Critical severity vulnerabilities
23,847 CVEs scored 9.0 to 10.0 on CVSS. Critical vulnerabilities can usually be exploited remotely, without a login, to take over the affected system. Patch these first.
- 9.9 Critical severity
ManageEngine OpManager: Improper Neutralization of Special Elements used in an OS Command
ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.
- 9.1 Critical severity
Apache Tomcat: Inconsistent Interpretation of HTTP Requests
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25
- 9.8 Critical severity
Apache Tomcat: Improper Authentication
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Use
- 9.8 Critical severity
Apache Tomcat: Authentication Bypass by Alternate Name
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 t
- 9.8 Critical severity
Apache BuildStream: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Python < 3.12 allows malicious source tarballs to write files on the host, with the privileges of the user running BuildStr
- 9.0 Critical severity
WP OAuth Server ( Login with WordPress ): Improper Authentication
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most
- 9.0 Critical severity
YAHMAN Add-ons: Improper Control of Generation of Code
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant featu
- 10.0 Critical severity
FAC1203R Gigabit Edition: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remote
- 9.9 Critical severity
Financial Transaction Manager (FTM) for RedHat…: Improper Limitation of a Pathname to a Restricted Directory
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.
- 9.8 Critical severity
Financial Transaction Manager (FTM) for RedHat…: Deserialization of Untrusted Data
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.
- 9.8 Critical severity
Financial Transaction Manager (FTM) for RedHat…: Improper Control of Generation of Code
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.
- 9.1 Critical severity
mcp-toolbox-sdk-python: Use of Cache Containing Sensitive Information
A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same p
- 9.1 Critical severity
Financial Transaction Manager (FTM) for RedHat…: Missing Authentication for Critical Functionality
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints.
- 9.8 Critical severity
Financial Transaction Manager (FTM) for RedHat…: Missing Authorization
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization.
- 9.6 Critical severity
Concert: Improper Privilege Management
IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.
- 9.9 Critical severity
DataStage on Cloud Pak for Data: Improper Authorization
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- 9.8 Critical severity
Enterprise Server: Observable Timing Discrepancy
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to in
- 9.1 Critical severity
Apache Lounge Windows: Incorrect Permission Assignment for Critical Resource
The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.
- 9.8 Critical severity
ALE: Improper Access Control
A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with eleva
- 9.8 Critical severity
ALE: Use of Hard-coded Credentials
A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vu
- 9.8 Critical severity
LTK3500SF: Use of Hard-coded Credentials
LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device
- 9.8 Critical severity
Observability Self-Hosted: Insufficient Verification of Data Authenticity
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected.
- 9.3 Critical severity
core: Improper Neutralization of Script-Related HTML Tags in a Web Page
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpo
- 9.6 Critical severity
AEM 6.5 Forms JEE: Server-Side Request Forgery
Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitati
- 9.1 Critical severity
Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability…
Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrar
- 9.1 Critical severity
mcp-atlassian: Missing Authentication for Critical Functionality
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or C
- 10.0 Critical severity
AEM 6.5 Forms JEE: Incorrect Authorization
Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of
- 9.3 Critical severity
Adobe Connect: Improper Neutralization of Input During Web Page Generation
Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Ex
- 9.3 Critical severity
Adobe Connect: Improper Neutralization of Input During Web Page Generation
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page
- 9.3 Critical severity
Adobe Connect: Improper Neutralization of Input During Web Page Generation
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page
- 9.3 Critical severity
Adobe Connect is affected by an Improper Input Validation vulnerability that could result in…
Adobe Connect is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue require
- 9.3 Critical severity
Adobe Connect: Improper Neutralization of Input During Web Page Generation
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page
- 9.9 Critical severity
Adobe Connect: Improper Neutralization of Special Elements used in an SQL Command
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vu
- 9.9 Critical severity
plone.app.portlets: Improper Neutralization of Directives in Dynamically Evaluated Code
plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet (plone.app.portlet
- 9.9 Critical severity
Adobe Campaign Classic: Improper Control of Generation of Code
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability
- 10.0 Critical severity
Adobe Campaign Classic: Improper Control of Generation of Code
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arb
- 10.0 Critical severity
Adobe Campaign Classic: Improper Control of Generation of Code
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arb
- 10.0 Critical severity
Adobe Campaign Classic: Server-Side Request Forgery
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
- 9.9 Critical severity
Adobe Campaign Classic: Server-Side Request Forgery
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of
- 9.9 Critical severity
Adobe Campaign Classic: Server-Side Request Forgery
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of