Critical vulnerability archive — page 299

bentoml1 vulnerability on this pageMax CVSS 9.9Priority 59KEV 0

CVE-2025-54381 · bentoml BentoML

BentoML is Vulnerable to an SSRF Attack Through File Upload Processing

EPSS 14%public exploit CVSS 9.9

mitre3 vulnerabilities on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2025-44136 · mitre

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS).

EPSS 3%public exploit CVSS 9.8

CVE-2025-50738 · mitre

The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs.

EPSS 2%public exploit CVSS 9.8

CVE-2025-46059 · mitre

langchain-ai v0.3.51 was discovered to contain an indirect prompt injection vulnerability in the GmailToolkit component.

EPSS 0.8%public exploit CVSS 9.8

Vaelsys2 vulnerabilities on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2025-8259 · Vaelsys VaelsysV4

Vaelsys VaelsysV4 Web interface vgrid_server.php execute_DataObjectProc os command injection

EPSS 3%public exploit CVSS 9.8

CVE-2025-8261 · Vaelsys VaelsysV4

Vaelsys VaelsysV4 User Creation vgrid_server.php improper authorization

EPSS 0.7%public exploit CVSS 9.8

code-projects10 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-8255 · code-projects Exam Form Submission

code-projects Exam Form Submission register.php unrestricted upload

EPSS 0.7%public exploit CVSS 9.8

CVE-2025-8269 · code-projects Exam Form Submission

code-projects Exam Form Submission delete_s1.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2025-8251 · code-projects Exam Form Submission

code-projects Exam Form Submission delete_s4.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8252 · code-projects Exam Form Submission

code-projects Exam Form Submission delete_s5.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8253 · code-projects Exam Form Submission

code-projects Exam Form Submission delete_s6.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8270 · code-projects Exam Form Submission

code-projects Exam Form Submission delete_s2.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8271 · code-projects Exam Form Submission

code-projects Exam Form Submission delete_s3.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8272 · code-projects Exam Form Submission

code-projects Exam Form Submission update_fst.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8273 · code-projects Exam Form Submission

code-projects Exam Form Submission update_s8.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8256 · code-projects Online Ordering System

code-projects Online Ordering System product.php unrestricted upload

EPSS 0.5%public exploit CVSS 9.8

Campcodes2 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-8274 · Campcodes Online Recruitment Management System

Campcodes Online Recruitment Management System ajax.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-8254 · Campcodes Courier Management System

Campcodes Courier Management System view_parcel.php sql injection

EPSS 0.4%public exploit CVSS 9.8

codeigniter41 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2025-54418 · codeigniter4 CodeIgniter4

CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

EPSS 2%CVSS 9.8

Apple4 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2025-31279 · Apple iPadOS

A permissions issue was addressed with additional restrictions.

EPSS 1%CVSS 9.8

CVE-2025-31281 · Apple iOS and iPadOS

An input validation issue was addressed with improved memory handling.

EPSS 1%CVSS 9.1

CVE-2025-43184 · Apple macOS

This issue was addressed by adding an additional prompt for user consent.

EPSS 0.8%CVSS 9.8

CVE-2025-43192 · Apple macOS

A configuration issue was addressed with additional restrictions.

EPSS 0.7%CVSS 9.8

SonicWall1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2025-40600 · SonicWall SonicOS

Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cau…

EPSS 1.0%CVSS 9.8

Linux5 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

Johnson Controls, Inc2 vulnerabilities on this pageMax CVSS 9.4Priority 40KEV 0

CVE-2025-53695 · Johnson Controls, Inc iSTAR Ultra

OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root'…

EPSS 0.9%CVSS 9.4

CVE-2025-53696 · Johnson Controls, Inc iSTAR Ultra

iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware.

EPSS 0.1%CVSS 9.3

MedDream2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-26469 · MedDream MedDream PACS Premium

An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.…

EPSS 0.6%CVSS 9.8

CVE-2025-27724 · MedDream MedDream PACS Premium

A privilege escalation vulnerability exists in the login.php functionality of meddream MedDream PACS Premium 7.3.3.840.

EPSS 0.6%CVSS 9.8

discourse1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-53102 · discourse discourse

Discourse's WebAuthn challenge isn't cleared from user session after authentication

EPSS 0.5%CVSS 9.8

GitLab1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-8279 · GitLab GitLab Language Server

Missing Authentication for Critical Function in GitLab Language Server

EPSS 0.5%CVSS 9.8

musombi1231 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-54428 · musombi123 RevelaCode-Backend

RevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak)

EPSS 0.5%CVSS 9.8

firecoders.com1 vulnerability on this pageMax CVSS 9.4Priority 37KEV 0

CVE-2025-54298 · firecoders.com CommentBox component for Joomla

Extension - firecoders.com - Stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla

EPSS 0.5%CVSS 9.4

nobossextensions.com1 vulnerability on this pageMax CVSS 9.4Priority 37KEV 0

CVE-2025-54299 · nobossextensions.com No Boss Testimonials component for Joomla

Extension - nobossextensions.com - Stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla

EPSS 0.5%CVSS 9.4

node-saml1 vulnerability on this pageMax CVSS 10.0Priority 37KEV 0

CVE-2025-54419 · node-saml node-saml

Node-SAML Contains SAML Signature Verification Vulnerability

EPSS 0.4%CVSS 10.0

Samsung Electronics3 vulnerabilities on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-53078 · Samsung Electronics Data Management Server

Deserialization of Untrusted Data in Samsung DMS(Data Management Server) allows attackers to execute arbitrary code via write file to system

EPSS 0.5%CVSS 9.8

CVE-2025-53082 · Samsung Electronics Data Management Server

An 'Arbitrary File Deletion' in Samsung DMS(Data Management Server) allows attackers to delete arbitrary files from unintended locations…

EPSS 0.5%CVSS 9.1

CVE-2025-53081 · Samsung Electronics Data Management Server

An 'Arbitrary File Creation' in Samsung DMS(Data Management Server) allows attackers to create arbitrary files in unintended locations on…

EPSS 0.4%CVSS 9.1

Ncvav1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2025-6918 · Ncvav Virtual PBX Software

SQLi in Ncvav's Virtual PBX Software

EPSS 0.4%CVSS 9.8

polkadot-evm1 vulnerability on this pageMax CVSS 9.9Priority 36KEV 0

CVE-2025-54426 · polkadot-evm frontier

Polkadot Frontier contains silent failure in Curve25519 arithmetic precompiles with malformed points

EPSS 0.4%CVSS 9.9

Human Resource Management System1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2025-40682 · Human Resource Management System Human Resource Management System

SQL injection vulnerability in Human Resource Management System

EPSS 0.3%CVSS 9.8

snyk1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2025-8264 · snyk

Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend.

EPSS 0.4%CVSS 9.1

JetBrains2 vulnerabilities on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2025-54531 · JetBrains TeamCity

In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows

EPSS 0.3%CVSS 9.4

CVE-2025-54530 · JetBrains TeamCity

In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions

EPSS 0.2%CVSS 9.8

SQLite1 vulnerability on this pageMax CVSS 9.1Priority 33KEV 0

CVE-2025-7458 · SQLite SQLite

SQLite integer overflow in key info allocation may lead to information disclosure.

EPSS 0.4%CVSS 9.1

HP, Inc.1 vulnerability on this pageMax CVSS 9.1Priority 32KEV 0

CVE-2025-43023 · HP, Inc. HP Linux Imaging and Printing Software

HP Linux Imaging and Printing Software - Use of DSA Key

EPSS 0.3%CVSS 9.1

The archive.