CRITICAL Severity CVEs

Le-show medical practice management system from Le-yan has a SQL Injection vulnerability, allowing unauthenticated remot

The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions

Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint.

KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename

KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can byp

KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-

DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.9, authenticated users can complete RCE

ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice when decoding s

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate kr

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in decryption with multichanne

Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This i

LibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments_list references, leading to a use-a

PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github

XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown.

XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Z

SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?p

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.

Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.

XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 1

XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.

A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticket

A SQL injection vulnerability was discovered in edit-ticket.php of PHPGurukul Park Ticketing Management System v2.0. Thi

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and p

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki vulnerable to remote code execution. An arbitra

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete

An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the

Slims (Senayan Library Management Systems) 9 Bulian V9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/c

A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow c

A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user

A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /login

An issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute arbitrary code via the /obbs/cha

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely r

Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the t

IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the at

An unauthenticated remote attacker could exploit the used, insecure TLS 1.0 and TLS 1.1 protocols to intercept and manip

The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settin

NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files.

NETSCOUT nGeniusONE before 6.4.0 P11 b3245 has a Weak Sudo Configuration.

Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tik

Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypa

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from vers

The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme,

Quantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution (RCE) via upload of a file. T

WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator accou

UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create en

UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges