Latest critical vulnerabilities
CVSS 9.0 and up.
- apache software foundation qpid proton cApache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.9.1 Critical
- radius synergies xenia m2m platformSQL Injection Vulnerability in Radius Xenia M2M Platform9.3 Critical
- unknown chat ai with dispatcherChat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload9.8 Critical
- unknown automated import products to cartAutomated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal9.9 Critical
- unknown logixfast authLogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset9.8 Critical
- m a vinoth kumar frontend dashboard, metagauss profilegrid +1 moreFrontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection9.0 Critical
- guru team bot for telegram on woocommerceBot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token9.8 Critical
- frangoteamA authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1...9.8 Critical
- apereo foundation openequellaUnrestricted Command Execution via system.execute9.4 Critical
- No product listedThe WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw...9.8 Critical
- No product listedOpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the...9.8 Critical
- No product listedDB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src...9.1 Critical
- No product listedInsecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make...9.1 Critical
- No product listedAn issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a...9.8 Critical
- No product listedAn issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a...9.8 Critical
- No product listedInsecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode...9.1 Critical
- No product listedInsecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers...9.1 Critical
retroarchUbuntuAn issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading...9.8 Critical- No product listedAn issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101...9.8 Critical
- No product listedInsecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62)...9.1 Critical
- No product listedInsecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily...9.1 Critical
- No product listedInsecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to...9.1 Critical
- No product listedInsecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized...9.1 Critical
- No product listedInsecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers...9.1 Critical
- No product listedInsecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized...9.1 Critical
- No product listedInsecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an...9.1 Critical
- No product listedInsecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized...9.1 Critical
- No product listedInsecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized...9.1 Critical
- No product listedInsecure permissions in the CardProvider content provider component of helloworld1 AnyMemo...9.1 Critical
- No product listedInsecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows...9.1 Critical
- No product listedInsecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write...9.1 Critical
- No product listedInsecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized...9.1 Critical
- d-link dir-505D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor9.3 Critical
- wwbn avideo-encoderAVideo-Encoder: unauthenticated command execution through streamer login trust10.0 Critical
- wwbn avideo-encoderAVideo-Encoder: unauthenticated installer PHP code injection10.0 Critical
- signalk signalk-serverSignal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs9.3 Critical
- red hat openshift ai (rhoai)Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization9.1 Critical
- fearlessgeekmedia fearlesscmsFearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS9.4 Critical
- sophos sg utmA path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code...9.2 Critical
libhttp-body-perlDebian,perl-HTTP-BodyopenSUSE +1 moreHTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk9.1 Criticallibhttp-body-perlDebian,perl-HTTP-BodyopenSUSE +1 moreHTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them9.8 Critical- apache software foundation kafkaApache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation9.1 Critical
- apache software foundation kafkaApache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing9.1 Critical
- apache software foundation kafkaApache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers9.1 Critical
- apache software foundation kafkaApache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured9.1 Critical
- juniper networks session smart routerSession Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed9.8 Critical
- juniper networks session smart conductorSession Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.9.8 Critical
- ultimate member memberWordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability9.8 Critical
- wing ftp server ftp serverPath Traversal in Wing WFTP Server leading to Remote Code Execution9.4 Critical
- aman funnelkit automationsWordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability9.3 Critical
- Show moreLoading…