Critical vulnerabilities, curated daily for security professionals
N-able N-Central Command Injection Vulnerability - Active in CISA KEV catalog.
N-able N-Central Insecure Deserialization Vulnerability - Active in CISA KEV catalog.
D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability - Active in CISA KEV catalog.
D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability - Active in CISA KEV catalog.
D-Link DNR-322L Download of Code Without Integrity Check Vulnerability - Active in CISA KEV catalog.
RARLAB WinRAR Path Traversal Vulnerability - Active in CISA KEV catalog.
Microsoft Office Excel Remote Code Execution Vulnerability - Active in CISA KEV catalog.
Microsoft Internet Explorer Resource Management Errors Vulnerability - Active in CISA KEV catalog.
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API end...
The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.0. This is due to the plugin ...
In vowifi service, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed.
Cross-Site Request Forgery (CSRF) vulnerability in iThemes ServerBuddy by PluginBuddy
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 67
The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the homework
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to unauthorized admin account creation in all versions up to, and including, 67
The Soledad theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8
A vulnerability has been found in Tenda AC20 16
A vulnerability was found in Tenda AC20 16
A vulnerability was determined in Tenda AC20 16
In engineer mode service, there is a possible command injection due to improper input validation
The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via several parameters across multiple AJAX action in all versions up to, and including, 93
The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1
A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the image build process
The The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8