CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- wso2 identity server, identity server as key manager, open banking iam +2 morePotential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Login6.8 Medium
- wso2 api manager, identity server, identity server as key manager +2 moreContent Spoofing in Multiple WSO2 Products via Error Message Injection4.3 Medium
- wso2 api control plane, api manager, open banking am +2 more +4 moreAuthenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service6.8 Medium
- dnnsoftware dotnetnuke, dnn.platform +1 moreDNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile6.5 Medium
- dnnsoftware dotnetnuke, dnn.platform +1 moreDNN Vulnerable to Stored XSS Using Backend Admin Credentials2.4 Low
- dnnsoftware dotnetnuke, dnn.platform +1 moreDNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module9.1 Critical
microcode_ctlTuxCareUpdate of microcode_ctlNo score- wso2 api control plane, api manager, traffic manager +2 more +4 moreAuthenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher4.8 Medium
- No product listedCoinomi cleartext transmission6.3 Medium
- huggingface huggingface/transformers, transformers +1 moreRegular Expression Denial of Service (ReDoS) in huggingface/transformers5.3 Medium
- autodesk revit, revit lt +1 moreRFA File Parsing Type Confusion Vulnerability7.8 High
- salesforce cliUncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows...8.8 High
- oneplus oxygenosOnePlus OxygenOS Telephony provider permission bypass8.2 High
- talentsys consulting information technology industry inc. inka.netUnrestricted File Upload in TaletSys Inka.Net10.0 Critical
- novakon p series (p07, p10, p12, p15)Execution with Unnecessary Privileges7.3 High
- novakon p series (p07, p10, p12, p15)UDP Service Weak Authentication9.3 Critical
- novakon p series (p07, p10, p12, p15)Weak Authentication for Root User8.6 High
- autodesk fusionHTML Payload Stored Cross-Site Scripting (XSS) Vulnerability8.7 High
- novakon p series (p07, p10, p12, p15)Path Traversal9.4 Critical
- novakon p series (p07, p10, p12, p15)Unauthenticated Buffer Overflow10.0 Critical
- wso2 api manager, micro integrator +1 moreInformation Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator6.5 Medium
- danny-avila danny-avila/librechat, librechat +1 moreAuthorization Bypass due to Incorrect Access Control in danny-avila/librechat5.3 Medium
kernel-livepatch-MICRO-6-0-RT_Update_12SUSESecurity update for kernel-livepatch-MICRO-6-0-RT_Update_12No scorekernel-livepatch-MICRO-6-0-RT_Update_12SUSESecurity update for kernel-livepatch-MICRO-6-0-RT_Update_12No score- moomoo product options and price calculation formulas for woocommerce – uni cpo (premium)Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.55 - Unauthenticated Arbitrary File Upload via 'uni_cpo_upload_file'9.8 Critical
- anadolu hayat emeklilik inc. ahe mobileIDOR in Anadolu Hayat Emeklilik's AHE Mobile6.5 Medium
- netcad software inc. netigmaStored XSS in Netcad Software's Netigma8.9 High
- campcodes point of sale system pos, point of sale system +1 moreCampcodes Point of Sale System POS login.php sql injection6.9 Medium
- eric teubert podlove podcast publisherPodlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Upload9.8 Critical
- campcodes gym management systemCampcodes Gym Management System ajax.php sql injection6.9 Medium
- cbk soft software hardware electronic computer systems industry and trade inc. envisionOS Command Injection in Iron Mountain's enVision10.0 Critical
- campcodes society membership information systemCampcodes Society Membership Information System check_student.php sql injection5.3 Medium
- portabilis i-educarPortabilis i-Educar edit sql injection5.3 Medium
- clevercontrol employee monitoring softwareMissing Certificate Validation in CleverControl Installer Allows Remote Code Execution6.5 Medium
- portabilis i-educarPortabilis i-Educar view sql injection5.3 Medium
- portabilis i-educarPortabilis i-Educar aluno sql injection5.3 Medium
- red hat ai inference server 3.2, discovery 2, enterprise linux 10 +16 more +18 moreLibtiff: libtiff write-what-where8.8 High
- code-projects online hotel reservation systemReservation Online Hotel Reservation System paypalpayout.php sql injection6.9 Medium
- code-projects online bidding systemcode-projects Online Bidding System wew.php sql injection6.9 Medium
- linux, linux kernel +1 morefuse: Block access to folio overlimit7.8 High
- linux, linux kernel +1 moretracing/osnoise: Fix null-ptr-deref in bitmap_parselist()5.5 Medium
- linux, linux kernel +1 morebpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()5.5 Medium
- debian linux, linux kernel +1 moreocfs2: fix recursive semaphore deadlock in fiemap call5.5 Medium
- linux, linux kernel +1 morebtrfs: fix subvolume deletion lockup caused by inodes xarray race4.7 Medium
- debian linux, linux kernel +1 moremm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory7.1 High
- linux, linux kernel +1 moredrm/mediatek: fix potential OF node use-after-free8.4 High
- debian linux, linux kernel +1 morekernfs: Fix UAF in polling when open file is released7.8 High
- debian linux, linux kernel +1 morelibceph: fix invalid accesses to ceph_connection_v1_info9.8 Critical
- linux, linux kernel +1 moreceph: always call ceph_shift_unused_folios_left()5.5 Medium
- linux, linux kernel +1 moreceph: fix crash after fscrypt_encrypt_pagecache_blocks() error5.5 Medium
- Show moreLoading…