Latest critical vulnerabilities
CVSS 9.0 and up.
- seancorfield honeysqlHoneySQL unchecked entity names can lead to SQL injection results9.8 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier9.4 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks9.2 Critical
- delinea secret server (on-prem)Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force9.9 Critical
- delinea secret server (on-prem)Secret Server device validation error9.4 Critical
- akuity kargoKargo: Privilege escalation via Project RBAC management in the Kargo API9.3 Critical
- madeofpendletonwool pinepodsPinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)9.1 Critical
- thalesgroup sentinel keys serverUnauthenticated Stack Buffer Overflow in Sentinel Keys Server9.3 Critical
- marketing fire widget optionsWordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability9.1 Critical
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability9.8 Critical
- leadsnapWordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability9.8 Critical
- aman funnelkit automationsWordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability9.8 Critical
- intinitum form transliteratorWordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability9.3 Critical
- themerex royal eventWordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability9.8 Critical
- jetbrains clion, datagrip, goland +8 more +10 moreIn JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the...9.0 Critical
- morpheus65535 bazarrBazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery10.0 Critical
- canonical lxdImproper certificate validation in the HTTPS listener in LXD10.0 Critical
- up9inc pybars4, wbond pybars3 +1 morepybars3 through 0.9.7 and pybars4 through 0.9.13 Code Injection via Bracketed Path Segments9.3 Critical
- internlm lmdeployLMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization9.3 Critical
- google cloud application integrationUnsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution9.4 Critical
- socfortress copilotSOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)10.0 Critical
- huajian123 ng-antd-adminng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin9.8 Critical
- socfortress copilotSOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount9.3 Critical
- socfortress copilotSOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection9.4 Critical
- socfortress copilotSOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover9.9 Critical
- givanz vvvebVvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft9.0 Critical
- givanz vvvebVvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover9.8 Critical
- yincongcyincong musebotMuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key9.3 Critical
- aidotnet opendeepwikiOpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery9.3 Critical
- No product listedCallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name9.8 Critical
- No product listedCallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator9.1 Critical
starletDebianStarlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection9.1 Criticallibhttp-parser-xs-perlDebian,perl-HTTP-Parser-XSopenSUSE +1 moreHTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request9.1 Critical- vsftpdvsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking9.1 Critical
- cakephpCakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation9.2 Critical
- cakephpCakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()9.2 Critical
- clickhouse, clickhouse cloud +1 moreUnauthenticated RCE vulnerability against ClickHouse Server9.5 Critical
- dahua intelligent connection centerDahua Intelligent Connection Center command injection9.8 Critical
- apache fineractApache Fineract: SQL injection vulnerability in Search API9.8 Critical
- cap, teltonika networks atrm, dap +11 more +13 moreAPI permission bypass via logic bug9.4 Critical
- gravity forms formsGravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field9.8 Critical
- imagination technologies graphics ddkGPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB9.8 Critical
- google chromeMemory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote...9.6 Critical
- google chromeImproper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote...9.6 Critical
- No product listedAn issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its...9.8 Critical
- veeam management pack for microsoft system centerA vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on...9.3 Critical
libspreadsheet-xlsx-perlDebian,perl-Spreadsheet-XLSXopenSUSE +1 moreSpreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt9.8 Critical- socfortress copilotSOCFortress CoPilot: Stored case-report template injection permits backend code execution9.0 Critical
- docat-org docatDocat has Arbitrary File Upload exists in Upload API9.1 Critical
- servicenow ai platformSandbox Escape via Table Rotation in ServiceNow AI Platform9.4 Critical
- Show moreLoading…