CRITICAL Severity CVEs

A vulnerability allows attackers to download source code or an executable from a remote location and execute the code wi

The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the devic

Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauth

A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this

Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit thi

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin f

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability

MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code executio

The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can l

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older p

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies

The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in a

An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers

Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. Thi

Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a sessio

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local s

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to fi

Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts i

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6

Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote a

External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated a

agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents. This vul

cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. This vulnerability allo

ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability al

2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows a

robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vuln

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This v

ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.merg

rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability

In gnss service, there is a possible escalation of privilege due to improper certificate validation. This could lead to

In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege

A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbit

Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways. This is rela

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for

parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g.,

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling

Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can injec

tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to man

Sites managed in S@M CMS (Concept Intermedia) might be vulnerable to a blind SQL Injection executed using the search bar

Soft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev. 1.4.0 allows a remote attacker to ex

A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjans

PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data

Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers t

Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnera

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or co

BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote

luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials.

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path t

In the latest version of vanna-ai/vanna, the `vanna.ask` function is vulnerable to remote code execution due to prompt i