Critical-severity CVEs (page 60)
Page 60 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12673 | Critical | 9.8 | 2025-12-06 | The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in… |
CVE-2025-66570 | Critical | 10.0 | 2025-12-05 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to i… |
CVE-2025-66562 | Critical | 9.6 | 2025-12-05 | TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution (RCE) vulnerability exists in Tuu… |
CVE-2025-34256 | Critical | 9.8 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for sign… |
CVE-2025-64054 | Critical | 9.6 | 2025-12-05 | A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitr… |
CVE-2025-12374 | Critical | 9.8 | 2025-12-05 | The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to auth… |
CVE-2025-13313 | Critical | 9.8 | 2025-12-05 | The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.6. This is due to mis… |
CVE-2025-66509 | Critical | 9.8 | 2025-12-04 | LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attacker… |
CVE-2025-66576 | Critical | 9.8 | 2025-12-04 | Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code… |
CVE-2025-29269 | Critical | 9.8 | 2025-12-04 | ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoint. |
CVE-2025-29268 | Critical | 9.8 | 2025-12-04 | ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library. |
CVE-2025-63362 | Critical | 9.8 | 2025-12-04 | Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to set the A… |
CVE-2025-40261 | Critical | 9.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme_fc_delete_a… |
CVE-2025-40258 | Critical | 9.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptc… |
CVE-2025-40257 | Critical | 9.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_t… |
CVE-2025-40252 | Critical | 9.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() … |
CVE-2025-65346 | Critical | 9.1 | 2025-12-04 | alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to b… |
CVE-2025-54304 | Critical | 9.8 | 2025-12-04 | An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. When they are powered on, an X11 display server is started. The display ser… |
CVE-2025-54303 | Critical | 9.8 | 2025-12-04 | The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API. The ionadmin user… |
CVE-2025-53963 | Critical | 9.8 | 2025-12-04 | An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. They run an SSH server accessible over the default port 22. The root accoun… |
CVE-2024-45538 | Critical | 9.6 | 2025-12-04 | Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Uni… |
CVE-2025-64055 | Critical | 9.8 | 2025-12-03 | An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access administrative functions of the device (e.g… |
CVE-2025-66489 | Critical | 9.8 | 2025-12-03 | Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a… |
CVE-2025-66222 | Critical | 9.6 | 2025-12-03 | DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid dia… |
CVE-2025-66208 | Critical | 9.8 | 2025-12-03 | Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versio… |
CVE-2025-66032 | Critical | 9.8 | 2025-12-03 | Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass… |
CVE-2025-64443 | Critical | 9.6 | 2025-12-03 | MCP Gateway allows easy and secure running and deployment of MCP servers. In versions 0.27.0 and earlier, when MCP Gateway runs in sse or streaming transport m… |
CVE-2024-32641 | Critical | 9.8 | 2025-12-03 | Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution… |
CVE-2025-55182 | Critical | 10.0 | 2025-12-03 | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following… |
CVE-2025-65267 | Critical | 9.0 | 2025-12-03 | In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payloa… |
CVE-2025-13390 | Critical | 10.0 | 2025-12-03 | The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of… |
CVE-2025-13342 | Critical | 9.8 | 2025-12-03 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and incl… |
CVE-2025-13486 | Critical | 9.8 | 2025-12-03 | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() fun… |
CVE-2025-13542 | Critical | 9.8 | 2025-12-02 | The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register… |
CVE-2025-66409 | Critical | 9.1 | 2025-12-02 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, rec… |
CVE-2025-65896 | Critical | 9.8 | 2025-12-02 | SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys. |
CVE-2025-60736 | Critical | 9.8 | 2025-12-02 | code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter. |
CVE-2025-60854 | Critical | 9.8 | 2025-12-02 | A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change request in the web a… |
CVE-2025-58386 | Critical | 9.8 | 2025-12-02 | In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power U… |
CVE-2025-65656 | Critical | 9.8 | 2025-12-02 | dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php. |
CVE-2025-65358 | Critical | 9.8 | 2025-12-02 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php. |
CVE-2025-59703 | Critical | 9.1 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a Physically Proximate Attacker to access the internal components of t… |
CVE-2025-59695 | Critical | 9.8 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a user with OS root access to alter firmware on the Chassis Management… |
CVE-2025-59693 | Critical | 9.8 | 2025-12-02 | The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allows a physically proximate attacker to ob… |
CVE-2025-41013 | Critical | 9.8 | 2025-12-02 | SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by se… |
CVE-2025-11788 | Critical | 9.8 | 2025-12-02 | Heap-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowSupervisorParameters()' function, there is an unlimited user inp… |
CVE-2025-11786 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'SetUserPassword()' function, the 'newPassword' parameter is directl… |
CVE-2025-11785 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowMeterPasswords()' function, there is an unlimited user input th… |
CVE-2025-11784 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'ShowMeterDatabase()' function, there is an unlimited user input tha… |
CVE-2025-11783 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The vulnerability is found in the 'AddEvent()' function when copying the us… |
