CRITICAL Severity CVEs

TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can chan

This vulnerability exists in Shilpi Client Dashboard due to missing restrictions for incorrect login attempts on its API

The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to

Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attac

The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, al

DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_d

Improper Check for Unusual or Exceptional Conditions vulnerability in Webroot SecureAnywhere - Web Shield on Windows, AR

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Webroot SecureAnywhere - Web Shield on Wi

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Webroot SecureAnywhere - Web Shield on Wi

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9,

Insecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows a remote attacker to g

The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. A remote and

An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the syst

A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticate

Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and

According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the applica

An unauthenticated remote attacker may use a missing authentication for critical function vulnerability to reboot or era

FileSender before 2.49 allows server-side template injection (SSTI) for retrieving credentials.

A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the get_station_info()function loca

Logicytics is designed to harvest and collect data for forensic analysis. Logicytics has a basic vuln affecting compromi

Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence

Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these b

A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability aff

The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacke

A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism

The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all version

The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to privilege escalation in all versions up to, and i

The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type valid

The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsof

An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In t

Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Incorrect Access Control. There is a lack of authori

Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, a

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add

Alisonic Sibylla devices are vulnerable to SQL injection attacks, which could allow complete access to the database.

OPW Fuel Management Systems SiteSentinel could allow an attacker to bypass authentication to the server and obtain full

OMNTEC Proteus Tank Monitoring OEL8000III Series could allow an attacker to perform administrative actions without pro

A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary

authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 al

In the Linux kernel, the following vulnerability has been resolved: fou: fix initialization of grc The grc must be ini

Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking. This issue affects Va

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oceanic Software V

Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usbP

Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.

Incorrect Authorization vulnerability in National Keep Cyber Security Services CyberMath allows Accessing Functionality

NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with de

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation

Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows

An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (ak