CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- elangovan embed google datastudioEmbed Google Datastudio <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- dejocar side slide responsive menuSide Slide Responsive Menu <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- slowmove spotify embed creatorSpotify Embed Creator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- iocoder yudao-cloudYunaiV yudao-cloud submit improper authorization5.3 Medium
- talemy spirit frameworkSpirit Framework <= 1.2.13 - Authenticated (Subscriber+) Local File Inclusion7.5 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's Organization Selector exposes organization data to remote authenticated users5.3 Medium
- iocoder ruoyi-vue-proYunaiV ruoyi-vue-pro transfer improper authorization5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal JSON Web Services Direct Class Invocation Enables Service Access Policy Execution1.0 Low
- stellarwp the events calendarThe Events Calendar <= 6.15.1 - Unauthenticated SQL Injection7.5 High
- iocoder yudao-cloudYunaiV yudao-cloud transfer improper authorization5.3 Medium
- microsoft visual studio codeAgentic AI and Visual Studio Code Remote Code Execution Vulnerability8.8 High
- 10oaerjinzhi 10OA item cross site scripting5.3 Medium
- totolink x2000r firmwareAn issue in TOTOLINK Wi-Fi 6 Router Series Device X2000R-Gh-V2.0.0 allows a remote attacker to...8.0 High
- No product listedAn issue in H3C Magic M Device M2V100R006 allows a remote attacker to execute arbitrary code via...8.0 High
- No product listedAn issue in H3C Device R365V300R004 allows a remote attacker to execute arbitrary code via the...8.0 High
- No product listedAn issue was discovered in AXIS BANK LIMITED Axis Mobile App 9.9 allowing attackers to gain...6.5 Medium
- rakuten viberViber Desktop 25.6.0 is vulnerable to HTML Injection via the text parameter of the message...6.3 Medium
- sueamcms project sueamcmsFile Upload vulnerability in SueamCMS v.0.1.2 allows a remote attacker to execute arbitrary code...9.8 Critical
- phpgurukul online shopping portalPHPGURUKUL Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) due to lack of...6.1 Medium
- audi universal traffic recorder firmwareA stack overflow in the FTP service of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows...7.0 High
- audi universal traffic recorder firmwareAn issue in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to arbitrarily overwrite...7.5 High
- audi universal traffic recorder firmwareMultiple stored cross-site scripting (XSS) vulnerabilities in Audi UTR 2.0 Universal Traffic...5.4 Medium
- audi universal traffic recorder firmwareIncorrect access control in the web service of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows...7.5 High
- audi universal traffic recorder firmwareIncorrect access control in the FTP protocol of Audi UTR 2.0 Universal Traffic Recorder 2.0...9.1 Critical
- opensynergy blue sdkOpenSynergy BlueSDK (aka Blue SDK) through 6.x has a Use-After-Free. The specific flaw exists...9.8 Critical
- opensynergy blue sdkOpenSynergy BlueSDK (aka Blue SDK) through 6.x has Incorrect Control Flow Scoping. The specific...6.5 Medium
- opensynergy blue sdkOpenSynergy BlueSDK (aka Blue SDK) through 6.x mishandles a function call. The specific flaw...7.5 High
- opensynergy blue sdkOpenSynergy BlueSDK (aka Blue SDK) through 6.x has Improper Input Validation. The specific flaw...5.3 Medium
- 10oaerjinzhi 10OA file.aspx path traversal5.1 Medium
- 10oaerjinzhi 10OA catalogue cross site scripting5.3 Medium
- red hat openshift service mesh 3Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions5.7 Medium
- 10oaerjinzhi 10OA finder cross site scripting5.3 Medium
- axiosAxios is vulnerable to DoS attack through lack of data size check7.5 High
- ibm fusion, fusion hci, fusion hci for watsonx +3 more +5 moreIBM Fusion insecure default configuration8.7 High
- daikin europe n.v security gatewayDaikin Europe N.V Security Gateway Weak Password Recovery Mechanism for Forgotten Password8.8 High
- instantcms, instantsoft icms2 +1 moreInstantCMS vulnerable to Server-Side Request Forgery via package installer4.7 Medium
- lenovo dispatcher 3.1 driver, dispatcher 3.0 driver +1 moreA potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0...7.3 High
- lenovo xclarity orchestrator (lxco)An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below...8.7 High
- lenovo lj2206w printer, lj2655dn printer, m7206w printer +9 more +11 moreA missing authentication vulnerability was reported in some Lenovo printers that could allow a...5.3 Medium
- lenovo wallpaper clientA potential vulnerability was reported in the Lenovo Wallpaper Client that could allow arbitrary...7.5 High
- lenovo browserA potential DLL hijacking vulnerability was discovered in Lenovo Browser during an internal...8.5 High
- moeru-ai airiAIRI's character card/chat UI is vulnerable to XSS and can lead to RCE9.7 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass7.4 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal API Allows Authenticated Users to Access Workflow Definitions by Name5.3 Medium
- linux, linux kernel +1 moredm: dm-crypt: Do not partially accept write BIOs with zoned targets7.8 High
- debian linux, linux kernel, siemens simatic cn 4100 +2 morebus: mhi: host: Detect events pointing to unexpected TREs8.4 High
- linux, linux kernel +1 morecrypto: x86/aegis - Add missing error checks7.3 High
- debian linux, linux kernel, siemens simatic cn 4100 +2 morescsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE7.8 High
- debian linux, linux kernel, siemens simatic cn 4100 +3 more +5 moresoc: qcom: mdt_loader: Ensure we don't read past the ELF header7.8 High
- linux, linux kernel +1 moreiio: adc: ad7173: fix channels index for syscalib_mode7.8 High
- Show moreLoading…