CVE-2025 list

CVE-2025 records published in October 2025

Page four of four: records 3,001 to 3,687 of the 3,687 published in October 2025, newest first. The first page carries the figures for October 2025.

CVE-2025 records published in October 2025, newest first: records 3,001 to 3,687 of 3,687
CVE Summary CVSS EPSS Published Signals
CVE-2025-10351SQL injection vulnerability in Melis Platform9.3CNA v4.00.4%2025-10-08Exploit codeFix
CVE-2025-9970ABB MConfig application credential stored in clear text in memory5.7CNA v4.00.1%2025-10-08Fix
CVE-2025-9868Nexus Repository 2 SSRF vulnerability in Remote Browser plugin8.7CNA v4.00.5%2025-10-08Fix
CVE-2025-5009Google information disclosure in Gemini iOS App1.0CNA v4.00.1%2025-10-08
CVE-2025-62187Ankitects Anki relative path traversal3.3NVD v3.10.2%2025-10-07Fix
CVE-2025-62186Ankitects Anki inclusion of untrusted functionality7.8NVD v3.10.1%2025-10-07Fix
CVE-2025-62185Ankitects Anki uncontrolled search path7.8NVD v3.10.2%2025-10-07Fix
CVE-2025-61910NASA ION-DTN BPv7 Uncontrolled Memory Allocation that leads to denial of service7.5CNA v3.10.4%2025-10-07
CVE-2025-61784hiyouga LLaMA-Factory LLaMA Factory's Chat API has critical SSRF and LFI7.6CNA v3.10.4%2025-10-07Fix
CVE-2025-61776Dependency-Track possibly discloses private NuGet repository credentials to api.nuget.org4.7CNA v3.10.3%2025-10-07Fix
CVE-2025-61772Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)7.5CNA v3.10.9%2025-10-07Fix
CVE-2025-61771Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS7.5CNA v3.10.6%2025-10-07Fix
CVE-2025-61770Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)7.5CNA v3.10.9%2025-10-07Fix
CVE-2025-61670Wasmtime has memory leak in C API with `externref` and `anyref` types1.0CNA v4.00.2%2025-10-07Fix
CVE-2025-60312Rems Markdown To HTML Converter cross-site scripting6.1CISA ADP v3.10.3%2025-10-07
CVE-2025-59425vLLM vulnerable to timing attack at bearer auth7.5CNA v3.10.6%2025-10-07Fix
CVE-2025-57564CubeAPM log ingestion endpoint log injection8.2CISA ADP v3.10.4%2025-10-07
CVE-2025-56243PuneethReddyHC Event Management System cross-site scripting6.1CISA ADP v3.10.2%2025-10-07
CVE-2025-54406PLANET Technology WGR-500 formPingCmd functionality of Planet OS command injection8.8CNA v3.14.3%2025-10-07Emerging Threats
CVE-2025-54405PLANET Technology WGR-500 formPingCmd functionality of Planet OS command injection8.8CNA v3.14.3%2025-10-07Emerging Threats
CVE-2025-54404PLANET Technology WGR-500 swctrl functionality of Planet OS command injection8.8CNA v3.14.6%2025-10-07
CVE-2025-54403PLANET Technology WGR-500 swctrl functionality of Planet OS command injection8.8CNA v3.14.6%2025-10-07
CVE-2025-54402PLANET Technology WGR-500 formPingCmd functionality of Planet stack-based buffer overflow8.8CNA v3.10.8%2025-10-07Emerging Threats
CVE-2025-54401PLANET Technology WGR-500 formPingCmd functionality of Planet stack-based buffer overflow8.8CNA v3.10.7%2025-10-07Emerging Threats
CVE-2025-54400PLANET Technology WGR-500 formPingCmd functionality of Planet stack-based buffer overflow8.8CNA v3.10.7%2025-10-07Emerging Threats
CVE-2025-54399PLANET Technology WGR-500 formPingCmd functionality of Planet stack-based buffer overflow8.8CNA v3.10.8%2025-10-07Emerging Threats
CVE-2025-53476OpenPLC_v3 ModbusTCP server functionality denial of service5.3CNA v3.10.5%2025-10-07
CVE-2025-52021Online Shopping System Advanced edit_product.php SQL injection9.8CISA ADP v3.10.3%2025-10-07
CVE-2025-50505Clash Verge Rev clash-verge-service privilege escalation7.8CISA ADP v3.10.2%2025-10-07Exploit code
CVE-2025-48826PLANET Technology WGR-500 formPingCmd functionality of Planet format string8.8CNA v3.16.9%2025-10-07Emerging Threats
CVE-2025-45375Dell PowerProtect Data Domain Operating System stack-based buffer overflow4.4CNA v3.10.1%2025-10-07Fix
CVE-2025-44824Nagios Log Server incorrect authorization6.5NVD v3.12.8%2025-10-07Emerging ThreatsFix
CVE-2025-44823Nagios Log Server system information disclosure8.8NVD v3.116.1%2025-10-07Emerging ThreatsExploit codeFix
CVE-2025-43934Dell PowerProtect Data Domain path traversal6.0CNA v3.10.2%2025-10-07Fix
CVE-2025-43914Dell PowerProtect Data Domain BoostFS incorrect privilege assignment7.5CNA v3.10.1%2025-10-07Fix
CVE-2025-43913Dell PowerProtect Data Domain DD OS weak cryptographic algorithm5.3CNA v3.10.2%2025-10-07Fix
CVE-2025-43912Dell PowerProtect Data Domain heap-based buffer overflow5.3CNA v3.10.4%2025-10-07Fix
CVE-2025-43911Dell PowerProtect Data Domain OS command injection6.7CNA v3.10.6%2025-10-07Fix
CVE-2025-43910Dell PowerProtect Data Domain DDSH CLI stack-based buffer overflow2.3CNA v3.10.1%2025-10-07Fix
CVE-2025-43909Dell PowerProtect Data Domain DD Boost weak cryptographic algorithm3.7CNA v3.10.2%2025-10-07Fix
CVE-2025-43908Dell PowerProtect Data Domain OS command injection6.4CNA v3.10.4%2025-10-07Fix
CVE-2025-43907Dell PowerProtect Data Domain path traversal6.5CNA v3.10.4%2025-10-07Fix
CVE-2025-43906Dell PowerProtect Data Domain OS command injection6.7CNA v3.10.6%2025-10-07Fix
CVE-2025-43905Dell PowerProtect Data Domain argument injection4.3CNA v3.10.3%2025-10-07Fix
CVE-2025-43891Dell PowerProtect Data Domain authentication weak cryptographic algorithm5.3CNA v3.10.2%2025-10-07Fix
CVE-2025-43890Dell PowerProtect Data Domain OS command injection6.7CNA v3.10.6%2025-10-07Fix
CVE-2025-43889Dell PowerProtect Data Domain UI path traversal5.3CNA v3.10.4%2025-10-07Fix
CVE-2025-43823Liferay Portal is vulnerable to XSS through its Commerce Search Result widget4.8CNA v4.00.2%2025-10-07Fix
CVE-2025-43822Liferay Portal has multiple stored XSS vulnerabilities on its View Order page4.8CNA v4.00.2%2025-10-07Fix
CVE-2025-43727Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an incorrect Implementation of Authentication Algorithm vul7.5CNA v3.10.4%2025-10-07Fix
CVE-2025-40889Path traversal in Time Machine functionality in Guardian/CMC7.2CNA v4.00.4%2025-10-07Fix
CVE-2025-40888Authenticated SQL injection on CLI functionality in Guardian/CMC6.0CNA v4.00.2%2025-10-07Fix
CVE-2025-40887Authenticated SQL injection on Alert functionality in Guardian/CMC6.0CNA v4.00.2%2025-10-07Fix
CVE-2025-40886Authenticated SQL injection on Alert functionality in Guardian/CMC7.7CNA v4.00.3%2025-10-07Fix
CVE-2025-40885Authenticated SQL injection on Smart Polling functionality in Guardian/CMC6.0CNA v4.00.2%2025-10-07Fix
CVE-2025-40676BBMRI-ERIC Negotiator insecure direct object reference5.3CNA v4.00.3%2025-10-07Fix
CVE-2025-40649BBMRI-ERIC Negotiator Biobanking and Biomolecular Resources stored cross-site scripting5.1CNA v4.00.4%2025-10-07Fix
CVE-2025-37728Kibana insufficiently protected credentials in the CrowdStrike Connector5.4CNA v3.10.2%2025-10-07Fix
CVE-2025-36569Dell PowerProtect Data Domain Operating System OS command injection6.7CNA v3.10.5%2025-10-07Fix
CVE-2025-36567Dell PowerProtect Data Domain Operating System OS command injection6.7CNA v3.10.6%2025-10-07Fix
CVE-2025-36566Dell PowerProtect Data Domain Operating System OS command injection6.7CNA v3.10.6%2025-10-07Fix
CVE-2025-36565Dell PowerProtect Data Domain Operating System argument injection6.7CNA v3.10.2%2025-10-07Fix
CVE-2025-36156IBM InfoSphere Data Replication VSAM for z/OS Remote Source code execution7.4CNA v3.10.1%2025-10-07Fix
CVE-2025-34251Tesla Telematics Control Unit (TCU) authentication bypass8.6CNA v4.00.4%2025-10-07Fix
CVE-2025-25009Kibana cross-site scripting (XSS)8.7CNA v3.10.2%2025-10-07Fix
CVE-2025-11462Local privilege escalation vulnerability in AWS Client VPN macOS Client9.3CNA v4.00.2%2025-10-07Fix
CVE-2025-11416PHPGurukul Beauty Parlour Management System invoices.php SQL injection9.8NVD v3.10.4%2025-10-07
CVE-2025-11415PHPGurukul Beauty Parlour Management System customer list page SQL injection9.8NVD v3.10.4%2025-10-07
CVE-2025-11414GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds5.5NVD v3.10.2%2025-10-07Fix
CVE-2025-11413GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds5.5NVD v3.10.2%2025-10-07Fix
CVE-2025-11412GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds5.5NVD v3.10.2%2025-10-07Fix
CVE-2025-11410Campcodes Advanced Online Voting Management System voters_add.php SQL injection8.8NVD v3.10.3%2025-10-07
CVE-2025-11409Campcodes Advanced Online Voting Management System index.php SQL injection8.8NVD v3.10.3%2025-10-07
CVE-2025-11408D-Link DI-7001 MINI dbsrv.asp buffer overflow9.8NVD v3.10.9%2025-10-07
CVE-2025-11407D-Link DI-7001 MINI upgrade_filter.asp os command injection9.8NVD v3.14.0%2025-10-07
CVE-2025-11406kaifangqian kaifangqian-base SysUserController.java getAllUsers information disclosure5.3CNA v4.00.3%2025-10-07
