Critical vulnerability archive — page 341

Commvault1 vulnerability on this pageMax CVSS 10.0Priority 100KEV 1

CVE-2025-34028 · Commvault Command Center Innovation Release

Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal

KEV · due 23 May EPSS 98%public exploit SSVC act CVSS 10.0

craftcms1 vulnerability on this pageMax CVSS 10.0Priority 100KEV 1

CVE-2025-32432 · craftcms cms

Craft CMS Allows Remote Code Execution

KEV · due 3 Apr EPSS 100%public exploit SSVC act CVSS 10.0

SAP_SE1 vulnerability on this pageMax CVSS 10.0Priority 100KEV 1

CVE-2025-31324 · SAP_SE SAP NetWeaver (Visual Composer development server)

Missing Authorization check in SAP NetWeaver (Visual Composer development server)

KEV · due 20 May ransomware use EPSS 99%public exploit SSVC act CVSS 10.0

dataease1 vulnerability on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2025-32966 · dataease dataease

Dataease H2 JDBC Connection Remote Code Execution

EPSS 4%public exploit CVSS 9.8

Unknown1 vulnerability on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2025-2907 · Unknown Order Delivery Date

Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update

EPSS 1%public exploit CVSS 9.8

mitre7 vulnerabilities on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2025-45429 · mitre

In the Tenda ac9 v1.0 router with firmware V15.03.05.14_multi, there is a stack overflow vulnerability in /goform/WifiWpsStart, which may…

EPSS 1%public exploit CVSS 9.8

CVE-2025-45427 · mitre

In Tenda AC9 v1.0 with firmware V15.03.05.14_multi, the security parameter of /goform/WifiBasicSet has a stack overflow vulnerability, wh…

EPSS 0.9%public exploit CVSS 9.8

CVE-2025-45428 · mitre

In Tenda ac9 v1.0 with firmware V15.03.05.14_multi, the rebootTime parameter of /goform/SetSysAutoRebbotCfg has a stack overflow vulnerab…

EPSS 0.9%public exploit CVSS 9.8

CVE-2025-25775 · mitre

Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-43951 · mitre

LabVantage before LV 8.8.0.13 HF6 allows local file inclusion.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-32980 · mitre

NETSCOUT nGeniusONE before 6.4.0 P11 b3245 has a Weak Sudo Configuration.

EPSS 0.5%CVSS 9.8

CVE-2025-32985 · mitre

NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files.

EPSS 0.5%CVSS 9.8

NASA2 vulnerabilities on this pageMax CVSS 9.9Priority 50KEV 0

CVE-2025-46674 · NASA CryptoLib

NASA CryptoLib before 1.3.2 uses Extended Procedures that are a Work in Progress (not intended for use during flight), potentially leadin…

EPSS 0.6%public exploit CVSS 9.9

CVE-2025-46673 · NASA CryptoLib

NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Spac…

EPSS 0.5%public exploit CVSS 9.9

withstars2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-3960 · withstars Books-Management-System

withstars Books-Management-System Background Interface allreaders.html authorization

EPSS 0.7%public exploit CVSS 9.8

CVE-2025-3963 · withstars Books-Management-System

withstars Books-Management-System Background Interface list authorization

EPSS 0.7%public exploit CVSS 9.8

xwiki1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-32969 · xwiki xwiki-platform

org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

EPSS 80%CVSS 9.8

opplus1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-3957 · opplus springboot-admin

opplus springboot-admin SysLogDao.xml sql injection

EPSS 0.5%public exploit CVSS 9.8

oceanwp1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-3472 · oceanwp Ocean Extra

Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution

EPSS 2%CVSS 9.8

Serosoft1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2024-53636 · Serosoft Academia Student Information System

An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows atta…

EPSS 2%CVSS 9.8

Planet Technology5 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2025-46271 · Planet Technology UNI-NMS-Lite

Planet Technology Network Products OS Command Injection

EPSS 2%CVSS 9.3

CVE-2025-46272 · Planet Technology WGS-804HPT-V2

Planet Technology Network Products OS Command Injection

EPSS 1%CVSS 9.3

CVE-2025-46273 · Planet Technology UNI-NMS-Lite

Planet Technology Network Products Use of Hard-coded Credentials

EPSS 0.6%CVSS 9.8

CVE-2025-46275 · Planet Technology WGS-804HPT-V2

Planet Technology Network Products Missing Authentication for Critical Function

EPSS 0.6%CVSS 9.8

CVE-2025-46274 · Planet Technology UNI-NMS-Lite

Planet Technology Network Products Use of Hard-coded Credentials

EPSS 0.5%CVSS 9.8

Bluegrams1 vulnerability on this pageMax CVSS 9.2Priority 41KEV 0

CVE-2025-43858 · Bluegrams YoutubeDLSharp

YoutubeDLSharp allows command injection on windows system due to non sanitized arguments

EPSS 0.3%public exploit CVSS 9.2

neoslab1 vulnerability on this pageMax CVSS 9.1Priority 41KEV 0

CVE-2025-3065 · neoslab Database Toolset

Database Toolset <= 1.8.4 - Unauthenticated Arbitrary File Deletion

EPSS 1%CVSS 9.1

Quantum1 vulnerability on this pageMax CVSS 9.9Priority 41KEV 0

CVE-2025-46616 · Quantum StorNext

Quantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution (RCE) via upload of a file.

