Critical-severity CVEs (page 79)
Page 79 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47568 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds dzs-zoomsounds allows Object Injection.This issue affects ZoomSounds: from n/a through <=… |
CVE-2025-47539 | Critical | 9.8 | 2025-05-23 | Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through <=… |
CVE-2025-47532 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in CoinPayments CoinPayments.net Payment Gateway for WooCommerce coinpayments-payment-gateway-for-woocommerce a… |
CVE-2025-47530 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels wpfunnels allows Object Injection.This issue affects WPFunnels: from n/a through <= 3.5… |
CVE-2025-46539 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFable Fable Extra fable-extra allows Blind SQL Injectio… |
CVE-2025-46490 | Critical | 9.9 | 2025-05-23 | Unrestricted Upload of File with Dangerous Type vulnerability in wordwebsoftware Crossword Compiler Puzzles crossword-compiler-puzzles allows Upload a Web Shel… |
CVE-2025-46468 | Critical | 9.8 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPFable Fable Extra fable-extra allows… |
CVE-2025-46460 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Detheme Easy Guide wp-easy-guide allows SQL Injection.Thi… |
CVE-2025-46455 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IndigoThemes WP HRM LITE wp-hrm-lite-human-resource-manag… |
CVE-2025-39504 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Blind SQL I… |
CVE-2025-39503 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Object Injection.This issue affects Goodlayers Hotel: from n/a… |
CVE-2025-39501 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Blind SQL… |
CVE-2025-39500 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Object Injection.This issue affects Goodlayers Hostel: from… |
CVE-2025-39499 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in BoldThemes Medicare medicare allows Object Injection.This issue affects Medicare: from n/a through <= 2.1.0. |
CVE-2025-39495 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in BoldThemes Avantage avantage allows Object Injection.This issue affects Avantage: from n/a through <= 2.4.9. |
CVE-2025-39489 | Critical | 9.8 | 2025-05-23 | Incorrect Privilege Assignment vulnerability in pebas CouponXL couponxl allows Privilege Escalation.This issue affects CouponXL: from n/a through <= 4.5.0. |
CVE-2025-39485 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.This issue affects Grand Tour: from n/a through <= 5… |
CVE-2025-39480 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in ThemeMakers Car Dealer cardealer allows Object Injection.This issue affects Car Dealer: from n/a through < 1… |
CVE-2025-32292 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in AncoraThemes Jarvis – Night Club, Concert, Festival WordPress jarvis allows Object Injection.This issue affe… |
CVE-2025-31927 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in themeton Acerola allows Object Injection. This issue affects Acerola: from n/a through 1.6.5. |
CVE-2025-31918 | Critical | 9.8 | 2025-05-23 | Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege Escalation.This issue… |
CVE-2025-31916 | Critical | 9.0 | 2025-05-23 | Unrestricted Upload of File with Dangerous Type vulnerability in joy2012bd JP Students Result Management System Premium allows Upload a Web Shell to a Web Serv… |
CVE-2025-31914 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autores… |
CVE-2025-31631 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in AncoraThemes Fish House fish-house allows Object Injection.This issue affects Fish House: from n/a through <… |
CVE-2025-31430 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in themeton The Business allows Object Injection. This issue affects The Business: from n/a through 1.6.1. |
CVE-2025-31423 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in AncoraThemes Umberto umberto allows Object Injection.This issue affects Umberto: from n/a through <= 1.2.8. |
CVE-2025-31397 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartcms Bus Ticket Booking with Seat Reservation for Woo… |
CVE-2025-31069 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Object Injection. This issue affects HotStar – Multi-… |
CVE-2025-31056 | Critical | 9.3 | 2025-05-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn WhatsCart - Whatsapp Abandoned Cart Recovery, O… |
CVE-2025-31049 | Critical | 9.8 | 2025-05-23 | Deserialization of Untrusted Data vulnerability in themeton Dash allows Object Injection. This issue affects Dash: from n/a through 1.3. |
CVE-2025-5099 | Critical | 9.8 | 2025-05-23 | An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory corruption and potentially arbitrary cod… |
