Critical vulnerability archive — page 355

D-Link3 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2025-2620 · D-Link DAP-1620

D-Link DAP-1620 Authentication storage mod_graph_auth_uri_handler stack-based overflow

EPSS 9%public exploit CVSS 9.8

CVE-2025-2618 · D-Link DAP-1620

D-Link DAP-1620 Path api set_ws_action heap-based overflow

EPSS 2%public exploit CVSS 9.8

CVE-2025-2619 · D-Link DAP-1620

D-Link DAP-1620 Cookie storage check_dws_cookie stack-based overflow

EPSS 2%public exploit CVSS 9.8

yiisoft1 vulnerability on this pageMax CVSS 9.1Priority 57KEV 0

CVE-2024-4990 · yiisoft yiisoft/yii2

Unsafe Reflection in base Component class in yiisoft/yii2

EPSS 80%public exploit CVSS 9.1

infiniflow2 vulnerabilities on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2024-12433 · infiniflow infiniflow/ragflow

Remote Code Execution in infiniflow/ragflow

EPSS 2%public exploit CVSS 9.8

CVE-2024-12450 · infiniflow infiniflow/ragflow

RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow

EPSS 1%public exploit CVSS 9.8

modelscope4 vulnerabilities on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2024-8502 · modelscope modelscope/agentscope

Remote Code Execution via Deserialization in modelscope/agentscope

EPSS 2%public exploit CVSS 9.8

CVE-2024-8537 · modelscope modelscope/agentscope

Path Traversal in modelscope/agentscope

EPSS 1%public exploit CVSS 9.1

CVE-2024-8551 · modelscope modelscope/agentscope

Path Traversal in modelscope/agentscope

EPSS 1%public exploit CVSS 9.1

CVE-2024-8487 · modelscope modelscope/agentscope

CORS Vulnerability in modelscope/agentscope

EPSS 0.3%public exploit CVSS 9.8

run-llama2 vulnerabilities on this pageMax CVSS 10.0Priority 55KEV 0

CVE-2024-12909 · run-llama run-llama/llama_index

SQL Injection to RCE in run-llama/llama_index

EPSS 1%public exploit CVSS 10.0

CVE-2024-11958 · run-llama run-llama/llama_index

SQL Injection in run-llama/llama_index

EPSS 1%public exploit CVSS 9.8

vllm-project2 vulnerabilities on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2024-11041 · vllm-project vllm-project/vllm

Remote Code Execution in vllm-project/vllm

EPSS 2%public exploit CVSS 9.8

CVE-2024-9053 · vllm-project vllm-project/vllm

Remote Code Execution in vllm-project/vllm

EPSS 1%public exploit CVSS 9.8

composiohq3 vulnerabilities on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2024-8958 · composiohq composiohq/composio

Unrestricted File Write and Read in composiohq/composio

EPSS 1%public exploit CVSS 9.8

CVE-2024-8953 · composiohq composiohq/composio

Unsafe eval usage in composiohq/composio

EPSS 1%public exploit CVSS 9.8

CVE-2024-8954 · composiohq composiohq/composio

Authentication Bypass in composiohq/composio

EPSS 0.9%public exploit CVSS 9.8

eosphoros-ai5 vulnerabilities on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2024-10902 · eosphoros-ai eosphoros-ai/db-gpt

Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gpt

EPSS 1%public exploit CVSS 9.8

CVE-2024-10835 · eosphoros-ai eosphoros-ai/db-gpt

Arbitrary File Write via SQL Injection in eosphoros-ai/db-gpt

EPSS 1%public exploit CVSS 9.8

CVE-2024-10901 · eosphoros-ai eosphoros-ai/db-gpt

Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt

EPSS 1%public exploit CVSS 9.8

CVE-2024-10833 · eosphoros-ai eosphoros-ai/db-gpt

Arbitrary File Write in eosphoros-ai/db-gpt

EPSS 0.8%public exploit CVSS 9.1

CVE-2024-10834 · eosphoros-ai eosphoros-ai/db-gpt

Arbitrary File Write in eosphoros-ai/db-gpt

EPSS 0.6%public exploit CVSS 9.1

open-mmlab1 vulnerability on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2024-12044 · open-mmlab open-mmlab/mmdetection

Remote Code Execution by Pickle Deserialization in open-mmlab/mmdetection

EPSS 1%public exploit CVSS 9.8

horovod1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2024-10190 · horovod horovod/horovod

Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovod

EPSS 1%public exploit CVSS 9.8

kedro-org1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2024-9701 · kedro-org kedro-org/kedro

Remote Code Execution in kedro-org/kedro

EPSS 1%public exploit CVSS 9.8

bentoml1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-9070 · bentoml bentoml/bentoml

Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml

EPSS 0.9%public exploit CVSS 9.8

netease-youdao1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-10264 · netease-youdao netease-youdao/qanything

