Critical-severity CVEs (page 95)
Page 95 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3867 | Critical | 9.1 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup ksmbd does not consider the case of that… |
CVE-2023-32249 | Critical | 9.1 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: not allow guest user on multichannel This patch return STATUS_NOT_SUPPORTED if bin… |
CVE-2025-38552 | Critical | 9.4 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the… |
CVE-2025-38533 | Critical | 9.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix the using of Rx buffer DMA The wx_rx_buffer structure contained two DMA a… |
CVE-2025-38527 | Critical | 9.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_o… |
CVE-2025-8898 | Critical | 9.8 | 2025-08-16 | The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and inc… |
CVE-2025-7441 | Critical | 9.8 | 2025-08-16 | The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the… |
CVE-2025-9060 | Critical | 9.1 | 2025-08-15 | A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs in the integration… |
CVE-2025-8995 | Critical | 9.8 | 2025-08-15 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authentica… |
CVE-2025-54466 | Critical | 9.8 | 2025-08-15 | Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBi… |
CVE-2025-7778 | Critical | 9.8 | 2025-08-15 | The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validation within the delet… |
CVE-2025-6679 | Critical | 9.8 | 2025-08-15 | The Bit Form builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.2… |
CVE-2025-20265 | Critical | 10.0 | 2025-08-14 | A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacke… |
CVE-2025-50518 | Critical | 9.8 | 2025-08-14 | A use-after-free vulnerability exists in the coap_delete_pdu_lkd function within coap_pdu.c of the libcoap library. This issue occurs due to improper handling… |
CVE-2025-7972 | Critical | 9.1 | 2025-08-14 | A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to ‘development’, the attacker can disable FTSP toke… |
CVE-2025-43983 | Critical | 9.1 | 2025-08-14 | KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices have multiple unauthenticated access control vulnerabilities within goform/goform_set_cmd_process and goform/gofor… |
CVE-2025-27845 | Critical | 9.8 | 2025-08-14 | In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret. This allows for e… |
CVE-2025-43984 | Critical | 9.8 | 2025-08-14 | An issue was discovered on KuWFi GC111 devices (Hardware Version: CPE-LM321_V3.2, Software Version: GC111-GL-LM321_V3.0_20191211). They are vulnerable to unaut… |
CVE-2025-54707 | Critical | 9.3 | 2025-08-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter a… |
CVE-2025-54693 | Critical | 9.0 | 2025-08-14 | Unrestricted Upload of File with Dangerous Type vulnerability in epiphyt Form Block form-block allows Upload a Web Shell to a Web Server.This issue affects For… |
CVE-2025-54686 | Critical | 9.8 | 2025-08-14 | Deserialization of Untrusted Data vulnerability in scriptsbundle Exertio exertio allows Object Injection.This issue affects Exertio: from n/a through <= 1.3.2. |
CVE-2025-54678 | Critical | 9.3 | 2025-08-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows… |
CVE-2025-54669 | Critical | 9.3 | 2025-08-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RomanCode MapSVG mapsvg allows SQL Injection.This issue a… |
CVE-2025-52720 | Critical | 9.3 | 2025-08-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp allows… |
CVE-2025-49887 | Critical | 9.9 | 2025-08-14 | Improper Control of Generation of Code ('Code Injection') vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce… |
CVE-2025-49059 | Critical | 9.3 | 2025-08-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL In… |
CVE-2025-48293 | Critical | 9.8 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allo… |
CVE-2025-25174 | Critical | 10.0 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beete… |
CVE-2025-24775 | Critical | 9.9 | 2025-08-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms forms-by-made-it allows Upload a Web Shell to a Web Server.This issue affects… |
CVE-2025-8943 | Critical | 9.8 | 2025-08-14 | The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent auth… |
CVE-2025-8047 | Critical | 9.8 | 2025-08-14 | The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been… |
CVE-2025-55346 | Critical | 9.8 | 2025-08-14 | User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in t… |
CVE-2012-10060 | Critical | 9.8 | 2025-08-13 | Sysax Multi Server versions prior to 5.55 contain a stack-based buffer overflow in its SSH service. When a remote attacker supplies an overly long username dur… |
