CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- samsung mobile goodlock, samsung good lock +1 moreImproper export of component in GoodLock prior to version 2.2.04.95 allows local attackers to...7.7 High
- samsung mobile devicesImproper access control vulnerability in retrieveExternalProxy in MiscPolicy prior to SMR Nov...4.3 Medium
- alobaidi popadPopAd <= 1.0.4 - Cross-Site Request Forgery to Settings Update5.3 Medium
- celonis make connectorMake Connector <= 1.5.10 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
- akinsoft taskpanoOTP Bypass in Akinsoft's TaskPano8.6 High
- akinsoft taskpanoXSS in Akinsoft's TaskPano4.7 Medium
- langchain-ai langchain-ai/langchainSensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchain7.5 High
- akinsoft e-mutabakatOTP Bypass in Akinsoft's e-Mutabakat8.6 High
- akinsoft e-mutabakatXSS in Akinsoft's e-Mutabakat4.3 Medium
- vaadin, vaadin vaadin-upload-flow, flarum framework +2 morePossibility to bypass file upload validation on the server-side5.3 Medium
- kleor easy timerEasy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode7.2 High
- docjojo atec debugatec Debug <= 1.2.22 - Authenticated (Administrator+) Remote Code Execution7.2 High
- docjojo atec debugatec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Read4.9 Medium
- docjojo atec debugatec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Deletion7.2 High
- liferay dxp, portal +1 moreLiferay Portal Vulnerable to Denial of Service in Kaleo Forms Admin7.1 High
- codeastro real estate management systemCodeAstro Real Estate Management System submitproperty.php unrestricted upload5.3 Medium
- codeastro real estate management systemCodeAstro Real Estate Management System register.php unrestricted upload5.3 Medium
- 5ire5ire Chat Message XSS Vulnerability Enables Remote Code Execution9.7 Critical
- codeastro real estate management systemCodeAstro Real Estate Management System feature.php cross site scripting5.1 Medium
- codeastro real estate management systemCodeAstro Real Estate Management System propertyview.php cross site scripting5.1 Medium
- phpgurukul online shopping portalPHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) in /admin...5.4 Medium
- phpversion vx guestbookAn authenticated SQL injection vulnerability in VX Guestbook 1.07 allows attackers with admin...7.2 High
- d-link di-8400, dlink di-8400 firmware +1 moreD-Link DI-8400 yyxz.asp yyxz_dlink_asp stack-based overflow8.7 High
- elunez eladminelunez eladmin LocalStorageController deleteFile improper authorization5.3 Medium
- fuyang lipengjun platformfuyang_lipengjun platform queryAll AdController improper authorization5.3 Medium
- totolink n600r, n600r firmware +1 moreTOTOLINK N600R cstecgi.cgi sub_4159F8 command injection6.9 Medium
- totolink x5000r, x5000r firmware +1 moreTOTOLINK X5000R cstecgi.cgi sub_410C34 command injection5.3 Medium
- phpgurukul beauty parlour management systemPHPGurukul Beauty Parlour Management System view-appointment.php sql injection6.9 Medium
- seperman deepdiffDeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollution10.0 Critical
- phpgurukul beauty parlour management systemPHPGurukul Beauty Parlour Management System update-image.php sql injection6.9 Medium
- jinher oaJinher OA POST Request login!changePassWord.action cross site scripting5.3 Medium
- 1000projects beauty parlour management system1000projects Beauty Parlour Management System contact-us.php sql injection6.9 Medium
- code-projects responsive blog sitecode-projects Responsive Blog Site blogs_view.php cross site scripting4.8 Medium
- honoHono contains a flaw in URL path parsing, potentially leading to path confusion7.5 High
- zcashfoundation frostfrost-core: refresh shares with smaller min_signers will reduce group security6.0 Medium
- electronElectron is vulnerable to Code Injection via resource modification6.1 Medium
- projectworlds travel management systemprojectworlds Travel Management System viewcategory.php sql injection6.9 Medium
- projectworlds travel management systemprojectworlds Travel Management System viewpackage.php sql injection6.9 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAi Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion6.5 Medium
- sitecore experience manager (xm), experience platform (xp), experience manager +4 more +6 moreSitecore Products ViewState Deserialization Vulnerability9.0 Critical
- projectworlds travel management systemprojectworlds Travel Management System viewsubcategory.php sql injection6.9 Medium
- envoyproxy envoyEnvoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag6.3 Medium
- fuji electric frenic-loader 4Fuji Electric FRENIC-Loader 4 Deserialization of Untrusted Data8.4 High
- projectworlds travel management systemprojectworlds Travel Management System detail.php sql injection6.9 Medium
- ibm transformation advisorIBM Transformation Advisor incorrect permissions8.4 High
- projectworlds travel management systemprojectworlds Travel Management System enquiry.php sql injection6.9 Medium
- campcodes sales and inventory systemCampcodes Sales and Inventory System index.php cross site scripting5.3 Medium
@anthropic-ai/claude-codenpmClaude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning8.7 High- ckeditor ckeditor5CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package2.3 Low
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform's configuration files can be accessed through jsx and sx endpoints9.3 Critical
- Show moreLoading…