Critical vulnerability archive — page 271

redis1 vulnerability on this pageMax CVSS 10.0Priority 60KEV 0

CVE-2025-49844 · redis redis

Redis Lua Use-After-Free may lead to remote code execution

EPSS 83%public exploit CVSS 10.0

LukeGus1 vulnerability on this pageMax CVSS 9.2Priority 56KEV 0

CVE-2025-59951 · LukeGus Termix

Termix' official Docker image contains an authentication bypass vulnerability

EPSS 5%public exploit CVSS 9.2

mitre4 vulnerabilities on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2025-61045 · mitre

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMesh…

EPSS 2%public exploit CVSS 9.8

CVE-2025-59403 · mitre

The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentication.

EPSS 1%public exploit CVSS 9.8

CVE-2025-61044 · mitre

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEa…

EPSS 1%public exploit CVSS 9.8

CVE-2025-59407 · mitre

The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow Lic…

EPSS 0.7%CVSS 9.8

snyk1 vulnerability on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2025-11148 · snyk

All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted w…

EPSS 1%public exploit CVSS 9.8

Vasion2 vulnerabilities on this pageMax CVSS 10.0Priority 51KEV 0

CVE-2025-34217 · Vasion Print Virtual Appliance Host

Vasion Print (formerly PrinterLogic) Undocumented Hardcoded SSH Key

EPSS 0.7%public exploit CVSS 10.0

CVE-2025-34210 · Vasion Print Virtual Appliance Host

Vasion Print (formerly PrinterLogic) Readable Cleartext Passwords

EPSS 0.2%public exploit CVSS 9.4

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-61622 · Apache Software Foundation Apache Fory

Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory

EPSS 48%CVSS 9.8

LabRedesCefetRJ2 vulnerabilities on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2025-61603 · LabRedesCefetRJ WeGIA

WeGIA: SQL Injection (Blind Time-Based) Vulnerability in API `descricao` Parameter

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-61605 · LabRedesCefetRJ WeGIA

WeGIA: SQL Injection (Blind Time-Based) Vulnerability in /pet/profile_pet.php Endpoint

EPSS 0.4%public exploit CVSS 9.8

thorsten1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2025-59943 · thorsten phpMyFAQ

phpMyFAQ duplicate email registration allows multiple accounts with the same email

EPSS 0.4%public exploit CVSS 9.8

Unknown1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2025-9697 · Unknown Ajax WooSearch

Ajax WooSearch <= 1.0.0 - Unauthenticated SQL Injection

EPSS 0.4%public exploit CVSS 9.8

magnigenie1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-9209 · magnigenie RestroPress – Online Food Ordering System

RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT

EPSS 2%CVSS 9.8

OpenSSL1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2025-9230 · OpenSSL OpenSSL

Out-of-bounds read & write in RFC 3211 KEK Unwrap

EPSS 2%CVSS 9.8

AndSoft9 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2025-59735 · AndSoft e-TMS

Multiple vulnerabilities in AndSoft's e-TMS

EPSS 1%CVSS 9.8

CVE-2025-59736 · AndSoft e-TMS

Multiple vulnerabilities in AndSoft's e-TMS

EPSS 1%CVSS 9.8

CVE-2025-59737 · AndSoft e-TMS

Multiple vulnerabilities in AndSoft's e-TMS

EPSS 1%CVSS 9.8

CVE-2025-59738 · AndSoft e-TMS

Multiple vulnerabilities in AndSoft's e-TMS

EPSS 1%CVSS 9.8

CVE-2025-59739 · AndSoft e-TMS

Multiple vulnerabilities in AndSoft's e-TMS

EPSS 1%CVSS 9.8

CVE-2025-59740 · AndSoft e-TMS

Multiple vulnerabilities in AndSoft's e-TMS

EPSS 1%CVSS 9.8

CVE-2025-59741 · AndSoft e-TMS

Multiple vulnerabilities in AndSoft's e-TMS

EPSS 1%CVSS 9.8

CVE-2025-59742 · AndSoft e-TMS

Multiple vulnerabilities in AndSoft's e-TMS

EPSS 0.4%CVSS 9.8

CVE-2025-59743 · AndSoft e-TMS

Multiple vulnerabilities in AndSoft's e-TMS

EPSS 0.4%CVSS 9.8

MegaSys1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2025-10659 · MegaSys Telenium Online Web Application:

MegaSys Enterprises Telenium Online Web Application OS Command Injection

EPSS 1%CVSS 9.8

opendatahub-io1 vulnerability on this pageMax CVSS 9.9Priority 41KEV 0

CVE-2025-10725 · opendatahub-io opendatahub-operator

Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster admin

EPSS 0.7%CVSS 9.9

beardev1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-7721 · beardev JoomSport – for Sports: Team & League, Football, Hockey & more

JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion

EPSS 0.7%CVSS 9.8

djangoproject1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-59681 · djangoproject Django

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.

