CRITICAL Severity CVEs

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerabi

The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Rem

Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions.

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From vers

DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitel

In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe comman

In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute al

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before version 2.1

Roo Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelis

Syntx's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist s

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() f

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configurat

Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulner

CrewAI does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that

CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud ser

The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through ar

A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_

A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artif

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerabl

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and proces

OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/de

OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable gr

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly n

OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with

GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization. GRID::Machine

HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults

Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions. In versions 6.

Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary cod

EChat Server 3.1 contains a buffer overflow vulnerability in the chat.ghp endpoint that allows remote attackers to execu

Bochs 2.6-5 contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supp

MAWK 1.3.3-17 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary

JAD Java Decompiler 1.5.8e-1kali1 and prior contains a stack-based buffer overflow vulnerability that allows attackers t

TiEmu 2.08 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary cod

JAD 1.5.8e-1kali1 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitr

Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, t

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the We

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handleb

Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and evaluation

Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 ar

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assis

Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (f

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking applic