CVEs published in October 2023
2,902 vulnerabilities, 370 critical, 18 exploited.
- seedprod website builder by seedprod, website builder by seedprod — theme builder, landing page builder, coming soon page, maintenance mode +1 moreWebsite Builder by SeedProd <= 6.15.13.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- pluginus bear - woocommerce bulk editor and products manager professional, realmag777 bear – bulk editor and products manager professional for woocommerce by pluginus.net +1 moreBEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation4.3 Medium
- yan&co woocommerce ean payment gatewayWooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update4.3 Medium
- pluginus bear - woocommerce bulk editor and products manager professional, realmag777 bear – bulk editor and products manager professional for woocommerce by pluginus.net +1 moreBEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation4.3 Medium
- wpdeveloper essential blocks, essential blocks pro, wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patterns +2 moreEssential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products8.1 High
- secondlinethemes podcast subscribe buttonsPodcast Subscribe Buttons <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- michaeluno auto amazon links, miunosoft auto amazon links – amazon associates affiliate plugin +1 moreAuto Amazon Links <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via style6.4 Medium
- cleantalk login security, firewall, malware removal by cleantalk, security \& malware scan +1 moreSecurity & Malware scan by CleanTalk <= 2.50 - Missing Authorization8.8 High
- veronalabs slimstat analyticsSlimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode8.8 High
- sitekit project sitekitSitekit <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sitekit_iframe' shortcode6.4 Medium
- apache http server, debian linux, fedoraproject fedora +2 moreApache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST5.9 Medium
- alexmoss whatsapp share buttonWhatsApp Share Button <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- themepoints super testimonials, super testimonial – testimonial & customer review slider plugin for wordpress +1 moreSuper Testimonials <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- plugin-planet theme switcha, specialk theme switcha – easily switch themes for development and testing +1 moreTheme Switcha <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- vmware aria operations for logsVMware Aria Operations for Logs contains an authentication bypass vulnerability. An...9.8 Critical
- vmware aria operations for logsVMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with...7.8 High
webkit2gtkDebianwebkit2gtk - regression updateNo score- nagvisXSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php.6.1 Medium
- qad search serverThe QAD Search Server is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to, and...5.4 Medium
- small crm project crmStored Cross-Site Scripting (XSS) vulnerability in the Company field in the "Request a Quote"...5.4 Medium
- cmsmadesimple cms made simpleCross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute...5.4 Medium
- cmsmadesimple cms made simpleCross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute...5.4 Medium
- cmsmadesimple cms made simpleCross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute...5.4 Medium
- cmsmadesimple cms made simpleCross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute...5.4 Medium
- cmsmadesimple cms made simpleCross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute...5.4 Medium
- opensolution quick cmsCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker...5.4 Medium
- secudos qiataSECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To...7.8 High
- sollace unicopiaSollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing...7.5 High
- superwebmailerAn issue was discovered in SuperWebMailer 9.00.0.01710. It allows spamtest_external.php XSS via a...6.1 Medium
- sitolog application connectSitolog sitologapplicationconnect v7.8.a and before was discovered to contain a SQL injection...9.8 Critical
- langchainLangchain Server-Side Request Forgery vulnerability7.5 High
- tauriUpdater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli8.4 High
- home-assistant core, home-assistant +1 moreAccount takeover via auth_callback login in Home Assistant Core4.3 Medium
- home-assistant core, home-assistant +1 moreLocal-only webhooks externally accessible via SniTun in Home Assistant Core5.3 Medium
- home-assistant core, home-assistant +1 moreCross-site Scripting via auth_callback login in Home Assistant Core8.8 High
- home-assistant core, home-assistant, home-assistant home-assistant-js-websocket +2 moreFake websocket server installation permits full takeover in Home Assistant Core7.1 High
- home-assistant core, home-assistant +1 moreLack of XFO header allows clickjacking in Home Assistant Core8.8 High
- home-assistant core, home-assistant +1 morePartial Server-Side Request Forgery in Home Assistant Core6.6 Medium
- home-assistant home assistant companion, core +1 moreArbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android8.6 High
- home-assistant home assistant companion, core +1 moreClient-Side Request Forgery in Home Assistant iOS/macOS native Apps8.6 High
- weintek cmt-fhd, cmt-fhd firmware, cmt-hdm +11 more +13 moreWeintek cMT3000 HMI Web CGI Stack-based Buffer Overflow9.8 Critical
- weintek cmt-fhd, cmt-fhd firmware, cmt-hdm +11 more +13 moreWeintek cMT3000 HMI Web CGI OS Command Injection8.8 High
- weintek cmt-fhd, cmt-fhd firmware, cmt-hdm +11 more +13 moreWeintek cMT3000 HMI Web CGI Stack-based Buffer Overflow9.8 Critical
- directusDirectus crashes on invalid WebSocket message5.9 Medium
- leantimeAuthenticated SQL Injection in leantime6.5 Medium
- dexma dexgateExposure of Sensitive Information to an Unauthorized Actor in DEXMA DEXGate5.3 Medium
- dexma dexgateCross-Site Request Forgery in DEXMA DEXGate5.5 Medium
- dexma dexgateImproper Authentication in DEXMA DEXGate8.0 High
- dexma dexgateCleartext Transmission of Sensitive Information in DEXMA DEXGate6.3 Medium
- dexma dexgateCross-site Scripting in DEXMA DEXGate5.4 Medium
- Show moreLoading…