Critical vulnerability archive — page 280

Adobe2 vulnerabilities on this pageMax CVSS 10.0Priority 97KEV 1

CVE-2025-54236 · Adobe Adobe Commerce

Adobe Commerce | Improper Input Validation (CWE-20)

KEV · due 14 Nov EPSS 96%public exploit SSVC act CVSS 9.1

CVE-2025-54261 · Adobe ColdFusion

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

EPSS 27%CVSS 10.0

D-Link1 vulnerability on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2025-10123 · D-Link DIR-823X

D-Link DIR-823X set_static_leases sub_415028 command injection

EPSS 4%public exploit CVSS 9.8

mitre3 vulnerabilities on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2025-57633 · mitre

A command injection vulnerability in FTP-Flask-python through 5173b68 allows unauthenticated remote attackers to execute arbitrary OS com…

EPSS 1%public exploit CVSS 9.8

CVE-2025-57085 · mitre

Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-44594 · mitre

halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/uplo…

EPSS 0.4%public exploit CVSS 9.1

ninofiliu1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2025-59046 · ninofiliu interactive-git-checkout

interactive-git-checkout has Command Injection vulnerability

EPSS 1%public exploit CVSS 9.8

xwikisas4 vulnerabilities on this pageMax CVSS 10.0Priority 53KEV 0

LabRedesCefetRJ1 vulnerability on this pageMax CVSS 10.0Priority 51KEV 0

CVE-2025-58745 · LabRedesCefetRJ WeGIA

WeGIA has a bypass for the fix for CVE-2025-22133 - Arbitrary File Upload leads to Remote Code Execution (RCE)

EPSS 0.8%public exploit CVSS 10.0

itsourcecode4 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-10118 · itsourcecode E-Logbook with Health Monitoring System for COVID-19

itsourcecode E-Logbook with Health Monitoring System for COVID-19 login.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-10111 · itsourcecode Student Information Management System

itsourcecode Student Information Management System index.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-10112 · itsourcecode Student Information Management System

itsourcecode Student Information Management System index.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-10113 · itsourcecode Student Information Management System

itsourcecode Student Information Management System index.php sql injection

EPSS 0.5%public exploit CVSS 9.8

Microsoft2 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-55234 · Microsoft Windows 10 Version 1507

Windows SMB Elevation of Privilege Vulnerability

EPSS 21%CVSS 9.8

CVE-2025-55232 · Microsoft Microsoft HPC Pack 2019

Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability

EPSS 2%CVSS 9.8

SAP_SE3 vulnerabilities on this pageMax CVSS 10.0Priority 48KEV 0

CVE-2025-42944 · SAP_SE SAP Netweaver (RMI-P4)

Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)

EPSS 3%CVSS 10.0

CVE-2025-42922 · SAP_SE SAP NetWeaver AS Java (Deploy Web Service)

Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)

EPSS 0.7%CVSS 9.9

CVE-2025-42958 · SAP_SE SAP NetWeaver

Missing Authentication check in SAP NetWeaver

EPSS 0.7%CVSS 9.1

PHPGurukul1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2025-10114 · PHPGurukul Small CRM

PHPGurukul Small CRM profile.php sql injection

EPSS 0.4%public exploit CVSS 9.8

TecCom1 vulnerability on this pageMax CVSS 9.1Priority 45KEV 0

CVE-2025-10183 · TecCom TecConnect

XML External Entity Injection in TecConnect 4.1

EPSS 0.4%public exploit CVSS 9.1

VolkovLabs1 vulnerability on this pageMax CVSS 9.1Priority 42KEV 0

CVE-2025-58746 · VolkovLabs business-links

Volkov Labs Business Links plugin vulnerable to privilege escalation attack

EPSS 0.3%public exploit CVSS 9.1

NVIDIA3 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-23343 · NVIDIA NVDebug tool

The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to write files to restricted components.

EPSS 0.8%CVSS 9.8

CVE-2025-23344 · NVIDIA NVDebug tool

The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to run code on the platform host as a non-privileged user.

EPSS 0.5%CVSS 9.8

CVE-2025-23342 · NVIDIA NVDebug tool

The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to gain access to a privileged account .

