CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- blazethemes blaze demo importerBlaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install4.3 Medium
linux-cloud-tools-genericTuxCare,linux-cloud-tools-lowlatencyTuxCare,linux-genericTuxCare +7 more +9 moreUpdate of linux-metaNo score- vmware spring frameworkCVE-2025-41249: Spring Framework Annotation Detection Vulnerability7.5 High
- spring security, vmware spring security +1 moreCVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types7.5 High
- sparkle project sparkleLocal Privilege Escalation in Sparkle Autoupdate Daemon8.8 High
- sparkle project sparkleTCC Bypass via Downloader XPC Service in Sparkle4.8 Medium
- zte t5400There is an unauthorized access vulnerability in ZTE T5400. Due to improper permission control of...5.7 Medium
- zte t5400There is an an information disclosure vulnerability in ZTE T5400. Due to improper configuration...3.5 Low
- typo3 extension "form to database" (form to database)Cross-Site Scripting in extension "Form to Database" (form_to_database)2.3 Low
- bgs interactive sinav.link exam result moduleSQLi in BGS Interactive's SINAV.LINK Exam Result Module9.8 Critical
- ubit information technologies stoysXSS in Ubit Information Technologies' STOYS4.3 Medium
linux-cloud-tools-genericTuxCare,linux-cloud-tools-lowlatencyTuxCare,linux-crashdumpTuxCare +9 more +11 moreUpdate of linux-metaNo score- linux, linux kernel +1 morenet: microchip: vcap api: Fix possible memory leak for vcap_dup_rule()5.5 Medium
- linux, linux kernel +1 morewifi: iwl4965: Add missing check for create_singlethread_workqueue()5.5 Medium
- linux, linux kernel +1 moref2fs: fix kernel crash due to null io->bio7.1 High
- linux, linux kernel +1 moremedia: hi846: Fix memleak in hi846_init_controls()5.5 Medium
- linux, linux kernel +1 morenfc: fix memory leak of se_io context in nfc_genl_se_io5.5 Medium
- linux, linux kernel +1 moreudf: Do not update file length for failed writes to inline files5.5 Medium
- linux, linux kernel +1 morefs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup()5.5 Medium
- linux, linux kernel +1 moremedia: bdisp: Add missing check for create_workqueue5.5 Medium
- linux, linux kernel +1 moreRDMA/mlx5: Return the firmware result upon destroying QP/RQ7.8 High
- linux, linux kernel +1 moredrm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init()5.5 Medium
- linux, linux kernel +1 morescsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write7.8 High
- linux, linux kernel +1 moredrivers: staging: rtl8723bs: Fix locking in _rtw_join_timeout_handler()5.5 Medium
- linux, linux kernel +1 moremisc: vmw_balloon: fix memory leak with using debugfs_lookup()5.5 Medium
- linux, linux kernel +1 moreubifs: Fix memory leak in ubifs_sysfs_init()5.5 Medium
- linux, linux kernel +1 morewifi: iwl3945: Add missing check for create_singlethread_workqueue5.5 Medium
- linux, linux kernel +1 moreubifs: Free memory for tmpfile name5.5 Medium
- linux, linux kernel +1 moreclk: mediatek: mt8183: Add back SSPM related clocks7.8 High
linux-cloud-tools-genericTuxCare,linux-cloud-tools-lowlatencyTuxCare,linux-crashdumpTuxCare +9 more +11 moreUpdate of linux-metaNo score- linux, linux kernel +1 morenet: ena: fix shift-out-of-bounds in exponential backoff7.1 High
- linux, linux kernel +1 moreubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()5.5 Medium
- linux, linux kernel +1 moreblock: ublk: make sure that block size is set correctly5.5 Medium
- linux, linux kernel +1 moredriver: soc: xilinx: fix memory leak in xlnx_add_cb_for_notify_event()5.5 Medium
- linux, linux kernel +1 moreubi: ensure that VID header offset + VID header size <= alloc, size7.1 High
- argus technology inc. bilgerInformation Disclosure in ArgusTech's BILGER6.5 Medium
- argus technology inc. bilgerIDOR in ArgusTech's BILGER6.5 Medium
- vegagrup software vega masterInformation Disclosure in Vegagrup Software's Vega Master8.6 High
- stellarwp the events calendarThe Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure5.3 Medium
- clickstudios passwordstateClick Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for...3.2 Low
- fedorindutny ipThe ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value...3.2 Low
- fedorindutny ipThe ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value...3.2 Low
- tduckcloud tduckSQL Injection vulnerability in TDuckCloud v.5.1 allows a remote attacker to execute arbitrary...9.8 Critical
- No product listedCYRISMA Sensor before 444 for Windows has an Insecure Folder and File Permissions vulnerability....8.8 High
- No product listedA DLL hijacking vulnerability in CYRISMA Agent before 444 allows local users to escalate...7.8 High
- phpgurukul auto taxi stand management systemA cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the...5.4 Medium
- phpgurukul online library management systemAn issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via...9.8 Critical
- edimax br-6473ax firmwareEdimax BR-6473AX v1.0.28 was discovered to contain a remote code execution (RCE) vulnerability...8.0 High
- askar634 computer base testA Stored Cross-Site Scripting (XSS) vulnerability was discovered in the /users/adminpanel/admin...6.1 Medium
- signify wiz connectedAn incorrect API discovered in Signify Wiz Connected 1.9.1 allows attackers to remotely launch a...7.5 High
- Show moreLoading…