Critical-severity CVEs (page 89)
Page 89 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9804 | Critical | 9.6 | 2025-10-16 | An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services an… |
CVE-2025-9152 | Critical | 9.8 | 2025-10-16 | An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations D… |
CVE-2025-10611 | Critical | 9.8 | 2025-10-16 | Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed… |
CVE-2025-54539 | Critical | 9.8 | 2025-10-16 | A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client. This issue affects all versions of Apache ActiveMQ NMS AMQP u… |
CVE-2025-41018 | Critical | 9.8 | 2025-10-16 | SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in… |
CVE-2025-62583 | Critical | 9.8 | 2025-10-16 | Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment. |
CVE-2025-55089 | Critical | 9.8 | 2025-10-16 | In FileX before 6.4.2, the file support module for Eclipse Foundation ThreadX, there was a possible buffer overflow in the FileX RAM disk driver. It could caus… |
CVE-2025-10850 | Critical | 9.8 | 2025-10-16 | The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded passwor… |
CVE-2025-10742 | Critical | 9.8 | 2025-10-16 | The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin pro… |
CVE-2025-11832 | Critical | 9.8 | 2025-10-15 | Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Access Technology BLU-IC4 allows Flooding.This iss… |
CVE-2025-56749 | Critical | 9.4 | 2025-10-15 | Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge vali… |
CVE-2025-53521 | Critical | 9.8 | 2025-10-15 | When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versio… |
CVE-2025-55081 | Critical | 9.1 | 2025-10-15 | In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was missing length verification of certai… |
CVE-2025-9967 | Critical | 9.8 | 2025-10-15 | The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. Thi… |
CVE-2025-10294 | Critical | 9.8 | 2025-10-15 | The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin… |
CVE-2025-10041 | Critical | 9.8 | 2025-10-15 | The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in thesave_qr_code_to_db() function… |
CVE-2025-39975 | Critical | 9.8 | 2025-10-15 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix wrong index reference in smb2_compound_op() In smb2_compound_op(), the l… |
CVE-2025-49553 | Critical | 9.3 | 2025-10-14 | Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute… |
CVE-2025-34267 | Critical | 9.9 | 2025-10-14 | Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox… |
CVE-2025-59287 | Critical | 9.8 | 2025-10-14 | Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network. |
CVE-2025-55315 | Critical | 9.9 | 2025-10-14 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature ove… |
CVE-2025-54603 | Critical | 9.0 | 2025-10-14 | An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation of existing OIDC u… |
CVE-2025-49708 | Critical | 9.9 | 2025-10-14 | Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network. |
CVE-2025-9064 | Critical | 9.1 | 2025-10-14 | A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete… |
CVE-2025-9063 | Critical | 9.8 | 2025-10-14 | An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows… |
CVE-2025-7328 | Critical | 9.8 | 2025-10-14 | Multiple Broken Authentication security issues exist in the affected product. The security issues are due to missing authentication checks on critical function… |
CVE-2025-11721 | Critical | 9.8 | 2025-10-14 | Memory safety bug present in Firefox 143 and Thunderbird 143. This bug showed evidence of memory corruption and we presume that with enough effort this could h… |
CVE-2025-11719 | Critical | 9.8 | 2025-10-14 | Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption… |
CVE-2025-11717 | Critical | 9.1 | 2025-10-14 | When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one bein… |
CVE-2025-11710 | Critical | 9.8 | 2025-10-14 | A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised proce… |
CVE-2025-11709 | Critical | 9.8 | 2025-10-14 | A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. This vulnerability… |
CVE-2025-11708 | Critical | 9.8 | 2025-10-14 | Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4. |
CVE-2025-10610 | Critical | 9.8 | 2025-10-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting Information Processing Industry and Foreig… |
CVE-2025-40771 | Critical | 9.8 | 2025-10-14 | A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All ver… |
CVE-2025-40765 | Critical | 9.8 | 2025-10-14 | A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application contains an information di… |
CVE-2025-46581 | Critical | 9.8 | 2025-10-14 | ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability. An unauthenticated attacker can remotely execute commands with non-root… |
CVE-2025-42937 | Critical | 9.8 | 2025-10-14 | SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent… |
CVE-2025-42910 | Critical | 9.0 | 2025-10-14 | Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These fil… |
CVE-2025-37729 | Critical | 9.1 | 2025-10-13 | Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltr… |
CVE-2025-6919 | Critical | 9.8 | 2025-10-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cats Information Technology Software Development Technolo… |
CVE-2025-9976 | Critical | 9.0 | 2025-10-13 | An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R20… |
CVE-2025-27258 | Critical | 9.8 | 2025-10-13 | Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result in an escalation of privilege. |
CVE-2025-6439 | Critical | 9.8 | 2025-10-11 | The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file del… |
CVE-2025-6553 | Critical | 9.8 | 2025-10-11 | The Ovatheme Events Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_checkout() function… |
CVE-2025-11533 | Critical | 9.8 | 2025-10-11 | The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() fu… |
CVE-2025-61929 | Critical | 9.6 | 2025-10-10 | Cherry Studio is a desktop client that supports for multiple LLM providers. Cherry Studio registers a custom protocol called `cherrystudio://`. When handling t… |
CVE-2025-60306 | Critical | 9.9 | 2025-10-10 | code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perform sensitive oper… |
CVE-2025-60269 | Critical | 9.4 | 2025-10-10 | JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExport… |
CVE-2025-60307 | Critical | 9.8 | 2025-10-10 | code-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where entering a universal password in the Password field on the login page can… |
