Critical vulnerability archive — page 239

Tenda1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2026-0581 · Tenda AC1206

Tenda AC1206 httpd BehaviorManager formBehaviorManager command injection

EPSS 9%public exploit CVSS 9.8

coollabsio5 vulnerabilities on this pageMax CVSS 10.0Priority 56KEV 0

CVE-2025-59157 · coollabsio coolify

Coolify has Git Repository RCE

EPSS 2%public exploit CVSS 10.0

CVE-2025-59156 · coollabsio coolify

Coolify has Docker Compose Injection issue

EPSS 1.0%public exploit CVSS 9.4

CVE-2025-64419 · coollabsio coolify

Coolify vulnerable to command injection via docker-compose.yaml parameters

EPSS 0.7%public exploit CVSS 9.7

CVE-2025-59158 · coollabsio coolify

Coolify has Stored XSS in Project Name

EPSS 0.5%public exploit CVSS 9.4

CVE-2025-64420 · coollabsio coolify

Coolify members can see private key of root user

EPSS 0.5%CVSS 10.0

bagisto3 vulnerabilities on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2026-21448 · bagisto bagisto

Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

EPSS 0.9%public exploit CVSS 9.8

CVE-2026-21450 · bagisto bagisto

Bagisto has SSTI in parameter that can lead to RCE

EPSS 1%CVSS 9.8

CVE-2026-21446 · bagisto bagisto

Bagisto Missing Authentication on Installer API Endpoints

EPSS 0.6%CVSS 9.8

staniel3591 vulnerability on this pageMax CVSS 9.6Priority 50KEV 0

CVE-2025-55204 · staniel359 muffon

muffon has One-click Remote Code Execution via XSS and Custom URL Handling

EPSS 0.7%public exploit CVSS 9.6

bg5sbk2 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-15457 · bg5sbk MiniCMS

bg5sbk MiniCMS Trash File Restore post.php improper authentication

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-15458 · bg5sbk MiniCMS

bg5sbk MiniCMS Article post-edit.php improper authentication

EPSS 0.6%public exploit CVSS 9.8

Centreon2 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-15029 · Centreon Infra Monitoring

An unauthenticated user is able to introduce SQL Injection using the Awie export module

EPSS 13%CVSS 9.8

CVE-2025-15026 · Centreon Infra Monitoring

Unauthenticated configuration import allows administrative account creation using AWIE component

EPSS 0.4%CVSS 9.8

code-projects12 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2026-0578 · code-projects Online Product Reservation System

code-projects Online Product Reservation System delete.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2026-0575 · code-projects Online Product Reservation System

code-projects Online Product Reservation System Administrator Login adminlogin.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-0576 · code-projects Online Product Reservation System

code-projects Online Product Reservation System Parameter prod.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-0579 · code-projects Online Product Reservation System

code-projects Online Product Reservation System POST Parameter edit.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-0583 · code-projects Online Product Reservation System

code-projects Online Product Reservation System User Login login.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-0585 · code-projects Online Product Reservation System

code-projects Online Product Reservation System GET Parameter order_view.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-0592 · code-projects Online Product Reservation System

code-projects Online Product Reservation System User Registration register_code.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-0605 · code-projects Online Music Site

code-projects Online Music Site login.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-0584 · code-projects Online Product Reservation System

code-projects Online Product Reservation System left_cart.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-0590 · code-projects Online Product Reservation System

code-projects Online Product Reservation System POST Parameter delete.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-0591 · code-projects Online Product Reservation System

code-projects Online Product Reservation System Cart Update update.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2026-0577 · code-projects Online Product Reservation System

code-projects Online Product Reservation System prod.php unrestricted upload

EPSS 0.4%public exploit CVSS 9.8

WHILL1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-14346 · WHILL Model C2 Electric Wheelchair

WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections.

