Critical vulnerability archive — page 356

invoke-ai2 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2024-12029 · invoke-ai invoke-ai/invokeai

Remote Code Execution via Model Deserialization in invoke-ai/invokeai

EPSS 6%public exploit CVSS 9.8

CVE-2024-11042 · invoke-ai invoke-ai/invokeai

Arbitrary File Delete in invoke-ai/invokeai

EPSS 2%public exploit CVSS 9.1

PHPGurukul1 vulnerability on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2025-2473 · PHPGurukul Company Visitor Management System

PHPGurukul Company Visitor Management System Sign In index.php sql injection

EPSS 2%public exploit CVSS 9.8

h2oai1 vulnerability on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2024-10553 · h2oai h2oai/h2o-3

Jdbc Deserialization in h2oai/h2o-3

EPSS 2%public exploit CVSS 9.8

significant-gravitas1 vulnerability on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2024-8156 · significant-gravitas significant-gravitas/autogpt

Command Injection in significant-gravitas/autogpt

EPSS 2%public exploit CVSS 9.8

IAHispano7 vulnerabilities on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2025-27781 · IAHispano Applio

Applio allows unsafe deserialization in inference.py

EPSS 0.9%public exploit CVSS 9.8

CVE-2025-27782 · IAHispano Applio

Applio allows arbitrary file write in inference.py

EPSS 1%CVSS 9.8

CVE-2025-27783 · IAHispano Applio

Applio allows arbitrary file write in train.py

EPSS 1%CVSS 9.8

CVE-2025-27778 · IAHispano Applio

Applio allows unsafe deserialization in infer.py

EPSS 1.0%CVSS 9.8

CVE-2025-27779 · IAHispano Applio

Applio allows unsafe deserialization in model_blender.py

EPSS 0.9%CVSS 9.8

CVE-2025-27780 · IAHispano Applio

Applio allows unsafe deserialization in model_information.py

EPSS 0.9%CVSS 9.8

CVE-2025-27786 · IAHispano Applio

Applio allows arbitrary file removal in core.py

EPSS 0.6%CVSS 9.1

lightning-ai1 vulnerability on this pageMax CVSS 9.1Priority 51KEV 0

CVE-2024-8019 · lightning-ai lightning-ai/pytorch-lightning

Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning

EPSS 1%public exploit CVSS 9.1

lunary-ai2 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-8999 · lunary-ai lunary-ai/lunary

Improper Access Control in lunary-ai/lunary

EPSS 0.8%public exploit CVSS 9.8

CVE-2024-9095 · lunary-ai lunary-ai/lunary

Improper Authorization in lunary-ai/lunary

EPSS 0.7%public exploit CVSS 9.8

mitre9 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2025-29401 · mitre

An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code…

EPSS 0.8%public exploit CVSS 9.8

CVE-2024-57061 · mitre

An issue in Termius Version 9.9.0 through v.9.16.0 allows a physically proximate attacker to execute arbitrary code via the insecure Elec…

EPSS 0.7%public exploit CVSS 9.8

CVE-2025-29411 · mitre

An arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execut…

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-48590 · mitre

Inflectra SpiraTeam 7.2.00 is vulnerable to Server-Side Request Forgery (SSRF) via the NewsReaderService.

EPSS 0.9%CVSS 9.8

CVE-2025-29137 · mitre

Tenda AC7 V1.0 V15.03.06.44 found a buffer overflow caused by the timeZone parameter in the form_fast_setting_wifi_set function, which ca…

EPSS 0.6%CVSS 9.8

CVE-2025-30137 · mitre

An issue was discovered in the G-Net GNET APK 2.6.2.

EPSS 0.5%CVSS 9.8

CVE-2025-30123 · mitre

An issue was discovered on ROADCAM X3 devices.

EPSS 0.4%CVSS 9.8

CVE-2025-30139 · mitre

An issue was discovered on G-Net Dashcam BB GONX devices.

EPSS 0.4%CVSS 9.8

CVE-2025-30132 · mitre

An issue was discovered on IROAD Dashcam V devices.