CVE-2025-11405SourceCodester Hotel and Lodge Management System del_tax.php SQL injection9.8NVD v3.10.4%2025-10-07
CVE-2025-11404SourceCodester Hotel and Lodge Management System save_tax.php SQL injection9.8NVD v3.10.4%2025-10-07
CVE-2025-11403SourceCodester Hotel and Lodge Management System del_booking.php SQL injection9.8NVD v3.10.4%2025-10-07
CVE-2025-11402SourceCodester Hotel and Lodge Management System del_curr.php SQL injection9.8NVD v3.10.4%2025-10-07
CVE-2025-11401SourceCodester Hotel and Lodge Management System save_curr.php SQL injection9.8NVD v3.10.4%2025-10-07
CVE-2025-11400SourceCodester Hotel and Lodge Management System del_room.php SQL injection9.8NVD v3.10.4%2025-10-07
CVE-2025-11399SourceCodester Hotel and Lodge Management System save_room.php SQL injection9.8NVD v3.10.4%2025-10-07
CVE-2025-11398SourceCodester Hotel and Lodge Management System Profile profile.php unrestricted upload8.8NVD v3.10.4%2025-10-07
CVE-2025-11397SourceCodester Hotel and Lodge Management System login.php SQL injection9.8NVD v3.10.4%2025-10-07
CVE-2025-11396code-projects Simple Food Ordering System product.php SQL injection9.8NVD v3.10.5%2025-10-07
CVE-2025-11390PHPGurukul Cyber Cafe Management System POST parameter search.php cross-site scripting6.1NVD v3.10.4%2025-10-07
CVE-2025-11389Tenda AC15 saveAutoQos stack-based overflow8.7CNA v4.00.8%2025-10-07
CVE-2025-11388Tenda AC15 setNotUpgrade stack-based overflow8.7CNA v4.00.8%2025-10-07
CVE-2025-11387Tenda AC15 fast_setting_pppoe_set stack-based overflow8.7CNA v4.00.8%2025-10-07
CVE-2025-11386Tenda AC15 POST Parameter SetDDNSCfg stack-based overflow8.7CNA v4.00.8%2025-10-07
CVE-2025-11385Tenda AC20 fast_setting_wifi_set sscanf buffer overflow8.7CNA v4.00.8%2025-10-07
CVE-2025-11362Pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding8.7CNA v4.00.4%2025-10-07Fix
CVE-2025-11360jakowenko double-take API app.js app.use cross-site scripting5.3CNA v4.00.3%2025-10-07Fix
CVE-2025-11359code-projects Simple Banking System transfermoney.php SQL injection8.8NVD v3.10.3%2025-10-07
CVE-2025-11358code-projects Simple Banking System removeuser.php SQL injection8.8NVD v3.10.3%2025-10-07
CVE-2025-11357code-projects Simple Banking System createuser.php SQL injection8.8NVD v3.10.3%2025-10-07
CVE-2025-11356Tenda AC23 SetStaticRouteCfg sscanf buffer overflow8.7CNA v4.00.8%2025-10-07
CVE-2025-11355UTT 1250GW aspChangeChannel strcpy buffer overflow8.7CNA v4.00.8%2025-10-07
CVE-2025-11354code-projects Online Hotel Reservation System addslideexec.php unrestricted upload9.8NVD v3.10.4%2025-10-07
CVE-2025-11353code-projects Online Hotel Reservation System addgalleryexec.php unrestricted upload8.8NVD v3.10.3%2025-10-07
CVE-2025-11352code-projects Online Hotel Reservation System addexec.php unrestricted upload8.8NVD v3.10.3%2025-10-07
CVE-2025-11351code-projects Online Hotel Reservation System editpicexec.php unrestricted upload8.8NVD v3.10.3%2025-10-07
CVE-2025-11350Campcodes Online Apartment Visitor Management System bwdates-reports-details.php SQL injection9.8NVD v3.10.4%2025-10-07
CVE-2025-11349Campcodes Online Apartment Visitor Management System search-visitor.php SQL injection9.8NVD v3.10.4%2025-10-07
CVE-2025-11348Campcodes Online Apartment Visitor Management System index.php SQL injection9.8NVD v3.10.4%2025-10-07
CVE-2025-11347Student Crud Operation add student page unrestricted file upload9.8NVD v3.10.5%2025-10-07
CVE-2025-11192Fabric Engine (VOSS) AutoSense authentication bypass8.4CNA v4.00.3%2025-10-07Fix
CVE-2025-10645WP Reset WordPress plugin unauthenticated sensitive information exposure via wf-licensing.log5.3CNA v3.10.3%2025-10-07Fix
CVE-2025-10162OrderConvo WordPress plugin unauthenticated arbitrary file read7.5CISA ADP v3.14.4%2025-10-07NucleiExploit codeFix
CVE-2025-8291Python CPython ZIP64 End of Central Directory (EOCD) Locator record offset not checked4.3CNA v3.10.5%2025-10-07Fix
CVE-2025-7400Featured Image from URL (FIFU) WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-10-07Fix
CVE-2025-6242Red Hat AI Inference Server vllm: Server side request forgery (SSRF) in mediaconnector7.1CNA v3.10.2%2025-10-07Fix
CVE-2025-3719Incorrect authorization for CLI in Guardian/CMC7.2CNA v4.00.3%2025-10-07Fix
CVE-2025-3718Client-side path traversal in Guardian/CMC5.8CNA v4.00.2%2025-10-07Fix
CVE-2025-3450Automation Runtime SDM requests may impact system9.3CNA v4.00.3%2025-10-07Fix
CVE-2025-3449Weak Session Token used in Automation Runtime SDM2.3CNA v4.00.2%2025-10-07Fix
CVE-2025-3448B&R Industrial Automation Automation Runtime XSS on SDM5.1CNA v4.00.3%2025-10-07Fix
CVE-2025-1826IBM Jazz Foundation cross-site scripting5.4CNA v3.10.2%2025-10-07Fix
CVE-2025-0603SQLi in Callvision Healthcare's Callvision Emergency Code9.8CNA v3.10.4%2025-10-07Fix
CVE-2025-61985OpenBSD OpenSSH code execution3.6CNA v3.10.1%2025-10-06Fix
CVE-2025-61984OpenBSD OpenSSH code execution3.6CNA v3.10.5%2025-10-06Exploit codeFix
CVE-2025-61778akkadotnet akka.net Akka.Remote TLS did not properly implement certificate-based authentication9.3CNA v4.00.3%2025-10-06Fix
CVE-2025-61777FlagForge allows Unauthenticated Badge Template API Access9.4CNA v3.10.5%2025-10-06Exploit codeFix
CVE-2025-61774PyVista has Dependency Confusion vulnerability in that leads to RCE9.3CNA v4.00.6%2025-10-06
CVE-2025-61769Emlog vulnerable to stored XSS in file upload functionality in emlog2.1CNA v4.00.3%2025-10-06
CVE-2025-61768Kuno CMS vulnerable to server-side request forgery (SSRF) via Unsafe SVG upload5.1CNA v4.00.3%2025-10-06Fix
CVE-2025-61766weirdgloop Bucket != operator query handling uncontrolled recursion6.5CNA v3.10.4%2025-10-06Fix
CVE-2025-61765python-socketio vulnerable to arbitrary Python code execution6.4CNA v3.10.5%2025-10-06Exploit codeFix
CVE-2025-61687FlowiseAI/Flosise has file upload8.3CNA v3.111.0%2025-10-06Fix
CVE-2025-61224DokuWiki cross-site scripting6.5CNA v3.11.5%2025-10-06NucleiFix
CVE-2025-61198Optimod A stored cross-site scripting5.4CISA ADP v3.10.3%2025-10-06
CVE-2025-61197Orban Optimod client-side storage privilege escalation8.9CISA ADP v3.10.3%2025-10-06
CVE-2025-60969Endruntechnologies Sonoma D12 path traversal5.7CISA ADP v3.10.6%2025-10-06
CVE-2025-60967Endruntechnologies Sonoma D12 cross-site scripting7.3CISA ADP v3.10.3%2025-10-06
CVE-2025-60965Endruntechnologies Sonoma D12 OS command injection9.1CISA ADP v3.11.2%2025-10-06
CVE-2025-60964Endruntechnologies Sonoma D12 OS command injection9.1CISA ADP v3.11.2%2025-10-06
CVE-2025-60963Endruntechnologies Sonoma D12 OS command injection8.2CISA ADP v3.10.9%2025-10-06
CVE-2025-60962Endruntechnologies Sonoma D12 OS command injection8.2CISA ADP v3.10.7%2025-10-06
CVE-2025-60961Endruntechnologies Sonoma D12 cross-site scripting6.1CISA ADP v3.10.2%2025-10-06
CVE-2025-60960Endruntechnologies Sonoma D12 OS command injection8.2CISA ADP v3.10.9%2025-10-06
CVE-2025-60959Endruntechnologies Sonoma D12 OS command injection8.2CISA ADP v3.10.7%2025-10-06
CVE-2025-60958Endruntechnologies Sonoma D12 cross-site scripting7.3CISA ADP v3.10.3%2025-10-06
CVE-2025-60957Endruntechnologies Sonoma D12 OS command injection9.9CISA ADP v3.11.2%2025-10-06
CVE-2025-60956Endruntechnologies Sonoma D12 cross-site request forgery8.0CISA ADP v3.10.2%2025-10-06
CVE-2025-59734Heap-buffer-overflow write in FFmpeg SANM process_ftch8.7CNA v4.00.2%2025-10-06Fix
CVE-2025-59733Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress8.7CNA v4.00.2%2025-10-06Fix
CVE-2025-59732Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress8.7CNA v4.00.2%2025-10-06Fix
CVE-2025-59731Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress6.9CNA v4.00.2%2025-10-06Fix
CVE-2025-59730Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec485.7CNA v4.00.2%2025-10-06Fix
CVE-2025-59729Heap-buffer-overflow read in FFmpeg DHAV get_duration5.7CNA v4.00.2%2025-10-06Fix
CVE-2025-59728Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path8.7CNA v4.00.2%2025-10-06Fix
CVE-2025-59452YoSmart YoLink API predictable identifiers5.8CNA v3.10.4%2025-10-06Fix
CVE-2025-59451YoSmart YoLink application incorrect authorization3.5CNA v3.10.3%2025-10-06
CVE-2025-59450YoSmart YoLink Smart Hub cleartext storage of sensitive information4.3CNA v3.10.1%2025-10-06
CVE-2025-59449YoSmart YoLink MQTT broker incorrect authorization4.9CNA v3.10.3%2025-10-06
CVE-2025-59448YoSmart YoLink ecosystem cleartext transmission of sensitive information4.7CNA v3.10.2%2025-10-06Fix
CVE-2025-59447YoSmart YoLink Smart Hub system information disclosure2.2CNA v3.10.2%2025-10-06
CVE-2025-59159SillyTavern Web interface vulnerable to DNS Rebinding9.7CNA v3.10.3%2025-10-06Fix
CVE-2025-59152X-Forwarded-For header spoofing Bypasses Litestar Rate Limiting7.5CNA v3.10.5%2025-10-06Fix
