Critical severity vulnerabilities
23,847 CVEs scored 9.0 to 10.0 on CVSS. Critical vulnerabilities can usually be exploited remotely, without a login, to take over the affected system. Patch these first.
- 9.1 Critical severity
ProSolution WP Client: Improper Neutralization of Special Elements used in an SQL Command
The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.
- 9.8 Critical severity
Single Sign On For TNG: Improper Authentication
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
- 9.8 Critical severity
FoodBoxBooker: Improper Privilege Management
The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
- 9.8 Critical severity
M300 Wi-Fi Repeater: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1. Performing a manipulation of the argument e
- 9.1 Critical severity
WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
- 9.8 Critical severity
InfiniteWP Client: Improper Authentication
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their ow
- 9.8 Critical severity
Radix AXE6600: Improper Neutralization of Special Elements used in an OS Command
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malic
- 9.8 Critical severity
Radix AXE6600: Improper Neutralization of Special Elements used in an OS Command
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject mal
- 9.8 Critical severity
Radix AXE6600: Improper Neutralization of Special Elements used in an OS Command
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this v
- 9.8 Critical severity
Radix AXE6600: Improper Neutralization of Special Elements used in an OS Command
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vuln
- 9.8 Critical severity
Radix AXE6600: Improper Neutralization of Special Elements used in an OS Command
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg
- 9.8 Critical severity
Radix AXE6600: Improper Neutralization of Special Elements used in an OS Command
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg func
- 9.8 Critical severity
Radix AXE6600: Improper Neutralization of Special Elements used in an OS Command
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg functio
- 9.8 Critical severity
Radix AXE6600: Improper Neutralization of Special Elements used in an OS Command
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the dmz functio
- 9.8 Critical severity
Radix AXE6600: Improper Neutralization of Special Elements used in an OS Command
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the a
- 9.8 Critical severity
Radix AXE6600: Improper Neutralization of Special Elements used in an OS Command
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the urlfilter function to inject mal
- 9.8 Critical severity
Radix AXE6600: Improper Neutralization of Special Elements used in an OS Command
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arbitrary commands by injecting malicious input through the pin2g, pin5g, or pin6g parameters. Attacke
- 9.8 Critical severity
DWR-M961: Buffer Copy without Checking Size of Input
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and ex
- 9.8 Critical severity
DWR-M961: Buffer Copy without Checking Size of Input
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist[].name field and execute arbit
- 9.8 Critical severity
DWR-M961: Improper Neutralization of Special Elements used in an OS Command
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting
- 9.8 Critical severity
DWR-M961: Improper Neutralization of Special Elements used in an OS Command
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, p
- 9.8 Critical severity
DWR-M961: Improper Neutralization of Special Elements used in an OS Command
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunn
- 9.8 Critical severity
DWR-M961: Improper Neutralization of Special Elements used in an OS Command
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field
- 9.8 Critical severity
DWR-M961: Improper Neutralization of Special Elements used in an OS Command
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn
- 9.8 Critical severity
DWR-M961: Improper Neutralization of Special Elements used in an OS Command
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEI_value f
- 9.8 Critical severity
DWR-M961: Improper Neutralization of Special Elements used in an OS Command
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value
- 9.8 Critical severity
DWR-M961: Improper Neutralization of Special Elements used in an OS Command
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue an
- 9.8 Critical severity
DWR-M961: Improper Neutralization of Special Elements used in an OS Command
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the hos
- 9.8 Critical severity
DWR-M961: Improper Neutralization of Special Elements used in an OS Command
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into th
- 9.8 Critical severity
DWR-M961: Improper Neutralization of Special Elements used in an OS Command
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host
- 9.8 Critical severity
DWR-M961: Improper Neutralization of Special Elements used in an OS Command
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the
- 9.8 Critical severity
DWR-M961: Improper Neutralization of Special Elements used in an OS Command
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the
- 9.8 Critical severity
Linux: Out-of-bounds Read
In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decode_lockers() decode_lockers() in cls_lock_client.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out
- 9.8 Critical severity
AI Copilot – Content Generator: Improper Privilege Management
The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f
- 9.6 Critical severity
openyak: Improper Control of Generation of Code
OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141) without server-side Origin validat
- 9.1 Critical severity
scim-patch: Improperly Controlled Modification of Object Prototype Attributes
`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set pr
- 9.2 Critical severity
kata-containers: Improper Limitation of a Pathname to a Restricted Directory
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In
- 9.6 Critical severity
Kata Containers is an open source project focusing on a standard implementation of lightweight…
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to version 4.0.0, kata-runtime is vulnerable to host code execution via an unvalidated configuration path
- 9.8 Critical severity
LightRAG: Missing Authentication for Critical Functionality
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document cont
- 9.1 Critical severity
meta-ads-mcp: Improper Authentication
Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to do