CRITICAL Severity CVEs

ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4,

pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in serve

An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to

Dell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability. A high privileged a

A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarm

An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel

A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permi

A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-s

Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryptio

The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization

N-central < 2025.4 is vulnerable to authentication bypass via path traversal

Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and

In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to c

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to s

Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a networ

Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3  on windows allows local attacker to escalate privela

Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in F

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 145 and Thunderbird

Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in F

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunder

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunder

Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the

The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up

Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified

The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and i

The EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce Plugin plugin for WordPress is vulnerable to Privile

The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation

SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended use

Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when cal

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where

An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross

Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthentica

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to init

New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated

EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a

In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the

In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the sy

Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e

An SQL injection vulnerability has been reported to affect QuMagie. A remote attacker can exploit the vulnerability to e

Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This fl

ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular use

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in th

Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vul

oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This

oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This

D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability wi

Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows

Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows