CVE-2019-6693
Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
This curated brief highlights 19 critical vulnerabilities and 70 high-priority updates requiring immediate attention.
Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability - Active in CISA KEV catalog.
D-Link DIR-859 Router Path Traversal Vulnerability - Active in CISA KEV catalog.
AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability - Active in CISA KEV catalog.
Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability - Active in CISA KEV catalog.
TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability - Active in CISA KEV catalog.
TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability - Active in CISA KEV catalog.
Google Chromium V8 Type Confusion Vulnerability - Active in CISA KEV catalog.
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability - Active in CISA KEV catalog.
Rails Ruby on Rails Path Traversal Vulnerability - Active in CISA KEV catalog.
PHPMailer Command Injection Vulnerability - Active in CISA KEV catalog.
Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability - Active in CISA KEV catalog.
pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoadâs CAPTCHA processing code allows unauthenticated remote attackers to execute a...
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the temp_fi...
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the t...
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation in the han...
The Alone â Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() func...
The Alone â Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data(...
Vulnerability in Oracle Application Express (component: Strategic Planner Starter App). Supported versions that are affected are 24.2.4 and 24.2.5. Easily exploitable vulnerability allows low privil...
VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with ...
VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. A malicious actor with local administrative pr...
VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. A malicious actor with local administra...
An authentication bypass vulnerability in the /web/um_open_telnet.cgi endpoint in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below, allowing an attacker to remotely enable the Telnet s...
The iSherlock developed by Hgiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. This vulnerability...
Vulnerabilities* in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. * vulnerabilities: * Improper Neutralization of Special Elem...
LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could po...
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 4.2-milestone-1 and prior to ...
A vulnerability, which was classified as critical, was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. Affected is the function reboot/restore...
Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the newpass parameter. This vulnerability allows attackers to execute arbitrary commands...
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to version 0.24.3, an unauthenticated preview deployment vulnerability in Dokploy allows any user to execute arbitrary code and acc...
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14...
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server)
Use after free in WebRTC in Google Chrome prior to 138
BatchSignCS, a background Windows application developed by WellChoose, has an Arbitrary File Write vulnerability
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138
Integer overflow in V8 in Google Chrome prior to 138
Vulnerability in the Oracle Database component of Oracle Database Server
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking)
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
The Restrict File Access plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1
Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal Operations)
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Multiplatform Sync Errors)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D)
Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payroll for Core)
Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D)
An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9
Vulnerability in the Java VM component of Oracle Database Server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
A vulnerability was found in PHPGurukul Hospital Management System 4
Vulnerability in Oracle Java SE (component: Install)
An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9
An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9
An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9
VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets
The cross-browser document creation component produced by Digitware System Integration Corporation has a Remote Code Execution vulnerability
SQL Injection vulnerability in openSIS v
Use After Free vulnerability exists in the CATPRODUCT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025
Use After Free vulnerability exists in the CATPRODUCT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025
Use After Free vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025
Use After Free vulnerability exists in the IPT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025
A vulnerability was found in Tenda FH1201 1
A vulnerability was found in UTT HiPER 840G up to 3
A vulnerability classified as critical has been found in UTT HiPER 840G up to 3
A vulnerability was found in Tenda AC500 2
A vulnerability was found in Tenda FH1205 2
A vulnerability classified as critical has been found in Tenda AX1803 1
A vulnerability classified as critical was found in Tenda AX1803 1
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions
Nix is a package manager for Linux and other Unix systems
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages
A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC3600 1
Out-Of-Bounds Read vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025
Use of Uninitialized Variable vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025
The Secure Password extension in One Identity Password Manager before 5
In JetBrains YouTrack before 2025
A segmentation fault in NanoMQ v0
ImageMagick is free and open-source software used for editing and manipulating digital images
NanoMQ 0
ImageMagick is free and open-source software used for editing and manipulating digital images
A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1
A vulnerability was found in code-projects Online Appointment Booking System 1
A vulnerability was found in code-projects Job Diary 1
A vulnerability was found in code-projects Job Diary 1
A vulnerability was found in code-projects Job Diary 1
A vulnerability was found in code-projects AVL Rooms 1
A vulnerability classified as critical has been found in code-projects AVL Rooms 1
A vulnerability, which was classified as critical, has been found in code-projects Simple Shopping Cart 1
A vulnerability, which was classified as critical, was found in code-projects Simple Shopping Cart 1
A vulnerability has been found in code-projects Simple Shopping Cart 1
A vulnerability was found in code-projects Electricity Billing System 1
A vulnerability was found in code-projects Wedding Reservation 1
A vulnerability was found in code-projects Mobile Shop 1
A vulnerability was found in D-Link DI-8100 16
A vulnerability was found in D-Link DI-8100 16
A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7
Directory traversal vulnerability in beiyuouo arxiv-daily thru 2025-05-06 (commit fad168770b0e68aef3e5acfa16bb2e7a7765d687) when parsing the the topic
Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software