CRITICAL Severity CVEs

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, t

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix XDP multi-buf frag counting for

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free I

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph

In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in p

In the Linux kernel, the following vulnerability has been resolved: kthread: consolidate kthread exit paths to prevent

In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: Fix MAC comparison to be constant-time

In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb_lazy_parent_lease_

In the Linux kernel, the following vulnerability has been resolved: smb: server: fix use-after-free in smb2_open() The

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free by using call_rcu() for o

RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, a

Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incomin

Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber paramete

PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (prais

PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw

In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound i

In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When

ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a r

CROSS implementation contains reference and optimized implementations of the CROSS post-quantum signature algorithm. Pri

math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.p

PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's MCP command handling does not a

Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This

OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthe

Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::

Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this

Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP ob

RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH e

1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Transla

Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior,

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before ver

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a comm

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a comm

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0

A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that a

A vulnerability has been identified in Mendix Runtime (All versions). Mendix documentation for access rules does not ade

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose i

Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unaut

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code ove

Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code ove

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-s

Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958

The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read

Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials ar

NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user