Critical severity vulnerabilities
23,847 CVEs scored 9.0 to 10.0 on CVSS. Critical vulnerabilities can usually be exploited remotely, without a login, to take over the affected system. Patch these first.
- 9.1 Critical severity
Bifrost: Authorization Bypass Through User-Controlled Key
The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is auth
- 9.8 Critical severity
NX10: Insufficiently Protected Credentials
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a va
- 9.8 Critical severity
Neurons for ITSM: Deserialization of Untrusted Data
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
- 9.8 Critical severity
Neurons for ITSM: Deserialization of Untrusted Data
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
- 9.1 Critical severity
XenForo: Incorrect Comparison
XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can exploi
- 9.8 Critical severity
Commvault Cloud: Improper Neutralization of Special Elements used in an SQL Command
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.
- 9.8 Critical severity
Commvault Cloud: Deserialization of Untrusted Data
Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.
- 9.8 Critical severity
Commvault Cloud: Authentication Bypass by Spoofing
Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.
- 9.9 Critical severity
Red Hat build of Apache Camel - HawtIO 4: Improper Certificate Validation
A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio c
- 9.8 Critical severity
Cosminexus Component Container: Improper Neutralization of Argument Delimiters in a Command
Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 throu
- 9.8 Critical severity
Cosminexus Component Container: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-
- 9.8 Critical severity
Reyrolle 7SR5: Missing Authentication for Critical Functionality
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and g
- 9.0 Critical severity
Siveillance Control Pro V3.0: Unrestricted Upload of File with Dangerous Type
A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance Control V3.0 (All versions < V3.0.22.2177), Siveillance Control V4.0 (All versions < V4.0.
- 9.8 Critical severity
Cosminexus Component Container: Deserialization of Untrusted Data
Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-3
- 9.9 Critical severity
DIR-822A: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclose
- 9.6 Critical severity
DIR-895L: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local netw
- 9.4 Critical severity
SAP Cloud Application Programming Model (CAP): Insufficiently Protected Credentials
@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse t
- 9.0 Critical severity
SAP NetWeaver (SAP GUI for Java): Reliance on Untrusted Inputs in a Security Decision
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality
- 9.8 Critical severity
SAP NetWeaver (Message Server): Use of Single-factor Authentication
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unaut
- 10.0 Critical severity
SAP Extended Passport (EPP) Processing: Buffer Copy without Checking Size of Input
A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefine
- 9.8 Critical severity
knowns: Missing Authentication for Critical Functionality
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunn
- 9.1 Critical severity
knowns: Improper Limitation of a Pathname to a Restricted Directory
knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwr
- 10.0 Critical severity
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Exploited
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbit
- 9.8 Critical severity
YouTrack: Authentication Bypass by Spoofing
In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
- 9.8 Critical severity
CSM (Customer Service Management): Deserialization of Untrusted Data
Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection. This issue affects CSM (Customer Service Management): before 8.0.3.
- 9.8 Critical severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Improper Authentication
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardl
- 9.1 Critical severity
Secure Connect Gateway 5.0 - Application: Improper Certificate Validation
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerabilit
- 9.8 Critical severity
Secure Connect Gateway 5.0 - Application: Improper Limitation of a Pathname to a Restricted Directory
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote acc
- 9.8 Critical severity
Secure Connect Gateway 5.0 - Application: Improper Limitation of a Pathname to a Restricted Directory
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote acc
- 9.8 Critical severity
librenms: Improper Authentication
LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending
- 9.1 Critical severity
MISP: Exposure of Sensitive Information to an Unauthorized Actor
Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination. The orig
- 9.3 Critical severity
Secure Connect Gateway 5.0 - Application: Execution with Unnecessary Privileges
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnera
- 9.8 Critical severity
Red Hat Enterprise Linux 10: Missing Authentication for Critical Functionality
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the unde
- 9.4 Critical severity
BiHayat App: Improper Restriction of Excessive Authentication Attempts
Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 before 2.3.
- 9.4 Critical severity
Secure Connect Gateway 5.0 - Application: Missing Authorization
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorization vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading
- 9.9 Critical severity
RE7000: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results
- 10.0 Critical severity
DIR-822A: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out
- 9.9 Critical severity
WISE-6610-NB: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251
- 9.9 Critical severity
WISE-6610-NB: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251
- 9.3 Critical severity
UNIVERGE IX-R/IX-V: Missing Authentication for Critical Functionality
An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet.