CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- huawei harmonyosOut-of-bounds read vulnerability in the runtime interpreter module. Impact: Successful...8.4 High
- huawei harmonyosVulnerability of exposing object heap addresses in the Ark eTS module. Impact: Successful...8.4 High
- huawei emui, harmonyos +1 morePermission verification vulnerability in the home screen module Impact: Successful exploitation...6.8 Medium
- eaton nmc g2An attacker with authenticated and privileged access could modify the contents of a non-sensitive...4.7 Medium
- oceanwpOceanWP < 4.1.2 - Subscriber+ Limited Option Update4.3 Medium
- ratoc systems, inc. raid monitoring manager for windowsRATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows...8.4 High
- ly corporation "yahoo! shopping" app for androidImproper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for...5.3 Medium
- kujirahand tkeasyguiTkEasyGUI Affected by Uncontrolled Search Path Element Issue8.5 High
- kujirahand tkeasyguiTkEasyGUI Vulnerable to OS Command Injection9.3 Critical
- pierre-adrien vasseur obsidian github copilot pluginObsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form....5.1 Medium
- ux-themes flatsomeFlatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- kubernetes secrets-store-sync-controllerKubernetes secrets-store-sync-controller discloses service account tokens in logs6.5 Medium
- smackcoders wordpress helpdesk integrationWordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusion8.1 High
- sciencelogic sl1index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request.7.2 High
- google chromeInappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a...4.3 Medium
- google chromeInappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a...4.3 Medium
- google chromeInappropriate implementation in Passkeys in Google Chrome prior to 140.0.7339.80 allowed a local...6.2 Medium
- google chromeInsufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a...5.3 Medium
- google chromeInsufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80...8.8 High
- google chromeInappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a...5.4 Medium
- freepbx apiapi: Shared OAuth Signing Key Between Different Instances5.1 Medium
- microsoft entra id, entra +1 moreAzure Entra ID Elevation of Privilege Vulnerability10.0 Critical
- microsoft dynamics 365 fasttrack implementation, dynamics 365 +1 moreDynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability7.5 High
- microsoft xbox gaming servicesXbox Certification Bug Copilot Djando Information Disclosure Vulnerability6.5 Medium
- microsoft azure networking, networking +1 moreAzure Networking Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure bot service, azure ai bot service +1 moreAzure Bot Service Elevation of Privilege Vulnerability9.0 Critical
- freepbx contactmanagerFreePBX UCP is Vulnerable to Stored XSS Through its User Control Panel5.1 Medium
- go standard library net/httpCrossOriginProtection insecure bypass patterns not limited to exact matches in net/http5.4 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 8.6 advanced mission critical update support +19 more +21 morePodman: podman kube play command may overwrite host files8.1 High
- prestashopPresta Shop vulnerable to email enumeration3.7 Low
- argoproj argo cd, argo-cd +1 moreArgo CD: Project API Token Exposes Repository Credentials10.0 Critical
- marcelotessaro promptcraft-forge-studioPromptcraft Forge Studio's incomplete URL check is vulnerable to XSS via SVG9.3 Critical
- google androidIn onCreate of MediaProjectionPermissionActivity.java , there is a possible way to grant a...7.8 High
- marcelotessaro promptcraft-forge-studioPromptcraft Forge Studio: Complete Sanitizer Bypass Enables XSS via Overlapping Patterns8.2 High
- google androidIn getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a...7.8 High
- google androidIn setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an...7.8 High
- google androidIn initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic...3.3 Low
- google androidIn setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an...6.2 Medium
- withastro astro, astro \@astrojs\/cloudflare +1 moreAstro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint7.2 High
- google androidIn android_app of Android.bp, there is a possible way to launch any activity as a system user....4.0 Medium
- google androidIn FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP...7.8 High
- google androidIn apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches...4.0 Medium
usd-corePyPIPixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution9.4 Critical- google androidIn VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates...8.4 High
- google androidIn multiple locations, there is a possible way to access data displayed on the screen due to side...5.5 Medium
- google androidIn multiple locations, there is a possible way to read files belonging to other apps due to SQL...7.8 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 moreCross-Origin Opener Policy Vulnerability in pgAdmin 47.9 High
com.vaadin:vaadinMavenVaadin Platform possible file bypass via upload validation on the server-side5.3 Mediumcom.vaadin:vaadin-upload-flowMavenVaadin Flow Components possible file bypass via upload validation on the server-side5.3 Medium- nvidia connectx ga, connectx lts22, connectx lts23 +3 more +5 moreNVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with...6.3 Medium
- Show moreLoading…