Critical severity vulnerabilities
23,833 CVEs scored 9.0 to 10.0 on CVSS. Critical vulnerabilities can usually be exploited remotely, without a login, to take over the affected system. Patch these first.
- 9.8 Critical severity
mcp-context-forge: Improper Authentication
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform adm
- 9.1 Critical severity
Apache Fesod (Incubating): Server-Side Request Forgery
Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writi
- 9.6 Critical severity
dragonfly: Double Free
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared o
- 9.0 Critical severity
wazuh-manager: Improper Limitation of a Pathname to a Restricted Directory
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send Distribute
- 9.1 Critical severity
wazuh-manager: Missing Authorization
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename
- 9.1 Critical severity
AIStore framework: Missing Authentication for Critical Functionality
NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.
- 10.0 Critical severity
AIStore framework: Execution with Unnecessary Privileges
NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege e
- 9.6 Critical severity
Firefox: Use of Uninitialized Resource
Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- 9.6 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- 9.6 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
- 9.6 Critical severity
Firefox: Use After Free
Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
- 9.6 Critical severity
Firefox: Use After Free
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
- 9.9 Critical severity
TEW-432BRP: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in stack-based buffer overflow. It is possible to
- 9.6 Critical severity
SIMATIC Drive Controller CPU 1504D TF: Improper Neutralization of Input During Web Page Generation
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnos
- 9.6 Critical severity
SIMATIC Drive Controller CPU 1504D TF: Improper Neutralization of Input During Web Page Generation
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importin
- 9.6 Critical severity
SIMATIC Drive Controller CPU 1504D TF: Improper Neutralization of Directives in Dynamically Evaluated Code
Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Su
- 9.1 Critical severity
Industrial Edge Device Kit - arm64 V1.10: Path Traversal: '.../...//'
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthoriz
- 10.0 Critical severity
JTL-WMS: Missing Authentication for Critical Functionality
The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication
- 10.0 Critical severity
WL-WN592AX6: Improper Neutralization of Special Elements used in a Command
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published a
- 10.0 Critical severity
WL-WN530BE1-A: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in
- 9.9 Critical severity
WL-WN530BE1-A: Improper Neutralization of Special Elements used in a Command
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The e
- 9.6 Critical severity
DCS-930L: Insufficient Verification of Data Authenticity
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improper verification of cr
- 9.3 Critical severity
Helix Authentication Service: Use of Hard-coded Credentials
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain
- 10.0 Critical severity
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Exploited
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server
- 10.0 Critical severity
SAP Cloud: Server-Side Request Forgery
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials
- 9.9 Critical severity
SAP NetWeaver Visual Composer: Exposed Dangerous Method or Function
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration,
- 9.1 Critical severity
SAP Manufacturing Integration and Intelligence…: Missing Authorization
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account wi
- 9.9 Critical severity
SAP S/4HANA (Manage Substitution/Validation…: Improper Control of Generation of Code
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit spec
- 9.8 Critical severity
Metasploit Framework: Missing Authentication for Critical Functionality
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential
- 9.9 Critical severity
i: Improper Control of Generation of Code
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.
- 9.9 Critical severity
DataStage on Cloud Pak for Data: Improper Limitation of a Pathname to a Restricted Directory
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.
- 9.6 Critical severity
DataStage on Cloud Pak for Data: Improper Limitation of a Pathname to a Restricted Directory
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
- 9.8 Critical severity
Planning Analytics: Authentication Bypass Using an Alternate Path or Channel
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
- 9.3 Critical severity
Qexo: Insertion of Sensitive Information into Externally-Accessible File or Directory
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained
- 9.1 Critical severity
Apache Allura: Authentication Bypass by Capture-replay
OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue.
- 9.1 Critical severity
Apache Allura: Improperly Controlled Modification of Dynamically-Determined Object Attributes
REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.
- 9.1 Critical severity
Apache Allura: URL Redirection to Untrusted Site
OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.
- 9.8 Critical severity
rapyd-admin: Use of Hard-coded Credentials
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the s
- 9.9 Critical severity
NR268: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched r
- 9.8 Critical severity
GPT-SoVITS: Improper Neutralization of Special Elements used in an OS Command
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output