CRITICAL Severity CVEs

The Electronic Official Document Management System from 2100 Technology has an Authentication Bypass vulnerability. Alth

In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public

In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings.

Incorrect Privilege Assignment vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification a

The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthen

Tasklists provides plugin tasklists for GLPI. Versions prior to 2.0.4 have a blind SQL injection vulnerability. Version

Simofa is a tool to help automate static website building and deployment. Prior to version 0.2.7, due to a design mistak

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Contro

Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO DMA API usage causing oops Co

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect link down work from execute after

SQL injection vulnerability in Smart Agent v.1.1.0 allows a remote attacker to execute arbitrary code via the client par

SQL injection vulnerability in Smart Agent v.1.1.0 allows a remote attacker to execute arbitrary code via the id paramet

SmartAgent v1.1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/interface.php.

An issue was discovered in Kurmi Provisioning Suite 7.9.0.33. If an X-Forwarded-For header is received during authentica

Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shoppin

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix aggregation ID mask to prevent oops on

In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_session_new(): fix skb reference

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix LGR and link use-after-free issue We

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix receive ring space parameters when XDP

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix use-after-free of nreq in reqsk_timer_hand

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in SMB request handling

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of signing key Cus

In the Linux kernel, the following vulnerability has been resolved: smb: prevent use-after-free due to open_cached_dir

In the Linux kernel, the following vulnerability has been resolved: smb: During unmount, ensure all cached dir instance

In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: fix kernel crash while shutting down

An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: th

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arne Informatics P

The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized

The WooCommerce Point of Sale plugin for WordPress is vulnerable to privilege escalation in all versions up to, and incl

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the

Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache Hug

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for externa

Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with

Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root pr

The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. Thi

SQL injection vulnerability in CodeAstro Complaint Management System v.1.0 allows a remote attacker to execute arbitrary

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: fro

IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL)

The Store Locator for WordPress with Google Maps – LotsOfLocales plugin for WordPress is vulnerable to Local File Inclus

There is a command injection vulnerability in Huawei terminal printer product. Successful exploitation could result in t

pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crat

An issue in Quectel BG96 BG96MAR02A08M1G allows attackers to bypass authentication via a crafted NAS message. NOTE: this

An issue in Quectel BC95-CNV V100R001C00SPC051 allows attackers to bypass authentication via a crafted NAS message.

A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than versi

A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (

cjwt is a C JSON Web Token (JWT) Implementation. Algorithm confusion occurs when a system improperly verifies the type o