Critical severity vulnerabilities
23,833 CVEs scored 9.0 to 10.0 on CVSS. Critical vulnerabilities can usually be exploited remotely, without a login, to take over the affected system. Patch these first.
- 9.8 Critical severity
Affiliates: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
- 9.8 Critical severity
Frontend Dashboard: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.
- 9.3 Critical severity
JTL-Shop: Improper Neutralization of Input During Web Page Generation
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the adm
- 9.2 Critical severity
Copart’s online billing service: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details a
- 9.8 Critical severity
SimpleForm – Form Maker to Chat Apps with…: Improper Privilege Management
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action
- 9.9 Critical severity
JTL-WMS: Improper Neutralization of Special Elements used in an SQL Command
A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.
- 10.0 Critical severity
File Upload to Order: External Control of File Name or Path
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them
- 9.8 Critical severity
JTL-Connector for WooCommerce: Unrestricted Upload of File with Dangerous Type
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid c
- 9.8 Critical severity
AGE-GATE: Unrestricted Upload of File with Dangerous Type
The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standal
- 9.8 Critical severity
Abandoned Cart Pro for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparati
- 9.8 Critical severity
Abandoned Cart Pro for WooCommerce: Authorization Bypass Through User-Controlled Key
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recover
- 9.8 Critical severity
Collabora Online – Built-in CODE Server OS Command Injection Exploited
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in
- 9.8 Critical severity
Snazzy Social Media Feed: Unrestricted Upload of File with Dangerous Type
The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the st
- 9.8 Critical severity
Printcart Store – Web to Print Product…: Unrestricted Upload of File with Dangerous Type
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is register
- 9.1 Critical severity
Click to Chat – HoliThemes: Improper Control of Generation of Code
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filter
- 9.8 Critical severity
QA-Board: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.
- 9.9 Critical severity
LegacyUpdate: Origin Validation Error
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hos
- 9.6 Critical severity
Chrome: Use After Free
Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- 9.6 Critical severity
Chrome: Use After Free
Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)
- 9.6 Critical severity
Chrome: Incorrect Authorization
Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
- 9.6 Critical severity
Chrome: Heap-based Buffer Overflow
Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- 9.6 Critical severity
Chrome: Use After Free
Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- 9.6 Critical severity
Chrome: Use After Free
Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 9.6 Critical severity
Chrome: Use After Free
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- 9.1 Critical severity
WebSphere Application Server - Liberty: Incorrect Authorization
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
- 9.1 Critical severity
WebSphere Application Server - Liberty: Session Fixation
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
- 9.1 Critical severity
WebSphere Application Server - Liberty: Improper Access Control
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
- 9.3 Critical severity
ColdFusion 2025: Improper Limitation of a Pathname to a Restricted Directory
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories
- 9.6 Critical severity
ColdFusion 2025: Incorrect Authorization
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted
- 9.8 Critical severity
xoscar: Deserialization of Untrusted Data
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidat
- 10.0 Critical severity
ColdFusion 2025: Improper Control of Generation of Code
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Explo
- 10.0 Critical severity
ColdFusion 2025: Server-Side Request Forgery
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
- 9.1 Critical severity
ColdFusion 2025: Improper Control of Generation of Code
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Explo
- 9.6 Critical severity
ColdFusion 2025: Incorrect Authorization
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this
- 9.0 Critical severity
ColdFusion is affected by an Improper Input Validation vulnerability that could result in…
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond
- 9.9 Critical severity
ColdFusion 2025: Incorrect Authorization
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issu
- 9.9 Critical severity
ColdFusion 2025: Improper Control of Generation of Code
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitra
- 10.0 Critical severity
ColdFusion 2025: Unrestricted Upload of File with Dangerous Type
ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of
- 10.0 Critical severity
Adobe Experience Manager as a Cloud Service: Incorrect Authorization
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation
- 9.6 Critical severity
Adobe Experience Manager as a Cloud Service: Improper Restriction of XML External Entity Reference
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal res