Critical vulnerability archive — page 266

F51 vulnerability on this pageMax CVSS 9.8Priority 96KEV 1

CVE-2025-53521 · F5 BIG-IP

BigIP APM Vulnerability

KEV · due 30 Mar EPSS 2%public exploit SSVC act CVSS 9.8

Ilevia Srl.3 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2025-34513 · Ilevia Srl. EVE X1 Server

Ilevia EVE X1 Server 4.7.18.0.eden Unauthenticated Command Injection

EPSS 8%public exploit CVSS 9.8

CVE-2025-34515 · Ilevia Srl. EVE X1 Server

Ilevia EVE X1 Server 4.7.18.0.eden Root Privilege Escalation

EPSS 8%CVSS 9.8

CVE-2025-34516 · Ilevia Srl. EVE X1 Server

Ilevia EVE X1 Server 4.7.18.0.eden Use of Default Credentials

EPSS 0.6%CVSS 9.8

BYTEVALUE (Luoyang Baiwei Intelligent Technology Co., Ltd.)1 vulnerability on this pageMax CVSS 9.3Priority 54KEV 0

CVE-2023-7311 · BYTEVALUE (Luoyang Baiwei Intelligent Technology Co., Ltd.) Flow Control Router

BYTEVALUE Intelligent Flow Control Router Command Injection

EPSS 2%public exploit CVSS 9.3

Restaurant Brands International2 vulnerabilities on this pageMax CVSS 9.9Priority 51KEV 0

CVE-2025-62645 · Restaurant Brands International assistant platform

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token…

EPSS 0.7%public exploit CVSS 9.9

CVE-2025-62650 · Restaurant Brands International assistant platform

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagn…

EPSS 0.5%public exploit CVSS 9.9

snyk1 vulnerability on this pageMax CVSS 9.3Priority 51KEV 0

CVE-2025-11849 · snyk

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of…

EPSS 1%public exploit CVSS 9.3

Keras1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-49655 · Keras Keras

Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, en…

EPSS 0.8%public exploit CVSS 9.8

squid-cache1 vulnerability on this pageMax CVSS 10.0Priority 50KEV 0

CVE-2025-62168 · squid-cache squid

Squid vulnerable to information disclosure via authentication credential leakage in error handling

EPSS 62%CVSS 10.0

Windsurf1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-62353 · Windsurf Windsurf

A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary local files in and…

EPSS 0.6%public exploit CVSS 9.8

mitre5 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-57567 · mitre

A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the…

EPSS 0.9%public exploit CVSS 9.1

CVE-2025-60279 · mitre

A server-side request forgery (SSRF) vulnerability in Illia Cloud illia-Builder before v4.8.5 allows authenticated users to send arbitrar…

EPSS 0.4%public exploit CVSS 9.6

CVE-2025-56218 · mitre

An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.

EPSS 0.6%CVSS 9.8

CVE-2025-56316 · mitre

A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to e…

EPSS 0.6%CVSS 9.8

CVE-2025-56221 · mitre

A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack.

EPSS 0.6%CVSS 9.8

Guangzhou Smart Software Co., Ltd.1 vulnerability on this pageMax CVSS 9.2Priority 47KEV 0

CVE-2023-7305 · Guangzhou Smart Software Co., Ltd. SmartBI

SmartBI RMIServlet Unrestricted File Upload RCE

EPSS 0.5%public exploit CVSS 9.2

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-54539 · Apache Software Foundation Apache ActiveMQ NMS AMQP Client

Apache ActiveMQ NMS AMQP Client: Deserialization of Untrusted Data

EPSS 2%CVSS 9.8

Ruijie Networks Co., Ltd.1 vulnerability on this pageMax CVSS 9.3Priority 46KEV 0

CVE-2023-7304 · Ruijie Networks Co., Ltd. RG-UAC

Ruijie RG-UAC nmc_sync.php Command Injection

EPSS 4%CVSS 9.3

HGiga1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2025-11900 · HGiga iSherlock 4.5

HGiga｜iSherlock - OS Command Injection

EPSS 2%CVSS 9.8

capricorn861 vulnerability on this pageMax CVSS 9.4Priority 44KEV 0

CVE-2025-62410 · capricorn86 happy-dom

--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom

EPSS 0.4%public exploit CVSS 9.4

Hikvision2 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2023-28815 · Hikvision iSecure Center

Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerabi…

EPSS 1%CVSS 9.8

CVE-2023-28814 · Hikvision iSecure Center

Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability.

EPSS 0.5%CVSS 9.8

ThingsBoard, Inc.1 vulnerability on this pageMax CVSS 9.1Priority 43KEV 0

CVE-2025-34282 · ThingsBoard, Inc. ThingsBoard

ThingsBoard < v4.2.1 SVG Image SSRF

EPSS 2%CVSS 9.1

ajitdas1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2025-10041 · ajitdas Flex QR Code Generator

Flex QR Code Generator <= 1.2.5 - Unauthenticated Arbitrary File Upload

EPSS 0.9%CVSS 9.8

victornavarro1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-10294 · victornavarro OwnID Passwordless Login

OwnID Passwordless Login <= 1.3.4 - Authentication Bypass

EPSS 0.8%CVSS 9.8

WSO23 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-10611 · WSO2 WSO2 API Manager

Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

EPSS 0.8%CVSS 9.8

CVE-2025-9152 · WSO2 WSO2 API Manager

Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint

EPSS 0.7%CVSS 9.8

CVE-2025-9804 · WSO2 WSO2 Identity Server as Key Manager

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

EPSS 0.6%CVSS 9.6

Moxa3 vulnerabilities on this pageMax CVSS 9.9Priority 40KEV 0

CVE-2025-6950 · Moxa EDR-G9010 Series

An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers.

EPSS 0.6%CVSS 9.9

CVE-2025-6893 · Moxa EDR-G9010 Series

An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers.

EPSS 0.7%CVSS 9.3

CVE-2025-6949 · Moxa EDR-G9010 Series

An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers.

EPSS 0.5%CVSS 9.3

OPEXUS1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-62586 · OPEXUS FOIAXpress

OPEXUS FOIAXpress unauthenticated administrator password reset

EPSS 0.7%CVSS 9.8

dreamstechnologies1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-10742 · dreamstechnologies Truelysell Core

Truelysell Core <= 1.8.6 - Unauthenticated Arbitrary User Password Change

EPSS 0.5%CVSS 9.8

RiceTheme1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-10850 · RiceTheme Felan Framework

Felan Framework <= 1.1.4 - Hardcoded Credentials

EPSS 0.6%CVSS 9.8

Eclipse Foundation3 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-55089 · Eclipse Foundation FileX

Eclipse ThreadX FileX RAM disk driver buffer overflow

EPSS 0.5%CVSS 9.8

CVE-2025-55100 · Eclipse Foundation USBX

Potential out-of-bounds read in _ux_host_class_audio10_sam_parse_func()

EPSS 0.6%CVSS 9.1

CVE-2025-55081 · Eclipse Foundation NetX Duo

Potential out of bound read in _nx_secure_tls_process_clienthello()

EPSS 0.4%CVSS 9.1

Flowring Technology1 vulnerability on this pageMax CVSS 9.2Priority 38KEV 0

CVE-2025-11899 · Flowring Technology Agentflow

Flowring Technology｜Agentflow - Use of Hard-coded Cryptographic Key

EPSS 0.7%CVSS 9.2

Linux1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-39975 · Linux Linux

smb: client: fix wrong index reference in smb2_compound_op()

EPSS 0.5%CVSS 9.8

NAVER1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-62583 · NAVER NAVER Whale browser

Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.

EPSS 0.5%CVSS 9.8

gsayed7861 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-9967 · gsayed786 Orion SMS OTP Verification.

Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeover

EPSS 0.4%CVSS 9.8

Sergestec2 vulnerabilities on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-41018 · Sergestec Exito

SQL injection vulnerability in Sergestec's Exito

EPSS 0.5%CVSS 9.8

CVE-2025-41019 · Sergestec SISTICK

SQL injection vulnerability in Sergestec's Exito

EPSS 0.4%CVSS 9.3

Azure Access Technology1 vulnerability on this pageMax CVSS 10.0Priority 36KEV 0

CVE-2025-11832 · Azure Access Technology BLU-IC2

APIs Lack Rate Limiting

EPSS 0.4%CVSS 10.0

Cisco1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2025-20359 · Cisco Cisco Cyber Vision

Multiple Cisco Products Snort 3 MIME Information Disclosure or Denial of Service Vulnerability

EPSS 0.5%CVSS 9.1

PrestaShopCorp1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2025-61922 · PrestaShopCorp ps_checkout

PrestaShop Checkout allows customer account takeover via email

EPSS 0.5%CVSS 9.1

Qt1 vulnerability on this pageMax CVSS 9.2Priority 35KEV 0

CVE-2025-6338 · Qt Qt

Possible denial of service with multiple incoming connections to a Schannel based server with a TLS backend

EPSS 0.4%CVSS 9.2

silabs.com1 vulnerability on this pageMax CVSS 9.4Priority 32KEV 0

CVE-2025-8414 · silabs.com Simplicity SDK

Zigbee Green Power Host Buffer Overflow Vulnerability

EPSS 0.3%CVSS 9.4

ConnectWise1 vulnerability on this pageMax CVSS 9.6Priority 31KEV 0

CVE-2025-11492 · ConnectWise Automate

HTTP Configuration and Encryption in Transit

EPSS 0.2%CVSS 9.6

The archive.