CVE-2012-10054 | Critical | 9.8 | 2025-08-13 | Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRS… |
CVE-2011-10019 | Critical | 9.8 | 2025-08-13 | Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitiz… |
CVE-2011-10018 | Critical | 9.8 | 2025-08-13 | myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP co… |
CVE-2025-43986 | Critical | 9.8 | 2025-08-13 | An issue was discovered on KuWFi GC111 GC111-GL-LM321_V3.0_20191211 devices. The TELNET service is enabled by default and exposed over the WAN interface withou… |
CVE-2025-43982 | Critical | 9.8 | 2025-08-13 | Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default. There is a hidden hard-coded root account that cannot be… |
CVE-2025-52385 | Critical | 9.8 | 2025-08-13 | An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the child_process module |
CVE-2025-51451 | Critical | 9.8 | 2025-08-13 | In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm. |
CVE-2025-50594 | Critical | 9.8 | 2025-08-13 | An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allo… |
CVE-2025-51452 | Critical | 9.8 | 2025-08-13 | In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm. |
CVE-2025-50251 | Critical | 9.1 | 2025-08-13 | Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery. |
CVE-2025-54382 | Critical | 9.6 | 2025-08-13 | Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution (RCE) vulnerability exists in the Cherry… |
CVE-2025-54074 | Critical | 9.8 | 2025-08-13 | Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.2.5 to 1.5.1, Cherry Studio is vulnerable to OS Command Injection d… |
CVE-2025-8913 | Critical | 9.8 | 2025-08-13 | Organization Portal System developed by WellChoose has a Local File Inclusion vulnerability, allowing unauthenticated remote attackers to execute arbitrary cod… |
CVE-2025-8760 | Critical | 9.8 | 2025-08-13 | A vulnerability was identified in INSTAR 2K+ and 4K 3.11.1 Build 1124. This affects the function base64_decode of the component fcgi_server. The manipulation o… |
CVE-2025-6715 | Critical | 9.8 | 2025-08-13 | The LatePoint WordPress plugin before 5.1.94 is vulnerable to Local File Inclusion via the layout parameter. This makes it possible for attackers to include a… |
CVE-2025-7384 | Critical | 9.8 | 2025-08-13 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4… |
CVE-2025-49457 | Critical | 9.6 | 2025-08-12 | Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access |
CVE-2025-55168 | Critical | 9.8 | 2025-08-12 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability… |
CVE-2025-25256 | Critical | 9.8 | 2025-08-12 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0… |
CVE-2025-53766 | Critical | 9.8 | 2025-08-12 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. |
CVE-2025-50171 | Critical | 9.1 | 2025-08-12 | Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-50165 | Critical | 9.8 | 2025-08-12 | Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
CVE-2025-55167 | Critical | 9.8 | 2025-08-12 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability… |
CVE-2025-55010 | Critical | 9.1 | 2025-08-12 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the Project… |
CVE-2025-40746 | Critical | 9.1 | 2025-08-12 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.2). Affected products do not properly validate input for a backup scrip… |
CVE-2025-8059 | Critical | 9.8 | 2025-08-12 | The B Blocks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization and improper input validation within the rgfr_registration… |
CVE-2025-42957 | Critical | 9.9 | 2025-08-12 | SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbit… |
CVE-2025-42950 | Critical | 9.9 | 2025-08-12 | SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables… |
CVE-2024-32640 | Critical | 9.8 | 2025-08-11 | MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulne… |
CVE-2025-53187 | Critical | 9.8 | 2025-08-11 | Due to an issue in configuration, code that was intended for debugging purposes was included in the market release of the ASPECT FW allowing an attacker to byp… |
CVE-2025-45146 | Critical | 9.8 | 2025-08-11 | ModelCache for LLM through v0.2.0 was discovered to contain an deserialization vulnerability via the component /manager/data_manager.py. This vulnerability all… |
CVE-2025-8853 | Critical | 9.8 | 2025-08-11 | Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtai… |
CVE-2025-8660 | Critical | 9.8 | 2025-08-11 | Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed. |
CVE-2025-8854 | Critical | 9.8 | 2025-08-11 | Stack-based buffer overflow in LoadOFF in bulletphysics bullet3 before 3.26 on all platforms allows remote attackers to execute arbitrary code via a crafted OF… |
