Latest critical vulnerabilities
CVSS 9.0 and up.
- mozilla firefox, thunderbird +1 moreSandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component9.6 Critical
- No product listedMobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, ...9.8 Critical
- No product listedreNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99)...9.8 Critical
- No product listedAn issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking...9.1 Critical
- No product listedProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference...10.0 Critical
- No product listedProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue...9.8 Critical
- ibm iIBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI9.9 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data Path Traversal9.6 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data Information Disclosure9.6 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data Path Traversal9.6 Critical
- thorsten phpmyfaqphpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint9.2 Critical
- qexoQexo initialization endpoint can reset setup state and expose stored credentials9.3 Critical
- ibm maximo ai serviceMaximo AI Service Code Injection9.8 Critical
- th0rgal sandboxed.shsandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace9.3 Critical
- zofe rapyd-adminRapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder9.3 Critical
- rvc-boss gpt-sovitsGPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py9.3 Critical
- karuppiah7890 easy-pdf-mergeeasy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function9.2 Critical
- netherman portal del hermano (portaldelhermano.es)Netherman Portal del Hermano Account Takeover via Password Reset Oracle9.1 Critical
- netcore nr268Netcore NR268 DDNS DDNSset.cgi execvp argument injection9.4 Critical
- apache software foundation alluraApache Allura: Oauth1 Replay Attack9.1 Critical
- apache software foundation alluraApache Allura: REST API Mass Assignment9.1 Critical
- apache software foundation alluraApache Allura: OAuth1 missing callback validation9.1 Critical
- netease cloud music for windowsNetEase Cloud Music TLS Certificate Validation Bypass9.1 Critical
- netease cloud music for windowsNetEase Cloud Music RCE via os.navigateExternal IPC9.2 Critical
- haproxy data plane api ce, data plane api ee +1 moreIn HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases),...9.8 Critical
- ibm db2 mirror for iIBM Db2 Mirror for i Privilege Escalation9.9 Critical
- privasys ra-tls-clientsPrivasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)9.1 Critical
- red hat exploit intelligence, build of quarkus 3.27.6.redhat, build of quarkus 3.33.4.redhat +2 moreIo.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations9.1 Critical
- edimax br-6208acEdimax BR-6208AC formWlanMP command injection10.0 Critical
- the-40-thieves obsidian-tcobsidian-tc tokens can access arbitrary configured vaults9.9 Critical
- edimax br-6208acEdimax BR-6208AC formAutoFWupgrade command injection10.0 Critical
- edimax br-6208acEdimax BR-6208AC formWlanMP buffer overflow9.4 Critical
- turboderp-org exllamav3OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table9.8 Critical
- edimax br-6208acEdimax BR-6208AC formWlSiteSurvey buffer overflow9.4 Critical
- netcore nr268Netcore NR268 CGI Execution user_ok improper authentication10.0 Critical
- zitadelZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie9.2 Critical
- zitadelZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion9.3 Critical
- librenmsLibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header9.2 Critical
- getgrav grav-plugin-login-oauthGrav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass9.3 Critical
- unclecode crawl4aiCrawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder9.2 Critical
- progress software corporation marklogic serverImproper privilege management in Progress MarkLogic Server backup and restore operations9.6 Critical
- progress software corporation marklogic serverImproper privilege management in Progress MarkLogic Server xdmp:eval-in9.9 Critical
- progress software corporation marklogic serverImproper privilege management in Progress MarkLogic Server Management API9.9 Critical
- progress software corporation marklogic serverImproper privilege management in Progress MarkLogic Server forest operations9.9 Critical
- progress software corporation marklogic serverInsufficient isolation of user-supplied code in Progress MarkLogic Server9.6 Critical
- sbabic swupdateSWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates9.2 Critical
- thirty bees beesThirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout9.1 Critical
- square squashSquare Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API9.2 Critical
- neo4j @neo4j/graphql@neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields9.3 Critical
- anydeskAnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap...9.8 Critical
- Show moreLoading…