CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- debian linux, linux kernel, siemens simatic cn 4100 +5 more +7 morex86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper5.5 Medium
- linux, linux kernel +1 morei2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer7.8 High
- linux, linux kernel +1 moredrm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().5.5 Medium
- linux, linux kernel +1 moreplatform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL5.5 Medium
- linux, linux kernel +1 morenet/sched: Fix backlog accounting in qdisc_dequeue_internal7.8 High
- debian linux, linux kernel, siemens simatic cn 4100 +2 morescsi: qla4xxx: Prevent a potential error pointer dereference5.5 Medium
- debian linux, linux kernel, siemens simatic cn 4100 +2 moredrm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()5.5 Medium
- linux, linux kernel +1 morescsi: ufs: ufs-qcom: Fix ESI null pointer dereference5.5 Medium
- debian linux, linux kernel, siemens simatic cn 4100 +2 moreppp: fix race conditions in ppp_fill_forward_path9.8 Critical
- linux, linux kernel +1 morecifs: Fix oops due to uninitialised variable9.8 Critical
- debian linux, linux kernel, siemens simatic cn 4100 +5 more +7 morenet: usb: asix_devices: Fix PHY address mask in MDIO bus initialization7.1 High
- debian linux, linux kernel, siemens simatic cn 4100 +2 moregve: prevent ethtool ops after shutdown7.8 High
- linux, linux kernel +1 morenet/smc: fix UAF on smcsk after smc_listen_out()9.8 Critical
- linux, linux kernel +1 mores390/mm: Do not map lowcore with identity mapping7.8 High
- debian linux, linux kernel, siemens simatic cn 4100 +5 more +7 morenetfilter: nf_reject: don't leak dst refcount for loopback packets5.5 Medium
- linux, linux kernel +1 moredrm/xe: Fix vm_bind_ioctl double free bug7.8 High
- nordic semiconductor nrf52810NRF52810 Runtime EM Fault Injection APPROTECT Bypass8.6 High
- arcinfo pcvueImproper validation of payload elements7.6 High
- arcinfo pcvueImproper validation of packets sequencing6.0 Medium
- fullworks quick paypal paymentsWordPress Quick Paypal Payments Plugin <= 5.7.46 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- villatheme happyWordPress HAPPY plugin <= 1.0.6 - Broken Access Control vulnerability6.5 Medium
- thememove maxcoachWordPress MaxCoach Theme <= 3.2.5 - Local File Inclusion Vulnerability8.1 High
- gavias indutriWordPress Indutri Theme < 1.3.0 - Local File Inclusion Vulnerability8.1 High
- kamleshyadav miraculousWordPress Miraculous Theme < 2.0.9 - SQL Injection Vulnerability9.3 Critical
- gourl bitcoin payment gateway & paid downloads & membershipWordPress GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- ericzane floating window music playerWordPress Floating Window Music Player plugin <= 3.4.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- mulscully today's date inserterWordPress Today's Date Inserter plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- stefan keller woocommerce payment gateway for saferpayWordPress WooCommerce Payment Gateway for Saferpay Plugin <= 0.4.9 - Path Traversal Vulnerability7.5 High
- vincent boiardt easy flash embedWordPress Easy Flash Embed plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- beaver builder wordpress assistantWordPress Assistant Plugin <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability7.1 High
- axiomthemes smart seoWordPress smart SEO Plugin <= 4.0 - Privilege Escalation Vulnerability9.8 Critical
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.6.15 - Broken Access Control vulnerability6.5 Medium
- realmag777 inpost galleryWordPress InPost Gallery Plugin <= 2.1.4.5 - Local File Inclusion Vulnerability7.5 High
- google androidIn System UI, there is a possible way to view other users' images due to a confused deputy. This...7.8 High
- google androidIn Skia, there is a possible out of bounds write due to a heap buffer overflow. This could lead...8.8 High
- google androidIn App Widget, there is a possible Information Disclosure due to a confused deputy. This could...5.5 Medium
- google androidIn gralloc4, there is a possible out of bounds write due to a missing bounds check. This could...5.5 Medium
- google androidIn Permission Manager, there is a possible way for the microphone privacy indicator to remain...3.3 Low
- google androidIn libxml2, there is a possible out of bounds read due to a buffer overflow. This could lead to...5.5 Medium
- google androidIn Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due...5.5 Medium
- portabilis i-educarPortabilis i-Educar exportacao-para-o-seb access control5.3 Medium
- portabilis i-educarPortabilis i-Educar educar_historico_escolar_lst.php sql injection5.3 Medium
- portabilis i-educarPortabilis i-Educar edit sql injection5.3 Medium
- course finder | andré martin - it solutions & research ug booking platformWordPress Course Booking Platform Plugin <= 1.0.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- tan nguyen instant locationsWordPress Instant Locations Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- ivan drago vipdrvWordPress vipdrv Plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- thomas harris search cloud oneWordPress Search Cloud One Plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- w1zzard simple text sliderWordPress Simple Text Slider Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- gopiplus new simple galleryWordPress New Simple Gallery Plugin <= 8.0 - SQL Injection Vulnerability8.5 High
- reubenthiessen translate this gtranslate shortcodeWordPress Translate This gTranslate Shortcode Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- Show moreLoading…