CVE-2025-58591SICK Baggage Analytics path traversal6.5CNA v3.10.5%2025-10-06Fix
CVE-2025-58590SICK Baggage Analytics path traversal6.5CNA v3.10.5%2025-10-06Fix
CVE-2025-58589SICK Baggage Analytics information disclosure through Stacktrace2.7CNA v3.10.4%2025-10-06Fix
CVE-2025-58587SICK Baggage Analytics improper restriction of excessive authentication attempts6.5CNA v3.10.5%2025-10-06Fix
CVE-2025-58586SICK Baggage Analytics user Enumeration by excessive error output5.3CNA v3.10.4%2025-10-06Fix
CVE-2025-58585SICK Baggage Analytics sensitive information disclosure through missing authentication5.3CNA v3.10.4%2025-10-06Fix
CVE-2025-58584SICK Baggage Analytics Plain Text Transmission of Username and Password in the URL5.3CNA v3.10.4%2025-10-06Fix
CVE-2025-58583SICK Enterprise Analytics user Enumeration5.3CNA v3.10.4%2025-10-06
CVE-2025-58582SICK Enterprise Analytics uncontrolled resource consumption via log file5.3CNA v3.10.6%2025-10-06
CVE-2025-58581SICK Enterprise Analytics information disclosure through Stacktrace-/MQTT/Config/changeAll4.3CNA v3.10.3%2025-10-06
CVE-2025-58580SICK Enterprise Analytics injection via log file6.5CNA v3.10.4%2025-10-06
CVE-2025-58579SICK Baggage Analytics username Disclosure through missing authentication5.3CNA v3.10.4%2025-10-06Fix
CVE-2025-58578SICK Enterprise Analytics unlimited user creation by authorized users3.8CNA v3.10.3%2025-10-06
CVE-2025-57781DENSO TEN Multiple installers of DENSO TEN drive recorder viewer uncontrolled search path8.4CNA v4.00.2%2025-10-06
CVE-2025-57515Uniclare Student Portal SQL injection9.8CISA ADP v3.10.5%2025-10-06
CVE-2025-57247BATBToken whitelist management functions privilege escalation9.1CISA ADP v3.10.4%2025-10-06
CVE-2025-56382LionCoders SalePro POS Customer Management module stored cross-site scripting6.1CISA ADP v3.10.2%2025-10-06
CVE-2025-52472XWiki Platform vulnerable to HQL injection via wiki and space search REST API9.3CNA v4.02.4%2025-10-06NucleiFix
CVE-2025-50538Flowise is vulnerable to stored XSS6.1NVD v3.114.0%2025-10-06Fix
CVE-2025-49594XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right9.2CNA v4.00.4%2025-10-06Fix
CVE-2025-43824Liferay Profile widget does not prevent vCard extension spoofing4.8CNA v4.00.2%2025-10-06Fix
CVE-2025-36356IBM Security Verify Access privilege escalation9.3CNA v3.10.2%2025-10-06Fix
CVE-2025-36355IBM Security Verify Access code execution8.5CNA v3.10.2%2025-10-06Fix
CVE-2025-36354IBM Security Verify Access command execution7.3CNA v3.10.3%2025-10-06Fix
CVE-2025-29192Flowise stored XSS vulnerability through logs in chatbot6.1NVD v3.10.4%2025-10-06Fix
CVE-2025-28129PHPGurukul Hostel Management System clickjacking5.4CISA ADP v3.10.2%2025-10-06
CVE-2025-11346ILIAS Base64 Decoding unserialize deserialization9.8v3.10.4%2025-10-06
CVE-2025-11345ILIAS Test Import unserialize deserialization9.8v3.10.4%2025-10-06Fix
CVE-2025-11344ILIAS Certificate Import code injection9.8v3.10.5%2025-10-06Fix
CVE-2025-11343code-projects Student Crud Operation delete.php SQL injection8.6NVD v3.10.4%2025-10-06
CVE-2025-11342code-projects Online Course Registration edit-course.php SQL injection9.8NVD v3.10.4%2025-10-06
CVE-2025-11341Jinher OA type XML external entity reference9.8NVD v3.10.5%2025-10-06
CVE-2025-11339D-Link DI-7100G C1 jhttpd hi_block.asp sub_4BD4F8 buffer overflow8.7CNA v4.01.0%2025-10-06Emerging Threats
CVE-2025-11338D-Link DI-7100G C1 jhttpd login.cgi sub_4C0990 buffer overflow9.8NVD v3.11.0%2025-10-06Emerging Threats
CVE-2025-11337Four-Faith Water Conservancy Informatization Platform download.do;othersusrlogout.do path traversal6.9CNA v4.00.7%2025-10-06
CVE-2025-11336Four-Faith Water Conservancy Informatization Platform download.do;otherlogout.do path traversal6.9CNA v4.00.7%2025-10-06
CVE-2025-11335D-Link DI-7100G C1 jhttpd msp_info.htm sub_46409C command injection7.2NVD v3.14.6%2025-10-06Emerging Threats
CVE-2025-11334Campcodes Online Apartment Visitor Management System visitor-detail.php SQL injection9.8NVD v3.10.4%2025-10-06
CVE-2025-11333Online Banking System add customer page cross-site scripting4.8CNA v4.00.3%2025-10-06
CVE-2025-11332CmsEasy URL view.php cross-site scripting6.1v3.10.3%2025-10-06
CVE-2025-11331IdeaCMS Website Name Config.php command injection7.2v3.117.5%2025-10-06
CVE-2025-11330PHPGurukul Beauty Parlour Management System sales-reports-detail.php SQL injection8.8NVD v3.10.3%2025-10-06
CVE-2025-11329code-projects Online Course Registration manage-students.php SQL injection9.8NVD v3.10.4%2025-10-06
CVE-2025-11328Tenda AC18 SetDDNSCfg stack-based overflow8.7CNA v4.01.1%2025-10-06Emerging Threats
CVE-2025-11327Tenda AC18 SetUpnpCfg stack-based overflow8.7CNA v4.01.2%2025-10-06Emerging Threats
CVE-2025-11326Tenda AC18 WifiMacFilterSet stack-based overflow8.7CNA v4.01.2%2025-10-06Emerging Threats
CVE-2025-11325Tenda AC18 fast_setting_pppoe_set stack-based overflow8.7CNA v4.00.8%2025-10-06
CVE-2025-11324Tenda AC18 setNotUpgrade stack-based overflow8.7CNA v4.00.8%2025-10-06
CVE-2025-11323UTT 1250GW formUserStatusRemark strcpy buffer overflow8.7CNA v4.00.8%2025-10-06
CVE-2025-11322Mangati NovoSGA User Creation new weak password6.3CNA v4.00.4%2025-10-06
CVE-2025-11321zhuimengshaonian wisdom-education WrongBookController.java authorization5.3CNA v4.00.4%2025-10-06
CVE-2025-11320zhuimengshaonian wisdom-education UploadController.java uploadFile unrestricted upload5.3CNA v4.00.3%2025-10-06
CVE-2025-11319nahiduddinahammed Hospital-Management-System-Website delete.php SQL injection5.3CNA v4.00.2%2025-10-06
CVE-2025-11318Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 uploadWxFile.do unrestricted upload9.8NVD v3.10.6%2025-10-06
CVE-2025-11317Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 SQL injection9.8NVD v3.10.5%2025-10-06
CVE-2025-11316Tipray Data Leakage Prevention System category page SQL injection9.8NVD v3.10.5%2025-10-06
CVE-2025-11315Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 SQL injection9.8NVD v3.10.5%2025-10-06
CVE-2025-11314Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 SQL injection9.8NVD v3.10.5%2025-10-06
CVE-2025-11313Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 SQL injection9.8NVD v3.10.5%2025-10-06
CVE-2025-11312Tipray Data Leakage Prevention System module page SQL injection9.8NVD v3.10.5%2025-10-06
CVE-2025-11311Tipray Data Leakage Prevention System tenant page SQL injection9.8NVD v3.10.5%2025-10-06
CVE-2025-11310Tipray Data Leakage Prevention System file server page SQL injection9.8NVD v3.10.5%2025-10-06
CVE-2025-10363Unauthenticated RCE via .NET deserialization in Topal Finance software10.0CNA v4.00.6%2025-10-06Fix
CVE-2025-9914SICK Baggage Analytics authentication bypass4.3CNA v3.10.3%2025-10-06Fix
CVE-2025-9913SICK Baggage Analytics cross-site scripting: Session hijacking4.5CNA v3.10.3%2025-10-06Fix
CVE-2025-9710Responsive Lightbox and Gallery WordPress plugin unauthenticated Stored-XSS via comments6.3CISA ADP v3.10.2%2025-10-06Fix
CVE-2025-9703Ultimate Addons for Elementor Lite WordPress plugin Author+ stored XSS4.3CISA ADP v3.10.2%2025-10-06Fix
CVE-2025-6985XXE vulnerability in langchain-ai/langchain7.5CNA v3.00.5%2025-10-06Fix
CVE-2025-0609XSS in Logo Software's Logo Cloud4.7CNA v3.10.2%2025-10-06Fix
CVE-2025-0608Open redirect in Logo Software's Logo Cloud5.5CNA v3.10.2%2025-10-06Fix
CVE-2025-0607HTML injection in Logo Software's Logo Cloud4.3CNA v3.10.2%2025-10-06Fix
CVE-2025-0606IDOR in Logo Software's Logo Cloud6.0CNA v3.10.3%2025-10-06Fix
CVE-2025-0038AMD Kria(TM) SOM improper quantity validation6.6CNA v3.10.1%2025-10-06
CVE-2025-61882Oracle E-Business Suite improper authentication9.8CNA v3.199.7%2025-10-05KEVNucleiMetasploitEmerging ThreatsExploit codeFix
CVE-2025-11309Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findDeptPage.do doFilter SQL injection9.8NVD v3.10.5%2025-10-05
CVE-2025-11308Vanderlande Baggage 360 messages cross-site scripting5.1CNA v4.00.3%2025-10-05
CVE-2025-11306qianfox FoxCMS Search cross-site scripting6.1NVD v3.10.3%2025-10-05
CVE-2025-11305UTT HiPER 840G formTaskEdit strcpy buffer overflow8.7CNA v4.01.0%2025-10-05
CVE-2025-11304CodeCanyon/ui-lib Mentor LMS API cross-domain policy5.3CNA v4.00.2%2025-10-05
CVE-2025-11303Belkin F9K1015 mp command injection8.8NVD v3.16.8%2025-10-05
CVE-2025-11302Belkin F9K1015 formWpsStart buffer overflow8.7CNA v4.01.1%2025-10-05
CVE-2025-11301Belkin F9K1015 formWlanSetupWPS buffer overflow8.7CNA v4.01.1%2025-10-05
CVE-2025-11300Belkin F9K1015 formWlanMP buffer overflow8.7CNA v4.00.8%2025-10-05
CVE-2025-11299Belkin F9K1015 formWanTcpipSetup buffer overflow8.7CNA v4.01.1%2025-10-05Emerging Threats
