CVE-2021-43798
Grafana Path Traversal Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
This curated brief highlights 16 critical vulnerabilities and 100 high-priority updates requiring immediate attention.
Grafana Path Traversal Vulnerability - Active in CISA KEV catalog.
IGEL OS Use of a Key Past its Expiration Date Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Untrusted Pointer Dereference Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Improper Access Control Vulnerability - Active in CISA KEV catalog.
SKYSEA Client View Improper Authentication Vulnerability - Active in CISA KEV catalog.
Adobe Experience Manager Forms Code Execution Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Unspecified Vulnerability - Active in CISA KEV catalog.
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability - Active in CISA KEV catalog.
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability - Active in CISA KEV catalog.
Microsoft Windows SMB Client Improper Access Control Vulnerability - Active in CISA KEV catalog.
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability - Active in CISA KEV catalog.
Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability - Active in CISA KEV catalog.
Adobe Commerce andâ¯Magento Improper Input Validation Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
Dassault Systèmes DELMIA Apriso Code Injection Vulnerability - Active in CISA KEV catalog.
Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability - Active in CISA KEV catalog.
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and ...
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Wind...
An issue was discovered in eTimeTrackLite Web thru 12.0 (20250704). There is a permission control flaw that allows unauthorized attackers to access specific routes and modify database connection confi...
SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal.
Taiga is an open source project management platform. In versions 6.8.3 and earlier, a remote code execution vulnerability exists in the Taiga API due to unsafe deserialization of untrusted data. This ...
An issue in MikroTik RouterOS v.7.14.2 and SwitchOS v.2.18 allows a remote attacker to execute arbitrary code via the HTTP- only WebFig management component
IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
Improper Control of Generation of Code ('Code Injection') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Remote Code Inclusion.This issue affects Paid Videochat Turn...
Missing Authorization vulnerability in epiphanyit321 Referral Link Tracker referral-link-tracker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Referral Lin...
Missing Authorization vulnerability in gerritvanaaken Podlove Web Player podlove-web-player allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Podlove Web Player: from ...
Missing Authorization vulnerability in Mark O'Donnell MSTW CSV EXPORTER mstw-csv-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSTW CSV EXPORTER: ...
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing ...
Landlord Onboarding & Rental Signup introduces the landlord onboarding workflow and rental signup system for VivaTurbo Rentals & Property Services. In 2.0.0 and earlier, a vulnerability was identified...
The device is running an outdated operating system, which may be susceptible to known vulnerabilities.
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sunshine Photo Cart:...
Missing Authorization vulnerability in themeshopy TS Demo Importer ts-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS Demo Importer: from n/...
The HUSKY â Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the `phrase` parameter in all versions up to, and including, 1
Missing Authorization vulnerability in microsoftstart MSN Partner Hub microsoft-start allows Exploiting Incorrectly Configured Access Control Security Levels
Nagios Fusion v2024R1
indieka900 online-shopping-system-php 1
Missing Authorization vulnerability in Conversios Conversios
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4
A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1
HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36Â with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system
Relative Path Traversal vulnerability in Apache Tomcat
Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Brands for WooCommerce premmerce-woocommerce-brands allows Cross Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in NikanWP NikanWP WooCommerce Reporting wc-reports-lite allows Stored XSS
A vulnerability has been found in dnsmasq up to 2
Missing Authorization vulnerability in clicksend SMS Contact Form 7 Notifications by ClickSend clicksend-contactform7 allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in ilmosys Open Close WooCommerce Store woc-open-close allows Exploiting Incorrectly Configured Access Control Security Levels
A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services
Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Pricing Table builder wpdevart-pricing-table allows Stored XSS
Missing Authorization vulnerability in KingAddons
Cross-Site Request Forgery (CSRF) vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows Cross Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in digitaldonkey Multilang Contact Form multilang-contact-form allows Stored XSS
