Critical vulnerability archive — page 368

wazuh1 vulnerability on this pageMax CVSS 9.9Priority 100KEV 1

CVE-2025-24016 · wazuh wazuh

Remote code execution in Wazuh server

KEV · due 1 Jul EPSS 94%public exploit SSVC act CVSS 9.9

clidey1 vulnerability on this pageMax CVSS 10.0Priority 57KEV 0

CVE-2025-24786 · clidey whodb

Path traversal opening Sqlite3 database in WhoDB

EPSS 3%public exploit CVSS 10.0

D-Link1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2025-1104 · D-Link DHP-W310AV

D-Link DHP-W310AV authentication spoofing

EPSS 3%public exploit CVSS 9.8

mitre7 vulnerabilities on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2024-55215 · mitre

An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register.

EPSS 1%public exploit CVSS 9.8

CVE-2024-57602 · mitre

An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file.

EPSS 0.8%public exploit CVSS 9.8

CVE-2024-57707 · mitre

An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components.

EPSS 0.8%public exploit CVSS 9.8

CVE-2024-57604 · mitre

An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.

EPSS 0.7%public exploit CVSS 9.8

CVE-2025-25343 · mitre

Tenda AC6 V15.03.05.16 firmware has a buffer overflow vulnerability in the formexeCommand function.

EPSS 0.7%public exploit CVSS 9.8

CVE-2025-25349 · mitre

PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the costitem parameter.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-25530 · mitre

Buffer overflow vulnerability in Digital China DCBI-Netlog-LAB Gateway 1.0 due to the lack of length verification, which is related to sa…

EPSS 0.9%CVSS 9.8

dayrui1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-1177 · dayrui XunRuiCMS

dayrui XunRuiCMS Linkage.php import_add deserialization

EPSS 0.7%public exploit CVSS 9.8

Wattsense1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-26410 · Wattsense Wattsense Bridge

Weak Hard-coded Credentials

EPSS 0.7%public exploit CVSS 9.8

Jack Hopman1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2022-3180 · Jack Hopman WPGateway

WPGateway <= 3.5 - Unauthenticated Privilege Escalation

EPSS 9%CVSS 9.8

Logsign1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-1044 · Logsign Unified SecOps Platform

Logsign Unified SecOps Platform Authentication Bypass Vulnerability

EPSS 75%CVSS 9.8

nuxt-modules1 vulnerability on this pageMax CVSS 9.3Priority 49KEV 0

CVE-2025-24981 · nuxt-modules mdc

Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc

EPSS 0.7%public exploit CVSS 9.3

Ivanti3 vulnerabilities on this pageMax CVSS 9.9Priority 48KEV 0

CVE-2025-22467 · Ivanti Connect Secure

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote c…

EPSS 5%CVSS 9.9

CVE-2024-47908 · Ivanti Cloud Services Application

OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privil…

EPSS 22%CVSS 9.1

CVE-2024-10644 · Ivanti Connect Secure

Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenti…

EPSS 3%CVSS 9.1

laurent221 vulnerability on this pageMax CVSS 9.6Priority 48KEV 0

CVE-2025-24028 · laurent22 joplin

Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin

EPSS 0.5%public exploit CVSS 9.6

taisan1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-1113 · taisan tarzan-cms

taisan tarzan-cms Add Theme admin#themes upload deserialization

EPSS 0.5%public exploit CVSS 9.8

Adobe1 vulnerability on this pageMax CVSS 9.1Priority 47KEV 0

CVE-2025-24434 · Adobe Adobe Commerce

Adobe Commerce | Incorrect Authorization (CWE-863)

EPSS 17%CVSS 9.1

Elber1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2025-0674 · Elber Signum DVB-S/S2 IRD

Elber Communications Equipment Authentication Bypass Using an Alternate Path or Channel

EPSS 4%CVSS 9.8

Fortinet1 vulnerability on this pageMax CVSS 9.0Priority 47KEV 0

CVE-2024-27781 · Fortinet FortiSandbox

An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 thro…

EPSS 28%CVSS 9.0

SolarWinds1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2024-52606 · SolarWinds SolarWinds

SolarWinds Platform Server-Side Request Forgery Vulnerability

EPSS 2%CVSS 9.8

Zach Swetz1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-25163 · Zach Swetz Plugin A/B Image Optimizer

WordPress Plugin A/B Image Optimizer Plugin <= 3.3 - Arbitrary File Download vulnerability

EPSS 2%CVSS 9.8

Sinaptik AI1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-12366 · Sinaptik AI PandasAI

CVE-2024-12366

EPSS 1%CVSS 9.8

SourceCodester2 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2025-1160 · SourceCodester Employee Management System

SourceCodester Employee Management System index.php default credentials

EPSS 0.9%CVSS 9.8

CVE-2025-1168 · SourceCodester Contact Manager with Export to VCF

SourceCodester Contact Manager with Export to VCF delete-contact.php sql injection

EPSS 0.5%CVSS 9.8

Chimpstudio4 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-13011 · Chimpstudio WP Foodbakery

