Critical-severity CVEs (page 87)
Page 87 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11958 | Critical | 9.8 | 2025-03-20 | A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version. The vulne… |
CVE-2024-11045 | Critical | 9.6 | 2025-03-20 | A Cross-Site WebSocket Hijacking (CSWSH) vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows an attacker to clone a malicious server ex… |
CVE-2024-11042 | Critical | 9.1 | 2025-03-20 | In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized… |
CVE-2024-11041 | Critical | 9.8 | 2025-03-20 | vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets… |
CVE-2024-10902 | Critical | 9.8 | 2025-03-20 | In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerabil… |
CVE-2024-10901 | Critical | 9.8 | 2025-03-20 | In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/chart/run` allows execution of arbitrary SQL queries without any access control. This v… |
CVE-2024-10835 | Critical | 9.8 | 2025-03-20 | In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. This vul… |
CVE-2024-10834 | Critical | 9.1 | 2025-03-20 | eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. The issue arises from the abilit… |
CVE-2024-10833 | Critical | 9.1 | 2025-03-20 | eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is suscep… |
CVE-2024-10831 | Critical | 9.1 | 2025-03-20 | In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to uploa… |
CVE-2024-10553 | Critical | 9.8 | 2025-03-20 | A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untruste… |
CVE-2024-10361 | Critical | 9.1 | 2025-03-20 | An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability ar… |
CVE-2024-10264 | Critical | 9.8 | 2025-03-20 | HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP reques… |
CVE-2024-10190 | Critical | 9.8 | 2025-03-20 | Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-e… |
CVE-2024-47552 | Critical | 9.8 | 2025-03-20 | Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0. … |
CVE-2025-2505 | Critical | 9.8 | 2025-03-20 | The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it… |
CVE-2024-12016 | Critical | 9.8 | 2025-03-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CM Informatics CM News allows SQL Injection. This issue… |
CVE-2025-27786 | Critical | 9.1 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file removal in core.py. `output_tts_path` in tts.py takes arbit… |
CVE-2025-27783 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in train.py. This issue may lead to writing arbitrary… |
CVE-2025-27782 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in inference.py. This issue may lead to writing arbit… |
CVE-2025-27781 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in inference.py. `model_file` in inference.py as we… |
CVE-2025-27780 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in model_information.py. `model_name` in model_info… |
CVE-2025-27779 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in `model_blender.py` lines 20 and 21. `model_fusio… |
CVE-2025-27778 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in `infer.py`. The issue can lead to remote code ex… |
CVE-2024-57061 | Critical | 9.8 | 2025-03-19 | An issue in Termius Version 9.9.0 through v.9.16.0 allows a physically proximate attacker to execute arbitrary code via the insecure Electron Fuses configurati… |
CVE-2025-29926 | Critical | 9.8 | 2025-03-19 | XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where th… |
CVE-2025-29783 | Critical | 9.0 | 2025-03-19 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed d… |
CVE-2025-29401 | Critical | 9.8 | 2025-03-19 | An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2025-29137 | Critical | 9.8 | 2025-03-19 | Tenda AC7 V1.0 V15.03.06.44 found a buffer overflow caused by the timeZone parameter in the form_fast_setting_wifi_set function, which can cause RCE. |
CVE-2025-2512 | Critical | 9.8 | 2025-03-19 | The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the upload() f… |
CVE-2024-13442 | Critical | 9.8 | 2025-03-19 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.0. This is… |
CVE-2024-13790 | Critical | 9.8 | 2025-03-19 | The MinimogWP – The High Converting eCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3… |
CVE-2024-13410 | Critical | 9.8 | 2025-03-19 | The CozyStay and TinySalt plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.7.0, and in all versions up to… |
CVE-2024-12922 | Critical | 9.8 | 2025-03-19 | The Altair theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check withi… |