CVE-2025-5098 | Critical | 9.1 | 2025-05-23 | PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account without proper authoriza… |
CVE-2025-48373 | Critical | 9.1 | 2025-05-22 | Schule is open-source school management system software. The application relies on client-side JavaScript (index.js) to redirect users to different panels base… |
CVE-2024-6914 | Critical | 9.8 | 2025-05-22 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A ma… |
CVE-2024-41198 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pac… |
CVE-2024-41197 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pa… |
CVE-2024-41196 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TC… |
CVE-2024-41195 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a craft… |
CVE-2025-30171 | Critical | 9.0 | 2025-05-22 | System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become compromised. This is… |
CVE-2025-2410 | Critical | 9.1 | 2025-05-22 | Port manipulation vulnerabilities in ASPECT provide attackers with the ability to con-trol TCP/IP port access if session administrator credentials become compr… |
CVE-2025-2409 | Critical | 9.1 | 2025-05-22 | File corruption vulnerabilities in ASPECT provide attackers access to overwrite sys-tem files if session administrator credentials become compromised This issu… |
CVE-2024-48853 | Critical | 9.0 | 2025-05-22 | An escalation of privilege vulnerability in ASPECT could provide an attacker root access to a server when logged in as a "non" root ASPECT user. This issue aff… |
CVE-2025-32814 | Critical | 9.8 | 2025-05-22 | An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur. |
CVE-2025-3484 | Critical | 9.8 | 2025-05-22 | MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-46412 | Critical | 9.8 | 2025-05-21 | Affected Vertiv products do not properly protect webserver functions that could allow an attacker to bypass authentication. |
CVE-2025-41426 | Critical | 9.8 | 2025-05-21 | Affected Vertiv products contain a stack based buffer overflow vulnerability. An attacker could exploit this vulnerability to gain code execution on the device. |
CVE-2025-36535 | Critical | 10.0 | 2025-05-21 | The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration changes, operational di… |
CVE-2025-44083 | Critical | 9.8 | 2025-05-21 | An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authentication |
CVE-2025-27558 | Critical | 9.1 | 2025-05-21 | IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equi… |
CVE-2025-48200 | Critical | 10.0 | 2025-05-21 | The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. |
CVE-2025-41232 | Critical | 9.1 | 2025-05-21 | Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may… |
CVE-2025-4524 | Critical | 9.8 | 2025-05-21 | The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and includi… |
CVE-2025-4094 | Critical | 9.8 | 2025-05-21 | The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for… |
CVE-2025-44898 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the theauthName parameter in the web_aaa_loginAuthlistEdit function. |
CVE-2025-44897 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bytftp_srvip parameter in the web_tool_upgradeManager_post function. |
CVE-2025-44896 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bindEditMACName parameter in the web_acl_bindEdit_post function. |
CVE-2025-44894 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the radDftParamKey parameter in the web_radiusSrv_dftParam_post function. |
CVE-2025-44891 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the host_ip parameter in the web_snmp_v3host_add_post function. |
CVE-2025-44883 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the tacIp parameter in the web_tacplus_serverEdit_post function. |
CVE-2025-44882 | Critical | 9.8 | 2025-05-20 | A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafte… |
CVE-2025-44880 | Critical | 9.8 | 2025-05-20 | A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted inp… |
CVE-2025-44893 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ruleNamekey parameter in the web_acl_mgmt_Rules_Apply_post function. |
CVE-2025-44890 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the host_ip parameter in the web_snmp_notifyv3_add_post function. |
CVE-2025-44888 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the stp_conf_name parameter in the web_stp_globalSetting_post function. |
CVE-2025-44887 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the radIpkey parameter in the web_radiusSrv_post function. |
CVE-2025-44886 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the byruleEditName parameter in the web_acl_mgmt_Rules_Edit_postcontains function. |