CVE-2025-11298Belkin F9K1015 formSetWanStatic command injection8.8NVD v3.16.8%2025-10-05
CVE-2025-11297Belkin F9K1015 formSetLanguage buffer overflow8.7CNA v4.01.1%2025-10-05
CVE-2025-11296Belkin F9K1015 formPPTPSetup buffer overflow8.7CNA v4.01.1%2025-10-05Emerging Threats
CVE-2025-11295Belkin F9K1015 formPPPoESetup buffer overflow8.7CNA v4.01.1%2025-10-05Emerging Threats
CVE-2025-11294Belkin F9K1015 formL2TPSetup buffer overflow8.7CNA v4.01.3%2025-10-05Emerging Threats
CVE-2025-11293Belkin F9K1015 formConnectionSetting buffer overflow8.7CNA v4.01.1%2025-10-05
CVE-2025-11292Belkin F9K1015 formBSSetSitesurvey command injection8.8NVD v3.16.8%2025-10-05
CVE-2025-11291ixmaps website2017 HTTP GET request map.php cross-site scripting5.3CNA v4.00.4%2025-10-05
CVE-2025-11290CRMEB JWT HMAC Secret hard-coded key8.1v3.10.4%2025-10-05
CVE-2025-11289westboy CicadasCMS Template Management TemplateFileServiceImpl.java save cross-site scripting5.4NVD v3.10.3%2025-10-05
CVE-2025-11288CRMEB GET parameter product SQL injection8.8v3.10.3%2025-10-05
CVE-2025-11287samanhappy MCPHub sseService.ts handleSseConnectionfunction improper authentication9.8NVD v3.10.6%2025-10-05
CVE-2025-11286samanhappy MCPHub MCPRouter service serverController.ts server-side request forgery5.1CNA v4.00.3%2025-10-05
CVE-2025-11285samanhappy MCPHub serverController.ts os command injection8.8NVD v3.17.8%2025-10-05
CVE-2025-11284Zytec Dalian Zhuoyun Technology Central Authentication Service HTTP header git hard-coded password6.9CNA v4.00.4%2025-10-05
CVE-2025-11283Frappe LMS Course cross-site scripting4.8CNA v4.00.4%2025-10-05
CVE-2025-11282Frappe LMS Incomplete Fix cross-site scripting6.1NVD v3.10.4%2025-10-05Fix
CVE-2025-11281Frappe LMS Unpublished Course courses access control2.3CNA v4.00.4%2025-10-05
CVE-2025-11280Frappe LMS Assignment Picture files direct request6.3CNA v4.00.5%2025-10-05
CVE-2025-11279Axosoft Scrum and Bug Tracking Add Work Item CSV injection5.1CNA v4.00.2%2025-10-05
CVE-2025-11278AllStarLink Supermon AllMon2 cross-site scripting5.3CNA v4.00.3%2025-10-05
CVE-2025-11277Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflow7.8NVD v3.10.2%2025-10-05Fix
CVE-2025-11276Rebuild Comment/Guestbook cross-site scripting5.1CNA v4.00.3%2025-10-05Fix
CVE-2025-11275Open Asset Import Library Assimp OpenDDLParserUtils.h getNextSeparator heap-based overflow7.8NVD v3.10.2%2025-10-05
CVE-2025-11274Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile allocation of resources5.5NVD v3.10.2%2025-10-05
CVE-2025-8917Path traversal leading to remote code execution in allegroai/clearml5.8CNA v3.00.5%2025-10-05Fix
CVE-2025-8406Path traversal in zenml-io/ZenML7.8v3.10.3%2025-10-05Fix
CVE-2025-61962fetchmail SMTP client denial of service5.9CNA v3.10.4%2025-10-04Fix
CVE-2025-39953Linux kernel cgroup destroy workqueue vulnerability5.5NVD v3.10.2%2025-10-04Fix
CVE-2025-39952Linux kernel wilc1000 Wi-Fi driver out-of-bounds write8.8CNA v3.10.2%2025-10-04Fix
CVE-2025-39951Linux kernel virtio_uml driver use-after-free7.8CNA v3.10.2%2025-10-04Fix
CVE-2025-39950Linux kernel net/tcp null pointer dereference5.5v3.10.1%2025-10-04Fix
CVE-2025-39949Linux kernel qed Ethernet driver out-of-bounds write7.8CNA v3.10.2%2025-10-04Fix
CVE-2025-39948Linux kernel ice Ethernet driver memory leak9.8CNA v3.10.3%2025-10-04Fix
CVE-2025-39947Linux kernel mlx5e Ethernet driver null pointer dereference5.5v3.10.1%2025-10-04Fix
CVE-2025-39946Linux kernel kernel TLS vulnerability9.8CNA v3.110.3%2025-10-04Exploit codeFix
CVE-2025-39945Linux kernel cnic driver use-after-free7.8CNA v3.10.2%2025-10-04Fix
CVE-2025-39944Linux kernel octeontx2 PTP timestamp handling use-after-free7.8CNA v3.10.2%2025-10-04Fix
CVE-2025-39943Linux kernel ksmbd SMB Direct server out-of-bounds read9.4CNA v3.10.3%2025-10-04Fix
CVE-2025-39942In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size This is inspired by the check for data_offset + data_length.7.5CNA v3.10.3%2025-10-04Fix
CVE-2025-39941Linux kernel zram driver race condition7.8CNA v3.10.1%2025-10-04Fix
CVE-2025-39940Linux kernel dm-stripe integer overflow5.5NVD v3.10.1%2025-10-04Fix
CVE-2025-39939Linux kernel s390 IOMMU driver out-of-bounds write7.8CNA v3.10.1%2025-10-04Fix
CVE-2025-39938Linux kernel q6apm-lpass-dais null pointer dereference5.5v3.10.1%2025-10-04Fix
CVE-2025-39937Linux kernel rfkill-gpio driver null pointer dereference5.5v3.10.1%2025-10-04Fix
CVE-2025-39936Linux kernel crypto null pointer dereference5.5v3.10.1%2025-10-04Fix
CVE-2025-39935Linux kernel SMA1307 audio codec driver out-of-bounds write7.8CNA v3.10.1%2025-10-04Fix
CVE-2025-39934Linux kernel anx7625 null pointer dereference5.5v3.10.1%2025-10-04Fix
CVE-2025-39933In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This is inspired by the related server fixes.9.4CNA v3.10.3%2025-10-04Fix
CVE-2025-39932In the Linux kernel, the following vulnerability has been resolved: smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) In smbd_destroy() we may destroy the memory so we better wait until post_send_credits_work is no longer pending and will never be started again.9.8CNA v3.10.3%2025-10-04Fix
CVE-2025-39931Linux kernel AF_ALG socket interface vulnerability7.8CNA v3.10.2%2025-10-04Fix
CVE-2025-39929Linux kernel smb client memory leak7.5CNA v3.10.3%2025-10-04Fix
CVE-2025-11273LaChatterie Verger provider.ts redirectToAuthorization deserialization5.3CNA v4.00.3%2025-10-04
CVE-2025-11272SeriaWei ZKEACMS POST Request UrlRedirectionController.cs delete improper authorization5.3CNA v4.00.3%2025-10-04
CVE-2025-11228GiveWP WordPress plugin unauthorized access5.3CNA v3.10.3%2025-10-04Fix
CVE-2025-11227GiveWP WordPress plugin information disclosure6.5NVD v3.10.3%2025-10-04Fix
CVE-2025-10751MacForge Beta 1 local privilege escalation7.8NVD v3.10.2%2025-10-04
CVE-2025-10746Integrate Dynamics 365 CRM WordPress plugin missing authorization6.5CNA v3.10.3%2025-10-04Fix
CVE-2025-10383Contest Gallery WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-10-04Fix
CVE-2025-9952Trinity Audio WordPress plugin reflected cross-site scripting6.1CNA v3.10.3%2025-10-04Fix
CVE-2025-9886Trinity Audio WordPress plugin cross-site request forgery4.3CNA v3.10.2%2025-10-04Fix
CVE-2025-9485OAuth Single Sign On SSO (OAuth Client) WordPress plugin authentication bypass9.8CNA v3.10.6%2025-10-04Fix
CVE-2025-9243Cost Calculator Builder WordPress plugin missing authorization8.1CNA v3.10.3%2025-10-04Fix
CVE-2025-9030Majestic Before After Image WordPress plugin stored cross-site scripting5.4CNA v3.10.2%2025-10-04Fix
CVE-2025-9029WDesignKit WordPress plugin missing authorization4.3CNA v3.10.2%2025-10-04Fix
CVE-2025-8726WP Photo Album Plus WordPress plugin stored cross-site scripting5.4CNA v3.10.2%2025-10-04Fix
CVE-2025-61685Mastra Docs MCP Server `@mastra/mcp-docs-server` leads to information exposure6.5CNA v3.10.6%2025-10-03Fix
CVE-2025-61681Kuno is vulnerable to stored XSS Attack via SVG file upload5.4CNA v3.10.2%2025-10-03Fix
CVE-2025-61680jaketcooper Minecraft-rcon Minecraft RCON Terminal: Plain Text Password Storage in Configuration6.6CNA v4.00.4%2025-10-03Fix
CVE-2025-61679Anyquery unauthenticated access vulnerability exposes Private Integration Data7.7CNA v3.10.2%2025-10-03Fix
CVE-2025-61677DataChain: Deserialization of untrusted data from Environment variables2.5CNA v3.10.2%2025-10-03Fix
CVE-2025-61673Karapace is vulnerable to authentication bypass8.6CNA v3.10.4%2025-10-03Fix
CVE-2025-61599Emlog is vulnerable to stored cross-site scripting (XSS) in Twitter feature via Markdown Input5.1CNA v4.00.2%2025-10-03
CVE-2025-61597Emlog Pro is vulnerable to stored XSS attack through HTML template injection7.6CNA v3.10.2%2025-10-03Fix
CVE-2025-61593Cursor CLI Agent: Sensitive File Overwrite Bypass7.1CNA v3.10.4%2025-10-03Fix
CVE-2025-61592Cursor CLI: Arbitrary code execution possible through Permissive CLI Config8.8CNA v3.10.5%2025-10-03Fix
CVE-2025-61591Cursor CLI's Cursor Agent MCP OAuth2 Communication is vulnerable to remote code execution8.8CNA v3.11.2%2025-10-03Fix
CVE-2025-61590Cursor is vulnerable to RCE via .code-workspace files using prompt injection7.5CNA v3.10.5%2025-10-03Fix
CVE-2025-61589Cursor: Potential information leakage via Mermaid Diagram5.9CNA v3.10.3%2025-10-03Fix
CVE-2025-60787motionEye vulnerable to RCE via unsanitized motion config parameter7.2CISA ADP v3.118.5%2025-10-03MetasploitExploit codeFix
CVE-2025-60454Metinfo cross-site scripting6.1CISA ADP v3.10.3%2025-10-03
CVE-2025-60453Metinfo cross-site scripting6.1CISA ADP v3.10.3%2025-10-03
CVE-2025-60452Metinfo cross-site scripting6.1CISA ADP v3.10.2%2025-10-03
CVE-2025-60451Metinfo cross-site scripting6.1CISA ADP v3.10.2%2025-10-03
