CRITICAL Severity CVEs

Improper Control of Generation of Code ('Code Injection') vulnerability in Membership Software WishList Member X allows

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Cons

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consultin

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-regist

Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM Software Business Process

The decrypted configuration file contains the password in cleartext which is used to configure WINSelect. It can be use

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe

CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the `ExtensionBuilder().bui

Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the

In the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injec

Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for pa

Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remo

When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate

Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze allows Code Injection.This is

Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained b

The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the ro

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix loop termination condition in gss_free_

The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditi

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin f

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin d

An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption.

In the Linux kernel, the following vulnerability has been resolved: tipc: improve size validations for received domain

The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13

The Lifeline Donation plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.

The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/r

A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parame

In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection.

In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injectio

In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can perform SQL inje

In the module "Channable" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injecti

In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for Prest

In the module "JA Marketplace" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop, a guest can upload fil

Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Add global locking for descriptor

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix potential glock use-after-free on unmount

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix overwriting ct original tuple

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt In r

Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client. If this vulnerability is exploited,

Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to arbitrary file uploads due to missing

The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validatio

The WordPress Picture / Portfolio / Media Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in a

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor wi

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor wi

Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Users can upload images via the "save_settin

Insecure Permissions vulnerability in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to e

An issue in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to execute arbitrary code via

DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not pre

Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to d

A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor.