CRITICAL Severity CVEs

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted P

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with e

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to bl

Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of

The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in version

The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is

File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privile

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creat

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who ca

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki i

Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki

An issue was discovered in Weblib Ucopia before 6.0.13. OS Command Injection injection can occur, related to chroot.

Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior

The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take ov

STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.0

Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and

D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the URL field in Set

An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execu

D-Link DIR-823G firmware version 1.02B05 has a buffer overflow vulnerability, which originates from the HostName field i

An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai route

Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing the docker container to escape.

Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files

Property Cloud Platform Management Center 1.0 is vulnerable to error-based SQL injection.

itsourcecode Online Hotel Management System Project In PHP v1.0.0 is vulnerable to SQL Injection. SQL injection points e

The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authe

Chemex through 3.7.1 is vulnerable to arbitrary file upload.

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts

D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method.

Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-lf

Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-addres

In cd_CodeMsg of cd_codec.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to r

A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as

Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow

A vulnerability in the change password functionality of Cisco Expressway Series and Cisco TelePresence Video Communicati

In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE.

Directory traversal vulnerability in Snow Monkey Forms v5.1.1 and earlier allows a remote unauthenticated attacker to de

Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported

Directory Traversal vulnerability found in Cryptoprof WCMS v.0.3.2 allows a remote attacker to execute arbitrary code vi

Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.

The wpbrutalai WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL

The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disa

The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Inj

Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vul

A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated atta

A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow

An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net vers

Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary cod

Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagParseAndStoreData integer overflow and resultant buffe

Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagVerifyProvisioning integer overflow and resultant buff