HTTP Request Smuggling in netease-youdao/qanything

EPSS 1.0%public exploit CVSS 9.8

onnx1 vulnerability on this pageMax CVSS 9.1Priority 52KEV 0

CVE-2024-7776 · onnx onnx/onnx

Arbitrary File Overwrite in onnx/onnx

EPSS 2%public exploit CVSS 9.1

mintplex-labs1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-8196 · mintplex-labs mintplex-labs/anything-llm

Missing Authentication for Critical Function in mintplex-labs/anything-llm

EPSS 0.8%public exploit CVSS 9.8

parisneo2 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-8898 · parisneo parisneo/lollms-webui

Path Traversal in parisneo/lollms-webui

EPSS 0.8%public exploit CVSS 9.8

CVE-2024-8581 · parisneo parisneo/lollms-webui

Path Traversal in parisneo/lollms-webui

EPSS 1.0%public exploit CVSS 9.1

aimhubio2 vulnerabilities on this pageMax CVSS 9.1Priority 50KEV 0

CVE-2024-8769 · aimhubio aimhubio/aim

Arbitrary File Deletion via Relative Path Traversal in aimhubio/aim

EPSS 0.9%public exploit CVSS 9.1

CVE-2024-6829 · aimhubio aimhubio/aim

Arbitrary File Overwrite through tarfile-extraction in aimhubio/aim

EPSS 0.9%public exploit CVSS 9.1

danswer-ai1 vulnerability on this pageMax CVSS 9.1Priority 50KEV 0

CVE-2024-7957 · danswer-ai danswer-ai/danswer

Arbitrary File Overwrite in danswer-ai/danswer

EPSS 1.0%public exploit CVSS 9.1

CentralSquare1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-29980 · CentralSquare eTRAKiT.Net

Blind SQL Injection vulnerability in eTRAKiT.Net

EPSS 0.6%public exploit CVSS 9.8

Veeam1 vulnerability on this pageMax CVSS 9.9Priority 49KEV 0

CVE-2025-23120 · Veeam Backup and Recovery

A vulnerability allowing remote code execution (RCE) for domain users.

EPSS 24%CVSS 9.9

code-projects1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-2589 · code-projects Human Resource Management System

code-projects Human Resource Management System Account.go Index improper authorization

EPSS 0.5%public exploit CVSS 9.8

Corosync1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-30472 · Corosync Corosync

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_toke…

EPSS 0.5%public exploit CVSS 9.8

danny-avila1 vulnerability on this pageMax CVSS 9.4Priority 48KEV 0

CVE-2024-11167 · danny-avila danny-avila/librechat

Improper Access Control in danny-avila/librechat

EPSS 0.6%public exploit CVSS 9.4

haotian-liu1 vulnerability on this pageMax CVSS 9.3Priority 47KEV 0

CVE-2024-9309 · haotian-liu haotian-liu/llava

SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava

EPSS 0.5%public exploit CVSS 9.3

open-webui1 vulnerability on this pageMax CVSS 9.0Priority 47KEV 0

CVE-2024-8017 · open-webui open-webui/open-webui

Cross-site Scripting (XSS) in open-webui/open-webui

EPSS 0.6%public exploit CVSS 9.0

vercel1 vulnerability on this pageMax CVSS 9.1Priority 47KEV 0

CVE-2025-29927 · vercel next.js

Authorization Bypass in Next.js Middleware

EPSS 99%CVSS 9.1

automatic11111 vulnerability on this pageMax CVSS 9.6Priority 46KEV 0

CVE-2024-11045 · automatic1111 automatic1111/stable-diffusion-webui

Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui

EPSS 0.4%public exploit CVSS 9.6

Microsoft1 vulnerability on this pageMax CVSS 9.3Priority 45KEV 0

CVE-2025-29814 · Microsoft Microsoft Partner Center

Microsoft Partner Center Elevation of Privilege Vulnerability

EPSS 2%CVSS 9.3

stitionai1 vulnerability on this pageMax CVSS 9.1Priority 42KEV 0

CVE-2024-5752 · stitionai stitionai/devika

Path Traversal in stitionai/devika

EPSS 2%CVSS 9.1

Dell1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-26336 · Dell Dell Chassis Management Controller (CMC) for Dell PowerEdge FX2

Dell Chassis Management Controller Firmware for Dell PowerEdge FX2, version(s) prior to 2.40.200.202101130302, and Dell Chassis Managemen…

EPSS 0.6%CVSS 9.8

Esri1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-2538 · Esri Portal for ArcGIS

BUG-000174336

EPSS 0.6%CVSS 9.8

mitre1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-53351 · mitre

Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.

EPSS 0.5%CVSS 9.8

kcp-dev1 vulnerability on this pageMax CVSS 9.6Priority 35KEV 0

CVE-2025-29922 · kcp-dev kcp

kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace

EPSS 0.4%CVSS 9.6

Sechard Information Technologies1 vulnerability on this pageMax CVSS 9.0Priority 28KEV 0

CVE-2025-2311 · Sechard Information Technologies SecHard

Authentication Bypass in Sechard Information Technologies' SecHard

EPSS 0.2%CVSS 9.0

The archive.