9.0 Critical
- ptzoptics link 4k 12x, link 4k 20x, link 4k 30x +21 more +23 morePTZOptics Missing Authentication in Firmware Upload9.1 Critical
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreUse-after-free of a server-side SSLContext when sni_callback switches contexts9.2 Critical
- internet2 grouperIn Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or...9.3 Critical
- ordasoft joomla cck, ordasoft.com ordasoft joomla cck +1 moreJoomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.1610.0 Critical
- modeltc lightllmLightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service9.3 Critical
- joomcode jc tables, joomcode.com jctables extension for joomla +1 moreJoomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.110.0 Critical
- trex digital smart manufacturing systems inc. mesSQL Injection in Trex Digital Manufacturing's Trex MES9.8 Critical
- litespeed technologies web server, litespeedtech litespeed web server +1 moreLiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a...9.4 Critical
- dolusoft software technologies soplogMultiple Vulnerabilities in Dolusoft Software's SOPLOG9.8 Critical
- cisco catalyst sd-wan managerCisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability9.8 Critical
- cyberlord92 oauth single sign on – sso (oauth client)WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability9.8 Critical
- booking activities team activitiesWordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability9.8 Critical
- hossni mubarak books galleryWordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability9.3 Critical
- estatikWordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability9.8 Critical
- siteskiteWordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability10.0 Critical
- acymailing newsletter team smtp newsletterWordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability9.0 Critical
- yunohost-apps sogo yhnAuthentication Bypass in sogo_yhn9.2 Critical
- yunohost-apps sogo yhnAuthentication Bypass in sogo_yhn9.3 Critical
- apache wss4jApache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection9.1 Critical
- apache wss4jApache WSS4J: SAML Sender-Vouches Authentication Bypass9.8 Critical
- apache wss4jApache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.9.1 Critical
- apache software foundation mina sshdApache MINA SSHD: Asynchronous authentication can bypass signature verification9.1 Critical
- apache software foundation mina sshdApache MINA SSHD: LDAP injection in sshd-ldap9.1 Critical
- apache software foundation mina sshdApache MINA SSHD: LDAP password authentication ineffective9.1 Critical
- Show moreLoading…