Critical-severity CVEs (page 65)
Page 65 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11709 | Critical | 9.8 | 2025-10-14 | A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. This vulnerability… |
CVE-2025-11708 | Critical | 9.8 | 2025-10-14 | Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4. |
CVE-2025-10610 | Critical | 9.8 | 2025-10-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting Information Processing Industry and Foreig… |
CVE-2025-40771 | Critical | 9.8 | 2025-10-14 | A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All ver… |
CVE-2025-40765 | Critical | 9.8 | 2025-10-14 | A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application contains an information di… |
CVE-2025-46581 | Critical | 9.8 | 2025-10-14 | ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability. An unauthenticated attacker can remotely execute commands with non-root… |
CVE-2025-42937 | Critical | 9.8 | 2025-10-14 | SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent… |
CVE-2025-42910 | Critical | 9.0 | 2025-10-14 | Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These fil… |
CVE-2025-37729 | Critical | 9.1 | 2025-10-13 | Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltr… |
CVE-2025-6919 | Critical | 9.8 | 2025-10-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cats Information Technology Software Development Technolo… |
CVE-2025-9976 | Critical | 9.0 | 2025-10-13 | An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R20… |
CVE-2025-27258 | Critical | 9.8 | 2025-10-13 | Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result in an escalation of privilege. |
CVE-2025-6439 | Critical | 9.8 | 2025-10-11 | The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file del… |
CVE-2025-6553 | Critical | 9.8 | 2025-10-11 | The Ovatheme Events Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_checkout() function… |
CVE-2025-11533 | Critical | 9.8 | 2025-10-11 | The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() fu… |
CVE-2025-61929 | Critical | 9.6 | 2025-10-10 | Cherry Studio is a desktop client that supports for multiple LLM providers. Cherry Studio registers a custom protocol called `cherrystudio://`. When handling t… |
CVE-2025-60306 | Critical | 9.9 | 2025-10-10 | code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perform sensitive oper… |
CVE-2025-60269 | Critical | 9.4 | 2025-10-10 | JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExport… |
CVE-2025-60307 | Critical | 9.8 | 2025-10-10 | code-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where entering a universal password in the Password field on the login page can… |
CVE-2025-59286 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a n… |
CVE-2025-59272 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosur… |
CVE-2025-59252 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a n… |
CVE-2025-59246 | Critical | 9.8 | 2025-10-09 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-59218 | Critical | 9.6 | 2025-10-09 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-55321 | Critical | 9.3 | 2025-10-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an unauthorized attacker to perform spoofing over… |
CVE-2025-35051 | Critical | 9.8 | 2025-10-09 | Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attack… |
CVE-2025-35050 | Critical | 9.8 | 2025-10-09 | Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbi… |
CVE-2025-60316 | Critical | 9.4 | 2025-10-09 | SourceCodester Pet Grooming Management Software 1.0 is vulnerable to SQL Injection in admin/view_customer.php via the ID parameter. |
CVE-2025-59978 | Critical | 9.0 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to sto… |
CVE-2025-10284 | Critical | 9.6 | 2025-10-09 | BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote… |
CVE-2025-10283 | Critical | 9.6 | 2025-10-09 | BBOT's gitdumper module could be abused to execute commands through a malicious git repository. |
CVE-2025-56683 | Critical | 9.6 | 2025-10-09 | A cross-site scripting (XSS) vulnerability in the component /app/marketplace.html of Logseq v0.10.9 allows attackers to execute arbitrary code via injecting ar… |
CVE-2025-11539 | Critical | 9.9 | 2025-10-09 | Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoi… |
CVE-2025-11522 | Critical | 9.8 | 2025-10-09 | The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and includin… |
CVE-2025-7634 | Critical | 9.8 | 2025-10-09 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and inclu… |
CVE-2025-7526 | Critical | 9.8 | 2025-10-09 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion (via renaming) due to insuffi… |
CVE-2025-10586 | Critical | 9.8 | 2025-10-09 | The Community Events plugin for WordPress is vulnerable to SQL Injection via the ‘event_venue’ parameter in all versions up to, and including, 1.5.1 due to ins… |
CVE-2025-61913 | Critical | 9.9 | 2025-10-08 | Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise… |
CVE-2025-10587 | Critical | 9.8 | 2025-10-08 | The Community Events plugin for WordPress is vulnerable to SQL Injection via the event_category parameter in all versions up to, and including, 1.5.1 due to in… |
CVE-2025-11423 | Critical | 9.8 | 2025-10-08 | A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function formSafeEmailFilter of the file /goform/SafeEmailFilter. Performing a manipulation o… |
CVE-2025-11418 | Critical | 9.8 | 2025-10-08 | A security vulnerability has been detected in Tenda CH22 up to 1.0.0.1. This issue affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of… |
CVE-2025-44823 | Critical | 9.9 | 2025-10-07 | Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_us… |
CVE-2025-3450 | Critical | 10.0 | 2025-10-07 | An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated net… |
CVE-2025-52021 | Critical | 9.8 | 2025-10-07 | A SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0. The product_id GET parameter is unsafe… |
CVE-2023-53629 | Critical | 9.8 | 2025-10-07 | In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in… |
CVE-2025-0603 | Critical | 9.8 | 2025-10-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Callvision Healthcare Callvision Emergency Code allows SQ… |