CVE-2025-59286 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a n… |
CVE-2025-59272 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosur… |
CVE-2025-59252 | Critical | 9.3 | 2025-10-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a n… |
CVE-2025-59246 | Critical | 9.8 | 2025-10-09 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-59218 | Critical | 9.6 | 2025-10-09 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-55321 | Critical | 9.3 | 2025-10-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an unauthorized attacker to perform spoofing over… |
CVE-2025-35051 | Critical | 9.8 | 2025-10-09 | Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attack… |
CVE-2025-35050 | Critical | 9.8 | 2025-10-09 | Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbi… |
CVE-2025-60316 | Critical | 9.4 | 2025-10-09 | SourceCodester Pet Grooming Management Software 1.0 is vulnerable to SQL Injection in admin/view_customer.php via the ID parameter. |
CVE-2025-59978 | Critical | 9.0 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to sto… |
CVE-2025-10284 | Critical | 9.6 | 2025-10-09 | BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote… |
CVE-2025-10283 | Critical | 9.6 | 2025-10-09 | BBOT's gitdumper module could be abused to execute commands through a malicious git repository. |
CVE-2025-56683 | Critical | 9.6 | 2025-10-09 | A cross-site scripting (XSS) vulnerability in the component /app/marketplace.html of Logseq v0.10.9 allows attackers to execute arbitrary code via injecting ar… |
CVE-2025-11539 | Critical | 9.9 | 2025-10-09 | Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoi… |
CVE-2025-11522 | Critical | 9.8 | 2025-10-09 | The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and includin… |
CVE-2025-7634 | Critical | 9.8 | 2025-10-09 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and inclu… |
CVE-2025-7526 | Critical | 9.8 | 2025-10-09 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion (via renaming) due to insuffi… |
CVE-2025-10586 | Critical | 9.8 | 2025-10-09 | The Community Events plugin for WordPress is vulnerable to SQL Injection via the ‘event_venue’ parameter in all versions up to, and including, 1.5.1 due to ins… |
CVE-2025-61913 | Critical | 9.9 | 2025-10-08 | Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise… |
CVE-2025-10587 | Critical | 9.8 | 2025-10-08 | The Community Events plugin for WordPress is vulnerable to SQL Injection via the event_category parameter in all versions up to, and including, 1.5.1 due to in… |
CVE-2025-11423 | Critical | 9.8 | 2025-10-08 | A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function formSafeEmailFilter of the file /goform/SafeEmailFilter. Performing a manipulation o… |
CVE-2025-11418 | Critical | 9.8 | 2025-10-08 | A security vulnerability has been detected in Tenda CH22 up to 1.0.0.1. This issue affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of… |
CVE-2025-44823 | Critical | 9.9 | 2025-10-07 | Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_us… |
CVE-2025-3450 | Critical | 10.0 | 2025-10-07 | An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated net… |
CVE-2025-52021 | Critical | 9.8 | 2025-10-07 | A SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0. The product_id GET parameter is unsafe… |
CVE-2023-53629 | Critical | 9.8 | 2025-10-07 | In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in… |
CVE-2025-0603 | Critical | 9.8 | 2025-10-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Callvision Healthcare Callvision Emergency Code allows SQ… |
CVE-2025-57515 | Critical | 9.8 | 2025-10-06 | A SQL injection vulnerability has been identified in Uniclare Student Portal v2. This flaw allows remote attackers to inject arbitrary SQL commands via vulnera… |
CVE-2025-61777 | Critical | 9.4 | 2025-10-06 | Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/b… |
CVE-2025-60965 | Critical | 9.1 | 2025-10-06 | OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary… |
CVE-2025-60964 | Critical | 9.1 | 2025-10-06 | OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary… |
CVE-2025-60957 | Critical | 9.9 | 2025-10-06 | OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary… |
CVE-2025-57247 | Critical | 9.1 | 2025-10-06 | The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorrect access control i… |
CVE-2025-36356 | Critical | 9.3 | 2025-10-06 | IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated us… |
CVE-2025-59159 | Critical | 9.6 | 2025-10-06 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2023-49886 | Critical | 9.8 | 2025-10-06 | IBM Standards Processing Engine 10.0.1.10 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe java deserialization. By s… |
CVE-2025-61882 | Critical | 9.8 | 2025-10-05 | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affect… |
CVE-2023-53600 | Critical | 9.1 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp error… |
CVE-2025-39948 | Critical | 9.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: ice: fix Rx page leak on multi-buffer frames The ice_put_rx_mbuf() function handles calli… |
CVE-2025-39946 | Critical | 9.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abort the stream if headers are bogus Normally we wait for the socket t… |
CVE-2025-39943 | Critical | 9.4 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer … |
CVE-2025-39933 | Critical | 9.4 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This… |
CVE-2025-39932 | Critical | 9.8 | 2025-10-04 | In the Linux kernel, the following vulnerability has been resolved: smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) In… |
CVE-2025-9485 | Critical | 9.8 | 2025-10-04 | The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and inc… |
CVE-2025-49844 | Critical | 9.9 | 2025-10-03 | Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script t… |
CVE-2025-9286 | Critical | 9.8 | 2025-10-03 | The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() R… |
CVE-2025-9209 | Critical | 9.8 | 2025-10-03 | The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plug… |
CVE-2025-7721 | Critical | 9.8 | 2025-10-03 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includ… |
CVE-2025-10726 | Critical | 9.1 | 2025-10-03 | The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. This is due to insuf… |
CVE-2025-10547 | Critical | 9.8 | 2025-10-03 | An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform R… |
CVE-2025-6388 | Critical | 9.8 | 2025-10-03 | The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_action… |