CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused5.5 Medium
- imagination technologies graphics ddkGPU DDK - Roll-back of pvr_exp_fence not in finalised state can cause UAF5.1 Medium
- akilli commerce software technologies ltd. co. e-commerce websitecode-projects E-Commerce Website admin_account_delete.php sql injection6.9 Medium
- d-link dir-513, dlink dir-513 firmware +1 moreD-Link DIR-513 formWPS buffer overflow8.7 High
- invoice ninja 5Authenticated admin RCE in Invoice Ninja8.6 High
- horato internet technologies ind. and trade inc. virtual library platformReflected XSS in Horato Internet Technologies' Virtual Library Platform5.4 Medium
- code-projects online bidding systemcode-projects Online Bidding System index.php sql injection6.9 Medium
- akıllı ticaret software technologies ltd. co. smart trade e-commerceReflected XSS in Akıllı Ticaret Software Technologies' Smart Trade E-Commerce4.6 Medium
- sourcecodester simple forum discussion system, oretnom23 simple forum\/discussion system +1 moreSourceCodester Simple Forum Discussion System ajax.php sql injection5.3 Medium
- red hat enterprise linux 10, enterprise linux 9 +1 moreRhel-lightspeed: improper access control in lightspeed history management allows local privilege manipulation7.7 High
- proliz computer software hardware service trade ltd. co. obs (student affairs information system)IDOR in Proliz Software's OBS6.5 Medium
- code-projects online hotel reservation systemSourceCodester Online Hotel Reservation System deleteslide.php sql injection6.9 Medium
- code-projects online hotel reservation systemSourceCodester Online Hotel Reservation System deleteroominventory.php sql injection6.9 Medium
- No product listedMuYuCMS Add Fiend Link index.html server-side request forgery5.3 Medium
- campcodes grocery sales and inventory systemCampcodes Grocery Sales and Inventory System ajax.php sql injection6.9 Medium
- campcodes grocery sales and inventory systemCampcodes Grocery Sales and Inventory System manage_user.php sql injection6.9 Medium
- unknown markup markdownMarkup Markdown < 3.20.10 - Contributor+ Stored XSS4.7 Medium
- unknown markup markdownMarkup Markdown < 3.20.10 - Contributor+ Stored XSS4.7 Medium
- bowo admin and site enhancements (ase)Admin and Site Enhancements < 7.9.8 - Authenticated Stored XSS via SVG4.7 Medium
- unknown etsy shopEtsy Shop < 3.0.7 - Reflected XSS via $_SERVER['REQUEST_URI']5.6 Medium
- campcodes online learning management systemCampcodes Online Learning Management System edit_subject.php sql injection6.9 Medium
- campcodes online learning management systemCampcodes Online Learning Management System add_subject.php sql injection6.9 Medium
- campcodes online learning management systemCampcodes Online Learning Management System class.php sql injection6.9 Medium
- campcodes online learning management systemCampcodes Online Learning Management System edit_class.php sql injection6.9 Medium
- codeastro simple pharmacy management, simple pharmacy management system +1 moreCodeAstro Simple Pharmacy Management view.php sql injection5.3 Medium
- d-link dcs-935l, dlink dcs-935l firmware +1 moreD-Link DCS-935L HNAP1 sub_402280 stack-based overflow8.7 High
- No product listedSmartstore Gift Voucher confirm race condition2.3 Low
- jsc r7 r7-office document serverJSC R7 R7-Office Document Server downloadas path traversal5.3 Medium
- lioncoders salepro posLionCoders SalePro POS Login cleartext transmission6.3 Medium
- wavlink wl-nu516u1, wl-nu516u1 firmware +1 moreWavlink WL-NU516U1 login.cgi sub_4012A0 os command injection5.1 Medium
- ruijie 6000-e10Ruijie 6000-E10 sub_commit.php os command injection5.1 Medium
- b-link bl-ac2100, lb-link bl-ac2100 firmware +1 moreB-Link BL-AC2100 Web Management set_delshrpath_cfg delshrpath stack-based overflow8.7 High
- artifex ghostxpsIn Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff...4.3 Medium
- artifex ghostscriptIn Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer...4.3 Medium
- artifex ghostscriptArtifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in...4.3 Medium
- artifex ghostscriptArtifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in...4.3 Medium
- profession fit fitProfession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api...5.8 Medium
- No product listedThe LB-Link routers, including the BL-AC2100_AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000_AE4 v2.4.9,...8.8 High
- papermarkDirectory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to...6.5 Medium
- No product listedLack of server-side authorisation on department admin assignment APIs in AiKaan IoT Platform...8.8 High
- No product listedInsufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined...9.8 Critical
- No product listedAiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for...9.8 Critical
- blackmagicdesign atem mini pro firmwareThe Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information...9.8 Critical
- No product listedThe Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993, which...7.5 High
- creacast creabox managerCreacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible...8.8 High
- 2wcom ip-4c firmwareThe 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. Certain...6.8 Medium
- blackmagicdesign web presenter hd firmwareThe Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an...9.8 Critical
- creacast creabox managerCreacast Creabox Manager contains a critical authentication flaw that allows an attacker to...8.8 High
- 2wcom ip-4c firmwareThe 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability....6.5 Medium
- blackmagicdesign web presenter 4k firmware, web presenter hd firmware +1 moreBlackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts...9.8 Critical
- Show moreLoading…