CVE-2025-60450Metinfo cross-site scripting6.1CISA ADP v3.10.2%2025-10-03
CVE-2025-60449Seacms information disclosure4.9CISA ADP v3.10.4%2025-10-03
CVE-2025-60448emlog cross-site scripting6.1CISA ADP v3.10.2%2025-10-03
CVE-2025-60447emlog cross-site scripting5.9CISA ADP v3.10.3%2025-10-03
CVE-2025-60445XunRuiCMS cross-site scripting6.1CISA ADP v3.10.2%2025-10-03
CVE-2025-59944Cursor IDE: Sensitive File Overwrite Bypass is possible8.1CNA v3.10.4%2025-10-03Fix
CVE-2025-59943phpMyFAQ duplicate email registration allows multiple accounts with the same email8.1CNA v3.10.4%2025-10-03Fix
CVE-2025-59829anthropics claude-code claude Code: Permission deny bypass is possible through symlink2.3CNA v4.00.4%2025-10-03Fix
CVE-2025-59536anthropics claude-code claude Code's startup trust dialog could lead to command execution attack8.7CNA v4.027.2%2025-10-03Exploit codeFix
CVE-2025-59489Unity3D Unity Editor argument injection8.4CISA ADP v3.10.6%2025-10-03Exploit codeFix
CVE-2025-59300File Parsing out-of-bounds write vulnerability in DIAScreen6.8CNA v4.00.2%2025-10-03Fix
CVE-2025-59299File Parsing out-of-bounds write vulnerability in DIAScreen6.8CNA v4.00.2%2025-10-03Fix
CVE-2025-59298File Parsing out-of-bounds write vulnerability in DIAScreen6.8CNA v4.00.2%2025-10-03Fix
CVE-2025-59297File Parsing out-of-bounds write vulnerability in DIAScreen6.8CNA v4.00.2%2025-10-03Fix
CVE-2025-57714QNAP NetBak Replicator unquoted search path8.5CNA v4.00.2%2025-10-03Fix
CVE-2025-57423MyClub articles endpoint SQL injection6.5CISA ADP v3.10.5%2025-10-03
CVE-2025-56551Directadmin sensitive query strings8.2CISA ADP v3.10.4%2025-10-03
CVE-2025-55972TCL 65c655 denial of service7.5CISA ADP v3.10.5%2025-10-03Exploit code
CVE-2025-55971TCL 65c655 server-side request forgery4.7CISA ADP v3.10.3%2025-10-03Exploit code
CVE-2025-54374Eidos: One-click remote code execution through Custom URL Handling8.8CNA v3.10.6%2025-10-03
CVE-2025-54154QNAP Authenticator improper authentication6.9CNA v4.00.2%2025-10-03Fix
CVE-2025-54153QNAP Qsync Central SQL injection8.6CNA v4.00.4%2025-10-03Fix
CVE-2025-53595QNAP Qsync Central SQL injection8.6CNA v4.00.4%2025-10-03Fix
CVE-2025-53407QNAP QTS and QuTS hero format string5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-53406QNAP QTS and QuTS hero format string5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-53354NiceGUI is vulnerable to reflected XSS attack6.1CNA v3.10.2%2025-10-03Fix
CVE-2025-52867QNAP Qsync Central resource exhaustion6.0CNA v4.00.4%2025-10-03Fix
CVE-2025-52866QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-52862QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-52860QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-52859QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-52858QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-52857QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-52855QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-52854QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-52853QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-52658HCL MyXalytics is affected by the use of vulnerable/outdated versions3.5CNA v3.10.2%2025-10-03Fix
CVE-2025-52656HCL MyXalytics product is affected by mass assignment7.6CNA v3.10.3%2025-10-03Fix
CVE-2025-52654HCL MyXalytics is affected by an HTML injection4.6CNA v3.10.2%2025-10-03Fix
CVE-2025-52653HCL MyXalytics cross-site scripting vulnerability in the web application7.6CNA v3.10.3%2025-10-03Fix
CVE-2025-52433QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-52432QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-52429QNAP QTS and QuTS hero format string5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-52428QNAP QTS null pointer dereference5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-52427QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.5%2025-10-03Fix
CVE-2025-52424QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.5%2025-10-03Fix
CVE-2025-49844Redis Lua use-after-free may lead to remote code execution10.0CNA v3.182.3%2025-10-03Reported exploitedNucleiExploit codeFix
CVE-2025-49641Zabbix insufficient permission check for the problem.view.refresh action5.1CNA v4.00.3%2025-10-03Fix
CVE-2025-48730QNAP Systems QTS format string5.1CNA v4.00.4%2025-10-03Fix
CVE-2025-48729QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.5%2025-10-03Fix
CVE-2025-48728QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.5%2025-10-03Fix
CVE-2025-48727QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.5%2025-10-03Fix
CVE-2025-48726QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.5%2025-10-03Fix
CVE-2025-47214QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.5%2025-10-03Fix
CVE-2025-47213QNAP QTS and QuTS hero null pointer dereference5.1CNA v4.00.5%2025-10-03Fix
CVE-2025-47212QNAP QTS and QuTS hero command injection5.1CNA v4.01.3%2025-10-03Fix
CVE-2025-47211QNAP QTS and QuTS hero path traversal6.9CNA v4.00.6%2025-10-03Fix
CVE-2025-47210QNAP Qsync Central null pointer dereference5.3CNA v4.00.5%2025-10-03Fix
CVE-2025-46819Redis is vulnerable to DoS via specially crafted LUA scripts6.3CNA v3.11.1%2025-10-03NucleiExploit codeFix
CVE-2025-46818Redis: Authenticated users can execute LUA scripts as a different user6.0CNA v3.10.7%2025-10-03NucleiExploit codeFix
CVE-2025-46817redis lua library commands may lead to integer overflow and potential RCE7.0CNA v3.13.8%2025-10-03NucleiExploit codeFix
CVE-2025-44014QNAP Qsync Central out-of-bounds write7.1CNA v4.00.5%2025-10-03Fix
CVE-2025-44012QNAP Qsync Central resource exhaustion7.1CNA v4.00.5%2025-10-03Fix
CVE-2025-44011QNAP Qsync Central null pointer dereference5.3CNA v4.00.4%2025-10-03Fix
CVE-2025-44010QNAP Qsync Central null pointer dereference5.3CNA v4.00.4%2025-10-03Fix
CVE-2025-44009QNAP Qsync Central null pointer dereference5.3CNA v4.00.4%2025-10-03Fix
CVE-2025-44008QNAP Qsync Central null pointer dereference5.3CNA v4.00.4%2025-10-03Fix
CVE-2025-44007QNAP Qsync Central resource exhaustion7.1CNA v4.00.4%2025-10-03Fix
CVE-2025-44006QNAP Qsync Central resource exhaustion7.1CNA v4.00.4%2025-10-03Fix
CVE-2025-43825Liferay Portal exposes sensitive user data through its Freemarker template4.6CNA v4.00.3%2025-10-03Fix
CVE-2025-40636SQL injection in the mod_vvisit_counter module9.3CNA v4.00.3%2025-10-03
CVE-2025-34226OpenPLC Runtime v3 Persistent DoS7.1CNA v4.00.7%2025-10-03Exploit code
CVE-2025-33040QNAP Qsync Central resource exhaustion7.1CNA v4.00.4%2025-10-03Fix
CVE-2025-33039QNAP Qsync Central resource exhaustion7.1CNA v4.00.4%2025-10-03Fix
CVE-2025-33034QNAP Qsync Central path traversal5.3CNA v4.00.5%2025-10-03Fix
CVE-2025-27237DLL injection in Zabbix agent and agent 2 via OpenSSL configuration7.3CNA v4.00.3%2025-10-03Exploit code
CVE-2025-27236Zabbix user information disclosure via api_jsonrpc.php on method user.get with param search2.1CNA v4.00.4%2025-10-03Fix
CVE-2025-27231LDAP Bind password field value can be leaked by a Zabbix Super Admin4.3CNA v4.00.5%2025-10-03Fix
CVE-2025-11241Yoast SEO Premium Authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.3%2025-10-03Fix
CVE-2025-11234Red Hat Enterprise Linux 10 qemu-kvm: Vnc websocket handshake use-after-free7.5CNA v3.10.9%2025-10-03Fix
CVE-2025-11223Panasonic AutoDownloader uncontrolled search path8.4CNA v4.00.2%2025-10-03
CVE-2025-10729Qt SVG pattern node parser use-after-free9.4CNA v4.00.2%2025-10-03Fix
CVE-2025-10728Uncontrolled recursion in Qt SVG module9.4CNA v4.00.2%2025-10-03Fix
CVE-2025-10726WPRecovery WordPress plugin unauthenticated SQL injection to arbitrary file deletion9.1CNA v3.10.4%2025-10-03
CVE-2025-10696OpenSupports insecure direct object reference in supervised list5.4NVD v3.10.2%2025-10-03
CVE-2025-10695OpenSupports SSRF via test imap and smtp endpoints5.3v3.10.3%2025-10-03
CVE-2025-10692OpenSupports SQL injection7.1CNA v4.00.4%2025-10-03
CVE-2025-10609Hard-coded credentials in Logo Software's TigerWings ERP5.9CNA v3.10.1%2025-10-03Fix
CVE-2025-10582WP Dispatcher WordPress plugin authenticated (Contributor+) SQL injection8.8CNA v3.10.3%2025-10-03
CVE-2025-10547DrayTek Vigor1000B An uninitialized memory use9.8CISA ADP v3.10.6%2025-10-03Fix
CVE-2025-10311Comment Info Detector WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.1%2025-10-03
CVE-2025-10309PayPal Forms WordPress plugin cross-site request forgery4.3CNA v3.10.1%2025-10-03
CVE-2025-10306Backup Bolt WordPress plugin authenticated (Admin+) arbitrary file download3.8CNA v3.10.3%2025-10-03Fix
CVE-2025-10302Ultimate Viral Quiz WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.1%2025-10-03
CVE-2025-10212SiteAlert WordPress plugin missing authorization unauthenticated site Health information exposure5.3CNA v3.10.4%2025-10-03
