Critical severity vulnerabilities
23,833 CVEs scored 9.0 to 10.0 on CVSS. Critical vulnerabilities can usually be exploited remotely, without a login, to take over the affected system. Patch these first.
- 9.8 Critical severity
odhcpd: Stack-based Buffer Overflow
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to ne
- 9.3 Critical severity
CrystalSky ZS600C: Missing Authentication for Critical Functionality
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root.
- 9.8 Critical severity
PraisonAI: Exposure of Sensitive Information to an Unauthorized Actor
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-
- 9.8 Critical severity
Little Birdies: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
- 9.8 Critical severity
Rhodos: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
- 9.8 Critical severity
Reprizo: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
- 9.8 Critical severity
Vagabonds: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
- 9.8 Critical severity
Holistic Center: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
- 9.8 Critical severity
Hallelujah: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
- 9.8 Critical severity
HotLock: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
- 9.8 Critical severity
Hostme v2: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.
- 9.8 Critical severity
ZenSoul: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.
- 9.8 Critical severity
Save Life: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.
- 9.1 Critical severity
req_llm: Improper Certificate Validation
Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not tr
- 9.8 Critical severity
BlueSpice: Improper Privilege Management
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was int
- 9.8 Critical severity
Participants Database: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
- 9.3 Critical severity
Participants Database: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
- 9.3 Critical severity
CGM CLININET: Incorrect Permission Assignment for Critical Resource
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with
- 9.4 Critical severity
CGM CLININET: Improper Control of Generation of Code
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted quer
- 9.4 Critical severity
CGM CLININET: Deserialization of Untrusted Data
CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local net
- 9.0 Critical severity
CGM CLININET: Execution with Unnecessary Privileges
In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data
- 9.8 Critical severity
Learning Management System: Improper Authentication
An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, po
- 9.6 Critical severity
Creative Sound Blaster Katana V2, V2X, SE: Download of Code Without Integrity Check
A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device.
- 9.0 Critical severity
Advanced Custom Fields: Extended: Improper Control of Generation of Code
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenti
- 9.6 Critical severity
Part-DB-server: Unrestricted Upload of File with Dangerous Type
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension
- 9.1 Critical severity
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing…
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service accoun
- 9.3 Critical severity
onPhase Forms: Missing Authentication for Critical Functionality
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary oper
- 9.9 Critical severity
E3 Firmware: Improper Neutralization of Special Elements used in an OS Command
The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform
- 9.9 Critical severity
E3 Firmware: Improper Neutralization of Special Elements used in an OS Command
The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed
- 10.0 Critical severity
Azure Kubernetes Configuration Service: Missing Authentication for Critical Functionality
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
- 9.1 Critical severity
authlib: Improper Authentication
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or emp
- 9.1 Critical severity
authlib: Incomplete List of Disallowed Inputs
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In dep
- 10.0 Critical severity
VM Inspector for Azure Virtual Machines: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
- 9.1 Critical severity
E3 Firmware: Improper Neutralization of Special Elements used in an OS Command
The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to exe
- 9.1 Critical severity
Azure Pipelines: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
- 9.9 Critical severity
Arista VeloCloud Orchestrator SQL Injection Exploited
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability
- 9.3 Critical severity
ArubaOS (AOS): Exposure of Sensitive Information to an Unauthorized Actor
A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be us
- 9.3 Critical severity
ArubaOS (AOS): Improper Authentication
A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, m
- 9.3 Critical severity
ArubaOS (AOS): Improper Authentication
An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or
- 9.3 Critical severity
ArubaOS (AOS): Improper Authentication
Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system c