CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- roland murg wp simple booking calendarWordPress WP Simple Booking Calendar plugin <= 2.0.13 - Broken Access Control vulnerability6.5 Medium
- goodbarberWordPress GoodBarber plugin <= 1.0.26 - Open Redirection Vulnerability4.7 Medium
- andy moyle church adminWordPress Church Admin plugin <= 5.0.9 - Sensitive Data Exposure vulnerability4.3 Medium
- wp swings woocommerce ultimate gift cardWordPress WooCommerce Ultimate Gift Card plugin <= 2.9.6 - SQL Injection vulnerability9.3 Critical
- litespeed technologies cache, litespeedtech litespeed cache +1 moreWordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- highwarden super store finderWordPress Super Store Finder plugin < 7.8 - Local File Inclusion vulnerability7.5 High
- villatheme woocommerce photo reviewsWordPress WooCommerce Photo Reviews plugin <= 1.3.13 - Cross Site Scripting (XSS) vulnerability7.1 High
- themegoods photographyWordPress Photography Theme <= 7.7.2 - PHP Object Injection Vulnerability9.0 Critical
- solwin blog designer proWordPress Blog Designer PRO plugin <= 3.4.7 - Authenticated Non-Arbitrary Local File Inclusion vulnerability7.5 High
- solwin blog designer proWordPress Blog Designer PRO plugin <= 3.4.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- majestic support supportWordPress Majestic Support plugin <= 1.1.0 - Broken Access Control vulnerability5.3 Medium
- frenify categorifyWordPress Categorify plugin <= 1.0.7.5 - Broken Access Control vulnerability4.3 Medium
- presstigers zip code based content protectionWordPress ZIP Code Based Content Protection plugin <= 1.0.0 - SQL Injection vulnerability7.6 High
- ivanti connect secure, neurons for secure access, policy secure +2 more +4 moreMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure...5.4 Medium
- ivanti connect secure, neurons for secure access, policy secure +2 more +4 moreReflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure...6.1 Medium
- ivanti connect secure, neurons for secure access, policy secure +2 more +4 moreMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure...8.8 High
- ivanti connect secure, neurons for secure access, policy secure +2 more +4 moreMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure...8.8 High
- ivanti connect secure, neurons for secure access, policy secure +2 more +4 moreSSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6,...6.8 Medium
- ivanti connect secure, neurons for secure access, policy secure +2 more +4 moreMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure...7.6 High
- ivanti connect secure, neurons for secure access, policy secure +2 more +4 moreCSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6,...8.8 High
- ivanti connect secure, neurons for secure access, policy secure +2 more +4 moreAn unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy...4.9 Medium
- ivanti connect secure, neurons for secure access, policy secure +3 more +5 moreMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure...8.9 High
- ivanti connect secure, neurons for secure, neurons for secure access +3 more +5 moreCSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6,...5.4 Medium
- ivanti connect secure before, connect secure, neurons for secure access +3 more +5 moreMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure...5.4 Medium
- 9001 copypartycopyparty: Sharing a single file does not fully restrict access to other files in source folder5.3 Medium
- ivanti endpoint managerInsufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 Security Update 1 and...8.8 High
- ivanti endpoint managerInsufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 Security Update 1 and...8.8 High
- teccom tecconnectXML External Entity Injection in TecConnect 4.19.1 Critical
- duckdb duckdb-nodeDuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware8.6 High
- trendnet tew-831drTRENDnet TEW-831DR formSysCmd command injection5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP vulnerable to store Cross-site Scripting4.6 Medium
- ami aptiov, aptio v +1 moreLegacy Serial Redirection SMRAM Vulnerabilities8.2 High
- crestron touchscreen x60s, touchscreen x70 +1 moreConsoleFindCommandMatchList5.9 Medium
- fortinet fortiwebA Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7...4.7 Medium
- fortinet fortiddos-fAn improper neutralization of special elements used in an OS command ('OS Command Injection')...6.5 Medium
- adobe commerce, commerce and magento, commerce b2b +1 more +3 moreAdobe Commerce | Improper Input Validation (CWE-20)9.1 Critical
- amped rf bt-ap 111Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not require authentication9.8 Critical
regionServiceClientConfigGCEopenSUSESecurity update for regionServiceClientConfigGCENo scoreregionServiceClientConfigEC2openSUSESecurity update for regionServiceClientConfigEC2No scoreregionServiceClientConfigAzureopenSUSESecurity update for regionServiceClientConfigAzureNo score- rockwell automation factorytalk optixRockwell Automation FactoryTalk Optix Remote Code Execution Vulnerability7.3 High
- rockwell automation stratix iosRockwell Automation Stratix® IOS Cross-Site Request Forgery to Code Execution Vulnerability8.6 High
- rockwell automation thinmanagerRockwell Automation ThinManager® Server-Side Request Forgery Vulnerability8.6 High
- rockwell automation factorytalk activation managerRockwell Automation FactoryTalk Activation Manager Lack of Encryption Vulnerability8.7 High
- rockwell automation factorytalk® analytics™ logixai®, rockwellautomation factorytalk analytics logixai +1 moreRockwell Automation FactoryTalk® Analytics™ LogixAI® Exposed Redis DB8.7 High
- rockwell automation controllogix® 5580, rockwellautomation controllogix 5580 firmware +1 moreRockwell Automation ControlLogix® 5580 V35.013 Denial-Of-Service8.2 High
- rockwell automation compactlogix® 5480Rockwell Automation CompactLogix® 5480 Code Execution Vulnerability7.0 High
- rockwell automation 1756-ent2r, 1756-en4tr, 1756-en4trxt, rockwellautomation 1756-en2tr series a firmware, 1756-en2tr series b firmware +3 more +5 moreRockwell Automation 1756-ENT2R, EN4TR, EN4TRXT Vulnerability7.1 High
- rockwell automation 1756-ent2r, 1756-en4tr, 1756-en4trxt, rockwellautomation 1756-en2tr series a firmware, 1756-en2tr series b firmware +3 more +5 moreRockwell Automation 1756-ENT2R, EN4TR, EN4TRXT Vulnerability7.1 High
google-apis-commoncrates.ioThe `google-apis-rs` project is now unmaintainedNo score- Show moreLoading…