CVE-2025-10192WP Photo Effects WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-10-03
CVE-2025-10165AP Background WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-10-03
CVE-2025-10053TableGen Data Table Generator WordPress plugin authenticated (Admin+) stored cross-site scripting4.4CNA v3.10.2%2025-10-03
CVE-2025-9945Optimize More! CSS WordPress plugin cross-site request forgery to plugin settings reset4.3CNA v3.10.1%2025-10-03
CVE-2025-9897AP Background WordPress plugin cross-site request forgery4.3CNA v3.10.1%2025-10-03
CVE-2025-9895Notification Bar WordPress plugin cross-site request forgery4.3CNA v3.10.1%2025-10-03
CVE-2025-9892DevriX Restrict User Registration settings update cross-site request forgery5.3CNA v3.10.2%2025-10-03
CVE-2025-9889ContentMX Content Publisher WordPress plugin cross-site request forgery4.3CNA v3.10.2%2025-10-03Fix
CVE-2025-9885MPWizard WordPress plugin cross-site request forgery4.3CNA v3.10.1%2025-10-03
CVE-2025-9884Mobile Site Redirect WordPress plugin cross-site request forgery to stored cross-site scripting6.1CNA v3.10.2%2025-10-03
CVE-2025-9876Ird Slider WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-10-03
CVE-2025-9875Event Tickets, RSVPs, Calendar WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-10-03Fix
CVE-2025-9859Fintelligence Calculator WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-10-03
CVE-2025-9858Auto Bulb Finder for WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-10-03Fix
CVE-2025-9854A Simple Multilanguage WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-10-03
CVE-2025-9630WP SinoType WordPress plugin cross-site request forgery4.3CNA v3.10.2%2025-10-03
CVE-2025-9561AP Background - missing authorization to Authenticated arbitrary file upload8.8CNA v3.10.6%2025-10-03
CVE-2025-9372Ultimate Multi Design Video Carousel WordPress plugin stored cross-site scripting5.5CNA v3.10.2%2025-10-03
CVE-2025-9333Smart Docs WordPress plugin authenticated (Admin+) stored cross-site scripting5.5CNA v3.10.2%2025-10-03
CVE-2025-9332Interactive Medical Drawing of Human Body WordPress plugin stored cross-site scripting5.5CNA v3.10.2%2025-10-03
CVE-2025-9286Appy Pie Connect for WooCommerce WordPress plugin privilege escalation9.8CNA v3.10.5%2025-10-03Exploit codeFix
CVE-2025-9213TextBuilder - cross-site request forgery to privilege escalation via account takeover8.8CNA v3.10.2%2025-10-03Fix
CVE-2025-9212WP Dispatcher WordPress plugin authenticated (Subscriber+) arbitrary file upload7.5CNA v3.10.5%2025-10-03
CVE-2025-9209RestroPress WordPress plugin authentication bypass9.8CNA v3.12.3%2025-10-03NucleiExploit codeFix
CVE-2025-9206Meks Easy Maps WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.2%2025-10-03Fix
CVE-2025-9204X Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-10-03Fix
CVE-2025-9200Blappsta Mobile App Plugin WordPress plugin SQL injection7.5CNA v3.10.4%2025-10-03
CVE-2025-9199Woo superb slideshow transition gallery with random effect WordPress plugin SQL injection6.5CNA v3.10.3%2025-10-03
CVE-2025-9198Wp cycle text announcement WordPress plugin authenticated (Contributor+) SQL injection6.5CNA v3.10.3%2025-10-03
CVE-2025-9194Constructor WordPress theme missing authorization to authenticated (Subscriber+) theme Clean4.3CNA v3.10.2%2025-10-03
CVE-2025-9130Unify WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-10-03Fix
CVE-2025-9129Flexi WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-10-03
CVE-2025-9080Generic Elements WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.3%2025-10-03
CVE-2025-9077Ultra Addons Lite for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-10-03Fix
CVE-2025-9045Easy Elementor Addons WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.3%2025-10-03Fix
CVE-2025-8776Epic Bootstrap Buttons WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-10-03
CVE-2025-8669Customify WordPress theme cross-site request forgery4.3CNA v3.10.2%2025-10-03Fix
CVE-2025-7825Schema Plugin For Divi, Gutenberg and Shortcodes WordPress plugin object Instantiation6.3CNA v3.10.3%2025-10-03
CVE-2025-7721JoomSport WordPress plugin unauthenticated directory traversal to local file inclusion9.8CNA v3.10.7%2025-10-03Fix
CVE-2025-6388Spirit Framework WordPress plugin authentication bypass to account takeover and privilege escalation9.8CNA v3.10.6%2025-10-03Fix
CVE-2025-0876XSS in Isin Basi Advertisement and IT's Workif4.1CNA v3.10.2%2025-10-03
CVE-2025-0616SQLi in Teknolojik Center Telecommunication's B2B Netsis Panel8.2CNA v3.10.3%2025-10-03
CVE-2025-61735Apache Kylin: Server-side request forgery7.3CISA ADP v3.10.5%2025-10-02Fix
CVE-2025-61734Apache Kylin: Improper restriction of file read7.5CISA ADP v3.120.7%2025-10-02Fix
CVE-2025-61733Apache Kylin: Authentication bypass7.5CISA ADP v3.11.3%2025-10-02Fix
CVE-2025-61692KEYENCE VT STUDIO use-after-free7.1CNA v4.00.1%2025-10-02Fix
CVE-2025-61691KEYENCE VT STUDIO out-of-bounds read7.1CNA v4.00.1%2025-10-02Fix
CVE-2025-61690KEYENCE KV STUDIO buffer underflow7.1CNA v4.00.1%2025-10-02
CVE-2025-61668@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user8.7CNA v4.00.4%2025-10-02Fix
CVE-2025-61666Traccar Unauthenticated local file inclusion on Windows Leakage of Traccar Config file8.7CNA v4.01.3%2025-10-02NucleiFix
CVE-2025-61665WeGIA: Broken access control in `get_relatorios_socios.php` endpoint8.7CNA v4.00.5%2025-10-02Fix
CVE-2025-61606WeGIA: Open redirect vulnerability in `control.php` endpoint4.8CNA v4.00.2%2025-10-02Fix
CVE-2025-61605WeGIA: SQL injection (Blind Time-Based) vulnerability in /pet/profile_pet.php endpoint9.4CNA v4.00.4%2025-10-02Fix
CVE-2025-61604WeGIA: Cross-site request forgery (CSRF) vulnerability in `control.php` endpoint7.1CNA v4.00.2%2025-10-02Fix
CVE-2025-61603WeGIA: SQL injection (Blind Time-Based) vulnerability in API `descricao` parameter9.4CNA v4.00.4%2025-10-02Fix
CVE-2025-61600Unbounded Memory Allocation in Stalwart IMAP parser7.5CNA v3.10.6%2025-10-02Fix
CVE-2025-61595mantrachain MANTRA tx gas limit is not enforced in send hooks8.8CNA v4.00.3%2025-10-02Fix
CVE-2025-61588risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`9.3CNA v4.00.5%2025-10-02Fix
CVE-2025-61096PHPGurukul Online Shopping Portal Project SQL injection6.5CISA ADP v3.10.3%2025-10-02
CVE-2025-61087Mayuri K Pet Grooming Management Software cross-site scripting6.1v3.10.2%2025-10-02
CVE-2025-60782Iqbolshoh PHP Education Management cross-site scripting5.4v3.10.2%2025-10-02
CVE-2025-60663Tenda AC18 stack-based buffer overflow7.5v3.10.4%2025-10-02
CVE-2025-60662Tenda AC18 stack-based buffer overflow7.5v3.10.5%2025-10-02
CVE-2025-60661Tenda AC18 stack-based buffer overflow5.3v3.10.4%2025-10-02
CVE-2025-60660Tenda AC18 stack-based buffer overflow7.5v3.10.5%2025-10-02
CVE-2025-59835LangBot has a cross-directory file upload vulnerability, which could lead to system takeover8.6CNA v4.00.4%2025-10-02Fix
CVE-2025-59774AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59773AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59772AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59771AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59770AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59769AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59768AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59767AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59766AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59765AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59764AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59763AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59762AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59761AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59760AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59759AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59758AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59757AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59756AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59755AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59754AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59753AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59752AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59751AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59750AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59749AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59748AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59747AndSoft e-TMS cross-site scripting6.1NVD v3.10.2%2025-10-02Fix
CVE-2025-59746AndSoft e-TMS cross-site scripting6.1NVD v3.10.3%2025-10-02Fix