EPSS 6%CVSS 9.8

langflow-ai1 vulnerability on this pageMax CVSS 9.1Priority 47KEV 0

CVE-2026-21445 · langflow-ai langflow

Langflow Missing Authentication on Critical API Endpoints

EPSS 33%CVSS 9.1

Campcodes1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2026-0597 · Campcodes Supplier Management System

Campcodes Supplier Management System edit_profile.php sql injection

EPSS 0.3%public exploit CVSS 9.8

itsourcecode1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2026-0582 · itsourcecode Society Management System

itsourcecode Society Management System edit_activity_query.php sql injection

EPSS 0.3%public exploit CVSS 9.8

Nuvation Energy5 vulnerabilities on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2025-64120 · Nuvation Energy Multi-Stack Controller (MSC)

Nuvation Energy Multi-Stack Controller OS Command Injection

EPSS 1%CVSS 9.4

CVE-2025-64121 · Nuvation Energy Multi-Stack Controller (MSC)

Nuvation Energy Multi-Stack Controller Authentication Bypass

EPSS 0.4%CVSS 10.0

CVE-2025-64119 · Nuvation Energy Battery Management System

Nuvation Energy BMS Client-side Authentication

EPSS 0.5%CVSS 9.3

CVE-2025-64123 · Nuvation Energy Multi-Stack Controller (MSC)

Nuvation Energy Multi-Stack Controller Proxy service allows arbitrary BMS access

EPSS 0.3%CVSS 9.8

CVE-2025-64125 · Nuvation Energy nCloud VPN Service

Nuvation Energy nCloud Client-to-Client Communication

EPSS 0.3%CVSS 9.4

adonisjs1 vulnerability on this pageMax CVSS 9.2Priority 40KEV 0

CVE-2026-21440 · adonisjs core

AdonisJS Path Traversal in Multipart File Handling

EPSS 1%CVSS 9.2

cld3786326682 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-15449 · cld378632668 JavaMall

cld378632668 JavaMall MinioController.java delete path traversal

EPSS 0.7%CVSS 9.1

CVE-2025-15448 · cld378632668 JavaMall

cld378632668 JavaMall MinioController.java upload unrestricted upload

EPSS 0.4%CVSS 9.8

mitre2 vulnerabilities on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2025-67397 · mitre

An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specifi…

EPSS 0.8%CVSS 9.1

CVE-2025-27807 · mitre

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 13…

EPSS 0.4%CVSS 9.1

Petlibrio3 vulnerabilities on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2025-15115 · Petlibrio Smart Pet Feeder Platform

Petlibro Smart Pet Feeder Platform through 1.7.31 Authentication Bypass via API endpoint

EPSS 0.3%CVSS 9.8

CVE-2025-3654 · Petlibrio Smart Pet Feeder Platform

Petlibro Smart Pet Feeder Platform through 1.7.31 Information Disclosure via API endpoint

EPSS 0.3%CVSS 9.8

CVE-2025-3653 · Petlibrio Smart Pet Feeder Platform

Petlibro Smart Pet Feeder through 1.7.31 Platform Improper Access Control via API endpoint

EPSS 0.3%CVSS 9.8

Themify1 vulnerability on this pageMax CVSS 9.9Priority 34KEV 0

CVE-2025-31048 · Themify Shopo

WordPress Shopo <= 1.1.4 - Arbitrary File Upload Vulnerability

EPSS 0.3%CVSS 9.9

Meow Apps1 vulnerability on this pageMax CVSS 9.1Priority 33KEV 0

CVE-2023-50897 · Meow Apps Media File Renamer

WordPress Media File Renamer plugin <= 5.7.7 - Arbitrary File Rename lead to RCE vulnerability

EPSS 0.3%CVSS 9.1

Ubiquiti Inc1 vulnerability on this pageMax CVSS 9.6Priority 33KEV 0

CVE-2025-59467 · Ubiquiti Inc UCRM Argentina AFIP invoices Plugin

A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalati…

EPSS 0.3%CVSS 9.6

AA-Team1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2025-30633 · AA-Team Amazon Native Shopping Recommendations

WordPress Amazon Native Shopping Recommendations Plugin <= 1.3 - SQL Injection Vulnerability

EPSS 0.3%CVSS 9.3

Infility1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2025-68865 · Infility Infility Global

WordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerability

EPSS 0.3%CVSS 9.3

Waituk1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2025-39484 · Waituk Entrada

WordPress Entrada Theme <= 5.7.7 - SQL Injection vulnerability

EPSS 0.3%CVSS 9.3

OpenCTI-Platform1 vulnerability on this pageMax CVSS 9.1Priority 30KEV 0

CVE-2025-61781 · OpenCTI-Platform opencti

GraphQL IDOR allows authenticated user to delete workspace content of other users

EPSS 0.2%CVSS 9.1

The archive.