Latest critical vulnerabilities
CVSS 9.0 and up.
- kky-ykk transcribe2textstranscribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath9.3 Critical
- ariym whisper-nodeWhisper-node through 1.1.1 OS Command Injection via filePath and language9.3 Critical
- mborne @mborne/extract@mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir9.3 Critical
- zepspaiva doc-recogdoc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path9.3 Critical
- revolunet pypdftkpypdftk through 0.5 OS Command Injection via PDF and Output Paths9.3 Critical
- scionoftech webp-converterwebp-converter before 3.0.0 OS Command Injection via File Names and Options9.3 Critical
- danday74 git-diffgit-diff before 2.0.7 OS Command Injection via gitDiff Input Strings9.3 Critical
- report one myreport updaterReport One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE9.2 Critical
- moghtech komodoKomodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration9.3 Critical
- nullclaw nullhubNullHub through 2026.5.29 Missing Authentication for /api Management API9.2 Critical
- wwwlike vlifevlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil9.3 Critical
- vworld4u office-converteroffice-converter through 1.0.2 OS Command Injection via fileName in generatePdf9.3 Critical
- gravitee api managementGravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass9.2 Critical
- channel software weballiance ecommerceUnauthenticated SQL Injection in Channel Software WebAlliance eCommerce9.8 Critical
- linuxwifi: mac80211: reset the AP_VLAN tailroom counter on ifdown9.8 Critical
- linuxnet: xfrm: reject unrepresentable espintcp transport headers9.8 Critical
- linuxdmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()9.8 Critical
- linuxwifi: rsi: fix heap OOB write on key removal9.8 Critical
- tr7 cyber defense inc. aspMissing Authentication for Critical Function in TR7 Cyber Defense's TR7 ASP9.8 Critical
- tr7 cyber defense inc. aspOS Command in TR7 Cyber Defense's TR7 ASP9.8 Critical
- itthinx affiliatesWordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability9.8 Critical
- m a vinoth kumar frontend dashboardWordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability9.8 Critical
- copart copart’s online billing serviceUnauthorised disclosure of information on Copart’s online billing service9.2 Critical
- curlAuthorization: Negotiate sent to foreign origin9.1 Critical
- curlwolfSSL public-key pinning bypass9.1 Critical
- curlcross-origin reuse of a Negotiate connection9.1 Critical
- curlNegotiate credentials sent to redirected origin9.1 Critical
- curlFTP connection reuse inherits client-certificate9.1 Critical
- wpazleen simpleform – form maker to chat apps with quiz, poll and multi lead notificationsSimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register9.8 Critical
- jtl sw gmbh jtl-wmsSQL Command Injection Vulnerability in JTL-WMS9.4 Critical
- unknown file upload to orderFile Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion10.0 Critical
- curlFTP wildcard write callback mixup9.1 Critical
- curlleaking host credentials to HTTP proxy9.1 Critical
- ntbyk jtl-connector for woocommerceJTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method9.8 Critical
- streetforce1 age-gateAGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php9.8 Critical
- collabora online - built-in code server, online – built-in code server +1 moreCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app,...9.2 Critical
- tyche softwares abandoned cart pro for woocommerceAbandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter9.8 Critical
- tyche softwares abandoned cart pro for woocommerceAbandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value9.8 Critical
- snazzyplugins snazzy social media feedSnazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter9.8 Critical
- samsung open source qa-boardSamsung QA-Board — Unauthenticated OS command injection via output redo/tuning9.8 Critical
- holithemes click to chat – holithemesClick to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder9.1 Critical
- printcart store – web to print product designer for woocommercePrintcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url9.8 Critical
- legacyupdateLegacy Update ActiveX control accepts unauthorized hosting origins9.9 Critical
- google chromeUse after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to...9.6 Critical
- google chromeIncorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local...9.6 Critical
- google chromeUse after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote...9.6 Critical
- google chromeUse after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to...9.6 Critical
- google chromeBuffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote...9.6 Critical
- google chromeUse after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to...9.6 Critical
- google chromeUse after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to...9.6 Critical
- Show moreLoading…