CRITICAL Severity CVEs

SQLi vulnerability in LMS Lite component for Joomla.

Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component

Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.

PlutoSVG commit 336c02997277a1888e6ccbbbe674551a0582e5c4 and before was discovered to contain an integer overflow via th

An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. Because of a double free, attackers can cause a

An issue was discovered in SchedMD Slurm 23.11.x. There is SQL Injection against the SlurmDBD database. The fixed versio

Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature

SQL Injection vulnerability in functions/point_list.php in Common Services soliberte before v4.3.03 allows attackers to

Rockoa <2.3.3 is vulnerable to SQL Injection. The problem exists in the indexAction method in reimpAction.php.

Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command (

An unrestricted file upload vulnerability has been identified in Repbox, which allows an attacker to upload malicious fi

An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted P

An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no ch

main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.

Microsoft Power Platform Connector Spoofing Vulnerability

The flash_tool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded

Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker t

In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN c

In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted p

SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, al

SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an

SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17

SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions a

Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re

OpenEXR-viewer is a viewer for OpenEXR files with detailed metadata probing. Versions prior to 0.6.1 have a memory overf

TOTOLink A7000R V9.1.0u.6115_B20201022has a stack overflow vulnerability via setIpPortFilterRules.

TOTOLink A7000R V9.1.0u.6115_B20201022 has a stack overflow vulnerability via setOpModeCfg.

An oversight in BCB handling of reboot reason that allows for persistent code execution

U-Boot vulnerability resulting in persistent Code Execution 

U-Boot shell vulnerability resulting in Privilege escalation in a production device

Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity Application

IzyBat Orange casiers before 20230803_1 allows getEnsemble.php ensemble SQL injection.

An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbit

Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitra

An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execu

In dhcp4_SetPDNAddress of dhcp4_Main.c, there is a possible out of bounds write due to a missing bounds check. This coul

DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords. This vulnerabil

In Netgear Orbi RBR750 firmware before V7.2.6.21, there is a stack-based buffer overflow in /usr/sbin/httpd.

Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. The 'sid' p

An authentication bypass in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17

Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter

Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-pr

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Tenda W30E V16.01.0.12(4843) contains a stack overflow vulnerability via the function formDeleteMeshNode.

Tenda AX3 V16.03.12.11 was discovered to contain a Command Execution vulnerability via the function /goform/telnet.

Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the function set_device_name.

Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the function /goform/telnet

Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function UploadCfg.

Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formAdvancedSetListSet.

NETSCOUT nGeniusPULSE 3.8 has Weak File Permissions Vulnerability