Critical-severity CVEs (page 69)
Page 69 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55583 | Critical | 9.8 | 2025-08-28 | D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endp… |
CVE-2025-54738 | Critical | 9.8 | 2025-08-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobmonster noo-jobmonster allows Authentication Abuse.This issue affects Job… |
CVE-2025-54725 | Critical | 9.8 | 2025-08-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo golo allows Authentication Abuse.This issue affects Golo: from n/a through… |
CVE-2025-54720 | Critical | 9.3 | 2025-08-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SteelThemes Nest Addons nest-addons allows SQL Injection… |
CVE-2025-52761 | Critical | 9.8 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in manfcarlo WP Funnel Manager wp-funnel-manager allows Object Injection.This issue affects WP Funnel Manager… |
CVE-2025-49388 | Critical | 9.8 | 2025-08-28 | Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Privilege Escalation.This issue affects Miraculous Co… |
CVE-2025-49387 | Critical | 10.0 | 2025-08-28 | Unrestricted Upload of File with Dangerous Type vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elemen… |
CVE-2025-48100 | Critical | 9.1 | 2025-08-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Remote Code Inc… |
CVE-2025-39496 | Critical | 9.3 | 2025-08-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WooBeWoo Product Filter Pro allows SQL Injection.This… |
CVE-2024-58240 | Critical | 9.8 | 2025-08-28 | In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, t… |
CVE-2025-54762 | Critical | 9.8 | 2025-08-28 | SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands wi… |
CVE-2025-53970 | Critical | 9.8 | 2025-08-28 | SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands wi… |
CVE-2025-7955 | Critical | 9.8 | 2025-08-28 | The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_ve… |
CVE-2025-34523 | Critical | 9.8 | 2025-08-27 | A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP). This flaw is reachab… |
CVE-2025-34522 | Critical | 9.8 | 2025-08-27 | A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Data Protection (UDP). This flaw can be triggered without auth… |
CVE-2025-34520 | Critical | 9.8 | 2025-08-27 | An authentication bypass vulnerability in Arcserve Unified Data Protection (UDP) allows unauthenticated attackers to gain unauthorized access to protected func… |
CVE-2024-13979 | Critical | 9.8 | 2025-08-27 | A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via c… |
CVE-2018-25115 | Critical | 9.8 | 2025-08-27 | Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability… |
CVE-2025-58050 | Critical | 9.1 | 2025-08-27 | The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exist… |
CVE-2025-50428 | Critical | 9.8 | 2025-08-27 | In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script. The vulnerability is due to improper sa… |
CVE-2025-34157 | Critical | 9.0 | 2025-08-27 | Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated use… |
CVE-2025-52122 | Critical | 9.8 | 2025-08-27 | Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection… |
CVE-2025-50989 | Critical | 9.1 | 2025-08-27 | OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span P… |
CVE-2025-50972 | Critical | 9.8 | 2025-08-27 | SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmpl_id parameter to index.php. Thr… |
CVE-2025-43728 | Critical | 9.6 | 2025-08-27 | Dell ThinOS 10, versions prior to 2508_10.0127, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could pote… |
CVE-2025-9523 | Critical | 9.8 | 2025-08-27 | A vulnerability was detected in Tenda AC1206 15.03.06.23. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulat… |
CVE-2025-22408 | Critical | 9.8 | 2025-08-26 | In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with… |
CVE-2025-22403 | Critical | 9.8 | 2025-08-26 | In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code ex… |
CVE-2025-0075 | Critical | 9.8 | 2025-08-26 | In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code… |
CVE-2025-0074 | Critical | 9.8 | 2025-08-26 | In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code exec… |
CVE-2025-55443 | Critical | 9.1 | 2025-08-26 | Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details (IP/port) that are stored in plaintext w… |
CVE-2025-52353 | Critical | 9.8 | 2025-08-26 | An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via t… |
CVE-2024-39335 | Critical | 9.1 | 2025-08-26 | Supported versions of Mahara 24.04 before 24.04.1 and 23.04 before 23.04.6 are vulnerable to information being disclosed to an institution administrator under… |
CVE-2025-55526 | Critical | 9.1 | 2025-08-26 | n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function within api_server.py |
CVE-2025-7776 | Critical | 9.8 | 2025-08-26 | Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is con… |
CVE-2025-7775 | Critical | 9.8 | 2025-08-26 | Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as… |
CVE-2025-41702 | Critical | 9.8 | 2025-08-26 | The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 toke… |
CVE-2025-57773 | Critical | 9.8 | 2025-08-25 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injecti… |
CVE-2025-57772 | Critical | 9.8 | 2025-08-25 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC… |
CVE-2025-53120 | Critical | 9.4 | 2025-08-25 | A path traversal vulnerability in unauthenticated upload functionality allows a malicious actor to upload binaries and scripts to the server’s configuration an… |
CVE-2025-50722 | Critical | 9.8 | 2025-08-25 | Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to execute arbitrary code via the Common.php component |
CVE-2025-55575 | Critical | 9.8 | 2025-08-25 | SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=service_detail. |
CVE-2025-53118 | Critical | 9.8 | 2025-08-25 | An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of pass… |
CVE-2025-56214 | Critical | 9.8 | 2025-08-25 | phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in index.php via the username parameter. |
CVE-2025-56212 | Critical | 9.8 | 2025-08-25 | phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in add-doctor.php via the docname parameter. |
CVE-2025-50900 | Critical | 9.8 | 2025-08-25 | An issue was discovered in getrebuild/rebuild 4.0.4. The affected source code class is com.rebuild.web.RebuildWebInterceptor, and the affected function is preH… |
