CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- portabilis i-educarPortabilis i-Educar ConfiguracaoMovimentoGeral cross site scripting5.3 Medium
- esm-dev esm.shesm.sh writes arbitrary files via path traversal in `X-Zone-Id` header5.5 Medium
- esm-dev esm.shLocal File Inclusion in esm.sh7.7 High
- ovh the-bastionThe Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync script4.4 Medium
- ruby rexmlREXML has a DoS condition when parsing malformed XML file1.2 Low
- dyad-sh dyadDyad Vulnerable to Remote Code Execution via Top-level Navigation in Preview Window9.1 Critical
- portabilis i-educarPortabilis i-Educar agenda_preferencias.php cross site scripting5.3 Medium
- emiloi online discussion forumPHPGurukul Online Discussion Forum edit_member.php sql injection6.9 Medium
- icewhaletech zimaosZimaOS Privilege Escalation using localhost calls to File API Upload5.2 Medium
- icewhaletech zimaosZimaOS reads arbitrary files using localhost calls to File API Download4.8 Medium
- emiloi online discussion forumPHPGurukul Online Discussion Forum search_result.php sql injection6.9 Medium
- janobe online exam form submissionSourceCodester Online Exam Form Submission delete_s1.php sql injection5.3 Medium
- cisa thoriumCISA Thorium account verification email error handling6.9 Medium
- cisa thoriumCISA Thorium download stream divide by zero5.3 Medium
- cisa thoriumCISA Thorium does not validate TLS connections to Elasticsearch2.3 Low
- cisa thoriumCISA Thorium does not properly invalidate previously used tokens2.3 Low
- cisa thoriumCISA Thorium does not rate limit account verification email messages6.9 Medium
- cisa thoriumCISA Thorium LDAP injection5.3 Medium
- cisa thoriumCISA Thorium insecure downloaded file path validation5.3 Medium
- janobe online exam form submissionSourceCodester Online Exam Form Submission index.php sql injection6.9 Medium
- janobe online exam form submissionSourceCodester Online Exam Form Submission register.php unrestricted upload6.9 Medium
- itsourcecode web-based internet laboratory management systemitsourcecode Web-Based Internet Laboratory Management System login.php AuthenticateUser sql injection6.9 Medium
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software search_product.php sql injection6.9 Medium
- kidaze courseselectionsystemkidaze CourseSelectionSystem COUNT2.php sql injection6.9 Medium
- janobe online exam form submissionSourceCodester Online Exam Form Submission index.php sql injection6.9 Medium
- linux, linux kernel +1 moretracing: Fix race issue between cpu buffer write and swap4.7 Medium
- linux, linux kernel +1 moreaccel/habanalabs: fix mem leak in capture user mappings5.5 Medium
- linux, linux kernel +1 moreregulator: da9063: better fix null deref with partial DT5.5 Medium
- linux, linux kernel +1 morebus: fsl-mc: don't assume child devices are all fsl-mc devices5.5 Medium
- linux, linux kernel +1 moreLoongArch: mm: Add p?d_leaf() definitions5.5 Medium
- linux, linux kernel +1 moreNFSv4.2: Rework scratch handling for READ_PLUS (again)9.8 Critical
- linux, linux kernel +1 moreksmbd: fix racy issue under cocurrent smb2 tree disconnect8.8 High
- linux, linux kernel +1 moremd/raid10: check slab-out-of-bounds in md_bitmap_get_counter7.1 High
- linux, linux kernel +1 moreusb: gadget: u_serial: Add null pointer check in gserial_suspend5.5 Medium
- linux, linux kernel +1 morestaging: pi433: fix memory leak with using debugfs_lookup()5.5 Medium
- linux, linux kernel +1 moreaccel/habanalabs: postpone mem_mgr IDR destruction to hpriv_release()5.5 Medium
- linux, linux kernel +1 moreaccel/qaic: Fix slicing memory leak5.5 Medium
- linux, linux kernel +1 moremedia: ov2740: Fix memleak in ov2740_init_controls()5.5 Medium
- linux, linux kernel +1 morebtrfs: fix deadlock when aborting transaction during relocation with scrub5.5 Medium
- linux, linux kernel +1 morenet/mlx5: Handle pairing of E-switch via uplink un/load APIs5.5 Medium
- linux, linux kernel +1 morekernel/fail_function: fix memory leak with using debugfs_lookup()5.5 Medium
- linux, linux kernel +1 morerxrpc: Fix potential data race in rxrpc_wait_to_be_connected()4.7 Medium
- linux, linux kernel +1 morecan: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write5.5 Medium
- linux, linux kernel +1 morenet: marvell: prestera: fix handling IPv4 routes with nhid5.5 Medium
- linux, linux kernel +1 moreof/fdt: run soc memory setup when early_init_dt_scan_memory fails5.5 Medium
- linux, linux kernel +1 morenet/mlx5: Collect command failures data only for known commands7.8 High
- linux, linux kernel +1 morebtrfs: fix BUG_ON condition in btrfs_cancel_balance5.5 Medium
- linux, linux kernel +1 morenilfs2: do not write dirty data after degenerating to read-only5.5 Medium
- linux, linux kernel +1 moremedia: ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warnings5.5 Medium
- linux, linux kernel +1 morefs: dlm: fix race in lowcomms9.8 Critical
- Show moreLoading…