Critical severity vulnerabilities
23,833 CVEs scored 9.0 to 10.0 on CVSS. Critical vulnerabilities can usually be exploited remotely, without a login, to take over the affected system. Patch these first.
- 9.1 Critical severity
mailcow: dockerized: Improper Neutralization of Special Elements Used in a Template Engine
mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an
- 9.4 Critical severity
Cloud Services Application: Missing Authentication for Critical Functionality
Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.
- 9.8 Critical severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
- 9.6 Critical severity
Firefox: Use After Free
Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
- 9.6 Critical severity
Firefox: Use After Free
Sandbox escape due to use-after-free in the IPC component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
- 9.6 Critical severity
Firefox: Use After Free
Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
- 9.6 Critical severity
Firefox: Use After Free
Sandbox escape due to use-after-free in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
- 9.6 Critical severity
Firefox: Buffer Copy without Checking Size of Input
Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
- 9.6 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
- 9.4 Critical severity
nerves_hub_web: Session Fixation
Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no authe
- 9.3 Critical severity
mbCONNECT24: Improper Neutralization of Input During Web Page Generation
An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of
- 9.8 Critical severity
HiRDB Server Version 10: Partial String Comparison
Partial String Comparison Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50-/F through 09-66/V; Hi
- 10.0 Critical severity
SAP Web Dispatcher: Heap-based Buffer Overflow
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Success
- 9.6 Critical severity
SAP Web Dispatcher and Internet Communication…: Cross-Site Request Forgery
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthentic
- 10.0 Critical severity
SAP Gateway: Incorrect Authorization
SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness t
- 9.9 Critical severity
SAP NetWeaver and ABAP Platform: Exposed Dangerous Method or Function
SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on th
- 10.0 Critical severity
SAP NetWeaver AS ABAP (Internet Communication…: Improper Validation of Specified Type of Input
SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected fun
- 10.0 Critical severity
M60: Use of Hard-coded Password
A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The e
- 10.0 Critical severity
GV-Face: Cleartext Transmission of Sensitive Information
GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic.
- 10.0 Critical severity
SAP NetWeaver AS ABAP and ABAP Platform (SAML2…: Improper Verification of Cryptographic Signature
SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitr
- 9.9 Critical severity
SAP NetWeaver Knowledge Management (XML Forms): Improper Control of Generation of Code
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an
- 9.1 Critical severity
SAP BusinessObjects Business Intelligence…: Improper Restriction of XML External Entity Reference
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, ena
- 9.9 Critical severity
S4CRM: Improper Control of Generation of Code
SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arb
- 9.2 Critical severity
Plesk extension "Site Import": Improper Limitation of a Pathname to a Restricted Directory
The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitr
- 9.1 Critical severity
VOS: Generation of Predictable Numbers or Identifiers
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), whi
- 9.8 Critical severity
Asp.Net-Core-Inventory-Order-Management-System: Use of Default Credentials
INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials,
- 9.8 Critical severity
Asp.Net-Core-Inventory-Order-Management-System: Use of Hard-coded Cryptographic Key
INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge toke
- 9.8 Critical severity
kubero: Use of Hard-coded Cryptographic Key
Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary
- 9.8 Critical severity
mongoose: Improper Neutralization of Special Elements in Data Query Logic
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application tha
- 9.8 Critical severity
cms: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search, allowing stacked query execution and enabling escalation to an administrator. Note that this only affects MySQL/MariaDB. Impact * SQL injection
- 9.3 Critical severity
cog: Server-Side Request Forgery
Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side HTTP requests by submitting prediction inputs with attacker-controlled URLs that are not validated against the
- 9.4 Critical severity
pyload: Improper Limitation of a Pathname to a Restricted Directory
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar
- 9.8 Critical severity
signalk-server: Improper Limitation of a Pathname to a Restricted Directory
Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId acce
- 9.1 Critical severity
Apache Commons Codec: Incorrect Provision of Specified Functionality
Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again wi
- 9.9 Critical severity
supertokens-core: Authorization Bypass Through User-Controlled Key
SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrU
- 9.8 Critical severity
Connect: Missing Authentication for Critical Functionality
Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (RCE). In streams mode, the management HTTP API is exposed on `0.0.0.0:4195`, but authentication is disabled by default an
- 9.8 Critical severity
Tasmota: Buffer Access with Incorrect Length Value
Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages ov
- 9.1 Critical severity
FrodoBots EarthRover Mini+ firmware: Download of Code Without Integrity Check
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the sam
- 9.8 Critical severity
FrodoBots EarthRover Mini+ firmware: Missing Authentication for Critical Functionality
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication. 1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-
- 9.8 Critical severity
FrodoBots EarthRover Mini+ firmware: Improper Neutralization of Special Elements used in an OS Command
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetr