Critical severity vulnerabilities
23,833 CVEs scored 9.0 to 10.0 on CVSS. Critical vulnerabilities can usually be exploited remotely, without a login, to take over the affected system. Patch these first.
- 9.9 Critical severity
Adobe Connect: Improper Restriction of XML External Entity Reference
Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute
- 10.0 Critical severity
Adobe Connect: Server-Side Request Forgery
Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
- 9.1 Critical severity
Adobe Connect: Incorrect Authorization
Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not
- 9.9 Critical severity
Adobe Connect: Improper Limitation of a Pathname to a Restricted Directory
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories o
- 10.0 Critical severity
Adobe Connect: Improper Neutralization of CRLF Sequences
Adobe Connect is affected by an Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's accoun
- 10.0 Critical severity
Adobe Connect: Incorrect Authorization
Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access to sensitive resources. Exploitation of this issue does not require user i
- 10.0 Critical severity
Adobe Connect: Improper Limitation of a Pathname to a Restricted Directory
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories o
- 9.6 Critical severity
Adobe Connect: Improper Limitation of a Pathname to a Restricted Directory
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerab
- 9.9 Critical severity
Adobe Experience Manager 6.5: Incorrect Authorization
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitatio
- 9.9 Critical severity
Adobe Experience Manager as a Cloud Service: Incorrect Authorization
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitatio
- 9.9 Critical severity
Adobe Experience Manager as a Cloud Service: Improper Control of Generation of Code
Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to e
- 9.9 Critical severity
Adobe Experience Manager as a Cloud Service: Improper Control of Generation of Code
Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to e
- 9.8 Critical severity
openobserve: Improper Authentication
OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/src/auth/validator.rs accepts an empty or whitespace-only HTTP Basic password for an account whose password_ext value is missing or empt
- 10.0 Critical severity
MongoDB Server: Use After Free
A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpect
- 9.8 Critical severity
Android: Use After Free
In SendInfo of UssiController.cpp, there is a possible way to corrupt memory via a dangling connection listener pointer due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction
- 9.8 Critical severity
Android: Out-of-bounds Write
In GetTwiddledMiptreeSparsePageMap of texmgmt.c, there is a possible way to trigger an out of bounds write due to a logic error. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploit
- 9.8 Critical severity
Android: Use After Free
In IMG_vkCreateImageView of image_view.c, there is a possible way to trigger a use after free due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- 9.8 Critical severity
Android: Improper Restriction of Operations within the Bounds of a Memory Buffer
In multiple functions of rmmi_utility.c, there is a possible way to trigger an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploi
- 9.8 Critical severity
Android: Improper Restriction of Operations within the Bounds of a Memory Buffer
In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 9.8 Critical severity
Android: Use After Free
In NotifySipResponse of SessionEx.cpp, there is a possible way to corrupt memory via a dangling connection pointer in the pending response queue due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges
- 9.8 Critical severity
Android: Heap-based Buffer Overflow
In chppProcessDiscoverAllResponse of system/chre/chpp/clients/discovery.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interac
- 9.8 Critical severity
Android: Improper Restriction of Operations within the Bounds of a Memory Buffer
In handleEvent of gscan.cpp, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed f
- 9.8 Critical severity
Android: Integer Overflow or Wraparound
In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- 9.8 Critical severity
Android: Improper Restriction of Operations within the Bounds of a Memory Buffer
In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for
- 9.8 Critical severity
Android: Protection Mechanism Failure
In EncodeLastScanBufferElement of data_manager.cc, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for ex
- 9.8 Critical severity
Android: Double Free
In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- 9.8 Critical severity
Android: Improper Restriction of Operations within the Bounds of a Memory Buffer
In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- 9.8 Critical severity
Android: Use After Free
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- 9.6 Critical severity
FortiClientMac: Origin Validation Error
A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote
- 9.6 Critical severity
EOS: Expected Behavior Violation
On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated atta
- 9.8 Critical severity
EOS: Stack-based Buffer Overflow
On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash. Successful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and p
- 9.0 Critical severity
Microsoft SharePoint Server Subscription Edition: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- 9.1 Critical severity
harnessrouter: Missing Authorization
HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Au
- 9.0 Critical severity
Microsoft SharePoint Server Subscription Edition: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- 9.4 Critical severity
Intel(R) TDX Migration Trust Domain (MigTD): Missing Critical Step in Authentication
Missing critical step in authentication in the MigTD SPDM rebind implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. Network adversary with an unauthentic
- 9.2 Critical severity
Intel(R) TDX Migration Trust Domain (MigTD): Authentication Bypass by Capture-replay
Authentication bypass by capture-replay in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may
- 9.3 Critical severity
Intel(R) TDX Migration Trust Domain (MigTD): Authentication Bypass by Spoofing
Authentication bypass by spoofing in the MigTD rebinding protocol for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexit
- 9.6 Critical severity
Chrome: Incorrect Authorization
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 9.4 Critical severity
groupoffice: Improper Control of Generation of Code
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string (tpl parameter) that is pas
- 9.8 Critical severity
rabbitmq-c: Out-of-bounds Write
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_by