Latest critical vulnerabilities
CVSS 9.0 and up.
- devolutions server, mariadb +1 moreMariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.9.9 Critical
- asynchttpclient async-http-clientAsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host9.4 Critical
- splunk, splunk enterprise +1 moreImproper Adherence to Coding Standards in Splunk Enterprise9.8 Critical
- splunk, splunk enterprise +1 moreImproper Neutralization in Splunk Enterprise9.8 Critical
- splunk, splunk enterprise +1 moreMissing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise9.8 Critical
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability9.8 Critical
- passionate programmer peter wp data accessWordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability9.3 Critical
- cisco campus gateway software, meraki mr wireless access points software, meraki mv firmware +1 more +3 moreCisco Meraki Hardening Release October 2026 - Buffer Management Vulnerabilities9.6 Critical
- cisco nx-os softwareCisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution Vulnerability9.8 Critical
- cisco application policy infrastructure controller (apic)Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime Vulnerabilities9.8 Critical
- cisco application policy infrastructure controller (apic)Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization Vulnerabilities9.8 Critical
- cisco application policy infrastructure controller (apic)Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control Vulnerabilities9.8 Critical
- cisco nx-os softwareCisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability9.8 Critical
- cisco nx-os softwareCisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability9.8 Critical
- cisco license on-premCisco License On-Prem Security Hardening Release9.1 Critical
- cisco license on-premCisco License On-Prem Security Hardening Release10.0 Critical
- cisco license on-premCisco License On-Prem Security Hardening Release9.8 Critical
- cisco nx-os software, nx-os system software in aci mode, unified computing system (managed) +2 moreCisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities9.8 Critical
- cisco nx-os software, unified computing system (managed) +1 moreCisco NX-OS Software NX-API Remote Code Execution Vulnerability9.8 Critical
- cisco nx-os software, nx-os system software in aci mode, unified computing system (managed) +2 moreCisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities9.8 Critical
- drupal block ajaxBlock AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-1929.8 Critical
- cisco nx-os softwareCisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability9.8 Critical
- cisco license on-premCisco Smart Software Manager On-Prem Unauthenticated API Vulnerability9.1 Critical
- cisco license on-premCisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability9.1 Critical
- sipcapture homerHomer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login9.8 Critical
- sipcapture homerHomer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)9.8 Critical
- apache jackrabbitApache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens9.3 Critical
- lmcacheLMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint9.3 Critical
- jonssonyan h-uiCVE-2026-1072029.1 Critical
- sungrow isolarcloudSungrow iSolarCloud before 2026 allows authentication bypass and account takeover via "login_type...9.2 Critical
- ggml-org llama.cppllama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser9.2 Critical
- sonicwall sma1000A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due...10.0 Critical
- six apart ltd. movable type, movable type cloud edition, movable type premium +1 more +3 moreA code injection vulnerability exists in the upgrade script of Movable Type, which may allow an...9.3 Critical
- lmcacheLMCache Unauthenticated RCE in multiprocess mode via pickle deserialization9.8 Critical
- eclipse foundation threadx - netx duoOut-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of…9.3 Critical
- veeam backup and replicationThis vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code...9.4 Critical
- apache software foundation impalaApache Impala: Impala Executor Webserver Auth Bypass9.1 Critical
- manacle technologies multi-tenant erp systemUnsafe Deserialization Vulnerability in Manacle Technologies ERP System9.3 Critical
- manacle technologies multi-tenant erp systemSQL Injection Vulnerability in Manacle Technologies ERP System9.3 Critical
- manacle technologies multi-tenant erp systemAccount Takeover Vulnerability in Manacle Technologies ERP System9.3 Critical
- ordasoft.com ordasoft simple membership extension for joomlaJoomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.09.3 Critical
- vmware fusion, workstation +1 moreVMware Workstation and Fusion VMXNET3 integer-overflow vulnerability9.3 Critical
- flexera flexnet publisherFlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability9.3 Critical
- wolfsshwolfSSH ECDSA host key curve not validated against negotiated algorithm9.0 Critical
- asus routerImproper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS...9.3 Critical
- asus routerA stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to...9.3 Critical
- asustor inc. admAn HTTP header injection vulnerability was found in the ADM9.2 Critical
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities9.8 Critical
- No product listedThe management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not...9.8 Critical
- No product listedThe websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper...9.8 Critical
- Show moreLoading…