Critical vulnerability archive — page 296

Adobe1 vulnerability on this pageMax CVSS 10.0Priority 100KEV 1

CVE-2025-54253 · Adobe Adobe Experience Manager

Adobe Experience Manager | Incorrect Authorization (CWE-863)

KEV · due 5 Nov EPSS 81%public exploit SSVC act CVSS 10.0

Trend Micro, Inc.2 vulnerabilities on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2025-54948 · Trend Micro, Inc. Trend Micro Apex One

Trend Micro Apex One OS Command Injection Vulnerability

KEV · due 8 Sep EPSS 33%public exploit SSVC act CVSS 9.8

CVE-2025-54987 · Trend Micro, Inc. Trend Micro Apex One

A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicio…

EPSS 27%CVSS 9.8

Dassault Systèmes1 vulnerability on this pageMax CVSS 9.1Priority 97KEV 1

CVE-2025-6205 · Dassault Systèmes DELMIA Apriso

Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025

KEV · due 18 Nov EPSS 67%public exploit SSVC act CVSS 9.1

Dell2 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2025-36604 · Dell Unity

Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inject…

EPSS 69%public exploit CVSS 9.8

CVE-2025-36594 · Dell PowerProtect Data Domain Feature Release

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2024 rel…

EPSS 0.6%CVSS 9.8

mitre11 vulnerabilities on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2025-51390 · mitre

TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWp…

EPSS 2%public exploit CVSS 9.8

CVE-2025-50706 · mitre

An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function

EPSS 1%public exploit CVSS 9.8

CVE-2025-50707 · mitre

An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component

EPSS 1%public exploit CVSS 9.8

CVE-2025-50754 · mitre

Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality.

EPSS 0.7%public exploit CVSS 9.6

CVE-2025-30127 · mitre

An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-50341 · mitre

A Boolean-based SQL injection vulnerability was discovered in Axelor 5.2.4 via the _domain parameter.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-52239 · mitre

An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-51535 · mitre

Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a SQL injection vulnerability.

EPSS 0.5%public exploit CVSS 9.1

CVE-2025-51387 · mitre

The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses.

EPSS 0.7%CVSS 9.8

CVE-2025-51536 · mitre

Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.

EPSS 0.6%CVSS 9.8

CVE-2025-46658 · mitre

An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6.

EPSS 0.4%CVSS 9.8

pyload1 vulnerability on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2025-54802 · pyload pyload

pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)

EPSS 1%public exploit CVSS 9.8

unjs1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2025-54387 · unjs ipx

IPX is Vulnerable to Path Traversal via Prefix Matching Bypass

EPSS 0.8%public exploit CVSS 9.8

code-projects4 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-8499 · code-projects Online Medicine Guide

code-projects Online Medicine Guide cusfindambulence2.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2025-8502 · code-projects Online Medicine Guide

code-projects Online Medicine Guide changepass.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8503 · code-projects Online Medicine Guide

code-projects Online Medicine Guide adaddmed.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8504 · code-projects Kitchen Treasure

code-projects Kitchen Treasure userregistration.php unrestricted upload

EPSS 0.5%public exploit CVSS 9.8

LiquidFiles1 vulnerability on this pageMax CVSS 9.9Priority 50KEV 0

CVE-2025-46093 · LiquidFiles LiquidFiles

LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code…

EPSS 0.6%public exploit CVSS 9.9

uclouvain1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-54874 · uclouvain openjpeg

OpenJPEG allows OOB heap memory write in opj_jp2_read_header

EPSS 0.7%public exploit CVSS 9.8

Delta Electronics1 vulnerability on this pageMax CVSS 9.3Priority 47KEV 0

CVE-2025-53417 · Delta Electronics DIAView

File Parsing Deserialization of Untrusted Data in DTM Soft

EPSS 20%CVSS 9.3

FTB-Gamepedia1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2025-54865 · FTB-Gamepedia Tilesheets

Tilesheets MediaWiki Extension is Vulnerable to Potential SQL Injection

EPSS 0.4%public exploit CVSS 9.8

ICT Innovations1 vulnerability on this pageMax CVSS 9.3Priority 47KEV 0

CVE-2025-2611 · ICT Innovations ICTBroadcast

ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCE

EPSS 8%CVSS 9.3

NVIDIA3 vulnerabilities on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2025-23311 · NVIDIA Triton Inference Server

