Latest critical vulnerabilities
CVSS 9.0 and up.
- expivi 3d product configurator for woocommerce3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter9.8 Critical
- htplugins extensions for cf7 (contact form 7 database, conditional fields and redirection)Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload9.8 Critical
- inilerm advanced ip blockerAdvanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler9.8 Critical
- creativethemeshq blocksy companionBlocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter9.1 Critical
- jetbrains exposedIn JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of...9.8 Critical
- privasys ra-tls-clientsra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session9.1 Critical
- privasys enclave-os-virtualenclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session9.1 Critical
- ecies goPrivasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session9.1 Critical
- privasys rustlsPrivasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session9.1 Critical
- privasys enclave-os-minienclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session9.1 Critical
- wizarrrr wizarrWizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)9.1 Critical
- iflytek astron-agentAstron Agent: Unsandboxed code-node leads to cross-tenant RCE9.9 Critical
- @tinacms app, tinacms +1 moreTinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment9.3 Critical
- contaoContao: Cross-site scripting in the comments bundle9.3 Critical
- duty1g x64dbg-mcp-serverx64dbg-MCP Server exposes debugger operations to unauthenticated network clients9.3 Critical
- pyloadpyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)9.4 Critical
- smp46 pingvin-share-xPingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking9.2 Critical
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite9.4 Critical
- savannah lwip smtp clientSavannah lwIP SMTP client Classic Buffer Overflow9.3 Critical
- red lion controls 700 seriesRed Lion Controls N-Tron 700 Series Missing Authentication for Critical Function9.3 Critical
- red lion controls 700 seriesRed Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format9.3 Critical
- hotspotbilling phpnuxbillPHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code9.3 Critical
- hotspotbilling phpnuxbillPHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php9.3 Critical
- red lion controls 700 seriesRed Lion Controls N-Tron 700 Series Insufficiently Protected Credentials9.3 Critical
- red lion controls 700 seriesRed Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials9.2 Critical
- grid protection alliance openpdc (docker image)Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials9.3 Critical
- grid protection alliance openhistorian, openpdc, openpdc (docker image) +2 moreGrid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data9.3 Critical
- sipay electronic money and payment services inc. prestashop virtual pos modulePayment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop9.8 Critical
- sipay electronic money and payment services inc. opencart virtual pos modulePayment Validation Bypass in Sipay Electronic Money's OpenCart 3.x9.8 Critical
mykeycrates.ioPre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key9.1 Critical- apache cxfApache CXF: The Netty HTTP client transport does not perform TLS hostname verification.9.1 Critical
- apache cxfApache CXF: Authentication bypass via weak cache keys for validated STS tokens9.1 Critical
- apache cxfApache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter9.1 Critical
- hclsoftware travelerWordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability9.3 Critical
- px-lab zombifyWordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability10.0 Critical
- chris gårdenberg, multinet interactive ab eduadmin bookingWordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability9.3 Critical
- unknown ajax search proWordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability9.3 Critical
- tagdiv opt-in builderWordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability9.3 Critical
- jegtheme jnews - pay writerWordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability9.3 Critical
- vibethemes wplmsWordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability9.3 Critical
- red hat build of podman desktop, certification program for red hat enterprise linux 9, edge manager 1 +8 more +10 moreGvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose9.3 Critical
- linuxxen/netfront: drop RX packets with a short Ethernet header9.8 Critical
- falkordbAuthentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling9.2 Critical
- falkordbPre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message9.3 Critical
- falkordbStack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDB9.2 Critical
- falkordbDouble free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB9.3 Critical
- No product listedRocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected...9.8 Critical
- No product listedAn issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary...9.8 Critical
- No product listedAn issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114...9.8 Critical
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreDouble flow control refund on HTTP/2 server streams in net/http9.1 Critical
- Show moreLoading…