Missing Authorization vulnerability in adivahaÂŽ Flights & Hotels Booking WP Plugin adiaha-hotel allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in ignitionwp IgnitionDeck ignitiondeck allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in wprio Table Block by RioVizual riovizual allows Exploiting Incorrectly Configured Access Control Security Levels
Cross-Site Request Forgery (CSRF) vulnerability in Prakash Awesome Testimonials awesome-testimonials allows Stored XSS
Cross-Site Request Forgery (CSRF) vulnerability in Mejar WP Business Hours wp-business-hours allows Stored XSS
Cross-Site Request Forgery (CSRF) vulnerability in Eduard Pinuaga Linares Did Prestashop Display did-prestashop-display allows Stored XSS
Missing Authorization vulnerability in everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in nanbu Welcart e-Commerce usc-e-shop allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in Codeinwp Revive Old Posts tweet-old-post allows Exploiting Incorrectly Configured Access Control Security Levels
Cross-Site Request Forgery (CSRF) vulnerability in iseremet Reloadly reloadly-topup-widget allows Stored XSS
Cross-Site Request Forgery (CSRF) vulnerability in Clifton Griffin Simple Content Templates for Blog Posts & Pages simple-post-template allows Cross Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in Andrea Landonio CloudSearch cloud-search allows Stored XSS
Missing Authorization vulnerability in MDZ Persian Admnin Fonts persian-admin-fonts allows Exploiting Incorrectly Configured Access Control Security Levels
A vulnerability was determined in Tenda O3 1
A vulnerability was identified in Tenda O3 1
A security flaw has been discovered in Tenda O3 1
A weakness has been identified in Tenda O3 1
A security vulnerability has been detected in Tenda O3 1
A vulnerability was detected in Tenda O3 1
A vulnerability has been found in Tenda AC6 15
A vulnerability was detected in Tenda CH22 1
A flaw has been found in Tenda CH22 1
A vulnerability has been found in Tenda CH22 1
A vulnerability was determined in Tenda CH22 1
A weakness has been identified in TOTOLINK A3300R 17
A security vulnerability has been detected in TOTOLINK A3300R 17
A vulnerability was detected in TOTOLINK A3300R 17
A vulnerability was detected in TOTOLINK A3300R 17
A flaw has been found in TOTOLINK A3300R 17
A vulnerability has been found in TOTOLINK A3300R 17
A weakness has been identified in Tenda CH22 1
A vulnerability was identified in Tenda CH22 1
A security flaw has been discovered in Tenda CH22 1
A weakness has been identified in Tenda CH22 1
A security vulnerability has been detected in Tenda CH22 1
An issue was discovered in BAE SOCET GXP before 4
A flaw has been found in Tenda CH22 1
Use of Hard-Coded Credentials issue exists in MZK-DP300N version 1
TRUfusion Enterprise through 7
Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on the MBI server This issue affects Infra Monitoring: from 24
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application
Authorization Bypass Through User-Controlled Key vulnerability in mediavine Create by Mediavine mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in mrityunjay Smart WeTransfer smart-wetransfer allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in Shambhu Patnaik Export Categories export-categories allows Accessing Functionality Not Properly Constrained by ACLs
Missing Authorization vulnerability in Nelio Software Nelio Content nelio-content allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in Joby Joseph SEO Meta Description Updater seo-meta-description-updater allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in Reoon Technology Reoon Email Verifier reoon-email-verifier allows Exploiting Incorrectly Configured Access Control Security Levels
Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security Levels
A vulnerability was found in Tenda CH22 1
An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1
IBM QRadar SIEM 7
A vulnerability was detected in ermig1979 AntiDupl up to 2
A use-after-free vulnerability exists in the XML parser functionality of GCC Productions Inc
An out-of-bounds write vulnerability exists in the XML parser functionality of GCC Productions Inc
A private key disclosure vulnerability exists in ZTE's ZXMP M721 product
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11
Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup Builder wp-popup-builder allows Retrieve Embedded Sensitive Data
Insertion of Sensitive Information Into Sent Data vulnerability in publitio Publitio publitio allows Retrieve Embedded Sensitive Data
The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access
Reachable Assertion vulnerability in Open5GS up to version 2
Reachable Assertion vulnerability in Open5GS up to version 2
StarCharge Artemis AC Charger 7-22 kW v1
TRUfusion Enterprise through 7
TRUfusion Enterprise through 7
FRRouting/frr from v2
FRRouting/frr from v2
FRRouting/frr from v4
FRRouting/frr from v4
FRRouting/frr from v4
FRRouting/frr from v4
FRRouting/frr from v4
FRRouting/frr from v4
FRRouting/frr from v4
Starlette is a lightweight ASGI framework/toolkit
A vulnerability was found in SourceCodester Best House Rental Management System 1
A flaw has been found in projectworlds Online Shopping System 1