CVE-2025-59745AndSoft e-TMS password encryption weak cryptographic algorithm7.5NVD v3.10.3%2025-10-02Fix
CVE-2025-59744AndSoft e-TMS path traversal7.5NVD v3.10.5%2025-10-02Fix
CVE-2025-59743AndSoft e-TMS SQL injection9.8NVD v3.10.4%2025-10-02Fix
CVE-2025-59742AndSoft e-TMS SQL injection9.8NVD v3.10.4%2025-10-02Fix
CVE-2025-59741AndSoft e-TMS OS command injection9.8NVD v3.11.3%2025-10-02Fix
CVE-2025-59740AndSoft e-TMS OS command injection9.8NVD v3.11.4%2025-10-02Fix
CVE-2025-59739AndSoft e-TMS OS command injection9.8NVD v3.11.4%2025-10-02Fix
CVE-2025-59738AndSoft e-TMS OS command injection9.8NVD v3.11.4%2025-10-02Fix
CVE-2025-59737AndSoft e-TMS OS command injection9.8NVD v3.11.4%2025-10-02Fix
CVE-2025-59736AndSoft e-TMS OS command injection9.8NVD v3.11.4%2025-10-02Fix
CVE-2025-59735AndSoft e-TMS OS command injection9.8NVD v3.11.5%2025-10-02Fix
CVE-2025-59409Flock Safety License Plate Reader Firmware cleartext storage of sensitive information7.5CISA ADP v3.10.3%2025-10-02
CVE-2025-59407Flock Safety hard-coded cryptographic key9.8CISA ADP v3.10.7%2025-10-02
CVE-2025-59406Flock Safety cleartext transmission of sensitive information6.2CISA ADP v3.10.2%2025-10-02
CVE-2025-59405Flock Safety information disclosure7.5CISA ADP v3.10.5%2025-10-02
CVE-2025-59403Flock Safety exposed dangerous method9.8CISA ADP v3.11.1%2025-10-02
CVE-2025-58777KEYENCE VT STUDIO uninitialized pointer access7.1CNA v4.00.1%2025-10-02Fix
CVE-2025-58776KEYENCE KV STUDIO stack-based buffer overflow8.4CNA v4.00.2%2025-10-02
CVE-2025-58775KEYENCE KV STUDIO stack-based buffer overflow8.4CNA v4.00.2%2025-10-02
CVE-2025-57443FrostWire application entitlements privilege escalation5.1CISA ADP v3.10.1%2025-10-02
CVE-2025-57305Vitaracharts server-side request forgery6.5CISA ADP v3.10.4%2025-10-02
CVE-2025-56381frappe erpnext SQL injection6.5CISA ADP v3.10.3%2025-10-02Exploit code
CVE-2025-56380frappe SQL injection6.5CISA ADP v3.10.3%2025-10-02Exploit code
CVE-2025-56379frappe erpnext blog post feature stored cross-site scripting5.4NVD v3.10.4%2025-10-02
CVE-2025-56162Yiovo Firefly Mall SQL injection6.5CISA ADP v3.10.5%2025-10-02
CVE-2025-56161Yiovo Firefly Mall information disclosure7.5CISA ADP v3.10.5%2025-10-02
CVE-2025-56154HTMLy cross-site scripting6.1CISA ADP v3.10.3%2025-10-02Fix
CVE-2025-56019Agasta Easy Touch Plus insecure inherited permissions6.5CISA ADP v3.10.3%2025-10-02
CVE-2025-54468Rancher sends sensitive information to external services through the `/meta/proxy` endpoint4.7CNA v3.10.4%2025-10-02Fix
CVE-2025-54315Matrix specification room create event vulnerability7.1CNA v3.10.3%2025-10-02Fix
CVE-2025-54293Path traversal in LXD Instance Log File Retrieval7.1CNA v4.00.6%2025-10-02Fix
CVE-2025-54292Canonical LXD Client-Side path traversal in LXD-UI4.8CNA v4.00.3%2025-10-02Fix
CVE-2025-54291Project existence disclosure in LXD images API6.9CNA v4.00.4%2025-10-02Fix
CVE-2025-54290Project Existence Disclosure via Error Handling in LXD Image Export6.9CNA v4.00.3%2025-10-02Fix
CVE-2025-54289Privilege escalation via WebSocket Connection Hijacking in LXD Operations API7.4CNA v4.00.2%2025-10-02Fix
CVE-2025-54288Canonical LXD Source Container Identification vulnerability via cmdline spoofing in devLXD Server5.1CNA v4.00.4%2025-10-02Fix
CVE-2025-54287Canonical LXD arbitrary file read via template injection in Snapshot Patterns7.1CNA v4.00.4%2025-10-02Fix
CVE-2025-54286Canonical LXD CSRF vulnerability when using Client Certificate Authentication with the LXD-UI7.5CNA v4.00.1%2025-10-02Fix
CVE-2025-54089Cross-site scripting vulnerability in Secure Access4.6CNA v4.00.2%2025-10-02Fix
CVE-2025-54088Open redirect in Secure Access5.5CNA v4.00.2%2025-10-02Fix
CVE-2025-54087Server-side request forgery in Secure Access1.8CNA v4.00.2%2025-10-02Fix
CVE-2025-54086Absolute Security Secure Access Excess Permissions in Warehouse5.3CNA v4.00.2%2025-10-02Fix
CVE-2025-53881openSUSE Tumbleweed symlink following6.9CNA v4.00.2%2025-10-02Fix
CVE-2025-49090Matrix specification external control of critical state data7.1CNA v3.10.5%2025-10-02Fix
CVE-2025-41064Incorrect authentication in GTT´s group OpenSIAC9.3CNA v4.00.4%2025-10-02
CVE-2025-41010Cross-origin resource sharing (CORS) in Hiberus Sintra5.1CNA v4.00.3%2025-10-02
CVE-2025-40992Stored XSS in Creativeitem Sociopro5.1CNA v4.00.4%2025-10-02
CVE-2025-40991Stored XSS in Creativeitem Ekushey CRM5.4NVD v3.10.2%2025-10-02
CVE-2025-40990Stored XSS in Creativeitem Ekushey CRM5.4NVD v3.10.2%2025-10-02
CVE-2025-40989Stored XSS in Creativeitem Ekushey CRM5.4NVD v3.10.2%2025-10-02
CVE-2025-40646Exposure of sensitive information in ViDay5.4NVD v3.10.2%2025-10-02
CVE-2025-40645Exposure of sensitive information in ViDay8.7CNA v4.00.3%2025-10-02
CVE-2025-34210Vasion Print (formerly PrinterLogic) Readable Cleartext Passwords5.5NVD v3.10.2%2025-10-02
CVE-2025-34208Vasion Print (formerly PrinterLogic) Insecure Password Hashing7.5v3.10.4%2025-10-02
CVE-2025-32942SSH Tectia Server incorrect control flow7.2CNA v3.10.2%2025-10-02Fix
CVE-2025-22862Fortinet FortiProxy authentication bypass6.3CNA v3.10.3%2025-10-02Fix
CVE-2025-11240Open redirect vulnerability in KNIME Business Hub5.3CNA v4.00.3%2025-10-02Fix
CVE-2025-11239Job details are visible to all team members on KNIME Business Hub2.3CNA v4.00.2%2025-10-02Fix
CVE-2025-11221Remote code execution in GTONE ChangeFlow9.4CNA v4.00.3%2025-10-02
CVE-2025-11182GTONE ChangeFlow path traversal7.1CNA v4.00.4%2025-10-02
CVE-2025-11020Remote code execution in MarkAny SafePC Enterprise8.7CNA v4.00.3%2025-10-02Fix
CVE-2025-10653Raise3D Pro2 Series 3D Printers authentication bypass using an alternate path or channel8.6CNA v3.10.4%2025-10-02
CVE-2025-9697Ajax WooSearch WordPress plugin unauthenticated SQL injection9.8CISA ADP v3.10.4%2025-10-02
CVE-2025-9587CTL Behance Importer Lite WordPress plugin unauthenticated SQL injection8.6CISA ADP v3.10.3%2025-10-02
CVE-2025-0642Hard-coded credentials in PosCube's Assist6.3CNA v3.10.3%2025-10-02
CVE-2025-61622Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory9.8CISA ADP v3.145.1%2025-10-01Exploit codeFix
CVE-2025-61587Weblate integration with Anubis can lead to open redirect via redir parameter2.1CNA v4.00.4%2025-10-01Fix
CVE-2025-61583joni1802 TS3 Manager login page error handling reflected cross-site scripting4.3CNA v3.10.3%2025-10-01Fix
CVE-2025-61582joni1802 ts3-manager ts3 Manager: Unauthenticated denial of service possible7.5CNA v3.10.5%2025-10-01Fix
CVE-2025-61189Adobe Jeecgboot path traversal6.3CISA ADP v3.10.3%2025-10-01
CVE-2025-61188Adobe Jeecgboot path traversal6.3CISA ADP v3.10.3%2025-10-01
CVE-2025-61045TOTOLINK X18 command injection9.8v3.11.5%2025-10-01Emerging Threats
CVE-2025-61044TOTOLINK X18 command injection9.8v3.11.0%2025-10-01Emerging Threats
CVE-2025-60991Codazon Magento Themes cat parameter reflected cross-site scripting8.8CISA ADP v3.10.4%2025-10-01
CVE-2025-59951Termix' official Docker image contains an authentication bypass9.2CNA v4.04.3%2025-10-01Fix
CVE-2025-59687IMPAQTR Aurora insecure direct object reference4.3CISA ADP v3.10.2%2025-10-01
CVE-2025-59686Kazaar orders API improper authorization6.5CISA ADP v3.10.2%2025-10-01
CVE-2025-59685Kazaar JWT authentication vulnerability5.3CISA ADP v3.10.3%2025-10-01
CVE-2025-59684Digisigner One uncontrolled search path8.8CISA ADP v3.10.6%2025-10-01
CVE-2025-59682Django vulnerable to partial directory traversal via archives6.5NVD v3.10.9%2025-10-01Fix
CVE-2025-59681Django vulnerable to SQL injection in column aliases9.8NVD v3.10.6%2025-10-01Fix
CVE-2025-59538argoproj argo-cd argo CD is vulnerable to unauthenticated remote DoS7.5CNA v3.19.4%2025-10-01Fix
CVE-2025-59537argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload7.5CNA v3.10.6%2025-10-01Fix
CVE-2025-59531argoproj argo-cd unauthenticated argocd-server panic7.5CNA v3.10.6%2025-10-01Fix
CVE-2025-59337Discourse: Cross-site data exposure5.5CNA v4.00.3%2025-10-01Fix
CVE-2025-59150Suricata: Keyword tls.subjectaltname can lead to null-ptr deref7.5CNA v3.10.5%2025-10-01Fix
CVE-2025-59149Suricata: Stack buffer overflow in rule parser when processing long keywords with transforms6.2CNA v3.10.2%2025-10-01Fix
CVE-2025-59148Suricata's improper use of entropy keyword can lead to a null-ptr deref7.5CNA v3.10.4%2025-10-01Fix
CVE-2025-59147Suricata is vulnerable to Detection Bypass via Crafted multiple SYN Packets7.5CNA v3.10.4%2025-10-01Fix
CVE-2025-58769auth0 laravel-auth0 auth0-PHP: Improper File Type Handling in Bulk User Import3.3CNA v3.10.4%2025-10-01Fix
CVE-2025-58055Discourse AI Suggestions Contain insecure direct object reference4.3CNA v3.10.3%2025-10-01Fix
