Latest critical vulnerabilities
CVSS 9.0 and up.
- oray pugongying x5 proOray Pugongying X5 Pro Ser2net crlf injection9.4 Critical
- yoosee gm8135s cameraYoosee GM8135S Camera Secure Boot signature verification9.3 Critical
- No product listedSQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote...9.8 Critical
- No product listedNexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.9.8 Critical
starmanDebian,perl-StarmanopenSUSE +1 moreStarman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections9.1 Critical- grokability snipe-itSnipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback9.2 Critical
- parse-community parse-serverParse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses9.1 Critical
- unknown datawiza proxy auth pluginDatawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers9.8 Critical
- unitree robotics go2, unitreerobotics unitree go2 +1 moreUnitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection9.4 Critical
- oracle corporation graalvm enterprise edition, graalvm for jdk, java se +2 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...9.1 Critical
- gitroomhq postiz-appForged signed tokens let any registered user take over other users and organizations9.9 Critical
- python software foundation cpythonDistrust compromised intermediate certificates in ssl module9.4 Critical
- gitroomhq postiz-appPath traversal in post media lets any registered user read server files9.6 Critical
- o6 automation gmbh open62541open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType9.2 Critical
- david de boer paytiumWordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability9.8 Critical
- tribulant software newslettersWordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability9.8 Critical
- woobewoo product filter by wbwWordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability9.3 Critical
- tribulant software newslettersWordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability9.3 Critical
- unknown asvereinbaseasVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation9.8 Critical
- codexonics prime mover – backup and migrationPrime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace9.8 Critical
- gitroomhq postiz-appArbitrary file read and backend crash through unrestricted provider method calls9.9 Critical
- labstack echoEcho: Rejected WebSocket upgrades can bypass Echo route-level access controls9.1 Critical
- aws multi-model-serverRelative path traversal during model archive extraction in Amazon Web Services Multi Model Server9.3 Critical
- conda infrastructureConda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN9.9 Critical
- intranda goobi-viewer-coreGoobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS9.3 Critical
- intranda goobi-viewer-corePath traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer9.8 Critical
- intranda goobi-viewer-coreUnauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer9.8 Critical
- openwrt odhcpdodhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)9.8 Critical
- aivahthemes hostme v2WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes holistic centerWordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability9.8 Critical
- themerex zensoulWordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes hallelujahWordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability9.8 Critical
- themerex group hotlockWordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability9.8 Critical
- themerex save lifeWordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes little birdiesWordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes rhodosWordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes reprizoWordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability9.8 Critical
- themerex group vagabondsWordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes redyWordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability9.8 Critical
- linuxnet/mlx5e: Prevent stale XSK buffer release on refill retry9.8 Critical
- linuxnet/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry9.8 Critical
- linuxbtrfs: fix xattr replace when multiple xattrs are packed in the same item9.8 Critical
- linuxwifi: ath11k: reset ar->num_stations on hardware start9.8 Critical
- fosowl agenticseekAgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server9.2 Critical
- agentjido req llmWebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers9.1 Critical
- hallo welt! gmbh bluespicebluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop9.3 Critical
- cgm clininetLocal Privilege Escalation in CGM CLININET9.3 Critical
- cgm clininetRemote Code Execution in CGM CLININET9.4 Critical
- cgm clininetRemote Code Execution via Java Deserialization in CGM CLININET9.4 Critical
- cgm clininetRemote Code Execution in CGM CLININET9.0 Critical
- Show moreLoading…