CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- tvcnet the hack repair guy's plugin archiverThe Hack Repair Guy's Plugin Archiver <= 2.0.4 - Cross-Site Request Forgery to Arbitrary Directory Deletion in /wp-content5.4 Medium
- n-partner n-cloud, n-probe, n-reporter +2 moreN-Partner｜N-Reporter, N-Cloud, N-Probe - OS Command Injection8.7 High
- i-o data device, inc. wn-7d36qr, wn-7d36qr/ue +1 moreImproper neutralization of special elements used in an OS command ('OS Command Injection') issue...8.6 High
- i-o data device, inc. wn-7d36qr, wn-7d36qr/ue +1 moreHidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is...6.9 Medium
- omron social solutions co., ltd. poweract pro <master agent>, poweract pro <slave agent>, powerattendant basic edition +2 more +4 moreVulnerability caused by unquoted file paths of Windows services registered by the Uninterruptible Power Supply (UPS) management application6.7 Medium
- portabilis i-educarPortabilis i-Educar educar_calendario_anotacao_cad.php cross site scripting5.1 Medium
- nec corporation univerge ix, univerge ix-r/ix-v +1 moreCross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from...5.1 Medium
- cyberlord92 user syncUser Sync – Remote User Sync <= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation4.3 Medium
- shenyanzhi uss upyunUSS Upyun <= 1.5.0 - Cross-Site Request Forgery4.3 Medium
- eskapism developer loggers for simple historyDeveloper Loggers for Simple History <= 0.5 - Authenticated (Admin+) Local File Inclusion6.6 Medium
- gentlesource appointmindAppointmind <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- catchthemes catch dark modeCatch Dark Mode <= 2.0 - Authenticated (Contributor+) Local File Inclusion7.5 High
- productiveminds productive style – optimisations & content publishing supportProductive Style <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_productive_breadcrumb Shortcode6.4 Medium
- tw2113 social media shortcodesSocial Media Shortcodes <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- lemonldap-ng lemonldap::ngIn LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can...8.0 High
- swetrixA directory traversal issue in Swetrix Web Analytics API 3.1.1 before 7d8b972 allows a remote...9.8 Critical
- wondercmsWonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module...6.5 Medium
- parceljs parcelParcel has an Origin Validation Error vulnerability6.5 Medium
- open5gsOpen5GS v2.7.5, prior to commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615, is vulnerable to a NULL...4.0 Medium
- No product listedA Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of...6.3 Medium
- No product listedAn issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a...4.3 Medium
- hewlett packard enterprise (hpe) hpe aruba networking edgeconnect sd-wan gatewayBroken access control vulnerability in Firewall Configuration Leads to Unauthorized Access to Internal Network Resources7.5 High
- hewlett packard enterprise (hpe) hpe aruba networking edgeconnect sd-wan gatewayAuthenticated Command Injection leads to Unauthorized Actions in CLI Interface8.8 High
- hewlett packard enterprise (hpe) hpe aruba networking edgeconnect sd-wan gatewayUnauthenticated Access Vulnerability allows Transit Traffic Misrouting in SD-WAN Edge Interface8.6 High
- liferay dxp, portal, digital experience platform +2 moreLiferay search widget vulnerable to Cross-site Scripting5.1 Medium
- hewlett packard enterprise (hpe) hpe aruba networking edgeconnect sd-wan gatewayAuthenticated Arbitrary Process Termination allows potential System Disruption in ECOS6.8 Medium
- hewlett packard enterprise (hpe) hpe aruba networking edgeconnect sd-wan gatewayAuthenticated Remote Code Execution allows Exploit in Scripts Feature6.7 Medium
- hewlett packard enterprise (hpe) hpe aruba networking edgeconnect sd-wan gatewayAuthenticated Replay Attack contains Cryptographic Vulnerability7.2 High
- hewlett packard enterprise (hpe) hpe aruba networking edgeconnect sd-wan gatewayUnrestricted Binary allows File Enumeration in Underlying Operating System6.5 Medium
- ongres scramTiming Attack Vulnerability in SCRAM Authentication6.6 Medium
- hewlett packard enterprise (hpe) hpe aruba networking edgeconnect sd-wan gatewayAuthenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface7.2 High
- hewlett packard enterprise (hpe) hpe aruba networking edgeconnect sd-wan gatewayAuthenticated Arbitrary File Read allows Data Exposure in CLI Interface4.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal allows remote attackers to view display page templates via crafted URLs6.9 Medium
- campcodes grocery sales and inventory systemCampcodes Grocery Sales and Inventory System index.php cross site scripting5.3 Medium
- kubernetes csharp clientKubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks6.8 Medium
- campcodes grocery sales and inventory systemCampcodes Grocery Sales and Inventory System ajax.php sql injection6.9 Medium
- campcodes grocery sales and inventory systemCampcodes Grocery Sales and Inventory System ajax.php sql injection6.9 Medium
- campcodes grocery sales and inventory systemCampcodes Grocery Sales and Inventory System ajax.php sql injection6.9 Medium
- ilevia srl. eve x1/x5 server, ilevia eve x1 server firmware +1 moreIlevia EVE X1/X5 Server 4.7.18.0.eden Reverse Rootshell9.3 Critical
- ilevia srl. eve x1/x5 server, ilevia eve x1 server firmware +1 moreIlevia EVE X1/X5 Server 4.7.18.0.eden Authentication Bypass9.3 Critical
- ilevia srl. eve x1 server, ilevia eve x1 server firmware +1 moreIlevia EVE X1 Server 4.7.18.0.eden Unauthenticated File Disclosure8.7 High
- ilevia srl. eve x1 server, ilevia eve x1 server firmware +1 moreIlevia EVE X1 Server 4.7.18.0.eden Neuro-Core Unauthenticated Code Injection9.3 Critical
- ilevia srl. eve x1 server, ilevia eve x1 server firmware +1 moreIlevia EVE X1 Server 4.7.18.0.eden Credentials Leak Through Log Disclosure9.3 Critical
- campcodes grocery sales and inventory systemCampcodes Grocery Sales and Inventory System ajax.php sql injection6.9 Medium
- microsoft pc managerMicrosoft PC Manager Security Feature Bypass Vulnerability4.0 Medium
- microsoft edge, edge (chromium-based) +1 moreMicrosoft Edge (Chromium-based) for Android Spoofing Vulnerability4.7 Medium
- adobe substance3d - stager, substance 3d stager +1 moreSubstance3D - Stager | Out-of-bounds Read (CWE-125)5.5 Medium
- adobe substance3d - stager, substance 3d stager +1 moreSubstance3D - Stager | Out-of-bounds Read (CWE-125)7.8 High
- lumen-oss luanoxRelative Path Traversal in Luanox6.9 Medium
- mohammadzain2008 linkrLinkr allows manifest tampering leading to arbitrary file injection9.7 Critical
- Show moreLoading…