Skip to main content

Over 150 LLM Providers · Over 5,300 Models The most extensible AI-powered pentesting platform. Open source. Star on GitHub

CRITICAL Severity CVEs

CVSS 9.0 – 10.0

CVSS 9.0–10.0 — vulnerabilities that allow remote code execution, full system compromise, or trivial exploitation with no authentication required

35,149
Total
312
Known Exploited
Showing 21,564 of 35,149 total · Page 185/432
9.3
CVE-2025-31565

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisandro Martinez

9.0
CVE-2025-32743

In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an empty string when the TC (Trunca

9.1
CVE-2025-32755

In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on De

9.1
CVE-2025-32754

In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on

9.1
CVE-2025-32206

Unrestricted Upload of File with Dangerous Type vulnerability in LABCAT Processing Projects processing-projects allows U

9.1
CVE-2025-32202

Unrestricted Upload of File with Dangerous Type vulnerability in Brian Batt - elearningfreak.com Insert or Embed Articul

9.9
CVE-2025-32140

Unrestricted Upload of File with Dangerous Type vulnerability in Nirmal Kumar Ram WP Remote Thumbnail wp-remote-thumbnai

9.8
CVE-2025-27690

Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0, contains a use of default password vulnerability. An unauthent

9.0
CVE-2024-58136 KEV

Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regres

9.8
CVE-2024-55210

An issue in TOTVS Framework (Linha Protheus) 12.1.2310 allows attackers to bypass multi-factor authentication (MFA) via

9.8
CVE-2025-3115

Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing th

9.8
CVE-2025-32695

Incorrect Privilege Assignment vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Privilege E

10.0
CVE-2025-32642

Cross-Site Request Forgery (CSRF) vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This issu

9.6
CVE-2025-32641

Cross-Site Request Forgery (CSRF) vulnerability in anantaddons Anant Addons for Elementor anant-addons-for-elementor all

9.6
CVE-2025-32576

Cross-Site Request Forgery (CSRF) vulnerability in Agence web Eoxia - Montpellier WP shop wpshop allows Upload a Web She

9.6
CVE-2025-32496

Cross-Site Request Forgery (CSRF) vulnerability in Uncodethemes Ultra Demo Importer ut-demo-importer allows Upload a Web

9.8
CVE-2025-31033

Cross-Site Request Forgery (CSRF) vulnerability in Adam Nowak Buddypress Humanity buddypress-humanity allows Cross Site

9.1
CVE-2025-31002

Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze squeeze allows Using Maliciou

9.8
CVE-2025-32375

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.

9.8
CVE-2025-27797

OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a

9.9
CVE-2025-32461

wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The

9.1
CVE-2025-30282

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that c

9.1
CVE-2025-30281

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that c

9.1
CVE-2025-24447

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili

9.1
CVE-2025-24446

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that

9.1
CVE-2025-22871

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit

9.8
CVE-2025-25226

Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database packag

9.8
CVE-2024-48887

A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to c

9.9
CVE-2025-32028

HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX

9.8
CVE-2024-54092

A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device K

10.0
CVE-2024-41794

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). Affected devices contain hardcod

9.1
CVE-2024-41790

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected de

9.1
CVE-2024-41789

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected de

9.1
CVE-2024-41788

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected de

9.9
CVE-2025-31330

SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function mo

9.8
CVE-2025-30016

SAP Financial Consolidation allows an unauthenticated attacker to gain unauthorized access to the Admin account. The vul

9.9
CVE-2025-27429

SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. T

9.1
CVE-2025-2004

The Simple WP Events plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat

9.8
CVE-2025-3363

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attac

9.8
CVE-2025-3362

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attac

9.8
CVE-2025-3361

The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attac

9.8
CVE-2025-28413

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component

9.8
CVE-2025-28412

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeControlle

9.8
CVE-2025-28411

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave

9.8
CVE-2025-28410

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not prop

9.8
CVE-2025-28408

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDe

9.8
CVE-2025-28406

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter

9.8
CVE-2025-28405

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method

9.8
CVE-2025-28402

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter

9.8
CVE-2025-3248 KEV

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and

Frequently Asked Questions

What does CRITICAL severity mean for CVEs?

CVSS 9.0–10.0 — vulnerabilities that allow remote code execution, full system compromise, or trivial exploitation with no authentication required

How many critical severity CVEs exist?

There are 35,149 CVE records rated CRITICAL in our database. Of these, 312 are listed in CISA's Known Exploited Vulnerabilities catalog.

How should I prioritize critical severity vulnerabilities?

CRITICAL severity vulnerabilities should be patched immediately, especially if they are in the CISA KEV catalog or have a high EPSS score. Use CyberStrike to automatically detect and prioritize these vulnerabilities across your infrastructure.

Detect CRITICAL Vulnerabilities

CyberStrike scans your infrastructure and detects critical severity vulnerabilities in real time.

Get Started