CVE-2024-11131 | Critical | 9.8 | 2025-03-19 | A vulnerability regarding out-of-bounds read is found in the video interface. This allows remote attackers to execute arbitrary code via unspecified vectors. T… |
CVE-2024-10442 | Critical | 10.0 | 2025-03-19 | Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified… |
CVE-2024-10441 | Critical | 9.8 | 2025-03-19 | Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Man… |
CVE-2025-30139 | Critical | 9.8 | 2025-03-18 | An issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts a fixed SSID with default credentials t… |
CVE-2025-30137 | Critical | 9.8 | 2025-03-18 | An issue was discovered in the G-Net GNET APK 2.6.2. Hardcoded credentials exist in in APK for ports 9091 and 9092. The GNET mobile application contains hardco… |
CVE-2025-21619 | Critical | 9.8 | 2025-03-18 | GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerabi… |
CVE-2025-25595 | Critical | 9.8 | 2025-03-18 | A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack. |
CVE-2024-56347 | Critical | 9.6 | 2025-03-18 | IBM AIX 7.2 and 7.3 nimsh service SSL/TLS protection mechanisms could allow a remote attacker to execute arbitrary commands due to improper process controls. |
CVE-2024-56346 | Critical | 10.0 | 2025-03-18 | IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improper process controls. |
CVE-2024-57169 | Critical | 9.8 | 2025-03-18 | A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php. This vulnerability allows remote attackers to bypass uplo… |
CVE-2025-30132 | Critical | 9.1 | 2025-03-18 | An issue was discovered on IROAD Dashcam V devices. It uses an unregistered public domain name as an internal domain, creating a security risk. During analysis… |
CVE-2025-30123 | Critical | 9.8 | 2025-03-18 | An issue was discovered on ROADCAM X3 devices. The mobile app APK (Viidure) contains hardcoded FTP credentials for the FTPX user account, enabling attackers to… |
CVE-2025-30122 | Critical | 9.8 | 2025-03-18 | An issue was discovered on ROADCAM X3 devices. It has a uniform default credential set that cannot be modified by users, making it easy for attackers to gain u… |
CVE-2025-30115 | Critical | 9.8 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Default Credentials Cannot Be Changed. It uses a fixed default SSID and password ("q… |
CVE-2025-30114 | Critical | 9.1 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Bypassing of Device Pairing can occur. The pairing mechanism relies solely on the co… |
CVE-2025-30113 | Critical | 9.8 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Hardcoded Credentials exist in the APK for Ports 9091 and 9092. The dashcam's Androi… |
CVE-2024-8997 | Critical | 9.8 | 2025-03-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Vestel EVC04 Configuration Interface allows SQL Injection… |
CVE-2023-47539 | Critical | 9.8 | 2025-03-18 | An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may allow a remote unauth… |
CVE-2025-2494 | Critical | 9.8 | 2025-03-18 | Unrestricted file upload to Softdial Contact Center of Sytel Ltd. This vulnerability could allow an attacker to upload files to the server via the ‘/softdial/p… |
CVE-2024-23943 | Critical | 9.1 | 2025-03-18 | An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availabili… |
CVE-2025-29913 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29912 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29911 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29909 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-25914 | Critical | 9.8 | 2025-03-17 | SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter |
CVE-2025-25650 | Critical | 9.1 | 2025-03-17 | An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC cards to bypass authentica… |
CVE-2024-12992 | Critical | 9.8 | 2025-03-17 | Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection via RCE. This issue affects Pandora FMS from 700 to 7… |
CVE-2025-2395 | Critical | 9.8 | 2025-03-17 | The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter… |
CVE-2025-2345 | Critical | 9.8 | 2025-03-16 | A vulnerability, which was classified as very critical, was found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. This affects an unknown part. The manipu… |
CVE-2025-26875 | Critical | 9.3 | 2025-03-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address Fo… |
CVE-2025-1771 | Critical | 9.8 | 2025-03-15 | The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' functio… |
CVE-2025-29386 | Critical | 9.8 | 2025-03-14 | In Tenda AC9 v1.0 V15.03.05.14_multi, the mac parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code… |
