CRITICAL Severity CVEs

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the dnsaddr parameter in the formD

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the routername parameter in the fo

A remote code execution vulnerability exists in the Windows agent component of SecureConnector due to improper access co

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to by

Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to by

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure allows an unauthorized attacker

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc f

EDIMAX CV7428NS v1.20 was discovered to contain a remote code execution (RCE) vulnerability via the command parameter in

Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 aff

rebuild v3.9.0 through v3.9.3 has a SQL injection vulnerability in /admin/admin-cli/exec component.

An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Se

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because fun

EngineerCMS v1.02 through v2.0.5 has a SQL injection vulnerability in the /project/addproject interface.

A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCa

Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 aff

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versio

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versio

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versio

A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of af

A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in af

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 2

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious c

The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which al

Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.4 and iPadOS 1

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Al

Tenda AC10 V1.0re_V15.03.06.46 is vulnerable to Buffer Overflow in the formSetPPTPUserList handler via the list POST par

EngineerCMS v1.02 through v.2.0.5 has a SQL injection vulnerability in the /project/addprojtemplet interface.

An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism.

An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to

Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by add

Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by pla

The ISOinsight from Netvision has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arb

The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to

The specific APIs of Parking Management System from ZONG YU has a Missing Authentication vulnerability, allowing unauthe

The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerabilit

The web management interface of Okcat Parking Management Platform from ZONG YU has a Missing Authentication vulnerabilit

SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_payment_update.php via the o

Arbitrary File Upload in user_payment_update.php in SourceCodester Client Database Management System 1.0 allows unauthen

SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_delivery_update.php via the

SourceCodester Client Database Management System 1.0 is vulnerable to Remote code execution via Arbitrary file upload in

SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_order_customer_update.php vi

SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in superadmin_phpmyadmin.php.

Tenda FH451 V1.0.0.9 has a stack overflow vulnerability in the function.P2pListFilter.

Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits o

Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent.

PHPGURUKUL Vehicle Parking Management System v1.13 is vulnerable to SQL injection in the /vpms/users/login.php file. Att

EnerSys AMPA versions 24.04 through 24.16, inclusive, are vulnerable to command injection leading to privileged remote s

EnerSys AMPA 22.09 and prior versions are vulnerable to command injection leading to privileged remote shell access.