Search
9,965 CVEs · Critical severity
CVEs (9,965, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 9,965 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2025-6440 | CRITICAL | 9.8 | 2025-10-24 | The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to m… | |
| CVE-2025-11253 | CRITICAL | 9.8 | 2025-10-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection. This issue affe… | |
| CVE-2025-43995 | CRITICAL | Patched | 9.8 | 2025-10-24 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote access could po… |
| CVE-2025-8536 | CRITICAL | — | 2025-10-24 | A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into language functionality allows for SQL Injection attack… | |
| CVE-2025-12176 | CRITICAL | Patched | 9.8 | 2025-10-24 | Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: throug… |
| CVE-2025-60548 | CRITICAL | 9.8 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLanSetupRouterSettings. | |
| CVE-2025-60553 | CRITICAL | 9.8 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard52. | |
| CVE-2025-60554 | CRITICAL | 9.8 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEnableWizard. | |
| CVE-2025-60803 | CRITICAL | 9.8 | 2025-10-24 | Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the component /api/aaa;/../register. | |
| CVE-2025-12216 | CRITICAL | Patched | 5.5 | 2025-10-25 | Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2025-12218 | CRITICAL | Patched | 9.1 | 2025-10-25 | Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2025-12219 | CRITICAL | Patched | 9.8 | 2025-10-25 | Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2025-12220 | CRITICAL | Patched | 9.8 | 2025-10-25 | Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2025-12275 | CRITICAL | Patched | 9.8 | 2025-10-26 | Mail Configuration File Manipulation + Command Execution.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2025-12285 | CRITICAL | Patched | 9.8 | 2025-10-26 | Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2025-62959 | CRITICAL | 9.1 | 2025-10-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Remote Code Inclusion.This issue… | |
| CVE-2025-41009 | CRITICAL | — | 2025-10-27 | SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the database by sen… | |
| CVE-2025-60291 | CRITICAL | 9.1 | 2025-10-27 | An issue was discovered in eTimeTrackLite Web thru 12.0 (20250704). There is a permission control flaw that allows unauthorized attackers to access specific routes and modi… | |
| CVE-2025-61481 | CRITICAL | 10.0 | 2025-10-27 | An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injec… | |
| CVE-2025-34292 | CRITICAL | — | 2025-10-27 | Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of untrusted data. User-controlled input is passed to PHP'… | |
| CVE-2025-27224 | CRITICAL | Patched | 9.8 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properly sanitize the input to this en… |
| CVE-2025-12363 | CRITICAL | Patched | 7.5 | 2025-10-27 | Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2025-12364 | CRITICAL | Patched | 9.8 | 2025-10-27 | Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2025-55754 | CRITICAL | Patched | 9.6 | 2025-10-27 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was ru… |
| CVE-2025-61385 | CRITICAL | 9.6 | 2025-10-27 | SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.n… |