Critical severity vulnerabilities
23,833 CVEs scored 9.0 to 10.0 on CVSS. Critical vulnerabilities can usually be exploited remotely, without a login, to take over the affected system. Patch these first.
- 9.8 Critical severity
FrodoBots EarthRover Mini+ firmware: Use of Hard-coded Credentials
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials,
- 9.3 Critical severity
V-Ray Swarm: Uncontrolled Search Path Element
Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries
- 9.8 Critical severity
rConfig Core: Deserialization of Untrusted Data
rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Ho
- 10.0 Critical severity
WidzialniCMS: Unrestricted Upload of File with Dangerous Type
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to a
- 10.0 Critical severity
WidzialniCMS: Unrestricted Upload of File with Dangerous Type
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arb
- 9.2 Critical severity
Infantia: Download of Code Without Integrity Check
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
- 9.1 Critical severity
Apache Axis2/Java: Server-Side Request Forgery
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault,
- 9.1 Critical severity
Apache Axis2/Java: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documen
- 9.1 Critical severity
Apache Allura: Incorrect Authorization
OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version 1.22.1, which fixes the issue.
- 10.0 Critical severity
Confection WordPress Cable: Improper Control of Generation of Code
The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users t
- 9.8 Critical severity
Apache Airflow: Missing Authentication for Critical Functionality
Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrar
- 9.1 Critical severity
Apache Airflow: Improper Neutralization of Special Elements used in an OS Command
The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, s
- 9.9 Critical severity
VW2100: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument
- 9.5 Critical severity
otterdog: Improper Neutralization of Directives in Dynamically Evaluated Code
The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely,
- 10.0 Critical severity
VW2100: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument ext
- 9.8 Critical severity
SG 2404 PoE L2+: Improper Authentication
A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack
- 9.8 Critical severity
WP Duplicate: Unrestricted Upload of File with Dangerous Type
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achie
- 9.8 Critical severity
Grand Job: Improper Authentication
The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the si
- 9.8 Critical severity
EASY-JS-WPAPI Client HANDLE for the WordPress…: Improper Authentication
The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticate
- 9.3 Critical severity
WebSAM WinShare: Heap-based Buffer Overflow
Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted pac
- 9.3 Critical severity
WebSAM WinShare: Exposed Dangerous Method or Function
Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM pr
- 9.8 Critical severity
DIR-878: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be init
- 9.1 Critical severity
Frontend Admin by DynamiApps: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.
- 9.8 Critical severity
Concert: Improper Neutralization of Special Elements used in an OS Command
IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the
- 9.8 Critical severity
Concert: Improper Neutralization of Special Elements used in an OS Command
IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.
- 9.9 Critical severity
DataStage on Cloud Pak for Data: Absolute Path Traversal
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.
- 9.6 Critical severity
Melapress Role Editor: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Privilege Escalation.This issue affects Melapress Role Editor: from n/a through 1.3.0.
- 9.1 Critical severity
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass…
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.
- 9.3 Critical severity
suneditor: Improper Neutralization of Input During Web Page Generation
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pa
- 9.3 Critical severity
suneditor: Improper Neutralization of Input During Web Page Generation
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript
- 9.1 Critical severity
openemr: External Control of File Name or Path
OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the file_path parameter. Attackers can use action
- 9.9 Critical severity
openemr: Improper Neutralization of Special Elements used in an SQL Command
OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the prod[N][warehouse] POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee Shee
- 9.9 Critical severity
openemr: External Control of File Name or Path
OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials a
- 9.8 Critical severity
openemr: Improper Restriction of Excessive Authentication Attempts
OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Att
- 9.9 Critical severity
kyverno: Unintended Proxy or Intermediary
Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to urlPath. Attackers
- 9.8 Critical severity
cms: Missing Authorization
Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entrie
- 9.8 Critical severity
Contact Form 7: Unrestricted Upload of File with Dangerous Type
The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary
- 9.8 Critical severity
Userplace: Improper Privilege Management
The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or wr
- 9.8 Critical severity
imgproxy: Heap-based Buffer Overflow
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips
- 10.0 Critical severity
OpenAM: Insertion of Sensitive Information Into Sent Data
OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forwa