Latest critical vulnerabilities
CVSS 9.0 and up.
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-1010.0 Critical
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Command Injection Vulnerabilities in AOS-810.0 Critical
- hewlett packard enterprise (hpe) arubaos (aos)Authentication Bypass Leading to Remote Code Execution in AOS-1010.0 Critical
- berriai litellmLiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key9.9 Critical
- schorschii oco-serverOCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack9.1 Critical
- tianocore edk2Pre-boot RCE in EDK II PXE driver9.5 Critical
- yootheme.com yootheme pro extension for joomlaJoomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.5210.0 Critical
- cozythemes rootbloxWordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability9.8 Critical
- mem0ai mem0mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store9.2 Critical
- dedecmsDedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php9.3 Critical
- fanruan finereportFineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer9.3 Critical
- brainstorm force surecartWordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability9.8 Critical
- ameliabooking ameliaWordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability9.3 Critical
- newtype infortech nt oneappNewType Infortech｜NT OneAPP - Improper Certificate Validation9.3 Critical
- newtype infortech nt oneappNewType Infortech｜NT OneAPP - Hard-coded Credentials9.1 Critical
- openremoteOpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints9.0 Critical
- totolink a950rgTOTOLINK A950RG product.so UploadCustomModule command injection10.0 Critical
- gitlabInteger Overflow or Wraparound in GitLab10.0 Critical
- No product listedAiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to Buffer Overflow via SSDP local header...9.8 Critical
- No product listedAn issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via...9.6 Critical
- splunk soarFiles or Directories Accessible to External Parties in Splunk SOAR9.9 Critical
- splunk soarImproper Protection of Alternate Path in Splunk SOAR9.8 Critical
- splunk soarProtection Mechanism Failure in Splunk SOAR9.8 Critical
- splunk soarImproper Check or Handling of Exceptional Conditions in Splunk SOAR9.8 Critical
- splunk soarImproper Control of a Resource Through its Lifetime in Splunk SOAR9.8 Critical
- splunk soarImproper Access Control in Splunk SOAR9.8 Critical
- splunk enterpriseSecurity Hardening in Splunk Enterprise - October 20269.9 Critical
- splunk enterpriseSecurity Hardening in Splunk Enterprise - October 20269.8 Critical
- splunk enterpriseSecurity Hardening in Splunk Enterprise - October 20269.9 Critical
- flarum frameworkLaravel TokenGuard authentication bypass through non-string API credentials9.2 Critical
- totolink ex200TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow10.0 Critical
- totolink ex200TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow10.0 Critical
- oracle corporation graalvm enterprise edition, graalvm for jdk, java se +2 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...9.1 Critical
- No product listedNet::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts9.1 Critical
rexDebianRex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no9.1 Critical- python pillowPillow multi-frame loaders can reuse stale native image storage after mode transitions9.8 Critical
- getsentry sentry-javascriptSentry-Javascript: Middleware Bypass when using Tunnel route9.1 Critical
- aws amazon sagemaker python sdkMissing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()9.4 Critical
- apache software foundation traffic serverApache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication9.4 Critical
- tenda be3l proTenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow9.4 Critical
- apache software foundation traffic serverApache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out9.2 Critical
- apache software foundation traffic serverApache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling9.1 Critical
- apache software foundation traffic serverApache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration10.0 Critical
- apache software foundation pulsar managerApache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life10.0 Critical
- apache software foundation pulsarApache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role9.2 Critical
- localaiLocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects9.2 Critical
- drupal ffmpeg image toolkitFfmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-2209.8 Critical
- mikrotik routerosMikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass9.1 Critical
- gstreamerGStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability9.8 Critical
- cisco emergency responder, unified communications manager, unity connection +1 more +3 moreCisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities9.3 Critical
- Show moreLoading…