CRITICAL Severity CVEs

A stack-based buffer overflow vulnerability in Tenda AC7 V15.03.06.44 allows a remote attacker to execute arbitrary code

Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the fromSetRouteStatic function via the parameter list.

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server com

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server pas

A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0

Cross-Site Request Forgery (CSRF) vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email al

Cross-Site Request Forgery (CSRF) vulnerability in wpshopee Awesome Logos awesome-logos allows SQL Injection.This issue

The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, a

A vulnerability was found in D-Link DAP-1620 1.03 and classified as critical. This issue affects the function check_dws_

A vulnerability has been found in D-Link DAP-1620 1.03 and classified as critical. This vulnerability affects the functi

A vulnerability, which was classified as critical, was found in D-Link DAP-1620 1.03. This affects the function check_dw

A vulnerability, which was classified as critical, has been found in D-Link DAP-1620 1.03. Affected by this issue is the

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer ove

Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalatio

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions

Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.

A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 an

DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema.

DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection.

A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote un

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior t

An arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows at

Inflectra SpiraTeam 7.2.00 is vulnerable to Server-Side Request Forgery (SSRF) via the NewsReaderService. This allows an

Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials

A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vu

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Contro

In lunary-ai/lunary version v1.4.28, the /bigquery API route lacks proper access control, allowing any logged-in user to

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting

vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core

In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the filetools action

In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header's value during the authenticatio

In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform ma

A path traversal vulnerability exists in the `install` and `uninstall` API endpoints of parisneo/lollms-webui version V1

A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitrary file d

A vulnerability in the `upload_app` function of parisneo/lollms-webui V12 (Strawberry) allows an attacker to delete any

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope vers

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerabilit

A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (

A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configurat

In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 wit

A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untru

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows

An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the

An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest versi

A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows

aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulne

A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` function to extr

A path traversal vulnerability exists in stitionai/devika, specifically in the project creation functionality. In the af

In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does

A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for