EPSS 0.4%CVSS 9.1

danny-avila1 vulnerability on this pageMax CVSS 9.1Priority 50KEV 0

CVE-2024-10361 · danny-avila danny-avila/librechat

Arbitrary File Deletion via Path Traversal in danny-avila/librechat

EPSS 1%public exploit CVSS 9.1

eosphoros-ai1 vulnerability on this pageMax CVSS 9.1Priority 49KEV 0

CVE-2024-10831 · eosphoros-ai eosphoros-ai/db-gpt

Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt

EPSS 0.8%public exploit CVSS 9.1

glpi-project2 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-24799 · glpi-project glpi

GLPI allows unauthenticated SQL injection through the inventory endpoint

EPSS 87%CVSS 9.8

CVE-2025-21619 · glpi-project glpi

GLPI allows SQL injection through the rules configuration

EPSS 0.4%CVSS 9.8

xwiki1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-29926 · xwiki xwiki-platform

The WikiManager REST API allows any user to create wikis

EPSS 0.6%public exploit CVSS 9.8

aimhubio1 vulnerability on this pageMax CVSS 9.6Priority 48KEV 0

CVE-2024-7760 · aimhubio aimhubio/aim

CSRF in aimhubio/aim

EPSS 0.5%public exploit CVSS 9.6

philsbury1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-2505 · philsbury Age Gate

Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'

EPSS 5%CVSS 9.8

Synology3 vulnerabilities on this pageMax CVSS 10.0Priority 45KEV 0

CVE-2024-10442 · Synology Unified Controller (DSMUC)

Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-042…

EPSS 1%CVSS 10.0

CVE-2024-10441 · Synology DiskStation Manager (DSM)

Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Sy…

EPSS 1%CVSS 9.8

CVE-2024-11131 · Synology Camera Firmware

A vulnerability regarding out-of-bounds read is found in the video interface.

EPSS 0.8%CVSS 9.8

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-47552 · Apache Software Foundation Apache Seata (incubating)

Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server

EPSS 1%CVSS 9.8

IBM2 vulnerabilities on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2024-56346 · IBM AIX

IBM AIX command execution

EPSS 1%CVSS 10.0

CVE-2024-56347 · IBM AIX

IBM AIX command execution

EPSS 0.9%CVSS 9.6

thomstark1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2025-2512 · thomstark File Away

File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Function

EPSS 1.0%CVSS 9.8

LoftOcean1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-13410 · LoftOcean CozyStay - Hotel Booking WordPress Theme

CozyStay <= 1.7.0 and TinySalt <= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler

EPSS 0.8%CVSS 9.8

ThemeMove1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-13790 · ThemeMove MinimogWP – The High Converting eCommerce WordPress Theme

MinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File Inclusion

EPSS 0.8%CVSS 9.8

Fortinet1 vulnerability on this pageMax CVSS 9.0Priority 40KEV 0

CVE-2023-47539 · Fortinet FortiMail

An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may…

EPSS 1%CVSS 9.0

Sytel Ltd1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-2494 · Sytel Ltd Softdial Contact Center

Unrestricted file upload vulnerability in Softdial Contact Center

EPSS 0.6%CVSS 9.8

ThemeGoods1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-12922 · ThemeGoods Altair

Altair <= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_current

EPSS 0.5%CVSS 9.8

vllm-project1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2025-29783 · vllm-project vllm

vLLM Allows Remote Code Execution via Mooncake Integration

EPSS 0.7%CVSS 9.1

aonetheme1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-13442 · aonetheme Service Finder Bookings

Service Finder Bookings <= 5.0 - Unauthenticated Privilege Escalation via Account Takeover

EPSS 0.4%CVSS 9.8

CM Informatics1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-12016 · CM Informatics CM News

SQLi in CM Informatics' CM News

EPSS 0.4%CVSS 9.8

Descor2 vulnerabilities on this pageMax CVSS 10.0Priority 37KEV 0

CVE-2025-26852 · Descor Infocad FM

DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection.

EPSS 0.4%CVSS 10.0

CVE-2025-26853 · Descor Infocad FM

DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema.

EPSS 0.4%CVSS 10.0

MB connect line1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2024-23943 · MB connect line mbCONNECT24

MB connect line: Cloud API access due to a lack of authentication for a critical function

EPSS 0.6%CVSS 9.1

Vestel1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-8997 · Vestel EVC04 Configuration Interface

SQLi in Vestel's EVC04 Configuration Interface

EPSS 0.4%CVSS 9.8

The archive.