CRITICAL Severity CVEs

`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segme

A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specif

A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mo

The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Wind

A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered aff

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered aff

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered aff

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered aff

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered aff

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated at

Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.

In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation.

On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into t

API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model

There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their

"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides log

The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugi

A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to res

An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying

There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. Th

Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communicat

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24405. It allows remote attackers

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24344. It allows remote attackers

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24343. It allows remote attackers

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24341. It allows remote attackers

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339. It allows remote attackers

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24336. It allows remote attackers

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334. It allows remote attackers

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_e

The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing

The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing f

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for Wo

The Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.9.0

NVIDIA Base Command Manager contains a missing authentication vulnerability in the CMDaemon component. A successful expl

An OS Command Injection vulnerability exists within myPRO Manager. A parameter within a command can be exploited by an u

A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauth

The administrative interface listens by default on all interfaces on a TCP port and does not require authentication when

Cohesive Networks VNS3 Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers

Cohesive Networks VNS3 Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers

Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypas

Allegra downloadExportedChart Directory Traversal Authentication Bypass Vulnerability. This vulnerability allows remote

Allegra Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass

An LDAP injection vulnerability in the login page of Gladinet CentreStack v13.12.9934.54690 allows attackers to access s

EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by man

In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter

A link following vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow rem

An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerabil