CRITICAL Severity CVEs

almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.

alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (

A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code.

Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allo

Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments. An unauthenticat

Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote

Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account secu

Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X

An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in

Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API.

Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password.

iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mai

htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell

Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '

Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be inse

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution mi

The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusi

The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execu

The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inc

Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter.

TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4_ping, ipv6_p

Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail

LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware.

Incorrect access control in the UART/Serial interface on the LB-LINK BL-W1210M v2.0 router allows attackers to access th

Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitra

TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid5g in the function setWizardCfg

Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can e

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a

The Where I Was, Where I Will Be plugin for WordPress is vulnerable to Remote File Inclusion in version <= 1.1.1 via the

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via th

Remote Command program allows an attacker to get Remote Code Execution. This vulnerability can be executed in combinatio

Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing e

Remote Command program allows an attacker to get Remote Code Execution. As for the affected products/models/versions, se

Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in

The Toshiba printers provide several ways to upload files using the admin web interface. An attacker can remotely compro

The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker ca

Toshiba printers use SNMP for configuration. Using the private community, it is possible to remotely execute commands as

File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted fil

NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where a user can inject forged logs and ex

In wl_notify_rx_mgmt_frame of wl_cfg80211.c, there is a possible out of bounds write due to an integer overflow. This co

There is a possible escalation of privilege due to improperly used crypto. This could lead to remote escalation of privi

In circ_read of link_device_memory_legacy.c, there is a possible out of bounds write due to an incorrect bounds check. T

In pktproc_fill_data_addr_without_bm of link_rx_pktproc.c, there is a possible out of bounds write due to a missing boun

TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid in the function setWiFiBasicCf

TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid in the function setWiFiEasyCfg

TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via the password parameter in function

An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device.

HPE Cray Parallel Application Launch Service (PALS) is subject to an authentication bypass.

A SQL Injection vulnerability in itsourcecode Billing System 1.0 allows a local attacker to execute arbitrary code in pr