CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- linux, linux kernel +1 moreled: qcom-lpg: Fix sleeping in atomic5.5 Medium
- linux, linux kernel +1 morei2c: designware: Fix handling of real but unexpected device interrupts5.5 Medium
- linux, linux kernel +1 moredrm/msm/dsi: fix memory corruption with too many bridges7.8 High
- linux, linux kernel +1 morefs: fix UAF/GPF bug in nilfs_mdt_destroy7.8 High
- linux, linux kernel +1 morepowercap: intel_rapl: fix UBSAN shift-out-of-bounds issue7.1 High
- linux, linux kernel +1 morei2c: mux: reg: check return value after calling platform_get_resource()5.5 Medium
- linux, linux kernel +1 moredmaengine: hisilicon: Add multi-thread support for a DMA channel7.8 High
- linux, linux kernel +1 moredrm/msm/dp: fix aux-bus EP lifetime5.5 Medium
- linux, linux kernel +1 moremedia: cx88: Fix a null-ptr-deref bug in buffer_prepare()5.5 Medium
- linux, linux kernel +1 morebrcmfmac: return error when getting invalid max_flowrings from dongle4.2 Medium
- linux, linux kernel +1 morestaging: vt6655: fix some erroneous memory clean-up loops7.8 High
- abb flxeonPredictable Salt and Weak Hashing Algorithm8.7 High
- abb flxeonHardcoded passwords7.3 High
- janobe online student file management systemSourceCodester Online Student File Management System delete_user.php sql injection5.3 Medium
- kgoldov apache::authanyApache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely7.5 High
- janobe online student file management systemSourceCodester Online Student File Management System delete_student.php sql injection5.3 Medium
- janobe online student file management systemSourceCodester Online Student File Management System update_student.php sql injection5.3 Medium
- jenkinsJenkins has a log message injection vulnerability5.3 Medium
- jenkinsJenkins is missing a permission check in the authenticated users' profile menu4.3 Medium
- jenkinsJenkins has a missing permission check, allowing users to obtain agent names5.3 Medium
- itsourcecode online public access catalog opac, online public access catalog +1 moreitsourcecode Online Public Access Catalog OPAC POST Parameter mysearch.php sql injection5.3 Medium
- sechard information technologies sechardIDOR in SecHard Information Technologies' SecHard5.3 Medium
- shopside software appXSS in Shopside Software's Shopside App4.7 Medium
- yordam informatics library automation systemSQLi in Yordam Library Automation System9.8 Critical
- mevzuattr software mevzuattrXSS in Mevzuattr Software's MevzuatTR4.7 Medium
- athemes sydneySydney <= 2.56 - Missing Authorization to Authenticated (Subscriber+) Limited Theme Options Update5.3 Medium
- dokuzsoft technology e-commerce web design productXSS in Dokuzsoft Technology's E-Commerce Web Design Product7.1 High
- portabilis i-educarPortabilis i-Educar Editar Função educar_funcao_cad.php cross site scripting5.1 Medium
- portabilis i-educarPortabilis i-Educar educar_usuario_det.php cross site scripting5.3 Medium
- paraşüt software paraşütXSS in Mikrogrup's Paraşüt4.7 Medium
- jetbrains junieIn JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61,...8.3 High
- jetbrains teamcityIn JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on...7.7 High
- jetbrains teamcityIn JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload5.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition4.2 Medium
- zirve information technologies inc. novaXSS in Mikrogrup's Zirve Nova4.7 Medium
- watchguard firebox, fireware, fireware os +2 moreWatchGuard Firebox iked Out of Bounds Write Vulnerability9.3 Critical
- planet technology icg-2510w-lte (eu/us), icg-2510wg-lte (eu/us) +1 morePlanet Technology｜Industrial Cellular Gateway - OS Command Injection9.3 Critical
- planet technology icg-2510w-lte (eu/us), icg-2510wg-lte (eu/us) +1 morePlanet Technology｜Industrial Cellular Gateway - Missing Authentication9.3 Critical
- creativethemeshq blocksy companionBlocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode6.4 Medium
- kodezen storeengine — complete ecommerce solution with memberships, licensing, affiliates & moreStoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- bplugins media player addons for elementor – audio and video widgets for elementorMedia Player Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields6.4 Medium
- kodezen storeengine — complete ecommerce solution with memberships, licensing, affiliates & moreStoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download6.5 Medium
- dassault systèmes solidworks edrawingsUse of Uninitialized Variable vulnerability affecting the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 20257.8 High
- dassault systèmes solidworks edrawingsUse After Free vulnerability affecting the PAR file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 20257.8 High
- dassault systèmes solidworks edrawingsOut-Of-Bounds Read affecting the PAR file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 20257.8 High
- smackcoders wp import – ultimate csv xml importer for wordpressWP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection8.8 High
- smackcoders wp ultimate csv importer – import csv, xml & excel into wordpressWP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion8.1 High
- ays pro quiz makerQuiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection5.9 Medium
- century corporation raid managerRAID Manager provided by Century Corporation registers a Windows service with an unquoted file...8.4 High
- jason c. memberlite shortcodesMemberlite Shortcodes <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- Show moreLoading…