The archive.

CVE-2025-63362 · mitre

Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows…

CVE-2025-53963 · mitre

An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices.

CVE-2025-54303 · mitre

The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API.

CVE-2025-65267 · mitre

In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious…

EPSS 0.4%CVSS 9.0

Remotecontrolio1 vulnerability on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2025-66576 · Remotecontrolio Remote Keyboard Desktop

Remote Keyboard Desktop 1.0.1 - Remote Code Execution (RCE)

EPSS 1%public exploit CVSS 9.8

Advantech Co., Ltd.1 vulnerability on this pageMax CVSS 10.0Priority 51KEV 0

CVE-2025-34256 · Advantech Co., Ltd. WISE-DeviceOn Server

Advantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication Bypass

EPSS 0.7%public exploit CVSS 10.0

H3C1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2025-14015 · H3C Magic B0

H3C Magic B0 aspForm EditWlanMacList buffer overflow

EPSS 0.9%public exploit CVSS 9.8

anthropics1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-66032 · anthropics claude-code

Claude Code Command Validation Bypass Allows Arbitrary Code Execution

EPSS 0.7%public exploit CVSS 9.8

hwk-fr1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-13486 · hwk-fr Advanced Custom Fields: Extended

Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form

EPSS 69%CVSS 9.8

ReQuest Serious Play LLC1 vulnerability on this pageMax CVSS 9.3Priority 49KEV 0

CVE-2020-36877 · ReQuest Serious Play LLC ReQuest Serious Play Pro

ReQuest Serious Play F3 Media Server <= 7.0.3 code execution

EPSS 0.8%public exploit CVSS 9.3

ThinkInAIXYZ1 vulnerability on this pageMax CVSS 9.7Priority 49KEV 0

CVE-2025-66222 · ThinkInAIXYZ deepchat

DeepChat Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)

EPSS 0.7%public exploit CVSS 9.7

dayrui1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-14004 · dayrui XunRuiCMS

dayrui XunRuiCMS Email Setting admind45f74adbd95.php server-side request forgery

EPSS 0.5%public exploit CVSS 9.8

Unknown1 vulnerability on this pageMax CVSS 9.3Priority 48KEV 0

CVE-2025-66571 · Unknown UNA CMS

UNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection

EPSS 0.7%public exploit CVSS 9.3

shabti1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-13342 · shabti Frontend Admin by DynamiApps

Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update

EPSS 2%CVSS 9.8

TOTOLINK1 vulnerability on this pageMax CVSS 9.3Priority 46KEV 0

CVE-2025-34319 · TOTOLINK N300RT

TOTOLINK N300RT <= V2.1.8-B20201030.1539 Boa formWsc RCE

EPSS 4%CVSS 9.3

CollaboraOnline1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2025-66208 · CollaboraOnline online

Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy

EPSS 2%CVSS 9.8

calcom1 vulnerability on this pageMax CVSS 9.9Priority 42KEV 0

CVE-2025-66489 · calcom cal.com

Cal.com Authentication Bypass via bad TOTP + password checks

EPSS 1.0%CVSS 9.9

Linux4 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-40252 · Linux Linux

net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

CVE-2025-40261 · Linux Linux

nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()

CVE-2025-40257 · Linux Linux

mptcp: fix a race in mptcp_pm_del_add_timer()

CVE-2025-40258 · Linux Linux

mptcp: fix race condition in mptcp_schedule_work()

dripadmin1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-13313 · dripadmin CRM Memberships

CRM Memberships <= 2.6 - Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint

Industrial Video & Control1 vulnerability on this pageMax CVSS 9.3Priority 39KEV 0

CVE-2025-13658 · Industrial Video & Control Longwatch

Industrial Video & Control Longwatch has a Code Injection vulnerability

EPSS 0.7%CVSS 9.3

AI-QL1 vulnerability on this pageMax CVSS 9.6Priority 38KEV 0

CVE-2025-66562 · AI-QL tuui

TUUI vulnerable to Remote Code Execution (RCE) via XSS in Markdown ECharts Rendering

EPSS 0.6%CVSS 9.6

espressif1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2025-66409 · espressif esp-idf

ESF-IDF has an Out-of-Bounds Read in ESP32 Bluetooth AVRCP Command Handling

EPSS 0.7%CVSS 9.1

Iskra1 vulnerability on this pageMax CVSS 9.3Priority 38KEV 0

CVE-2025-13510 · Iskra iHUB and iHUB Lite

Iskra iHUB and iHUB Lite has a Missing Authentication for Critical Function vulnerabilitiy

EPSS 0.6%CVSS 9.3

pickplugins1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-12374 · pickplugins User Verification by PickPlugins

Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification <= 2.0.44 - Authentication Bypass to Account Takeover

docker1 vulnerability on this pageMax CVSS 9.6Priority 37KEV 0

CVE-2025-64443 · docker mcp-gateway

DNS Rebinding vulnerability present when running MCP Gateway in sse or streaming mode

EPSS 0.5%CVSS 9.6

laradashboard1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-66509 · laradashboard laradashboard

LaraDashboard: 1-Click Pre-Auth RCE via Host Header + Module Installation Chain

DesignThemes1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2025-13542 · DesignThemes DesignThemes LMS

DesignThemes LMS <= 1.0.4 - Unauthenticated Privilege Escalation

SGE-PLC1000 SGE-PLC502 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2025-11786 · SGE-PLC1000 SGE-PLC50 Circutor

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50

CVE-2025-11788 · SGE-PLC1000 SGE-PLC50 Circutor

Heap-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50

EPSS 0.3%CVSS 9.8

Synology1 vulnerability on this pageMax CVSS 9.6Priority 36KEV 0

CVE-2024-45538 · Synology DiskStation Manager (DSM)

Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-…

EPSS 0.4%CVSS 9.6

Medtronic1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2025-12995 · Medtronic CareLink Network

Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be use…