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a stack overflow through specially crafted HTTP req…

EPSS 3%CVSS 9.8

CVE-2025-23317 · NVIDIA Triton Inference Server

NVIDIA Triton Inference Server contains a vulnerability in the HTTP server, where an attacker could start a reverse shell by sending a sp…

EPSS 3%CVSS 9.8

CVE-2025-23310 · NVIDIA Triton Inference Server

NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause stack buffer overflow by spec…

EPSS 2%CVSS 9.8

cronoh1 vulnerability on this pageMax CVSS 9.0Priority 46KEV 0

CVE-2025-8535 · cronoh NanoVault

cronoh NanoVault xrb URL main.js executeJavaScript cross site scripting

EPSS 0.5%public exploit CVSS 9.0

cursor2 vulnerabilities on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-54135 · cursor cursor

Cursor Agent is vulnerable to prompt injection via MCP Special Files

EPSS 2%CVSS 9.8

CVE-2025-54130 · cursor cursor

Cursor Agent is vulnerable prompt injection via Editor Special Files

EPSS 0.4%CVSS 9.8

Exrick1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-8526 · Exrick xboot

Exrick xboot UploadController.java upload unrestricted upload

EPSS 0.4%public exploit CVSS 9.8

RUCKUS3 vulnerabilities on this pageMax CVSS 9.9Priority 46KEV 0

CVE-2025-44961 · RUCKUS SmartZone

In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticate…

EPSS 2%CVSS 9.9

CVE-2025-44954 · RUCKUS SmartZone

RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account.

EPSS 0.7%CVSS 9.8

CVE-2025-44963 · RUCKUS Network Director

RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certai…

EPSS 0.6%CVSS 9.0

anthropics2 vulnerabilities on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2025-54795 · anthropics claude-code

Claude Code echo command allowed bypass of user approval prompt for command execution

EPSS 1%CVSS 9.8

CVE-2025-54794 · anthropics claude-code

Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access

EPSS 1%CVSS 9.1

Ubiquiti Inc1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2025-27212 · Ubiquiti Inc UniFi Access Reader Pro

An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Ac…

EPSS 1%CVSS 9.8

SATO Corporation1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-22470 · SATO Corporation CL4/6NX Plus

CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1 allow crafted dangerous files to be uploaded.

EPSS 0.8%CVSS 9.8

Shenzhen Aitemi E Commerce Co. Ltd.1 vulnerability on this pageMax CVSS 9.4Priority 41KEV 0

CVE-2025-34147 · Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater

Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via SSID

EPSS 0.9%CVSS 9.4

ADOdb1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2025-54119 · ADOdb ADOdb

ADOdb's sqlite3 driver allows SQL injection

EPSS 0.6%CVSS 10.0

SmartDataSoft1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-6994 · SmartDataSoft Reveal Listing

Reveal Listing <= 3.3 - Unauthenticated Privilege Escalation

EPSS 0.5%CVSS 9.8

callstackincubator1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2025-54594 · callstackincubator react-native-bottom-tabs

react-native-bottom-tabs: Arbitrary code execution in GitHub Actions canary workflow leads to secret exfiltration

EPSS 0.5%CVSS 9.1

Huawei1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2025-54617 · Huawei HarmonyOS

Stack-based buffer overflow vulnerability in the dms_fwk module.

EPSS 0.4%CVSS 9.8

Zscaler1 vulnerability on this pageMax CVSS 9.6Priority 36KEV 0

CVE-2025-54982 · Zscaler Authentication Server

SAML 2.0 Public Key Validation Issue

EPSS 0.4%CVSS 9.6

DavidOsipov1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2025-54883 · DavidOsipov Vision-ui

Vision UI's security-kit Contains Cryptographic Weakness

EPSS 0.4%CVSS 9.3

Qualcomm, Inc.1 vulnerability on this pageMax CVSS 9.8Priority 32KEV 0

CVE-2025-27071 · Qualcomm, Inc. Snapdragon

Buffer Copy Without Checking Size of Input in Powerline Communication Firmware

EPSS 0.2%CVSS 9.8

The archive.