CRITICAL Severity CVEs

A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited,

IBM Engineering Systems Design Rhapsody - Model Manager 7.0.2 and 7.0.3 could allow a remote attacker to bypass security

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_e

Stored Cross-Site Scripting in the Manager component of Wowza Streaming Engine below 4.9.1 allows an unauthenticated att

An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attacke

An arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arbi

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free of network namespac

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Add sendpage_ok() check to disable MSG_SP

authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx co

An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can

An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can

A lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3. A specially crafted HTTP re

InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows aut

Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication me

D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function via the flag parameter

H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter.

HkCms <= v2.3.2.240702 is vulnerable to file upload in the getFileName method in /app/common/library/Upload.php.

An issue was discovered in MBed OS 6.16.0. When parsing hci reports, the hci parsing software dynamically determines the

An issue in Kasda LinkSmart Router KW5515 v1.7 and before allows an authenticated remote attacker to execute arbitrary O

Multiple OS Command Injection vulnerabilities affecting Kasda LinkSmart Router KW6512 <= v1.3 enable an authenticated re

In process_service_attr_req and process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to

In process_service_attr_req and process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to

DedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the component /admin/file_manage_v

An arbitrary file upload vulnerability in the component /admin/file_manage_control of DedeBIZ v6.3.0 allows attackers to

Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code

Deserialization of Untrusted Data vulnerability in masikonis Geolocator geolocator allows Object Injection.This issue af

Incorrect Privilege Assignment vulnerability in userplus UserPlus userplus allows Privilege Escalation.This issue affect

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Rajesh Thanoc

Deserialization of Untrusted Data vulnerability in xpresslane Xpresslane Fast Checkout xpresslane-integration-for-woocom

Deserialization of Untrusted Data vulnerability in Mark O'Donnell Team Rosters team-rosters allows Object Injection.This

Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLD

In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could le

D-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the ip parameter in the ip_position_asp funct

Tenda AC6 v2.0 v15.03.06.50 was discovered to contain a buffer overflow in the function 'fromSetSysTime.

File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote att

In the Linux kernel, the following vulnerability has been resolved: nfs: Fix KMSAN warning in decode_getfattr_attrs()

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: TSO: Fix unbalanced DMA map/unmap for

Weaver Ecology v9.* was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?inv

An issue in Weaver E-cology v. attackers construct special requests to insert remote malicious code and to trigger malic

A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to uploa

The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Av

Cross-Site Request Forgery (CSRF) vulnerability in gunghoinc Exclusive Content Password Protect exclusive-content-passwo

Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog DownloadManager hacklog-downloadmanager allows

SourceCodester Sentiment Based Movie Rating System 1.0 is vulnerable to SQL Injection in /msrps/movies.php.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in ksmbd_smb2_sessio

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in smb3_preauth_hash

In the Linux kernel, the following vulnerability has been resolved: net: vertexcom: mse102x: Fix possible double free o

AVSCMS v8.2.0 was discovered to contain weak default credentials for the Administrator account.

An arbitrary file upload vulnerability in the component /main/fileupload.php of AVSCMS v8.2.0 allows attackers to execut

Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file format