A critical vulnerability in the Metasploit Framework Web Service allows unauthenticated users to read, modify, or delete stored credentials without any authentication checks.
AnyDesk released version 8.0.3 to address a heap buffer overflow in Linux builds that allowed attackers to gain root access before user approval.
A critical severity vulnerability in IBM DataStage allows remote authenticated attackers to trigger denial of service via path traversal.
A newly disclosed vulnerability in IBM DataStage allows authenticated attackers to execute arbitrary code via path traversal, rated 9.6 by the NVD.
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a critical flaw allowing remote authenticated attackers to access sensitive information.
A critical vulnerability in IBM i versions 7.3 through 7.6 enables authenticated attackers to execute arbitrary code via improper data sanitization.
The surveillance vendor joined the CVE Program as a CNA, allowing it to assign IDs and grade vulnerabilities in its own cameras and license plate readers.
An unauthenticated SQL injection in phpMyFAQ versions before 4.1.9 allows attackers to steal credentials and drop database tables.
A critical flaw in Qexo versions prior to 4.2.0 enables attackers to bypass authentication and potentially steal stored service credentials via the setup API.
A critical flaw in IBM Maximo AI Service 9.1.0 and 9.2.0 allows remote attackers to run arbitrary code via improper control of code generation.
National Vulnerability Database records CVE-2020-37279 as a critical risk in the Node.js library, enabling arbitrary OS command execution through manipulated file paths.
Unauthenticated attackers can execute arbitrary system commands via manipulated output folder paths in versions of GPT-SoVITS through 20250606v2pro.
A critical vulnerability in Rapyd Admin allowed unauthenticated attackers to bypass security controls using default credentials seeded by the installer.
A critical vulnerability in sandboxed.sh allows container workspaces to access host filesystems, posing severe risks to isolated environments.
A critical broken authentication flaw in Netherman Portal del Hermano lets attackers hijack accounts by exploiting error messages and missing rate limits.
A critical vulnerability in Netcore NR268 firmware allows remote argument injection via the DDNS hostname field, rated CVSS 9.4.
A high-severity vulnerability in the Windows client allows attackers to run local binaries via manipulated IPC bridges and unvalidated connections.
A critical vulnerability in NetEase Cloud Music for Windows allows attackers to intercept traffic and steal session credentials through man-in-the-middle attacks.
A critical flaw in HAProxy Data Plane API allows unauthenticated access to administrative controls when specific TLS settings are active.
A critical vulnerability in IBM Db2 Mirror for i allows authenticated attackers to bypass checks and execute code with elevated privileges.
A critical flaw in Privasys remote attestation clients allowed attackers to impersonate TLS endpoints by forging evidence, a issue resolved in the latest release.
A critical vulnerability in Quarkus REST Data Panache allows attackers to bypass security controls on generated endpoints due to silent role dropping.
Unauthenticated users could exploit missing access controls in PraisonAI to enumerate agents and trigger workflows remotely.
A heap buffer overflow in Ghostscript allows attackers to execute code remotely via crafted PDFs, according to new research from Wordfence.