EPSS 0.3%CVSS 9.8

rathena3 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-58447 · rathena rathena

rAthena has heap-based buffer overflow in login server

EPSS 0.9%CVSS 9.8

CVE-2025-58448 · rathena rathena

rAthena has SQL Injection in PartyBooking component via `WorldName` parameter.

EPSS 0.4%CVSS 9.8

CVE-2025-58750 · rathena rathena

rAthena missing bound check in chclif_parse_moveCharSlot

EPSS 0.3%CVSS 9.1

Sophos1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-10159 · Sophos AP6 Series Wireless Access Points

An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Poi…

EPSS 0.9%CVSS 9.8

OPEXUS1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-58462 · OPEXUS FOIAXpress Public Access Link (PAL)

OPEXUS FOIAXpress PAL SQL injection

EPSS 0.7%CVSS 9.8

Siemens3 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-40795 · Siemens SIMATIC PCS neo V4.1

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (Al…

EPSS 0.7%CVSS 9.8

CVE-2025-40804 · Siemens SIMATIC Virtualization as a Service (SIVaaS)

A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions).

EPSS 0.4%CVSS 9.3

CVE-2025-40594 · Siemens SINAMICS G220 V6.4

A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions < V6.4 HF7), SINAMI…

EPSS 0.2%CVSS 9.8

Amped RF1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-9994 · Amped RF BT-AP 111

Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not require authentication

EPSS 0.5%CVSS 9.8

Baicells4 vulnerabilities on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2025-55048 · Baicells NEUTRINO430, NOVA436Q, NOVA430e/430i, NOVA846, NOVA246, NOVA243, NOVA233, NOVA227

Multiple CWE-78

EPSS 0.6%CVSS 9.8

CVE-2025-55051 · Baicells NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846

CWE-1392: Use of Default Credentials

EPSS 0.3%CVSS 10.0

CVE-2025-55050 · Baicells NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846

CWE-1242: Inclusion of Undocumented Features

EPSS 0.3%CVSS 9.8

CVE-2025-55049 · Baicells NEUTRINO430

Use of Default Cryptographic Key (CWE-1394)

EPSS 0.3%CVSS 9.1

Tautulli1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2025-58762 · Tautulli Tautulli

Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent

EPSS 0.8%CVSS 9.1

ThinkInAIXYZ1 vulnerability on this pageMax CVSS 9.7Priority 39KEV 0

CVE-2025-58768 · ThinkInAIXYZ deepchat

DeepChat's Mermaid rendering has XSS leading to RCE

EPSS 0.6%CVSS 9.7

WPSwings1 vulnerability on this pageMax CVSS 9.3Priority 38KEV 0

CVE-2025-47569 · WPSwings WooCommerce Ultimate Gift Card

WordPress WooCommerce Ultimate Gift Card plugin <= 2.9.6 - SQL Injection vulnerability

EPSS 0.6%CVSS 9.3

Bearsthemes1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2025-10134 · Bearsthemes Goza - Nonprofit Charity WordPress Theme

Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Deletion

EPSS 0.6%CVSS 9.1

Hossein1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2025-32486 · Hossein Material Dashboard

WordPress Material Dashboard plugin <= 1.4.6 - Privilege Escalation Vulnerability

EPSS 0.3%CVSS 9.8

Shibboleth1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2025-9943 · Shibboleth Service Provider

Unauthenticated SQL Injection Vulnerability in Shibboleth Service Provider

EPSS 0.4%CVSS 9.1

HP, Inc.1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2025-43491 · HP, Inc. Poly Lens

Poly Lens Desktop Application – Privilege Escalation

EPSS 0.3%CVSS 9.8

prebid1 vulnerability on this pageMax CVSS 9.3Priority 33KEV 0

CVE-2025-59039 · prebid prebid-universal-creative

Prebid Universal Creative on npm briefly compromised

EPSS 0.3%CVSS 9.3

ThemeGoods1 vulnerability on this pageMax CVSS 9.0Priority 32KEV 0

CVE-2025-47579 · ThemeGoods Photography

WordPress Photography Theme <= 7.7.2 - PHP Object Injection Vulnerability

EPSS 0.3%CVSS 9.0

Frenify1 vulnerability on this pageMax CVSS 9.6Priority 30KEV 0

CVE-2025-58997 · Frenify Mow

WordPress Mow Theme <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability

EPSS 0.2%CVSS 9.6

The archive.