EPSS 0.7%CVSS 9.8

Polska Akademia Dostępności3 vulnerabilities on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2025-7063 · Polska Akademia Dostępności PAD CMS

Remote Code Execution via Unrestricted File Upload in PAD CMS

EPSS 0.6%CVSS 10.0

CVE-2025-7065 · Polska Akademia Dostępności PAD CMS

Remote Code Execution via Unrestricted File Upload in PAD CMS

EPSS 0.6%CVSS 10.0

CVE-2025-8120 · Polska Akademia Dostępności PAD CMS

Remote Code Execution via Unrestricted File Upload in PAD CMS

EPSS 0.6%CVSS 10.0

cyberlord921 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-9485 · cyberlord92 OAuth Single Sign On – SSO (OAuth Client)

OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()

EPSS 0.6%CVSS 9.8

DrayTek Corporation1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-10547 · DrayTek Corporation Vigor1000B

CVE-2025-10547

EPSS 0.6%CVSS 9.8

Theme-Spirit1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-6388 · Theme-Spirit Spirit Framework

Spirit Framework <= 1.2.14 - Authentication Bypass to Account Takeover and Privilege Escalation

EPSS 0.6%CVSS 9.8

cursor1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-59944 · cursor cursor

Cursor IDE: Sensitive File Overwrite Bypass is Possible

EPSS 0.5%CVSS 9.8

hancock111 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-9286 · hancock11 Appy Pie Connect for WooCommerce

Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password

EPSS 0.5%CVSS 9.8

Red Hat1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2025-7493 · Red Hat Red Hat Enterprise Linux 10

Freeipa: idm: privilege escalation from host to domain admin in freeipa

EPSS 0.6%CVSS 9.1

risc01 vulnerability on this pageMax CVSS 9.3Priority 36KEV 0

CVE-2025-61588 · risc0 risc0

risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`

EPSS 0.5%CVSS 9.3

Extreme Networks1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2025-8679 · Extreme Networks ExtremeGuest Essentials

ExtremeGuest Essentials Captive Portal Unauthenticated Brute Force

EPSS 0.3%CVSS 9.8

quantumrose1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2025-10726 · quantumrose WPRecovery

WPRecovery <= 2.0 - Unauthenticated SQL Injection to Arbitrary File Deletion

EPSS 0.4%CVSS 9.1

GTT1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2025-41064 · GTT OpenSIAC

Incorrect authentication in GTT´s group OpenSIAC

EPSS 0.4%CVSS 9.3

Linux3 vulnerabilities on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2023-53517 · Linux Linux

tipc: do not update mtu if msg_max is too small in mtu negotiation

EPSS 0.3%CVSS 9.8

CVE-2025-39932 · Linux Linux

smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)

EPSS 0.3%CVSS 9.8

CVE-2025-39933 · Linux Linux

smb: client: let recv_done verify data_offset, data_length and remaining_data_length

EPSS 0.3%CVSS 9.4

ghazale1 vulnerability on this pageMax CVSS 9.1Priority 33KEV 0

CVE-2020-36852 · ghazale Custom Searchable Data Entry System

Custom Searchable Data Entry System <= 1.7.1 - Unauthenticated Database Wiping

EPSS 0.3%CVSS 9.1

GTONE1 vulnerability on this pageMax CVSS 9.4Priority 32KEV 0

CVE-2025-11221 · GTONE ChangeFlow

Remote Code Execution in GTONE ChangeFlow

EPSS 0.3%CVSS 9.4

mod_vvisit_counter1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2025-40636 · mod_vvisit_counter mod_vvisit_counter

SQL injection in the mod_vvisit_counter module

EPSS 0.3%CVSS 9.3

Qt2 vulnerabilities on this pageMax CVSS 9.4Priority 31KEV 0

CVE-2025-10728 · Qt Qt

Uncontrolled recursion in Qt SVG module

EPSS 0.2%CVSS 9.4

CVE-2025-10729 · Qt Qt

Use-after-free vulnerability in Qt SVG qsvghandler.cpp allows denial of service via crafted SVG

EPSS 0.2%CVSS 9.4

The archive.