Critical severity vulnerabilities
23,833 CVEs scored 9.0 to 10.0 on CVSS. Critical vulnerabilities can usually be exploited remotely, without a login, to take over the affected system. Patch these first.
- 9.1 Critical severity
Apache Impala: Incorrect Implementation of Authentication Algorithm
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth toke
- 9.3 Critical severity
Multi-tenant ERP System: Deserialization of Untrusted Data
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functiona
- 9.3 Critical severity
Multi-tenant ERP System: Improper Neutralization of Special Elements used in an SQL Command
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerabl
- 9.3 Critical severity
Multi-tenant ERP System: Insufficient Verification of Data Authenticity
This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to c
- 9.3 Critical severity
Eclipse ThreadX - NetX Duo: Out-of-bounds Write
Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A maliciou
- 9.3 Critical severity
OrdaSoft Simple Membership extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request param
- 9.3 Critical severity
VMware Workstation: Integer Overflow or Wraparound
VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - V
- 9.3 Critical severity
FlexNet Publisher: Authentication Bypass Using an Alternate Path or Channel
A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing va
- 9.1 Critical severity
wolfSSH: Missing Authorization
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allow
- 9.3 Critical severity
Router: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a cr
- 9.3 Critical severity
Router: Stack-based Buffer Overflow
A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' secti
- 9.2 Critical severity
ADM: Improper Neutralization of CRLF Sequences in HTTP Headers
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can lever
- 9.8 Critical severity
Langflow OSS: Improper Control of Generation of Code
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- 9.6 Critical severity
backstage: Exposure of Sensitive Information to an Unauthorized Actor
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read an
- 9.1 Critical severity
Gitea: Improper Authentication
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a ne
- 9.9 Critical severity
backstage: Improper Limitation of a Pathname to a Restricted Directory
Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder acti
- 9.0 Critical severity
bedrock-agentcore-starter-toolkit: Improper Control of Generation of Code
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, v
- 9.1 Critical severity
Gitea: Use of Incorrectly-Resolved Name or Reference
Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contribut
- 9.8 Critical severity
Gitea: Unintended Proxy or Intermediary
Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run w
- 9.8 Critical severity
ClearPass Policy Manager (CPPM): Improper Limitation of a Pathname to a Restricted Directory
An authenticated path traversal vulnerability exists in ClearPass Policy Manager. Successful exploitation could allow an attacker to read and modify certain files on the underlying operating system.
- 9.8 Critical severity
ClearPass Policy Manager (CPPM): Missing Support for Integrity Check
A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to introduce untrusted code. Successful exploitation could allow an attacker to execute arbitr
- 9.9 Critical severity
ClearPass Policy Manager (CPPM): Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation c
- 9.8 Critical severity
ClearPass Policy Manager (CPPM): Improper Authentication
Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain u
- 9.1 Critical severity
ClearPass Policy Manager (CPPM): Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an
- 9.8 Critical severity
ClearPass Policy Manager (CPPM): Improper Neutralization of Special Elements used in a Command
A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary
- 9.8 Critical severity
ClearPass Policy Manager (CPPM): Use of Externally-Controlled Format String
A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory. Successful exploitation could allow an attacker to execute arbitrary code.
- 9.8 Critical severity
ClearPass Policy Manager (CPPM): Improper Authentication
Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to circumvent existing authentication controls and gai
- 9.8 Critical severity
ClearPass Policy Manager (CPPM): Missing Support for Integrity Check
A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an unauthenticated, remote attacker to execute arbitrary code on the affected endpoint with the elevated privileges of t
- 9.8 Critical severity
ClearPass Policy Manager (CPPM): Deserialization of Untrusted Data
Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.
- 9.1 Critical severity
AOS-Switch (AOS-S): Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to expose sensitive memory contents and cause a denial of service on the device.
- 9.3 Critical severity
AOS-Switch (AOS-S): Buffer Copy without Checking Size of Input
An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device.
- 9.6 Critical severity
AOS-Switch (AOS-S): Improper Restriction of Operations within the Bounds of a Memory Buffer
Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code.
- 9.8 Critical severity
AOS-Switch (AOS-S): Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code.
- 9.8 Critical severity
AOS-Switch (AOS-S): Improper Authentication
A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Success
- 9.8 Critical severity
AOS-Switch (AOS-S): Improper Privilege Management
Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to gain unauthorized access to the affected system.
- 9.8 Critical severity
Gitea: Improper Authentication
Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the pas
- 9.8 Critical severity
handlebars.js: Improper Control of Generation of Code
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLite
- 9.2 Critical severity
handlebars.js: Incomplete List of Disallowed Inputs
Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Fu
- 9.1 Critical severity
Gitea: Authentication Bypass by Primary Weakness
When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can
- 9.8 Critical severity
CloudVision CUE: Missing Authentication for Critical Functionality
An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.