CRITICAL Severity CVEs

GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.

Command Injection in GitHub repository microweber/microweber prior to 1.3.3.

Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.

A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands vi

In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via

The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to th

OS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd.

SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execu

Permissions vulnerability found in KiteCMS allows a remote attacker to execute arbitrary code via the upload file type.

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug func

An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserializ

Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute a

SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via sql paramete

SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the

SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic

Buffer Overflow found in Nginx NJS allows a remote attacker to execute arbitrary code via the njs_object_property parame

An issue found in Espruino Espruino 6ea4c0a allows an attacker to execute arbitrrary code via oldFunc parameter of the j

Buffer Overflow vulnerabilty found in Nginx NJS v.0feca92 allows a remote attacker to execute arbitrary code via the njs

Directory Traversal vulnerability found in B3log Wide allows a an attacker to escalate privileges via symbolic links.

GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3_V1.1 and MH-46360-2.0.3-R5-GP respe

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10

Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Ser

BluePage CMS thru v3.9 processes an insufficiently sanitized HTTP Header allowing MySQL Injection in the 'User-Agent' fi

BluePage CMS thru 3.9 processes an insufficiently sanitized HTTP Header Cookie value allowing MySQL Injection in the 'us

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Akbim Computer Pan

Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Executio

Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build

Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've be

HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote a

D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at

Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.

Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that

openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen

SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faqs

An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An a

An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-

PrestaShop/paypal is an open source module for the PrestaShop web commerce ecosystem which provides paypal payment suppo

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to t

An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrec

An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows r

The web configuration service of the affected device contains an authenticated command injection vulnerability. It can

Akuvox E11 appears to be using a custom version of dropbear SSH server. This server allows an insecure option that by de

Panasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass authentication due to mishandling of X-Fo

A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterpris

Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed us

A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master bran

Server-Side Request Forgery (SSRF) vulnerability in Infoline Project Management System allows Server Side Request Forger

AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campai

Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30.

Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 bu