Critical-severity CVEs (page 55)
Page 55 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-71095 | Critical | 9.1 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix the crash issue for zero copy XDP_TX action There is a crash issue when… |
CVE-2025-71093 | Critical | 9.1 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: e1000: fix OOB in e1000_tbi_should_accept() In e1000_tbi_should_accept() we read the last… |
CVE-2025-71068 | Critical | 9.8 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: bound check rq_pages index in inline path svc_rdma_copy_inline_range indexed rqs… |
CVE-2025-69992 | Critical | 9.8 | 2026-01-13 | phpgurukul News Portal Project V4.1 has File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identit… |
CVE-2025-69991 | Critical | 9.8 | 2026-01-13 | phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php. |
CVE-2025-69990 | Critical | 9.1 | 2026-01-13 | phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted. |
CVE-2025-68817 | Critical | 9.8 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency Under high concurre… |
CVE-2025-68811 | Critical | 9.8 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rc_pageoff for memcpy byte offset svc_rdma_copy_inline_range added rc_curpag… |
CVE-2025-68809 | Critical | 9.1 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: vfs: fix race on m_flags in vfs_cache ksmbd maintains delete-on-close and pending-… |
CVE-2025-68794 | Critical | 9.8 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: iomap: adjust read range correctly for non-block-aligned positions iomap_adjust_read_rang… |
CVE-2025-68775 | Critical | 9.8 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations leak socket When a handshake request is… |
CVE-2025-65783 | Critical | 9.8 | 2026-01-13 | An arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows attackers to execute ar… |
CVE-2025-12548 | Critical | 9.0 | 2026-01-13 | A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH key… |
CVE-2026-0892 | Critical | 9.8 | 2026-01-13 | Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-0884 | Critical | 9.8 | 2026-01-13 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
CVE-2026-0881 | Critical | 10.0 | 2026-01-13 | Sandbox escape in the Messaging System component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. |
CVE-2026-0879 | Critical | 9.8 | 2026-01-13 | Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140… |
CVE-2025-11250 | Critical | 9.1 | 2026-01-13 | Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations. |
CVE-2025-40805 | Critical | 10.0 | 2026-01-13 | Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent… |
CVE-2025-14829 | Critical | 9.1 | 2026-01-13 | The E-xact | Hosted Payment | WordPress plugin through 2.0 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it pos… |
CVE-2025-10915 | Critical | 9.8 | 2026-01-13 | The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check. |
CVE-2026-0501 | Critical | 9.9 | 2026-01-13 | Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could execute crafted SQL q… |
CVE-2026-0500 | Critical | 9.6 | 2026-01-13 | Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malici… |
CVE-2026-0498 | Critical | 9.1 | 2026-01-13 | SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This fla… |
CVE-2026-0491 | Critical | 9.1 | 2026-01-13 | SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the… |
CVE-2026-22214 | Critical | 9.8 | 2026-01-12 | RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking… |
CVE-2026-22213 | Critical | 9.8 | 2026-01-12 | RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused… |
CVE-2026-22794 | Critical | 9.6 | 2026-01-12 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the e… |
CVE-2025-67146 | Critical | 9.4 | 2026-01-12 | Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search… |
CVE-2025-29329 | Critical | 9.8 | 2026-01-12 | Buffer Overflow in the ippprint (Internet Printing Protocol) service in Sagemcom F@st 3686 MAGYAR_4.121.0 allows remote attacker to execute arbitrary code by s… |
CVE-2025-12420 | Critical | 9.8 | 2026-01-12 | A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operati… |
CVE-2025-67147 | Critical | 9.8 | 2026-01-12 | Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_c… |
CVE-2025-66802 | Critical | 9.8 | 2026-01-12 | Sourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution). The application receives a reverse shell (php) into imagem of… |
CVE-2025-51567 | Critical | 9.1 | 2026-01-12 | A SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote attackers to execute arbitrary SQL comma… |
CVE-2026-22785 | Critical | 9.8 | 2026-01-12 | orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relie… |
CVE-2026-22783 | Critical | 9.6 | 2026-01-12 | Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore fil… |
CVE-2026-22781 | Critical | 9.8 | 2026-01-12 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDE… |
CVE-2026-22252 | Critical | 9.1 | 2026-01-12 | LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allo… |
CVE-2025-63314 | Critical | 10.0 | 2026-01-12 | A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and… |
CVE-2025-46070 | Critical | 9.8 | 2026-01-12 | An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component |
CVE-2025-46066 | Critical | 9.9 | 2026-01-12 | An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges |
CVE-2025-65552 | Critical | 9.8 | 2026-01-12 | D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel. The system does not implement roll… |
CVE-2025-69270 | Critical | 9.8 | 2026-01-12 | Information Exposure Through Query Strings in GET Request vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Session Hijacking.This issue af… |
CVE-2025-69269 | Critical | 9.8 | 2026-01-12 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allow… |
CVE-2025-52694 | Critical | 10.0 | 2026-01-12 | Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable s… |
CVE-2026-22688 | Critical | 9.9 | 2026-01-10 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulne… |
CVE-2025-65091 | Critical | 10.0 | 2026-01-10 | XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (i… |
CVE-2025-61686 | Critical | 9.1 | 2026-01-10 | React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to v… |
CVE-2026-22600 | Critical | 9.1 | 2026-01-10 | OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality… |
CVE-2025-15501 | Critical | 9.8 | 2026-01-09 | A vulnerability was determined in Sangfor Operation and Maintenance Management System up to 3.0.8. Impacted is the function WriterHandle.getCmd of the file /is… |
CVE-2026-22584 | Critical | 9.8 | 2026-01-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Ex… |