WP Foodbakery <= 4.7 - Unauthenticated Arbitrary File Upload

EPSS 0.9%CVSS 9.8

CVE-2025-0316 · Chimpstudio WP Directorybox Manager

WP Directorybox Manager <= 2.5 - Authentication Bypass

EPSS 0.7%CVSS 9.8

CVE-2025-0181 · Chimpstudio WP Foodbakery

WP Foodbakery <= 4.8 - Authentication Bypass in foodbakery_parse_request

EPSS 0.6%CVSS 9.8

CVE-2025-0180 · Chimpstudio WP Foodbakery

WP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validation

EPSS 0.5%CVSS 9.8

Honeywell1 vulnerability on this pageMax CVSS 9.4Priority 41KEV 0

CVE-2023-5878 · Honeywell OneWireless Network Wireless Device Manager

OneWireless command injection possible when updating firmware

EPSS 1.0%CVSS 9.4

IBL Software Engineering1 vulnerability on this pageMax CVSS 9.5Priority 40KEV 0

CVE-2025-1077 · IBL Software Engineering Visual Weather

Remote Code Execution vulnerability in IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather)

EPSS 0.9%CVSS 9.5

nextendweb1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-1061 · nextendweb Nextend Social Login Pro

Nextend Social Login Pro <= 3.1.16 - Authentication Bypass via Apple OAuth provider

EPSS 0.7%CVSS 9.8

Microsoft1 vulnerability on this pageMax CVSS 9.0Priority 39KEV 0

CVE-2025-21198 · Microsoft Microsoft HPC Pack 2016

Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability

EPSS 0.9%CVSS 9.0

Black and White1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-25167 · Black and White BookPress – For Book Authors

WordPress BookPress – For Book Authors Plugin <= 1.2.7 - Broken Access Control vulnerability

EPSS 0.5%CVSS 9.8

Mayuri K1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-1167 · Mayuri K Employee Management System

Mayuri K Employee Management System Update_User.php sql injection

EPSS 0.5%CVSS 9.8

MetricThemes1 vulnerability on this pageMax CVSS 9.6Priority 38KEV 0

CVE-2025-25101 · MetricThemes Munk Sites

WordPress Munk Sites plugin <= 1.0.7 - CSRF to Arbitrary Plugin Installation vulnerability

EPSS 0.6%CVSS 9.6

OpenSC1 vulnerability on this pageMax CVSS 9.2Priority 38KEV 0

CVE-2025-24032 · OpenSC pam_pkcs11

PAM-PKCS#11 vulnerable to authentication bypass with default value for `cert_policy` (`none`)

EPSS 0.7%CVSS 9.2

Quanxun1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-1144 · Quanxun School Affairs System

Quanxun School Affairs System - Exposure of Sensitive Information

EPSS 0.5%CVSS 9.8

ClearML1 vulnerability on this pageMax CVSS 9.0Priority 37KEV 0

CVE-2024-39272 · ClearML ClearML

A cross-site scripting (xss) vulnerability exists in the dataset upload functionality of ClearML Enterprise Server 3.22.5-1533.

EPSS 0.6%CVSS 9.0

Impronta1 vulnerability on this pageMax CVSS 9.9Priority 37KEV 0

CVE-2025-1107 · Impronta Janto

Unverified password change vulnerability in Janto

EPSS 0.4%CVSS 9.9

Siemens1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2025-24956 · Siemens OpenV2G

A vulnerability has been identified in OpenV2G (All versions < V0.9.6).

EPSS 0.4%CVSS 9.8

JetBrains1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2025-26492 · JetBrains TeamCity

In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources

EPSS 0.4%CVSS 9.1

Huawei1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2024-57961 · Huawei HarmonyOS

Out-of-bounds write vulnerability in the emcom module Impact: Successful exploitation of this vulnerability may cause features to perform…

EPSS 0.3%CVSS 9.8

FancyWP1 vulnerability on this pageMax CVSS 9.6Priority 32KEV 0

CVE-2025-25106 · FancyWP Starter Templates by FancyWP

WordPress Starter Templates by FancyWP plugin <= 2.0.0 - CSRF to Arbitrary Plugin Installation vulnerability

EPSS 0.2%CVSS 9.6

sainwp1 vulnerability on this pageMax CVSS 9.6Priority 32KEV 0

CVE-2025-25107 · sainwp OneStore Sites

WordPress OneStore Sites plugin <= 0.1.1 - CSRF to Arbitrary Plugin Installation vulnerability

EPSS 0.2%CVSS 9.6

Lexmark1 vulnerability on this pageMax CVSS 9.3Priority 31KEV 0

CVE-2025-1126 · Lexmark Lexmark Print Management Client

Lexmark has identified a vulnerability in our Lexmark Print Management Client (LPMC).

EPSS 0.3%CVSS 9.3

nexryai1 vulnerability on this pageMax CVSS 9.4Priority 30KEV 0

CVE-2025-24973 · nexryai concorde

Concorde not removing authentication tokens after logging out

EPSS 0.2%CVSS 9.4

The archive.