EPSS 0.7%CVSS 9.9

NVIDIA3 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-23249 · NVIDIA NeMo Framework

NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution.

EPSS 0.7%CVSS 9.8

CVE-2025-23250 · NVIDIA NeMo Framework

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause an improper limitation of a pathname to a restricted directo…

EPSS 0.6%CVSS 9.8

CVE-2025-23251 · NVIDIA NeMo Framework

NVIDIA NeMo Framework contains a vulnerability where a user could cause an improper control of generation of code by remote code execution.

EPSS 0.7%CVSS 9.8

v1rustyle2 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-3604 · v1rustyle Flynax Bridge

Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover

EPSS 0.7%CVSS 9.8

CVE-2025-3603 · v1rustyle Flynax Bridge

Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password Update

EPSS 0.6%CVSS 9.8

XRPLF1 vulnerability on this pageMax CVSS 9.3Priority 40KEV 0

CVE-2025-32965 · XRPLF xrpl.js

Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2

EPSS 0.9%CVSS 9.3

Arista1 vulnerability on this pageMax CVSS 9.6Priority 39KEV 0

CVE-2025-2767 · Arista NG Firewall

Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability

EPSS 0.7%CVSS 9.6

halo-dev1 vulnerability on this pageMax CVSS 9.0Priority 39KEV 0

CVE-2024-56156 · halo-dev halo

Halo Vulnerable to Stored XSS and RCE via File Upload Bypass

EPSS 0.8%CVSS 9.0

JetBrains1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-46433 · JetBrains TeamCity

In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible

EPSS 0.6%CVSS 9.8

xxyopen1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-3856 · xxyopen Novel-Plus

xxyopen Novel-Plus searchByPage sql injection

EPSS 0.6%CVSS 9.8

aonetheme1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-2470 · aonetheme Service Finder Bookings

Service Finder Bookings <= 5.1 - Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input'

EPSS 0.5%CVSS 9.8

blubrry1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2025-46264 · blubrry PowerPress Podcasting

WordPress PowerPress Podcasting <= 11.12.5 - Arbitrary File Upload Vulnerability

EPSS 0.4%CVSS 9.9

Johnson Controls1 vulnerability on this pageMax CVSS 9.3Priority 38KEV 0

CVE-2025-26382 · Johnson Controls iSTAR Configuration Utility (ICU)

Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool

EPSS 0.6%CVSS 9.3

2012060301 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-3956 · 201206030 novel-cloud

201206030 novel-cloud BookInfoMapper.xml RestResp sql injection

EPSS 0.5%CVSS 9.8

Hewlett Packard Enterprise (HPE)1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-37087 · Hewlett Packard Enterprise (HPE) HPE Performance Cluster Manager (HPCM)

A vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an attacker to gain access to an arbitrary…

EPSS 0.4%CVSS 9.8

python-hyper1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2025-43859 · python-hyper h11

h11 accepts some malformed Chunked-Encoding bodies

EPSS 0.6%CVSS 9.1

codepeople1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2025-46247 · codepeople Appointment Booking Calendar

WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability

EPSS 0.4%CVSS 9.8

Meon1 vulnerability on this pageMax CVSS 9.3Priority 36KEV 0

CVE-2025-42605 · Meon Bidding Solutions

Improper Access Control Vulnerability in Meon Bidding Solutions

EPSS 0.5%CVSS 9.3

Dotstore1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2025-46244 · Dotstore Advanced Linked Variations for Woocommerce

WordPress Advanced Linked Variations for Woocommerce plugin <= 1.0.3 - Broken Access Control Vulnerability

EPSS 0.3%CVSS 9.8

M A Vinoth Kumar1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2025-46248 · M A Vinoth Kumar Frontend Dashboard

WordPress Frontend Dashboard plugin <= 2.2.5 - SQL Injection Vulnerability

EPSS 0.4%CVSS 9.3

HCL Software1 vulnerability on this pageMax CVSS 9.8Priority 32KEV 0

CVE-2024-30152 · HCL Software HCL SX

HCL SX is affected by usage of a weak cryptographic algorithm

EPSS 0.2%CVSS 9.8

IBM1 vulnerability on this pageMax CVSS 9.3Priority 30KEV 0

CVE-2025-1950 · IBM Hardware Management Console - Power Systems

IBM Hardware Management Console - Power Systems command execution

EPSS 0.2%CVSS 9.3

The archive.