CVE-2025-11782 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The 'ShowDownload()' function uses “sprintf()” to format a string that incl… |
CVE-2025-11780 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'showMeterReport()' function, there is an unlimited user input that… |
CVE-2025-11779 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in CircutorSGE-PLC1000/SGE-PLC50 v9.0.2. The 'SetLan' function is invoked when a new configuration is applied. This n… |
CVE-2025-11778 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow in Circutor SGE-PLC1000/SGE-PLC50 v0.9.2. This vulnerability allows an attacker to remotely exploit memory corruption through the '… |
CVE-2025-41744 | Critical | 9.1 | 2025-12-02 | Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereb… |
CVE-2025-41742 | Critical | 9.8 | 2025-12-02 | Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use… |
CVE-2025-13872 | Critical | 9.1 | 2025-12-02 | Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to fo… |
CVE-2025-66410 | Critical | 9.1 | 2025-12-01 | Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage… |
CVE-2025-66405 | Critical | 9.8 | 2025-12-01 | Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the… |
CVE-2025-66401 | Critical | 9.8 | 2025-12-01 | MCP Watch is a comprehensive security scanner for Model Context Protocol (MCP) servers. In 0.1.2 and earlier, the MCPScanner class contains a critical Command… |
CVE-2025-66301 | Critical | 9.6 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/page… |
CVE-2025-65836 | Critical | 9.1 | 2025-12-01 | PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController. |
CVE-2025-51683 | Critical | 9.8 | 2025-12-01 | A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request… |
CVE-2025-51682 | Critical | 9.8 | 2025-12-01 | mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to administrative features. A… |
CVE-2025-63535 | Critical | 9.6 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the abs.php component. The application fails to properly sanitize usersuppl… |
CVE-2025-63532 | Critical | 9.6 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the cancel.php component. The application fails to properly sanitize user-s… |
CVE-2025-3500 | Critical | 9.0 | 2025-12-01 | Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This issue affects Antivirus: from 25.1.981… |
CVE-2025-63531 | Critical | 10.0 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the receiverLogin.php component. The application fails to properly sanitize… |
CVE-2025-63525 | Critical | 9.6 | 2025-12-01 | An issue was discovered in Blood Bank Management System 1.0 allowing authenticated attackers to perform actions with escalated privileges via crafted request t… |
CVE-2025-12106 | Critical | 9.1 | 2025-12-01 | Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses |
CVE-2025-35028 | Critical | 9.1 | 2025-11-30 | By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP serve… |
CVE-2025-13615 | Critical | 9.8 | 2025-11-30 | The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 4.78. This is due to the plugin prov… |
CVE-2025-66216 | Critical | 9.8 | 2025-11-29 | AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been identified in the AIS::Message class of AIS-… |
CVE-2025-66219 | Critical | 9.8 | 2025-11-29 | willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitme… |
CVE-2025-65112 | Critical | 9.4 | 2025-11-29 | PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to uplo… |
CVE-2025-64314 | Critical | 9.3 | 2025-11-28 | Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2025-12421 | Critical | 9.9 | 2025-11-27 | Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange… |
CVE-2025-12419 | Critical | 9.9 | 2025-11-27 | Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Conn… |
CVE-2025-13675 | Critical | 9.8 | 2025-11-27 | The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file… |
CVE-2025-13540 | Critical | 9.8 | 2025-11-27 | The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the 'tiare_membership… |
CVE-2025-13539 | Critical | 9.8 | 2025-11-27 | The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not p… |
CVE-2025-13538 | Critical | 9.8 | 2025-11-27 | The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findall_listing… |
CVE-2025-40934 | Critical | 9.3 | 2025-11-26 | XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML docum… |
CVE-2025-65276 | Critical | 9.8 | 2025-11-26 | An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0 thru commit 5919dec… |
CVE-2025-50433 | Critical | 9.8 | 2025-11-26 | An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary us… |
CVE-2025-65669 | Critical | 9.1 | 2025-11-26 | An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication ch… |
CVE-2025-26155 | Critical | 9.8 | 2025-11-26 | NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability. |
CVE-2025-64130 | Critical | 9.8 | 2025-11-26 | Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the v… |
CVE-2025-64128 | Critical | 10.0 | 2025-11-26 | An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, wh… |
CVE-2025-64127 | Critical | 10.0 | 2025-11-26 | An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incor… |
CVE-2025-64126 | Critical | 10.0 | 2025-11-26 | An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying… |
CVE-2025-55469 | Critical | 9.8 | 2025-11-26 | Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend. |
CVE-2025-65236 | Critical | 9.8 | 2025-11-26 | OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.p… |
CVE-2025-65235 | Critical | 9.8 | 2025-11-26 | OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByPr… |
CVE-2025-62354 | Critical | 9.8 | 2025-11-26 | Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are… |
CVE-2025-50402 | Critical | 9.8 | 2025-11-26 | FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via the parameter string fac_password. |
CVE-2025-50399 | Critical | 9.8 | 2025-11-26 | FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via the parameter password. |
CVE-2025-59390 | Critical | 9.8 | 2025-11-26 | Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not expli… |
CVE-2025-66022 | Critical | 9.6 | 2025-11-26 | FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework per… |
CVE-2025-66262 | Critical | 9.8 | 2025-11-26 | Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 100… |