CRITICAL Severity CVEs

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super S

Deserialization of Untrusted Data vulnerability in themegusta Smart Sections Theme Builder - WPBakery Page Builder Addon

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Deserialization of Untrusted Data vulnerability in QuantumCloud WPBot Pro Wordpress Chatbot allows Object Injection.This

Gardener External DNS Management is an environment to manage external DNS entries for a kubernetes cluster. A security v

Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Celestial Aura allows Using Malicious Files.Thi

Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Eximius allows Using Malicious Files.This issue

Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerabilit

A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap

An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was

Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against

The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type v

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to mis

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in imithemes Eventer

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPGYM all

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The

Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior t

Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_

Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability.

Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user

The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of S

The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using

The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.

The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a para

An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command an

The TicketBAI Facturas para WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficien

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA netw

The 百度站长SEO合集(支持百度/神马/Bing/头条推送) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type v

In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth"

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentiall

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 128

mediDOK before 2.5.18.43 allows remote attackers to achieve remote code execution on a target system via deserialization

A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary (P

Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application featu

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Versions prior to

Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decompre

Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create

The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6

Adobe Connect versions 12.8 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability that could

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that c

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that c

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Neutralization of Special Elements

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that c

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the macstr parameter in the formMa