CVE-2025-29385 | Critical | 9.8 | 2025-03-14 | In Tenda AC9 v1.0 V15.03.05.14_multi, the cloneType parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary… |
CVE-2025-29384 | Critical | 9.8 | 2025-03-14 | In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary co… |
CVE-2025-29031 | Critical | 9.8 | 2025-03-14 | Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the fromAddressNat function. |
CVE-2025-29030 | Critical | 9.8 | 2025-03-14 | Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formWifiWpsOOB function. |
CVE-2025-29029 | Critical | 9.8 | 2025-03-14 | Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formSetSpeedWan function. |
CVE-2025-2000 | Critical | 9.8 | 2025-03-14 | A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY formats < 13. A… |
CVE-2025-27595 | Critical | 9.8 | 2025-03-14 | The device uses a weak hashing alghorithm to create the password hash. Hence, a matching password can be easily calculated by an attacker. This impacts the sec… |
CVE-2025-27593 | Critical | 9.3 | 2025-03-14 | The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target… |
CVE-2025-2232 | Critical | 9.8 | 2025-03-14 | The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, an… |
CVE-2024-13771 | Critical | 9.8 | 2025-03-14 | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including… |
CVE-2024-13824 | Critical | 9.8 | 2025-03-14 | The CiyaShop - Multipurpose WooCommerce Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.19.0 via deseri… |
CVE-2024-11286 | Critical | 9.8 | 2025-03-14 | The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to the plugin not properly ve… |
CVE-2024-11285 | Critical | 9.8 | 2025-03-14 | The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 7.1. This is due to the pl… |
CVE-2024-11284 | Critical | 9.8 | 2025-03-14 | The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.9. This is due to the pl… |
CVE-2025-26163 | Critical | 9.8 | 2025-03-14 | CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the CPF parameter. |
CVE-2025-2263 | Critical | 9.8 | 2025-03-13 | During login to the web server in "Sante PACS Server.exe", OpenSSL function EVP_DecryptUpdate is called to decrypt the username and password. A fixed 0x80-byte… |
CVE-2025-27138 | Critical | 9.8 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease… |
CVE-2025-25292 | Critical | 9.8 | 2025-03-12 | ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior… |
CVE-2025-25291 | Critical | 9.8 | 2025-03-12 | ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior… |
CVE-2025-27407 | Critical | 9.0 | 2025-03-12 | graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21… |
CVE-2025-25568 | Critical | 9.8 | 2025-03-12 | SoftEtherVPN 5.02.5187 is vulnerable to Use after Free in the Command.c file via the CheckNetworkAcceptThread function. NOTE: the Supplier disputes this becaus… |
CVE-2025-25567 | Critical | 9.8 | 2025-03-12 | SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in Internat.c via the UniToStrForSingleChars function. NOTE: the Supplier disputes this because the be… |
CVE-2025-25565 | Critical | 9.8 | 2025-03-12 | SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in the Command.c file via the PtMakeCert and PtMakeCert2048 functions. NOTE: the Supplier disputes thi… |
CVE-2025-1960 | Critical | 9.8 | 2025-03-12 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a syste… |
CVE-2025-22954 | Critical | 10.0 | 2025-03-12 | GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter. |
CVE-2024-10838 | Critical | 9.1 | 2025-03-12 | An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers… |
CVE-2025-21850 | Critical | 9.8 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: nvmet: Fix crash when a namespace is disabled The namespace percpu counter protects pendi… |
CVE-2024-13446 | Critical | 9.8 | 2025-03-12 | The Workreap plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.2.5. This is due to the pl… |
CVE-2024-58087 | Critical | 9.8 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue from session lookup and expire Increment the session reference coun… |
CVE-2025-28915 | Critical | 9.1 | 2025-03-11 | Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit themeegg-toolkit allows Upload a Web Shell to a Web Server.This iss… |
CVE-2025-26701 | Critical | 10.0 | 2025-03-11 | An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, an… |
CVE-2025-24201 | Critical | 10.0 | 2025-03-11 | An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15… |
CVE-2024-54085 | Critical | 9.8 | 2025-03-11 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitatio… |
CVE-2025-27494 | Critical | 9.1 | 2025-03-11 | A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected de… |