CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
kernelTuxCare,kernel-abi-stablelistsTuxCare,kernel-coreTuxCare +54 more +56 moreUpdate of kernelNo score- facebook-kimmymatillano point of sale system, itsourcecode pos point of sale system +1 moreitsourcecode POS Point of Sale System complex_header_2.php cross site scripting5.1 Medium
- tp-link systems inc. ax10 v1/v1.2/v2/v2.6/v3/v3.6, ax1500 v1/v1.20/v1.26/v1.60/v1.80/v2.60/v3.6 +1 moreAuthenticated RCE by CWMP binary8.6 High
- elextensions elex woocommerce google shopping (google product feed)ELEX WooCommerce Google Shopping (Google Product Feed) <= 1.4.3 - Authenticated (Admin+) SQL Inejction4.9 Medium
- facebook-kimmymatillano point of sale system, itsourcecode pos point of sale system +1 moreitsourcecode POS Point of Sale System 6776.php cross site scripting5.1 Medium
- themejunkie recent posts widget extendedRecent Posts Widget Extended <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via rpwe Shortcode6.4 Medium
- sonalsinha21 skt addons for elementorSKT Addons for Elementor <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- smub athemes addons for elementoraThemes Addons for Elementor Lite <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget6.4 Medium
- janis elsts admin menu editorAdmin Menu Editor <= 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder Parameter6.4 Medium
- cloudinfrastructureservices cloud saml sso – single sign on loginCloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Identity Provider Deletion via delete_config Action6.5 Medium
- cloudinfrastructureservices cloud saml sso – single sign on loginCloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings Action8.2 High
- streamweasels kick integrationStreamWeasels Kick Integration <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via vodsChannel Parameter6.4 Medium
- designful smart table builderSmart Table Builder <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter6.4 Medium
- pt-guy content views – post grid & filter, recent posts, category posts … (shortcode, gutenberg blocks, and widgets for elementor)Content Views <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Grid and List Widgets6.4 Medium
- stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wpUsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- optio dentistryOptio Dentistry <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- scriptsbundle adforestAdForest <= 6.0.9 - Authentication Bypass to Admin9.8 Critical
- mondula2016 multi step formMulti Step Form <= 1.7.25 - Authenticated (Admin+) Arbitrary File Upload7.2 High
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection4.9 Medium
- choijun la-studio element kit for elementor, la-studio element kit for elementor +1 moreLA-Studio Element Kit for Elementor <= 1.5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- roocode roo code, roocodeinc roo-code +1 moreRoo Code: Auto-approve allows npm install execution of malicious postinstall scripts7.8 High
- sjaved easy social feed – social photos gallery and post feed for wordpressEasy Social Feed – Social Photos Gallery – Post Feed – Like Box <= 6.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting6.4 Medium
- alimuzzamanalim html social share buttonsHtml Social share buttons <= 2.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- sizam rehub - price comparison, multi vendor marketplace wordpress themeRehub <= 19.9.7 - Unauthenticated Password Protected Post Disclosure5.3 Medium
- sizam rehub - price comparison, multi vendor marketplace wordpress themeRehub <= 19.9.7 - Unauthenticated Arbitrary Shortcode Execution via re_filterpost7.3 High
- frappe erpnextERP: Possibility of SQL injection due to missing validation8.1 High
- elated-themes frappeFrappe has potential SQL Injection due to missing validation8.1 High
- frappeFrappe has potential SQL Injection due to missing validation6.5 Medium
wireless-regdbDebianwireless-regdb - security updateNo score- amd instinct™ mi210, instinct™ mi250, radeon™ pro v520 graphics products +11 more +13 moreInsufficient bounds checking in AMD TEE (Trusted Execution Environment) could allow an attacker...7.9 High
- roocode roo code, roocodeinc roo-code +1 moreRoo Code: Symlink-bypass of .rooignore can lead to unintended file disclosure5.5 Medium
- roocode roo code, roocodeinc roo-code +1 moreRoo Code: Potential Remote Code Execution via .code-workspace8.1 High
- roocode roo code, roocodeinc roo-code +1 moreRoo Code is vulnerable to command injection via GitHub actions workflow9.9 Critical
- roocode roo code, roocodeinc roo-code +1 moreRoo Code: Potential Remote Code Execution via Bash Parameter Expansion and Indirect Reference8.1 High
- facebook-kimmymatillano point of sale system, itsourcecode pos point of sale system +1 moreitsourcecode POS Point of Sale System 2512.php cross site scripting5.1 Medium
- inseefrlab onyxiaOnyxia private helm repository credentials are leaked through unauthenticated API9.4 Critical
- runatlantis atlantisAtlantis Exposes Service Version Publicly on /status API Endpoint6.9 Medium
- mlc-ai xgrammarxgrammar vulnerable to denial of service by huge enum grammar6.9 Medium
- jjjake internetarchiveinternetarchive is vulnerable to Directory Traversal through file downloads9.4 Critical
- typelevel fs2fs2: Half-shutdown of socket during TLS handshake may result in spin loop on opposite side5.3 Medium
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreMalformed $group Query May Cause MongoDB Server to Crash6.5 Medium
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreMongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation6.5 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability4.7 Medium
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreMongoDB Server router will crash when incorrect lsid is set on a sharded query6.5 Medium
- coderCoder's privilege escalation vulnerability could lead to a cross workspace compromise8.1 High
- imagemagickImageMagick BlobStream Forward-Seek Under-Allocation3.8 Low
- facebook-kimmymatillano point of sale system, itsourcecode pos point of sale system +1 moreitsourcecode POS Point of Sale System -complex_header.php cross site scripting5.1 Medium
- keycloak, red hat build of keycloak 26.0, build of keycloak 26.0.17 +2 more +4 moreKeycloak: keycloak error_description injection on error pages4.3 Medium
- phpgurukul online course registrationPHPGurukul Online Course Registration semester.php sql injection6.9 Medium
- mikado themes biagiotti coreBiagiotti Core <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- Show moreLoading…