CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- ascensio system sia onlyofficeAscensio System SIA OnlyOffice Comment Messages.aspx cross site scripting5.1 Medium
- ascensio system sia onlyofficeAscensio System SIA OnlyOffice SVG Image Messages.aspx cross site scripting5.1 Medium
- xenArm issues with page refcounting7.5 High
- xenArm issues with page refcounting7.5 High
- neo4j neo4j-cypher mcp serverNeo4j Cypher MCP server is vulnerable to DNS rebinding attacks7.4 High
- opendcimopenDCIM SVG File uploadifive.php cross site scripting5.1 Medium
- opentext content managementCache exploitation vulnerability5.8 Medium
- seat queue ticket kioskSEAT Queue Ticket Kiosk Java RMI Registry deserialization2.3 Low
- foxcmsFoxCMS Images.php batchCope sql injection5.3 Medium
- xenMutiple vulnerabilities in the Viridian interface9.8 Critical
regionServiceClientConfigGCESUSESecurity update for regionServiceClientConfigGCENo scoreregionServiceClientConfigEC2SUSESecurity update for regionServiceClientConfigEC2No scoreregionServiceClientConfigAzureSUSESecurity update for regionServiceClientConfigAzureNo scoreserde_ymlcrates.ioserde_yml crate is unsound and unmaintained6.9 Mediumlibymlcrates.ioLibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained8.7 High- matrix-org matrix-rust-sdkmatrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method2.7 Low
- phpgurukul online fire reporting systemCross Site Scripting in PHPGurukul Online Fire Reporting System5.1 Medium
- phpgurukul online fire reporting systemCross Site Scripting in PHPGurukul Online Fire Reporting System5.1 Medium
- phpgurukul online fire reporting systemCross Site Scripting in PHPGurukul Online Fire Reporting System5.1 Medium
- phpgurukul online fire reporting systemCross Site Scripting in PHPGurukul Online Fire Reporting System5.1 Medium
- dji mavic air, mavic mini, mavic spark +2 moreDJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key2.3 Low
- phpgurukul online fire reporting systemSQL injection in PHPGurukul Online Fire Reporting System9.3 Critical
- phpgurukul online fire reporting systemSQL injection in PHPGurukul Online Fire Reporting System9.3 Critical
- phpgurukul online fire reporting systemSQL injection in PHPGurukul Online Fire Reporting System9.3 Critical
- phpgurukul online fire reporting systemSQL injection in PHPGurukul Online Fire Reporting System9.3 Critical
- phpgurukul online fire reporting systemSQL injection in PHPGurukul Online Fire Reporting System9.3 Critical
- germanpearls time trackerTime Tracker <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Limited Data Deletion8.8 High
- delta electronics dialinkDIALink - Directory Traversal Authentication Bypass Vulnerability7.3 High
- delta electronics dialinkDIALink - Directory Traversal Authentication Bypass Vulnerability10.0 Critical
- erlang otpSSH_FXP_OPENDIR may Lead to Exhaustion of File Handles7.1 High
- erlang otpMalicious Key Exchange Messages may Lead to Excessive Resource Consumption6.9 Medium
- erlang otpUnverified Paths can Cause Excessive Use of System Resources5.3 Medium
- erlang otpUnverified File Handles can Cause Excessive Use of System Resources5.3 Medium
- google cloud secops soarZip Slip in Google SecOps SOAR allows for Remote Code Execution8.7 High
- shawfactor lh signingLH Signing <= 2.83 - Cross-Site Request Forgery4.3 Medium
- softmus wp scriptcaseWP Scriptcase <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter6.4 Medium
- azurecurve bbcodeazurecurve BBCode <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Shortcode6.4 Medium
- zuotian enhanced bibliplugEnhanced BibliPlug <= 1.3.8 - Authenticated (Contirbutor+) Stored Cross-Site Scripting6.4 Medium
- mythemeshop my wp translateMy WP Translate <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- vinzzb phplist subberPhpList Subber <= 1.1 - Cross-Site Request Forgery4.3 Medium
- manchumahara cbx map for google map & openstreetmapCBX Map for Google Map & OpenStreetMap <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- khaledsaikat user meta – user profile builder and user management pluginUser Meta – User Profile Builder and User management plugin <= 3.1.2 - Authenticated (Subscriber+) Arbitrary File Deletion8.0 High
- evidentlycube publish approvalPublish approval <= 1.1 - Cross-Site Request Forgery5.3 Medium
- eideasy eid easyeID Easy <= 4.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter6.4 Medium
- edsteep seo monsterSeo Monster <= 3.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- smartcatai smartcat translator for wpmlSmartcat Translator for WPML <= 3.1.72 - Authenticated (Author+) SQL Injection via orderby Parameter6.5 Medium
- beyondcart connectorBeyondCart Connector <= 3.0.1 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation via determine_current_user Filter9.8 Critical
- cssigniterteam elements plus!Elements Plus! <= 2.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- cyberchimps responsive addons for elementor – free elementor addons, kits and elementor templatesResponsive Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- dontcare admin in english with switchAdmin in English with Switch <= 1.1 - Cross-Site Request Forgery4.3 Medium
- Show moreLoading…