CVE-2025-44885 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the remote_ip parameter in the web_snmpv3_remote_engineId_add_post function. |
CVE-2025-44884 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the web_sys_infoContact_post function. |
CVE-2025-44881 | Critical | 9.8 | 2025-05-20 | A command injection vulnerability in the component /cgi-bin/qos.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted inp… |
CVE-2025-47277 | Critical | 9.8 | 2025-05-20 | vLLM, an inference and serving engine for large language models (LLMs), has an issue in versions 0.6.5 through 0.8.4 that ONLY impacts environments using the `… |
CVE-2025-46725 | Critical | 9.8 | 2025-05-20 | Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `LanceDocChatAgent` uses pandas eval() throu… |
CVE-2025-46724 | Critical | 9.8 | 2025-05-20 | Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `TableChatAgent` uses `pandas eval()`. If fe… |
CVE-2025-44084 | Critical | 9.8 | 2025-05-20 | D-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests, triggering the com… |
CVE-2025-48017 | Critical | 9.0 | 2025-05-20 | Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of files |
CVE-2025-37959 | Critical | 9.4 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redirect_peer When bpf_redirect_peer is used to redirect packets… |
CVE-2025-37935 | Critical | 9.8 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM If the mtk_poll_rx() function det… |
CVE-2025-37924 | Critical | 9.8 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in kerberos authentication Setting sess->user = NULL was introd… |
CVE-2025-37894 | Critical | 9.8 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: net: use sock_gen_put() when sk_state is TCP_TIME_WAIT It is possible for a pointer of ty… |
CVE-2025-4978 | Critical | 9.8 | 2025-05-20 | A vulnerability, which was classified as very critical, was found in Netgear DGND3700 1.1.00.15_1.00.15NA. This affects an unknown part of the file /BRS_top.ht… |
CVE-2025-4322 | Critical | 9.8 | 2025-05-20 | The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the them… |
CVE-2025-48340 | Critical | 9.8 | 2025-05-19 | Cross-Site Request Forgery (CSRF) vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows Privilege Escalation.This issue affects User P… |
CVE-2025-39402 | Critical | 9.9 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2025-39401 | Critical | 10.0 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2025-39395 | Critical | 9.3 | 2025-05-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection… |
CVE-2025-39389 | Critical | 9.3 | 2025-05-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solid Plugins AnalyticsWP allows SQL Injection.This issue… |
CVE-2025-39386 | Critical | 9.3 | 2025-05-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla Hospital Management System hospital-management a… |
CVE-2025-39380 | Critical | 10.0 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System hospital-management allows Upload a Web Shell to a Web Ser… |
CVE-2025-39356 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in Chimpstudio Foodbakery Sticky Cart foodbakery-sticky-cart allows Object Injection.This issue affects Foodbak… |
CVE-2025-39354 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference grandconference allows Object Injection.This issue affects Grand Conference: fro… |
CVE-2025-39349 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in Potenzaglobalsolutions CiyaShop ciyashop allows Object Injection.This issue affects CiyaShop: from n/a throu… |
CVE-2025-39348 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: fro… |
CVE-2025-32928 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in ThemeGoods Altair altair allows Object Injection.This issue affects Altair: from n/a through <= 5.2.2. |
CVE-2025-32927 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in Chimpstudio FoodBakery wp-foodbakery allows Object Injection.This issue affects FoodBakery: from n/a through… |
CVE-2025-32926 | Critical | 9.8 | 2025-05-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Path Travers… |
CVE-2025-47581 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Object Injection.This issue af… |
CVE-2025-47577 | Critical | 10.0 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to… |
CVE-2025-47284 | Critical | 9.9 | 2025-05-19 | Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the `gardenlet` comp… |
CVE-2025-47283 | Critical | 9.9 | 2025-05-19 | Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to ve… |
CVE-2025-39445 | Critical | 9.3 | 2025-05-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp allows… |
CVE-2025-39410 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in themegusta Smart Sections Theme Builder - WPBakery Page Builder Addon.This issue affects Smart Sections Them… |