Critical vulnerability archive — page 332

Fortinet1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2025-32756 · Fortinet FortiNDR

Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

KEV · due 4 Jun EPSS 31%public exploit SSVC act CVSS 9.8

Samsung Electronics1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2025-4632 · Samsung Electronics MagicINFO 9 Server

Samsung MagicINFO 9 Server Path Traversal Vulnerability

KEV · due 12 Jun EPSS 24%public exploit SSVC act CVSS 9.8

SAP_SE2 vulnerabilities on this pageMax CVSS 10.0Priority 97KEV 1

CVE-2025-42999 · SAP_SE SAP NetWeaver (Visual Composer development server)

Insecure Deserialization in SAP NetWeaver (Visual Composer development server)

KEV · due 5 Jun ransomware use EPSS 13%public exploit SSVC act CVSS 9.1

CVE-2025-30012 · SAP_SE SAP Supplier Relationship Management (Live Auction Cockpit)

Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

EPSS 0.8%CVSS 10.0

NetAlertX1 vulnerability on this pageMax CVSS 10.0Priority 60KEV 0

CVE-2024-46506 · NetAlertX NetAlertX

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesetting…

EPSS 63%public exploit CVSS 10.0

mitre9 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2025-45858 · mitre

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc function.

EPSS 11%public exploit CVSS 9.8

CVE-2025-45857 · mitre

EDIMAX CV7428NS v1.20 was discovered to contain a remote code execution (RCE) vulnerability via the command parameter in the mp function.

EPSS 1%public exploit CVSS 9.8

CVE-2025-45861 · mitre

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the routername parameter in the formDnsv6 interface.

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-45863 · mitre

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the macstr parameter in the formMapDelDevice interf…

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-45865 · mitre

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the dnsaddr parameter in the formDhcpv6s interface.

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-28056 · mitre

rebuild v3.9.0 through v3.9.3 has a SQL injection vulnerability in /admin/admin-cli/exec component.

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-44831 · mitre

EngineerCMS v1.02 through v2.0.5 has a SQL injection vulnerability in the /project/addproject interface.

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-32363 · mitre

mediDOK before 2.5.18.43 allows remote attackers to achieve remote code execution on a target system via deserialization of untrusted data.

EPSS 1.0%CVSS 9.8

CVE-2025-27891 · mitre

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 13…

EPSS 0.5%CVSS 9.1

lukevella1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-47781 · lukevella rallly

Rallly Insufficient Password Login Token Entropy Leads to Account Takeover

EPSS 0.6%public exploit CVSS 9.8

Arraytics1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-47445 · Arraytics Eventin

WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability

EPSS 5%CVSS 9.8

Adobe7 vulnerabilities on this pageMax CVSS 9.3Priority 47KEV 0

CVE-2025-43560 · Adobe ColdFusion

ColdFusion | Improper Input Validation (CWE-20)

EPSS 23%CVSS 9.1

CVE-2025-43561 · Adobe ColdFusion

ColdFusion | Incorrect Authorization (CWE-863)

EPSS 24%CVSS 9.1

CVE-2025-43562 · Adobe ColdFusion

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

EPSS 51%CVSS 9.1

CVE-2025-43563 · Adobe ColdFusion

ColdFusion | Improper Access Control (CWE-284)

EPSS 17%CVSS 9.1

CVE-2025-43564 · Adobe ColdFusion

ColdFusion | Incorrect Authorization (CWE-863)

EPSS 17%CVSS 9.1

CVE-2025-43559 · Adobe ColdFusion

ColdFusion | Improper Input Validation (CWE-20)

EPSS 2%CVSS 9.1

CVE-2025-43567 · Adobe Adobe Connect

Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

EPSS 0.5%CVSS 9.3

Ivanti1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-22462 · Ivanti Neurons for ITSM (on-prem)

An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allo…

EPSS 2%CVSS 9.8

ZKTeco1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-45746 · ZKTeco ZKBio CVSecurity

In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service…

EPSS 0.4%public exploit CVSS 9.8

Apache Software Foundation2 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-24780 · Apache Software Foundation Apache IoTDB

Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function

EPSS 1%CVSS 9.8

CVE-2025-47436 · Apache Software Foundation Apache ORC

Apache ORC: Potential Heap Buffer Overflow during C++ LZO Decompression

EPSS 0.6%CVSS 9.8

Siemens6 vulnerabilities on this pageMax CVSS 10.0Priority 44KEV 0

CVE-2025-32469 · Siemens RUGGEDCOM ROX MX5000

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RU…

EPSS 1%CVSS 9.9

CVE-2025-33024 · Siemens RUGGEDCOM ROX MX5000

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RU…

EPSS 1%CVSS 9.9

CVE-2025-33025 · Siemens RUGGEDCOM ROX MX5000

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RU…

EPSS 1%CVSS 9.9

CVE-2025-26389 · Siemens OZW672

A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0).

EPSS 1.0%CVSS 10.0

CVE-2025-26390 · Siemens OZW672

A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0).

EPSS 0.6%CVSS 9.8

CVE-2025-40566 · Siemens SIMATIC PCS neo V4.1

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Upd…

EPSS 0.5%CVSS 9.8

Forescout1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2025-4660 · Forescout SecureConnector

Remote Code Execution in Windows Secure Connector/ HPS Inspection Engine via Insecure Named Pipe Access

EPSS 1%CVSS 9.8

Microsoft1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2025-30387 · Microsoft Azure AI Document Intelligence Studio

Document Intelligence Studio On-Prem Elevation of Privilege Vulnerability

EPSS 1%CVSS 9.8

nanbingxyz1 vulnerability on this pageMax CVSS 9.7Priority 42KEV 0

CVE-2025-47777 · nanbingxyz 5ire

5ire Client Vulnerable to Cross-Site Scripting (XSS) and Remote Code Execution (RCE)

EPSS 1%CVSS 9.7

Apple2 vulnerabilities on this pageMax CVSS 9.1Priority 40KEV 0

CVE-2025-30448 · Apple iOS and iPadOS

This issue was addressed with additional entitlement checks.

EPSS 1%CVSS 9.1

CVE-2025-30436 · Apple iOS and iPadOS

This issue was addressed by restricting options offered on a locked device.

EPSS 0.5%CVSS 9.1

cap-collectif1 vulnerability on this pageMax CVSS 9.5Priority 39KEV 0

CVE-2025-47292 · cap-collectif cap-collectif

Cap Collectif vulnerable to insecure deserialization leading to remote code execution

EPSS 0.7%CVSS 9.5

PointCloudLibrary1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-4638 · PointCloudLibrary pcl

Improper Pointer Arithmetic in pcl

EPSS 0.6%CVSS 9.8

uncannyowl1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2025-3623 · uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin

Uncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function

EPSS 0.9%CVSS 9.1

getkirby2 vulnerabilities on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2025-30159 · getkirby kirby

Kirby vulnerable to path traversal of snippet names in the `snippet()` helper

EPSS 0.7%CVSS 9.1

CVE-2025-31493 · getkirby kirby

Path traversal of collection names during file system lookup

EPSS 0.6%CVSS 9.1

bonigarcia1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2025-4641 · bonigarcia webdrivermanager

XML External Entity (XXE) injection vulnerability in WebDriverManager

EPSS 0.6%CVSS 9.3

Kashipara Group1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2023-49641 · Kashipara Group Billing Software

Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

EPSS 0.4%CVSS 9.8

OPKSSH2 vulnerabilities on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-3757 · OPKSSH OPKSSH

Authentication Bypass in OpenPubKey

EPSS 0.4%CVSS 9.8

CVE-2025-4658 · OPKSSH OPKSSH

Authentication Bypass in OPKSSH

EPSS 0.3%CVSS 9.8

VMware1 vulnerability on this pageMax CVSS 9.4Priority 37KEV 0

CVE-2025-22248 · VMware Bitnami

[pgpool] Unauthenticated access to postgres through pgpool

EPSS 0.5%CVSS 9.4

OpenText1 vulnerability on this pageMax CVSS 9.4Priority 36KEV 0

CVE-2024-10865 · OpenText Advance Authentication

Reflected Cross-Site Scripting vulnerability in OpenText Advanced Authentication

EPSS 0.4%CVSS 9.4

DomainsPRO1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2025-40628 · DomainsPRO DomainsPRO

SQL Injection in DomainsPRO

EPSS 0.4%CVSS 9.3

The archive.