A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be abl
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1
In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate s
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has be
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identifi
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavp
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identifi
GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the funct
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability ha
GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in t
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discover
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the functi
GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerabili
GStreamer is a library for constructing graphs of media-handling components. An out-of-bounds write vulnerability was id
GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected i
GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memo
Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback
From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is pos
GFI Archiver Telerik Web UI Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal an
CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidential
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that c
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that c
Phpgurukul's Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in `login.php` via the `emailcont` par
TL-WR845N(UN)_V4_201214, TP-Link TL-WR845N(UN)_V4_200909, and TL-WR845N(UN)_V4_190219 was discovered to transmit user cr
An issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attac
SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with ad
Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker wit
An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to
Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allo
Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin pr
The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one works
MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials.
SNMP objects in NET-SNMP used in ORing IAP-420 allows Command Injection. This issue affects IAP-420: through 2.01e.
An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has an
An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has int
COMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows at
Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Co
Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly p
Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.
CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.
Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: f
Frequently Asked Questions
What does CRITICAL severity mean for CVEs?
CVSS 9.0–10.0 — vulnerabilities that allow remote code execution, full system compromise, or trivial exploitation with no authentication required
How many critical severity CVEs exist?
There are 35,149 CVE records rated CRITICAL in our database. Of these, 312 are listed in CISA's Known Exploited Vulnerabilities catalog.
How should I prioritize critical severity vulnerabilities?
CRITICAL severity vulnerabilities should be patched immediately, especially if they are in the CISA KEV catalog or have a high EPSS score. Use CyberStrike to automatically detect and prioritize these vulnerabilities across your infrastructure.
Detect CRITICAL Vulnerabilities
CyberStrike scans your infrastructure and detects critical severity vulnerabilities in real time.
Get Started