CVE-2025-15500 | Critical | 9.8 | 2026-01-09 | A vulnerability was found in Sangfor Operation and Maintenance Management System up to 3.0.8. This issue affects some unknown processing of the file /isomp-pro… |
CVE-2025-70161 | Critical | 9.8 | 2026-01-09 | EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName field is directly passed to a shell command via the system() f… |
CVE-2025-69542 | Critical | 9.8 | 2026-01-09 | A Command Injection Vulnerability has been discovered in the DHCP daemon service of D-Link DIR895LA1 v102b07. The vulnerability exists in the lease renewal pro… |
CVE-2025-14598 | Critical | 9.8 | 2026-01-09 | BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQ… |
CVE-2025-66050 | Critical | 9.8 | 2026-01-09 | Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible… |
CVE-2025-64093 | Critical | 10.0 | 2026-01-09 | Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device. |
CVE-2025-64090 | Critical | 10.0 | 2026-01-09 | This vulnerability allows authenticated attackers to execute commands via the hostname of the device. |
CVE-2025-14741 | Critical | 9.1 | 2026-01-09 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing ca… |
CVE-2025-70974 | Critical | 10.0 | 2026-01-09 | Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may b… |
CVE-2025-14736 | Critical | 9.8 | 2026-01-09 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insuf… |
CVE-2025-68717 | Critical | 9.4 | 2026-01-08 | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints such as /cgi-bin/sy… |
CVE-2025-68715 | Critical | 9.1 | 2026-01-08 | An issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple HTTP endpoints (/goform/setWan, /goform/setLan, /goform/wirel… |
CVE-2025-66916 | Critical | 9.4 | 2026-01-08 | The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but… |
CVE-2025-66913 | Critical | 9.8 | 2026-01-08 | JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied… |
CVE-2025-67325 | Critical | 9.8 | 2026-01-08 | Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execu… |
CVE-2026-22234 | Critical | 9.8 | 2026-01-08 | OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable value… |
CVE-2025-61548 | Critical | 9.8 | 2026-01-08 | SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Sho… |
CVE-2025-61546 | Critical | 9.1 | 2026-01-08 | There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69) t… |
CVE-2025-61246 | Critical | 9.8 | 2026-01-08 | indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action.php via the proId parameter. |
CVE-2025-59470 | Critical | 9.0 | 2026-01-08 | This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter. |
CVE-2025-59469 | Critical | 9.0 | 2026-01-08 | This vulnerability allows a Backup or Tape Operator to write files as root. |
CVE-2025-59468 | Critical | 9.0 | 2026-01-08 | This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter. |
CVE-2025-56425 | Critical | 9.1 | 2026-01-08 | An issue was discovered in the AppConnector component version 10.10.0.183 and earlier of enaio 10.10, in the AppConnector component version 11.0.0.183 and earl… |
CVE-2026-22043 | Critical | 9.8 | 2026-01-08 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IA… |
CVE-2026-22034 | Critical | 9.8 | 2026-01-08 | Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snu… |
CVE-2026-21891 | Critical | 9.4 | 2026-01-08 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks th… |
CVE-2026-21876 | Critical | 9.3 | 2026-01-08 | The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8… |
CVE-2025-69258 | Critical | 9.8 | 2026-01-08 | A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executab… |
CVE-2025-62877 | Critical | 9.8 | 2026-01-08 | Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive i… |
CVE-2025-67928 | Critical | 9.3 | 2026-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themesuite Automotive Listings automotive allows Blind SQ… |
CVE-2025-67924 | Critical | 9.9 | 2026-01-08 | Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Corpkit corpkit allows Upload a Web Shell to a Web Server.This issue affects Corpki… |
CVE-2025-67911 | Critical | 9.8 | 2026-01-08 | Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from… |
CVE-2025-67910 | Critical | 9.1 | 2026-01-08 | Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload a Web Shell to a Web Server.This issue… |
CVE-2025-23993 | Critical | 9.3 | 2026-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Framework felan-framework allows SQL Inje… |
CVE-2025-23504 | Critical | 9.8 | 2026-01-08 | Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affe… |
CVE-2019-25296 | Critical | 9.8 | 2026-01-08 | The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file type validation in the lfb_upload_form and… |
CVE-2026-21881 | Critical | 9.1 | 2026-01-08 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE… |
CVE-2026-21877 | Critical | 9.9 | 2026-01-08 | n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8… |
CVE-2026-21875 | Critical | 9.8 | 2026-01-08 | ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment… |
CVE-2026-21858 | Critical | 10.0 | 2026-01-08 | n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server… |
CVE-2019-25282 | Critical | 9.8 | 2026-01-08 | V-SOL GPON/EPON OLT Platform v2.03 contains an open redirect vulnerability in the script that allows attackers to manipulate the 'parent' GET parameter. Attack… |
CVE-2019-25268 | Critical | 9.8 | 2026-01-08 | NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking users into opening application files fr… |
CVE-2017-20216 | Critical | 9.8 | 2026-01-08 | FLIR Thermal Camera PT-Series firmware version 8.0.0.64 contains multiple unauthenticated remote command injection vulnerabilities in the controllerFlirSystem… |
CVE-2025-69222 | Critical | 9.1 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 is prone to a server-side request forgery (SSRF) vulnerability due to missing restrict… |
CVE-2026-22189 | Critical | 9.8 | 2026-01-07 | The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains a stack-based buffer overflow vulnerability due to use of an unbounded sprintf(… |
CVE-2025-68705 | Critical | 9.8 | 2026-01-07 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in th… |
CVE-2026-21855 | Critical | 9.3 | 2026-01-07 | The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, a reflected Cross Site Scripting (XSS) vulnerability in the toast n… |
CVE-2026-21854 | Critical | 9.8 | 2026-01-07 | The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows… |
CVE-2025-61492 | Critical | 10.0 | 2026-01-07 | A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted… |