CRITICAL Severity CVEs

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow

: Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Improper Access Control v

: Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP (develop

: Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP (deve

: Exposure of Sensitive Information to an Unauthorized Actor : Exposure of Private Personal Information to an Unauthoriz

: Improper Authentication vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions)

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-veri

UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-esc

PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document

In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constr

UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s devi

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/val

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically wit

The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coor

IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restor

The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an

A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a

A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or updat

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This

An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an auth

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an a

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated a

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions duri

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During th

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrict

ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (includin

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflo

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks r

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authoriz

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutr

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolle

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobi

Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: befo

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handlin

Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_conte

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the syst

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file sys

An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.

The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. A