CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...5.1 Medium
- apple macosA downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in...4.0 Medium
- apple macosAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS...5.5 Medium
- pojoin h3blogpojoin h3blog HTTP Header login ppt_log cross site scripting5.3 Medium
- janobe online student file management systemSourceCodester Online Student File Management System save_user.php sql injection5.3 Medium
- janobe online student file management systemSourceCodester Online Student File Management System index.php sql injection6.9 Medium
- janobe online student file management systemSourceCodester Online Student File Management System remove_file.php sql injection5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Stored Cross-site Scripting vulnerability4.8 Medium
- janobe online student file management systemSourceCodester Online Student File Management System save_file.php unrestricted upload5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay has Insecure Default Initialization of Resource issue5.3 Medium
- watchguard fireware osWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy Configuration4.8 Medium
- watchguard fireware osWatchGuard Firebox Authentication Portal Request Smuggling Vulnerability6.9 Medium
- sangoma freepbx, flarum framework +1 moreFreePBX vulnerable to unauthenticated Denial of Service6.6 Medium
- janobe online student file management systemSourceCodester Online Student File Management System index.php sql injection6.9 Medium
- flarum framework, sangoma freepbx +1 moreFreePBX Post-Authenticated Command Injection6.3 Medium
- liferay dxp, digital experience platform +1 moreLiferay DXP Missing Critical Step in Authentication2.1 Low
- kidaze courseselectionsystemkidaze CourseSelectionSystem eligibility.php sql injection5.3 Medium
- ghostGhost 6.0.6 - SSRF via oEmbed Bookmark6.1 Medium
- flowiseFlowise - Unsandboxed Remote Code Execution via Custom MCP9.3 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Uses Default Password6.9 Medium
- flowiseFlowise - Arbitrary File Access via Missing Chat Flow ID Validation9.3 Critical
- dolfinus 3dalloy3DAlloy allows stored XSS through attributes provided to the 3d parser tag/function8.6 High
- igniterealtime openfireOpenfire allows potential identity spoofing via unsafe CN parsing5.9 Medium
- No product listedSpyShelter IOCTL SpyShelter.sys denial of service6.8 Medium
- flowiseFlowise - Arbitrary File Read via chatId Parameter8.7 High
- flowiseai flowiseFlowise has Remote Code Execution vulnerability10.0 Critical
- flowiseai flowiseFlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability7.5 High
- flowiseai flowiseFlowiseAI Pre-Auth Arbitrary Code Execution6.5 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Cross-site Scripting (XSS) vulnerability4.8 Medium
- ruoyiyangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection5.3 Medium
- harry0703 moneyprinterturboharry0703 MoneyPrinterTurbo URL video.py stream_video path traversal6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to Cross-site Scripting4.8 Medium
- yuna0x0 hackmd-mcphackmd-mcp server-side request forgery in HTTP transport mode6.9 Medium
- n8nn8n stored cross-site scripting in LangChain Chat Trigger node initialMessages parameter5.4 Medium
- plait-board drawnixdrawnix debug logging cross-site scripting vulnerability5.3 Medium
- seriawei zkeacmsZKEACMS MediaController.cs Proxy server-side request forgery5.3 Medium
- digilent waveformsRelative Path Traversal Vulnerability in Digilent WaveForms8.5 High
- apache foryApache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data6.5 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal has External Control of System or Configuration Settings2.3 Low
- dataeaseDataease H2 data source JDBC URL validation bypass leads to remote code execution8.7 High
- mongodb inc server, mongodb, inc. mongodb server +1 moreMongoDB Windows installation MSI may leave ACLs unset on custom installation directories7.8 High
- dataeaseDataease has a JDBC attack vulnerability in the Impala datasource8.7 High
- dataeaseDataease server-side request forgery via unfiltered DB2 JDBC ldap parameter7.1 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal has Improper Validation of Specified Quantity in Input6.9 Medium
- ibm openpagesIBM OpenPages information disclosure4.0 Medium
- sk hynix ddr5Phoenix: Rowhammer attack on Hynix DDR5 devices7.1 High
- phpgurukul beauty parlour management systemPHPGurukul Beauty Parlour Management System all-appointment.php sql injection6.9 Medium
- linux, linux kernel +1 moreocxl: fix pci device refcount leak when calling get_function_0()5.5 Medium
- linux, linux kernel +1 morefs/ntfs3: Add null pointer check to attr_load_runs_vcn5.5 Medium
- linux, linux kernel +1 more9p: set req refcount to zero to avoid uninitialized usage9.8 Critical
- Show moreLoading…