CRITICAL Severity CVEs

System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitr

Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the databas

Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the databas

Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the databas

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows,

Missing Authorization vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager.This issue affects Bar

Missing Authorization vulnerability in Bricksforge.This issue affects Bricksforge: from n/a through 2.0.17.

In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to a

Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enable

An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers

Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\

Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0 is vulnerable SQL Injection via login.php. This vulnerabi

The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify u

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL I

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_ide

robdns commit d76d2e6 was discovered to contain a heap overflow via the component block->filename at /src/zonefile-inser

The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with I

Dynamsoft Service 1.8.1025 through 1.8.2013, 1.7.0330 through 1.7.2531, 1.6.0428 through 1.6.1112, 1.5.0625 through 1.5.

A Server-Side Request Forgery (SSRF) vulnerability exists in the lunary-ai/lunary application, specifically within the e

A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui app

A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_en

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper

A path traversal vulnerability exists in the 'cyber_security/codeguard' native personality of the parisneo/lollms-webui,

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio

A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application

A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically w

A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper

parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient

A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and exe

AutoGPT, a component of significant-gravitas/autogpt, is vulnerable to an improper neutralization of special elements us

parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database`

A Server-Side Request Forgery (SSRF) vulnerability exists in the 'add_webpage' endpoint of the parisneo/lollms-webui app

A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to im

A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment varia

An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/

An issue in the oneflow.permute component of OneFlow-Inc. Oneflow v0.9.1 causes an incorrect calculation when the same d

Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a craf

Untrusted data deserialization vulnerability has been found in Mentor - Employee Portal, affecting version 3.83.35. This

Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injection via editCategories.php.

SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and incl

Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be rea

Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/re

FDSK Leak in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to take control vi

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning f

The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in

Files or Directories Accessible to External Parties vulnerability in smb server in ProjectDiscovery Interactsh allows re

LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.

An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execut