Latest critical vulnerabilities
CVSS 9.0 and up.
- cognicellai cognitionCognition < 0.13.0 Unauthenticated RCE via Local Shell Backend9.2 Critical
libcpanel-json-xs-perlDebian,perl-Cpanel-JSON-XSAzure Linux +1 moreCpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag9.1 Critical- ccc-attestation attested-tls-pocCCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack9.1 Critical
- eptura archibusEptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution9.6 Critical
- rank math seo pro, rankmath rank math seo pro +1 moreRank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code9.8 Critical
- mljar mercuryMercury: Unauthenticated Remote Code Execution via /api/kernels9.8 Critical
- mljar mercuryMercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass10.0 Critical
- camunda 7Camunda Expression Injection via orQueries RCE9.3 Critical
- sunkaifei flycmsFlyCms through commit edfdf724 Default Super Administrator Credentials9.3 Critical
- operacle checkcleCheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules9.3 Critical
- bytecodealliance wasmtimeWasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction9.9 Critical
- bytecodealliance wasmtimeWasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation9.9 Critical
- apache software foundation johnzonApache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON9.8 Critical
- apache camelApache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)10.0 Critical
- apache software foundation answerApache Answer: Reaction API authorization bypass for restricted content9.8 Critical
- apache software foundation answerApache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation9.8 Critical
- apache software foundation kylinApache Kylin: unauthenticated broadcast API and polymorphic deserialization9.8 Critical
- hivepressWordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability9.9 Critical
- pt norther lights production mapsvgWordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability9.9 Critical
- google samInsecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)9.3 Critical
- google samMissing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)9.3 Critical
- geovision gv-asmanagerGV-ASManager Web Server Command Injection Vulnerability9.8 Critical
- No product listedSENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL...9.8 Critical
- No product listedSQL injection via identifier injection in the tableName and tableFields POST parameters of admin...9.8 Critical
- wso2 api manager, carbon user manager kernel, enterprise integrator +4 more +6 moreRemote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution9.1 Critical
- linuxtipc: prevent GCM nonce reuse on peer key changes9.1 Critical
- linuxnvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()9.2 Critical
- linuxnet: gue: reject invalid REMCSUM offsets9.2 Critical
- linuxnet: stmmac: clear stale buf->page after recycling on skb build failure9.2 Critical
- linuxtcp: prevent collapsing skbs across boundary in rtx queue9.1 Critical
- linuxsctp: discard the rest of the packet on a stale-cookie error9.8 Critical
- linuxnet: openvswitch: conntrack: fix helper UAF due to extensions realloc9.8 Critical
- linuxRISC-V: KVM: Synchronize hrtimer callback during teardown9.3 Critical
- clidey whodbWhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor9.2 Critical
- vanus-labs vanusVanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway9.3 Critical
- chatbot for wordpress - wpbot conversational forms for chatbotWordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability9.8 Critical
- arraytics bookticsWordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability9.3 Critical
- brainstorm force ottokitWordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability9.8 Critical
- thorsten phpmyfaqphpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection9.3 Critical
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter9.8 Critical
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter9.1 Critical
- mage mage-aiMage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an...9.8 Critical
libtext-csv-xs-perlDebian,perl-Text-CSV_XSAzure Linux +1 moreText::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse9.8 Criticallibtext-csv-xs-perlDebian,perl-Text-CSV_XSAzure Linux +1 moreText::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine9.8 Criticallibtext-csv-xs-perlDebian,perl-Text-CSV_XSAzure Linux +1 moreText::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print9.8 Criticallibtext-csv-xs-perlDebian,perl-Text-CSV_XSAzure Linux +1 moreText::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline9.8 Critical- anthropics claude-agent-sdk-pythonClaude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution9.2 Critical
- apache software foundation kylinApache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)9.8 Critical
- apache software foundation kylinApache Kylin: Unauthenticated Metastore Cleanup9.8 Critical
- netcore nr256cnNetcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()9.3 Critical
- Show moreLoading…