CVE-2025-57515 | Critical | 9.8 | 2025-10-06 | A SQL injection vulnerability has been identified in Uniclare Student Portal v2. This flaw allows remote attackers to inject arbitrary SQL commands via vulnera… |
CVE-2025-61777 | Critical | 9.4 | 2025-10-06 | Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/b… |
CVE-2025-60965 | Critical | 9.1 | 2025-10-06 | OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary… |
CVE-2025-60964 | Critical | 9.1 | 2025-10-06 | OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary… |
CVE-2025-60957 | Critical | 9.9 | 2025-10-06 | OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary… |
CVE-2025-57247 | Critical | 9.1 | 2025-10-06 | The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorrect access control i… |
CVE-2025-36356 | Critical | 9.3 | 2025-10-06 | IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated us… |
CVE-2025-59159 | Critical | 9.6 | 2025-10-06 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2023-49886 | Critical | 9.8 | 2025-10-06 | IBM Standards Processing Engine 10.0.1.10 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe java deserialization. By s… |
CVE-2025-61882 | Critical | 9.8 | 2025-10-05 | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affect… |
CVE-2023-53600 | Critical | 9.1 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp error… |
CVE-2025-39948 | Critical | 9.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: ice: fix Rx page leak on multi-buffer frames The ice_put_rx_mbuf() function handles calli… |
CVE-2025-39946 | Critical | 9.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abort the stream if headers are bogus Normally we wait for the socket t… |
CVE-2025-39943 | Critical | 9.4 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer … |
CVE-2025-39933 | Critical | 9.4 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This… |
CVE-2025-39932 | Critical | 9.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) In… |
CVE-2025-9485 | Critical | 9.8 | 2025-10-04 | The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and inc… |
CVE-2025-49844 | Critical | 9.9 | 2025-10-03 | Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script t… |
CVE-2025-9286 | Critical | 9.8 | 2025-10-03 | The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() R… |
CVE-2025-9209 | Critical | 9.8 | 2025-10-03 | The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plug… |
CVE-2025-7721 | Critical | 9.8 | 2025-10-03 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includ… |
CVE-2025-10726 | Critical | 9.1 | 2025-10-03 | The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. This is due to insuf… |
CVE-2025-10547 | Critical | 9.8 | 2025-10-03 | An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform R… |
CVE-2025-6388 | Critical | 9.8 | 2025-10-03 | The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_action… |
CVE-2025-61605 | Critical | 9.8 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerability which was identif… |
CVE-2025-61603 | Critical | 9.8 | 2025-10-02 | WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in the /controle/cont… |
CVE-2025-59407 | Critical | 9.8 | 2025-10-02 | The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and… |
CVE-2025-59403 | Critical | 9.8 | 2025-10-02 | The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentication. It is responsible for the camera f… |
CVE-2025-59743 | Critical | 9.8 | 2025-10-02 | SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending… |
CVE-2025-59742 | Critical | 9.8 | 2025-10-02 | SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending… |
CVE-2025-59741 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59740 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59739 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59738 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59737 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59736 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-59735 | Critical | 9.8 | 2025-10-02 | Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the s… |
CVE-2025-9697 | Critical | 9.8 | 2025-10-02 | The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action avail… |
CVE-2025-59951 | Critical | 9.1 | 2025-10-01 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image for Termix versions 1… |
CVE-2025-8679 | Critical | 9.8 | 2025-10-01 | In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials… |
CVE-2025-61045 | Critical | 9.8 | 2025-10-01 | TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function. |
CVE-2025-61044 | Critical | 9.8 | 2025-10-01 | TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg functio… |
CVE-2023-53517 | Critical | 9.8 | 2025-10-01 | In the Linux kernel, the following vulnerability has been resolved: tipc: do not update mtu if msg_max is too small in mtu negotiation When doing link mtu ne… |
CVE-2025-61622 | Critical | 9.8 | 2025-10-01 | Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary… |
CVE-2020-36852 | Critical | 9.1 | 2025-10-01 | The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a… |
CVE-2025-10659 | Critical | 9.8 | 2025-09-30 | The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input… |
CVE-2025-56513 | Critical | 9.8 | 2025-09-30 | NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. An attacker capable of intercepting or redi… |
CVE-2025-10725 | Critical | 9.9 | 2025-09-30 | A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a st… |
CVE-2025-7493 | Critical | 9.1 | 2025-09-30 | A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate… |
CVE-2025-34217 | Critical | 9.8 | 2025-09-30 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) contain an undocumented 'printerlogic' user with a hardcoded… |
CVE-2025-9762 | Critical | 9.8 | 2025-09-30 | The Post By Email plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save_attachments function in all vers… |
CVE-2025-8625 | Critical | 9.8 | 2025-09-30 | The Copypress Rest API plugin for WordPress is vulnerable to Remote Code Execution via copyreap_handle_image() Function in versions 1.1 to 1.2. The plugin fall… |
CVE-2025-8120 | Critical | 9.8 | 2025-09-30 | Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to upload files of any type… |
CVE-2025-7065 | Critical | 9.8 | 2025-09-30 | Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenticated remote attacker to upload files of any type… |