CRITICAL Severity CVEs

File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffi

File Upload vulnerability in LJCMS v.4.3.R60321 allows a remote attacker to execute arbitrary code via the ljcms/index.p

File Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute arbitrary code via a cra

Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand param

SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checkti

Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain

Improper permission control vulnerability in the Notepad app.Successful exploitation of the vulnerability may lead to pr

A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of AP

A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of Transpo

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marksoft allows SQ

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0,

Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that w

Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidenc

A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious fil

Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have

An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior. This vulnerability affe

A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in arbitrary code exec

Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team repo

An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potent

FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA

In Siren Investigate before 13.2.2, session keys remain active even after logging out.

A buffer overflow in Nintendo Mario Kart Wii RMCP01, RMCE01, RMCJ01, and RMCK01 can be exploited by a game client to exe

A buffer overflow in Counter-Strike through 8684 allows a game server to execute arbitrary code on a remote client's mac

In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. Th

A bypass in the component sofa-hessian of Solon before v2.3.3 allows attackers to execute arbitrary code via providing c

Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experi

Nanopb before 0.3.1 allows size_t overflows in pb_dec_bytes and pb_dec_string.

A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004,

TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4.

jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interfac

In Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS, insecure SCPI interface discloses web password.

Simple Customer Relationship Management 1.0 is vulnerable to SQL Injection via the email parameter.

A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code executi

Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up wi

In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.

Thinking Software Efence login function has insufficient validation for user input. An unauthenticated remote attacker c

OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote at

L7 Networks InstantScan IS-8000 & InstantQoS IQ-8000’s file uploading function does not restrict upload of file with dan

D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at

PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.

In the PrestaShop < 2.4.3 module "Length, weight or volume sell" (ailinear) there is a SQL injection vulnerability.

Buffer overflow in Wi-Fi Commissioning MicriumOS example in Silicon Labs Gecko SDK v4.2.3 or earlier allows connected de

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Imprope

In btm_ble_periodic_adv_sync_lost of btm_ble_gap.cc, there is a possible remote code execution due to a buffer overflow.

In _PMRCreate of the PowerVR kernel driver, a missing bounds check means it is possible to overwrite heap memory via Phy

In PVRSRVBridgeSyncPrimOpCreate of the PowerVR kernel driver, a missing size check means there is a possible integer ove

cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admi

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection

There is a command injection vulnerability in the adslr VW2100 router with firmware version M1DV1.0. An unauthenticated

PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.