Latest critical vulnerabilities
CVSS 9.0 and up.
- crowd favorite dxp toolkitWordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability9.3 Critical
- topluyo appTopluyo Desktop for Linux has an OS Command Injection issue9.6 Critical
- hcl software bigfix aexHCL BigFix AEX is affected by multiple security vulnerabilities.9.1 Critical
- eclipse foundation che, the eclipse foundation eclipse che +1 moreUnauthenticated Command Injection via kubeconfig Username in che-machine-exec9.8 Critical
- linuxscsi: libiscsi: Reject a negative task index from parse_pdu_itt9.8 Critical
- linuxscsi: libiscsi: Validate the ITT reflected in a Reject PDU9.8 Critical
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...9.6 Critical
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...9.6 Critical
- tactis novigest desktop appMissing Authentication for Critical Function in Tactis' NoviGest Desktop App9.4 Critical
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...9.8 Critical
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...9.8 Critical
- futurum software user authentication moduleSQL injection (SQLi) in the user authentication module of Futurum Software9.1 Critical
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...9.8 Critical
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...9.8 Critical
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...9.1 Critical
- kleor contact managerContact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass9.8 Critical
- unknown checkout files upload for woocommerceCheckout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- eaglecloud aquilaCode injection in EagleCloud Aquila on-premises version9.4 Critical
- notfound pie register premium, pie register premium +1 morePie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler9.8 Critical
- ggml-org llama.cppllama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()9.2 Critical
- artbees jupiter x coreJupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter9.8 Critical
- fasterxml jackson-databindjackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)9.8 Critical
- google chromeMemory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...9.6 Critical
- google chromeImproper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a...9.6 Critical
- google chromeOut of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker...9.6 Critical
- google chromeImproper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed...9.6 Critical
- google chromeUse after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...9.6 Critical
- google chromeImproper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker...9.6 Critical
- google chromeImproper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote...9.6 Critical
- google chromeMissing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker...9.3 Critical
- google chromeImproper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote...9.6 Critical
- google chromeImproper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote...9.3 Critical
- google chromeMemory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to...9.6 Critical
- google chromeImproper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a...9.6 Critical
- google chromeMemory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker...9.6 Critical
- google chromeMemory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker...9.6 Critical
- jeromedevome grrGRR vulnerable to Remote Code Execution Via PHP Code Injection9.1 Critical
- mlflowMLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules9.8 Critical
- sunhillo surelineSunhillo SureLine Authentication Bypass via Session Cookie9.1 Critical
- mozilla thunderbirdCalendar discovery accepted local file and remote network share locations9.1 Critical
- strapi open source and enterprise headless cmsCVE-2026-1181709.1 Critical
- gnupgCVE-2026-1181319.8 Critical
- adobe campaign classicAdobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)9.9 Critical
- adobe campaign classicAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)9.9 Critical
- adobe campaign classicAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)9.9 Critical
- adobe campaign classicAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)10.0 Critical
- adobe campaign classicAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)9.1 Critical
- adobe campaign classicAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)9.1 Critical
- adobe campaign classicAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)9.9 Critical
- adobe campaign classicAdobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79)9.3 Critical
- Show moreLoading…