CRITICAL Severity CVEs

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The vulnerability is found in the 'A

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'ShowDownload()' function uses “

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'showMeterReport()' function,

Stack-based buffer overflow vulnerability in CircutorSGE-PLC1000/SGE-PLC50 v9.0.2. The 'SetLan' function is invoked when

Stack-based buffer overflow in Circutor SGE-PLC1000/SGE-PLC50 v0.9.2. This vulnerability allows an attacker to remotely

Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to acce

Sprecher Automations SPRECON-E-C,  SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker

Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-b

Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file

Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the

MCP Watch is a comprehensive security scanner for Model Context Protocol (MCP) servers. In 0.1.2 and earlier, the MCPSca

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical

PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController.

A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL

mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and ga

A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the abs.php component. The applicati

A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the cancel.php component. The applic

Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This

A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the receiverLogin.php component. The

An issue was discovered in Blood Bank Management System 1.0 allowing authenticated attackers to perform actions with esc

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-

By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecu

The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and includin

AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been ident

willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a comm

PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubN

Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t

Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat

The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This

The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.

The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including,

The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0

XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can

An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/he

An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted p

An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without

NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability

Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to

An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to e

An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application a

An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter dire

Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator bac

OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID p

OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via

Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized

FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via the parameter string fac

FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via the parameter password.

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSign

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution pa