Latest critical vulnerabilities
CVSS 9.0 and up.
- apache software foundation airflow sftp provider, airflow ssh provider +1 moreApache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default9.1 Critical
- energizelab station-middlewareEnergizeLab Station Middleware Admin APIs Missing Role Checks9.6 Critical
- energizelab fastapi ai inference serverEnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching9.8 Critical
- energizelab station-middlewareEnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read9.9 Critical
- energizelab fastapi ai inference serverEnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write9.1 Critical
- beyondtrust remote supportImproper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support9.3 Critical
- openstack horizon, the opennms group meridian +1 moreOpenNMS REST authorization bypass via non-canonical HTTP method9.1 Critical
- authlib joserfcjoserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json9.1 Critical
- containerd runwasirunwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox9.3 Critical
- msgbyte tianjiTianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates9.1 Critical
- nutanix acropolis operating system (aos)Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS9.3 Critical
- aws amazon neptune engineDeserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune9.4 Critical
- wavlink wn530hg4bWavlink WN530HG4B api.cgi heap-based overflow10.0 Critical
- webpros solusvm 2A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote...9.4 Critical
- opnsense coreOPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer9.9 Critical
- wavlink wl-wn530be2-aWavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection10.0 Critical
- espocrmEspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params9.1 Critical
- link whisper inc whisper free, unknown link whisper free +1 moreWordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability9.8 Critical
- shabti frontend admin by dynamiappsWordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability9.8 Critical
- link whisper inc whisper free, unknown link whisper free +1 moreWordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability9.3 Critical
- linuxipv4: validate checksum_start before completing checksum9.3 Critical
- kitae park mang board wpWordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability9.3 Critical
- linux, linux kernel +1 moreipv4: free inet_opt and ireq_opt after an RCU grace period9.8 Critical
- wp email newsletter team - fluentcrm fluent crmWordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability9.8 Critical
- ameliabooking ameliaWordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability9.3 Critical
- No product listedAn unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an u…9.3 Critical
- qnap systems inc. qsirchUnauthenticated remote code execution vulnerability9.3 Critical
- qnap systems inc. hybriddesk stationPre-Authentication Command Injection9.3 Critical
- qnap systems inc. qumagieImport Symlink Following Remote Code Execution Vulnerability in QuMagie9.4 Critical
- qnap systems inc. smedio dtcp movePre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer9.3 Critical
- diaple stelaAuthentication bypass in Stela by Diaple Networking9.3 Critical
- mitsubishi electric corporation analytix, genesis64, hyper historian +3 more +5 moreAn arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works649.4 Critical
- mitsubishi electric corporation analytix, bizviz, genesis +7 more +9 moreAn authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz9.2 Critical
- eclipse vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],...9.2 Critical
- freebsdRemotely triggerable buffer overflow in tcp_rack9.1 Critical
- freebsdMultiple jail filesystem root escapes9.8 Critical
- prism it systems user rights access managerUser Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler9.8 Critical
- 10web booster – website speed optimization, cache & page speed optimizer10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter9.8 Critical
- znunyIn Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain...9.5 Critical
- wheelsWheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed...9.8 Critical
- No product listedAUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in...9.8 Critical
- renovatebot renovate, mend mend-renovate-ce helm chart, mend-renovate-enterprise-edition helm chart +3 more +5 moreRenovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset9.0 Critical
- better-authBetter Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy9.1 Critical
- better-authbetter-auth: OAuth state can be used as a Magic Link to sign in as another user9.1 Critical
- better-authBetter Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link9.3 Critical
- gitpython-developers gitpythonGitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec9.2 Critical
- hitachi vantara remot ops agentToken Signing Key Allows Unauthenticated Administrative Access9.1 Critical
- hitachi vantara remote ops agentPassword Reset Functionality Missing Brute-Force Protection9.1 Critical
- labredescefetrj wegiaWeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php9.8 Critical
- labredescefetrj wegiaWeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter9.8 Critical
- Show moreLoading…