CVE-2025-54997 | Critical | 9.1 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and… |
CVE-2025-6573 | Critical | 9.8 | 2025-08-09 | Kernel software installed and running inside an untrusted/rich execution environment (REE) could leak information from the trusted execution environment (TEE). |
CVE-2025-5095 | Critical | 9.8 | 2025-08-08 | Burk Technology ARC Solo's password change mechanism can be utilized without proper authentication procedures, allowing an attacker to take over the device. … |
CVE-2025-52913 | Critical | 9.8 | 2025-08-08 | A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated attacker to conduc… |
CVE-2025-8284 | Critical | 9.8 | 2025-08-08 | By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow unauthorized users… |
CVE-2025-8731 | Critical | 9.8 | 2025-08-08 | A vulnerability was identified in TRENDnet TI-G160i, TI-PG102i and TPL-430AP up to 20250724. This affects an unknown part of the component SSH Service. The man… |
CVE-2025-8356 | Critical | 9.8 | 2025-08-08 | In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remot… |
CVE-2025-8730 | Critical | 9.8 | 2025-08-08 | A vulnerability was found in Belkin F9K1009 and F9K1010 2.00.04/2.00.09 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-53606 | Critical | 9.8 | 2025-08-08 | Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): 2.4.0. Users are recommended to u… |
CVE-2025-48913 | Critical | 9.8 | 2025-08-08 | If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities… |
CVE-2025-54887 | Critical | 9.1 | 2025-08-08 | jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brut… |
CVE-2025-54952 | Critical | 9.8 | 2025-08-08 | An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentially resulting in… |
CVE-2025-54951 | Critical | 9.8 | 2025-08-07 | A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution… |
CVE-2025-54950 | Critical | 9.8 | 2025-08-07 | An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other unde… |
CVE-2025-54949 | Critical | 9.8 | 2025-08-07 | A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affe… |
CVE-2025-30405 | Critical | 9.8 | 2025-08-07 | An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, potentially resulting… |
CVE-2025-30404 | Critical | 9.8 | 2025-08-07 | An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undes… |
CVE-2025-53792 | Critical | 9.1 | 2025-08-07 | Azure Portal Elevation of Privilege Vulnerability |
CVE-2025-53767 | Critical | 10.0 | 2025-08-07 | Azure OpenAI Elevation of Privilege Vulnerability |
CVE-2025-45765 | Critical | 9.1 | 2025-08-07 | ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is "keysize is not something that is enforced by this library… |
CVE-2025-50692 | Critical | 9.8 | 2025-08-07 | FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html. |
CVE-2023-41530 | Critical | 9.8 | 2025-08-07 | Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php. |
CVE-2023-41528 | Critical | 9.8 | 2025-08-07 | Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in contact.php via the txtname, txtphone, and txtmail parameters. |
CVE-2023-41527 | Critical | 9.8 | 2025-08-07 | Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the password2 parameter in func.php. |
CVE-2023-41526 | Critical | 9.8 | 2025-08-07 | Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func1.php via the username3 and password3 parameters. |
CVE-2023-41525 | Critical | 9.8 | 2025-08-07 | Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php. |
CVE-2025-30127 | Critical | 9.8 | 2025-08-06 | An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. Once access is gained either by default, common, or cracked passwords, the video recordings… |
CVE-2025-23317 | Critical | 9.1 | 2025-08-06 | NVIDIA Triton Inference Server contains a vulnerability in the HTTP server, where an attacker could start a reverse shell by sending a specially crafted HTTP r… |
CVE-2025-23311 | Critical | 9.8 | 2025-08-06 | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a stack overflow through specially crafted HTTP requests. A successful ex… |
CVE-2025-23310 | Critical | 9.8 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause stack buffer overflow by specially crafted inputs… |
CVE-2025-22470 | Critical | 9.8 | 2025-08-06 | CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1 allow crafted dangerous files to be uploaded. An arbitrary Lua scri… |
CVE-2025-6994 | Critical | 9.8 | 2025-08-06 | The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.3. This is due to the plugin… |
CVE-2025-54594 | Critical | 9.1 | 2025-08-06 | react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/workflows/release-canary.yml GitHub Actio… |