CVE-2025-58054Discourse is vulnerable to XSS when quoting chat messages3.5CNA v3.10.2%2025-10-01Fix
CVE-2025-57444Radware AlteonOS Web UI Management Description parameter cross-site scripting6.1CISA ADP v3.10.2%2025-10-01
CVE-2025-57393Kissflow Work Platform stored cross-site scripting8.8CISA ADP v3.10.3%2025-10-01
CVE-2025-57389OpenWrt LuCI system packages page reflected cross-site scripting5.4CISA ADP v3.10.2%2025-10-01
CVE-2025-57275SPDK is vulnerable to buffer overflow in the NVMe-oF target component5.5CISA ADP v3.10.3%2025-10-01Fix
CVE-2025-56588Dolibarr vulnerable to RCE via the computed field parameter8.8CISA ADP v3.10.5%2025-10-01Fix
CVE-2025-56515Fiora chat group avatar is vulnerable to XSS via SVG files8.8CISA ADP v3.10.5%2025-10-01Exploit code
CVE-2025-56514Fiora chat user avatar is vulnerable to XSS via SVG files5.4v3.10.3%2025-10-01Exploit code
CVE-2025-54811OpenPLC_V3 enipThread function denial of service6.1CNA v4.00.2%2025-10-01Fix
CVE-2025-52042frappe erpnext SQL injection8.2CISA ADP v3.10.3%2025-10-01
CVE-2025-52041frappe erpnext SQL injection8.2CISA ADP v3.10.3%2025-10-01
CVE-2025-52040frappe erpnext SQL injection8.2CISA ADP v3.10.3%2025-10-01
CVE-2025-52039frappe erpnext SQL injection8.2CISA ADP v3.10.3%2025-10-01
CVE-2025-46205podofo PdfTokenizer::ReadDictionary function use-after-free8.1v3.10.4%2025-10-01
CVE-2025-43718Freedesktop Poppler uncontrolled recursion2.9CNA v3.10.1%2025-10-01Fix
CVE-2025-41421Privilege escalation via Symbolic Link spoofing in TeamViewer Client4.7CNA v3.10.1%2025-10-01Fix
CVE-2025-40648Stored cross-site scripting (XSS) vulnerability in Issabel products4.8CNA v4.00.3%2025-10-01Fix
CVE-2025-40647Stored cross-site scripting (XSS) vulnerability in Issabel products5.1CNA v4.00.3%2025-10-01Fix
CVE-2025-39928Linux kernel rtl9300 I2C driver integer underflow7.1CNA v3.10.1%2025-10-01Fix
CVE-2025-39927Linux kernel Ceph client race condition7.8CNA v3.10.1%2025-10-01Fix
CVE-2025-39926Linux kernel generic netlink bind handling vulnerability5.5v3.10.1%2025-10-01Fix
CVE-2025-39925In the Linux kernel, the following vulnerability has been resolved: can: j1939: implement NETDEV_UNREGISTER notification handler syzbot is reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 problem, for j1939 protocol did not have NETDEV_UNREGISTER notification h5.5v3.10.1%2025-10-01Fix
CVE-2025-39924Linux kernel EROFS encoded extent algorithm validation vulnerability7.8CNA v3.10.1%2025-10-01Fix
CVE-2025-39923In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees When we don't have a clock specified in the device tree, we have no way to ensure the BAM is on. This is often the case for remotely-controlled or remotely-power5.5v3.10.2%2025-10-01Fix
CVE-2025-39922Linux kernel ixgbe driver EEE linkmode mapping out-of-bounds read7.1v3.10.1%2025-10-01Fix
CVE-2025-39921Linux kernel Microchip Core QSPI driver divide by zero5.5NVD v3.10.1%2025-10-01Fix
CVE-2025-39920Linux kernel PCMCIA memory validation null pointer dereference5.5v3.10.2%2025-10-01Fix
CVE-2025-39919Linux kernel mt76 mt7996 Wi-Fi driver receive path vulnerability8.8CNA v3.10.2%2025-10-01Fix
CVE-2025-39918Linux kernel mt76 Wi-Fi driver wcid list handling vulnerability8.8CNA v3.10.2%2025-10-01Fix
CVE-2025-39917Linux kernel BPF crypto dynptr handling out-of-bounds write7.8v3.10.2%2025-10-01Fix
CVE-2025-39916Linux kernel DAMON RECLAIM module divide by zero5.5v3.10.1%2025-10-01Fix
CVE-2025-39915Linux kernel PHY inband configuration locking vulnerability5.5v3.10.1%2025-10-01Fix
CVE-2025-39914Linux kernel ftrace PID filter write handler double free5.5v3.10.2%2025-10-01Fix
CVE-2025-39913Linux kernel TCP BPF socket message cork allocation vulnerability7.8v3.10.2%2025-10-01Fix
CVE-2025-39912Linux kernel NFS localio credential handling vulnerability5.5v3.10.1%2025-10-01Fix
CVE-2025-39911Linux kernel i40e driver IRQ request error path vulnerability7.8v3.10.2%2025-10-01Fix
CVE-2025-39910Linux kernel KASAN vmalloc shadow population deadlock5.5NVD v3.10.1%2025-10-01Fix
CVE-2025-39909Linux kernel DAMON LRU_SORT module divide by zero5.5v3.10.1%2025-10-01Fix
CVE-2025-39908In the Linux kernel, the following vulnerability has been resolved: net: dev_ioctl: take ops lock in hwtstamp lower paths ndo hwtstamp callbacks are expected to run under the per-device ops lock. Make the lower get/set paths consistent with the rest of ndo invocations. Kernel log: WARNING: CPU: 17.8CNA v3.10.1%2025-10-01Fix
CVE-2025-39907Linux kernel STM32 FMC2 NAND controller ECC buffer vulnerability5.5v3.10.2%2025-10-01Fix
CVE-2025-39906Linux kernel AMD display driver OEM I2C adapter null pointer dereference7.8CNA v3.10.1%2025-10-01Fix
CVE-2025-39905Linux kernel phylink PHY device locking race condition7.0v3.10.1%2025-10-01Fix
CVE-2025-39904Linux kernel arm64 kexec buffer initialization vulnerability5.5v3.10.1%2025-10-01Fix
CVE-2025-39903Linux kernel NUMA memory node initialization null pointer dereference5.5v3.10.1%2025-10-01Fix
CVE-2025-39902Linux kernel slub allocator null pointer dereference7.1CNA v3.10.2%2025-10-01Fix
CVE-2025-39901Linux kernel i40e driver debugfs interface out-of-bounds read7.1v3.10.2%2025-10-01Fix
CVE-2025-39900In the Linux kernel, the following vulnerability has been resolved: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y syzbot reported a WARNING in est_timer() [1] Problem here is that with CONFIG_PREEMPT_RT=y, timer callbacks can be preempted. Adopt preempt_disable_nested()/preemp5.5v3.10.1%2025-10-01Fix
CVE-2025-39899Linux kernel userfaultfd page move vulnerability5.5v3.10.1%2025-10-01Fix
CVE-2025-39897Linux kernel axienet crash7.5CNA v3.10.3%2025-10-01Fix
CVE-2025-39896Linux kernel ivpu accelerator driver use-after-free7.8CNA v3.10.1%2025-10-01Fix
CVE-2025-39895Linux kernel NUMA CPU scheduler null pointer dereference5.5v3.10.1%2025-10-01Fix
CVE-2025-39894Linux kernel bridge netfilter conntrack vulnerability7.5CNA v3.10.3%2025-10-01Fix
CVE-2025-39893Linux kernel SPI QPIC SNAND driver memory leak5.5v3.10.1%2025-10-01Fix
CVE-2025-39892Linux kernel ASoC sound core null pointer dereference5.5v3.10.1%2025-10-01Fix
CVE-2025-39891Linux kernel mwifiex Wi-Fi driver information disclosure7.1v3.10.2%2025-10-01Fix
CVE-2025-34182Deciso OPNsense /interfaces_ppps_edit.php ptpid stored XSS5.1CNA v4.00.3%2025-10-01Fix
CVE-2025-28357Neto CMS v6.313.0 A CRLF injection8.8CISA ADP v3.10.4%2025-10-01
CVE-2025-23355NVIDIA NSIGHT Graphics uncontrolled search path6.7CNA v3.10.2%2025-10-01Fix
CVE-2025-23297NVIDIA App incorrect default permissions7.8CNA v3.10.1%2025-10-01Fix
CVE-2025-20371Unauthenticated blind server side request forgery (SSRF) in Splunk Enterprise7.5CNA v3.10.5%2025-10-01Fix
CVE-2025-20370Denial of service (DoS) through multiple LDAP Bind requests in Splunk Enterprise4.9CNA v3.10.6%2025-10-01Fix
CVE-2025-20369Splunk Enterprise dashboard label field XML external entity injection4.6CNA v3.10.3%2025-10-01Fix
CVE-2025-20368Splunk Enterprise saved search job inspector stored cross-site scripting5.7CNA v3.10.4%2025-10-01Fix
CVE-2025-20367Splunk Enterprise search table endpoint reflected cross-site scripting5.7CNA v3.10.4%2025-10-01Fix
CVE-2025-20366Improper access control in Background Job Submission in Splunk Enterprise6.5CNA v3.10.4%2025-10-01Fix
CVE-2025-20361Cisco Unified Communications Manager stored cross-site scripting4.8CNA v3.10.2%2025-10-01Fix
CVE-2025-20357Cisco CyberVision Center Reports stored cross-site scripting5.4CNA v3.10.2%2025-10-01Fix
CVE-2025-20356Cisco CyberVision Center Sensor Explorer stored cross-site scripting5.4CNA v3.10.2%2025-10-01Fix
CVE-2025-11233Rust standard library didn't detect all path separators on Cygwin6.3CNA v4.00.5%2025-10-01Fix
CVE-2025-11226QOS.CH Logback-core is vulnerable to arbitrary code execution through file processing7.0CNA v4.00.2%2025-10-01Fix
CVE-2025-10847Broadcom Unified Infrastructure Management DX UIM Probe Improper ACL Handling RCE8.4CNA v4.00.5%2025-10-01Fix
CVE-2025-10744File Manager, Code editor, backup by Managefy WordPress plugin unauthenticated information exposure5.9CNA v3.10.4%2025-10-01Fix
CVE-2025-10735Block For Mailchimp WordPress plugin server-side request forgery4.0CNA v3.10.3%2025-10-01Fix
CVE-2025-10578HP Support Assistant potential escalation of privilege5.8CNA v4.00.1%2025-10-01Fix
CVE-2025-10538Authentication bypass in LG Innotek Camera8.8CNA v4.00.5%2025-10-01
CVE-2025-9512Schema and Structured Data for WP and AMP WordPress plugin unauthenticated Stored-XSS6.1CISA ADP v3.10.3%2025-10-01Fix
CVE-2025-9075ZoloBlocks WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-10-01Fix
CVE-2025-8679ExtremeGuest Essentials Captive Portal Unauthenticated brute force7.6CNA v4.00.3%2025-10-01Fix