CVE-2025-54494 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54493 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54492 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54491 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54490 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54489 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54488 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54487 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54486 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54485 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54484 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54483 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54482 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54481 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54480 | Critical | 9.8 | 2025-08-25 | A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-54462 | Critical | 9.8 | 2025-08-25 | A heap-based buffer overflow vulnerability exists in the Nex parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specia… |
CVE-2025-53853 | Critical | 9.8 | 2025-08-25 | A heap-based buffer overflow vulnerability exists in the ISHNE parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A spec… |
CVE-2025-53557 | Critical | 9.8 | 2025-08-25 | A heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A speci… |
CVE-2025-53518 | Critical | 9.8 | 2025-08-25 | An integer overflow vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially craft… |
CVE-2025-53511 | Critical | 9.8 | 2025-08-25 | A heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A speci… |
CVE-2025-52581 | Critical | 9.8 | 2025-08-25 | An integer overflow vulnerability exists in the GDF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially craft… |
CVE-2025-48005 | Critical | 9.8 | 2025-08-25 | A heap-based buffer overflow vulnerability exists in the RHS2000 parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A sp… |
CVE-2025-45968 | Critical | 9.8 | 2025-08-25 | An issue in System PDV v1.0 allows a remote attacker to obtain sensitive information via the hash parameter in a URL. The application contains an Insecure Dire… |
CVE-2025-29515 | Critical | 9.8 | 2025-08-25 | Incorrect access control in the DELT_file.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settin… |
CVE-2025-29514 | Critical | 9.8 | 2025-08-25 | Incorrect access control in the config.xgi function of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to download the configuration… |
CVE-2025-36157 | Critical | 9.8 | 2025-08-24 | IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server… |
CVE-2025-5821 | Critical | 9.8 | 2025-08-23 | The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.3. This is due to the plugin not prop… |
CVE-2025-5352 | Critical | 9.6 | 2025-08-23 | A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_C… |
CVE-2025-7642 | Critical | 9.8 | 2025-08-23 | The Simpler Checkout plugin for WordPress is vulnerable to Authentication Bypass in versions 0.7.0 to 1.1.9. This is due to the plugin not properly verifying a… |
CVE-2025-43766 | Critical | 9.8 | 2025-08-23 | The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12… |
CVE-2025-4609 | Critical | 9.6 | 2025-08-22 | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially per… |
CVE-2025-26496 | Critical | 9.3 | 2025-08-22 | Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload module… |
CVE-2025-57801 | Critical | 9.1 | 2025-08-22 | gnark is a zero-knowledge proof system framework. In versions prior to 0.14.0, the Verify function in eddsa.go and ecdsa.go used the S value from a signature w… |
CVE-2022-43110 | Critical | 9.8 | 2025-08-22 | Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web… |
CVE-2022-31491 | Critical | 10.0 | 2025-08-22 | Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to run arbit… |
CVE-2025-51092 | Critical | 9.8 | 2025-08-22 | The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. The functions logIn() and… |
CVE-2022-45134 | Critical | 9.8 | 2025-08-22 | Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely during skin import. A particularly structured XML… |
CVE-2025-55613 | Critical | 9.8 | 2025-08-22 | Tenda O3V2 1.0.0.12(3880) is vulnerable to Buffer Overflow in the fromSafeSetMacFilter function via the mac parameter. |
CVE-2024-53499 | Critical | 9.8 | 2025-08-22 | Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API. |
CVE-2024-53496 | Critical | 9.8 | 2025-08-22 | Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication. |
CVE-2024-52786 | Critical | 9.8 | 2025-08-22 | An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL. |
CVE-2024-50645 | Critical | 9.8 | 2025-08-22 | MallChat v1.0-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token. |
CVE-2025-57105 | Critical | 9.8 | 2025-08-22 | The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device. The sub_478D28 function in in m… |
CVE-2025-55637 | Critical | 9.8 | 2025-08-22 | Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to contain a command injection vulnerability via the… |
CVE-2025-55619 | Critical | 9.8 | 2025-08-22 | Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decry… |
CVE-2025-55398 | Critical | 9.8 | 2025-08-22 | An issue was discovered in mouse07410 asn1c thru 0.9.29 (2025-03-20) - a fork of vlm asn1c. In UPER (Unaligned Packed Encoding Rules), asn1c-generated decoders… |
CVE-2024-50644 | Critical | 9.8 | 2025-08-22 | zhisheng17 blog 3.0.1-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token. |
CVE-2025-52095 | Critical | 9.8 | 2025-08-22 | An issue in PDQ Smart Deploy V.3.0.2040 allows an attacker to escalate privileges via the Credential encryption routines in SDCommon.dll |
CVE-2025-38660 | Critical | 9.8 | 2025-08-22 | In the Linux kernel, the following vulnerability has been resolved: [ceph] parse_longname(): strrchr() expects NUL-terminated string ... and parse_longname()… |
CVE-2025-29366 | Critical | 9.8 | 2025-08-22 | In mupen64plus v2.6.0 there is an array overflow vulnerability in the write_rdram_regs and write_rdram_regs functions, which enables executing arbitrary comman… |
CVE-2025-29365 | Critical | 9.8 | 2025-08-22 | spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in READ_STRING_SYSCALL. |
CVE-2025-9254 | Critical | 9.8 | 2025-08-22 | WebITR developed by Uniong has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to log into the system as arbitrary users by e… |
CVE-2010-20113 | Critical | 9.8 | 2025-08-21 | EasyFTP Server 1.7.0.11 and earlier contains a stack-based buffer overflow vulnerability in its HTTP interface. When processing a GET request to list.html, the… |
CVE-2025-53795 | Critical | 9.1 | 2025-08-21 | Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network. |