CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
counterpartnpmcounterpart vulnerable to prototype pollution6.5 Medium@messageformat/runtimenpmmessageformat prototype pollution vulnerability5.3 Mediummin-documentnpm,node-min-documentDebian +1 moremin-document vulnerable to prototype pollution5.3 Mediumts-fnsnpmts-fns has prototype pollution vulnerability6.5 Medium- keyangxiang csvtojsonCSVTOJSON has a prototype pollution vulnerability8.6 High
- openjsf messageformatmessageformat has a prototype pollution vulnerability7.5 High
- node-cubenode-cube vulnerable to prototype pollution6.5 Medium
- tbo47 dagre-d3-esA vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within...9.8 Critical
- web3js web3-core-subscriptionsweb3-core-subscriptions has a Prototype Pollution vulnerability7.5 High
- web3js web3-core-methodweb3-core-method is vulnerable to prototype pollution7.5 High
- jonschlinkert toggle-arraytoggle-array vulnerable to prototype pollution7.5 High
- spmjs spmrcspmrc vulnerable to prototype pollution7.5 High
- sassdoc sassdoc-extrassassdoc-extras vulnerable to prototype pollution7.5 High
- rollbarDuplicate Advisory: rollbar vulnerable to prototype pollution7.5 High
- parseplatform parse javascript sdkparse is vulnerable to prototype pollution6.5 Medium
- regularjs mpregularmpregular vulnerable to prototype pollution7.5 High
- magix-combine-ex project magix-combine-exmagix-combine-ex vulnerable to prototype pollution9.8 Critical
- open-federation json-schema-editor-visualjson-schema-editor-visual vulnerable to prototype pollution6.5 Medium
fast-redactTuxCareWithdrawn Advisory: fast-redact vulnerable to prototype pollution7.5 High- pradeep-mishra csvjsoncsvjson vulnerable to prototype injection7.5 High
- running-elephant datartAn issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT...9.8 Critical
- running-elephant datartDatart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the...8.8 High
- running-elephant datartDatart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since...7.1 High
- No product listedAztech DSL5005EN firmware 1.00.AZ_2013-05-10 and possibly other versions allows unauthenticated...7.5 High
- automationdirect click plus c0-0x cpu firmware, click plus c0-1x cpu firmware, click plus c2-x cpu firmware +2 moreAutomationDirect CLICK PLUS Improper Resource Shutdown or Release8.2 High
- automationdirect click plus c0-0x cpu firmware, click plus c0-1x cpu firmware, click plus c2-x cpu firmware +2 moreAutomationDirect CLICK PLUS Missing Authorization7.6 High
- automationdirect click plus c0-0x cpu firmware, click plus c0-1x cpu firmware, click plus c2-x cpu firmware +2 moreAutomationDirect CLICK PLUS Improper Resource Shutdown or Release8.2 High
- automationdirect click plus c0-0x cpu firmware, click plus c0-1x cpu firmware, click plus c2-x cpu firmware +2 moreAutomationDirect CLICK PLUS Predictable Seed in Pseudo-Random Number Generator8.7 High
- automationdirect click plus c0-0x cpu firmware, click plus c0-1x cpu firmware, click plus c2-x cpu firmware +2 moreAutomationDirect CLICK PLUS Use of a Broken or Risky Cryptographic Algorithm8.7 High
- automationdirect click plus c0-0x cpu firmware, click plus c0-1x cpu firmware, click plus c2-x cpu firmware +2 moreAutomationDirect CLICK PLUS Use of Hard-coded Cryptographic Key6.9 Medium
- automationdirect click plus c0-0x cpu firmware, click plus c0-1x cpu firmware, click plus c2-x cpu firmware +2 moreAutomationDirect CLICK PLUS Cleartext Storage of Sensitive Information4.1 Medium
- amd instinct™ mi300xImproper input validation in Satellite Management Controller (SMC) may allow an attacker with...5.0 Medium
- amd instinct™ mi300xImproper input validation in Satellite Management Controller (SMC) may allow an attacker with...5.0 Medium
- kata-containersKata Containers coco-tdx malicious host can circumvent initdata verification6.9 Medium
- flagforgeFlagForgeCTF Vulnerable to Unauthorized Problem Creation7.6 High
- wordpressWordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability5.9 Medium
- nasa cryptolibCryptoLib command Injection vulnerability in initialize_kerberos_keytab_file_login()7.3 High
- lizardbyte sunshineSunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution6.7 Medium
- dnnsoftware dotnetnuke, dnn.platform +1 moreDNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser5.9 Medium
- dnnsoftware dotnetnuke, dnn.platform +1 moreDNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscation5.3 Medium
- totolink x6000r, x6000r firmware +1 moreTOTOLINK X6000R Argument Injection Vulnerability7.0 High
- rti connext professionalUse After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation.5.8 Medium
- rti connext professionalUntrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.8.3 High
- rti connext professionalBuffer Over-read, Off-by-one Error vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation, Overread Buffers.4.8 Medium
- rti connext professionalUntrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.8.3 High
- astral-sh tokio-tarastral-tokio-tar has a path traversal in tar extraction6.1 Medium
- http4sHttp4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section6.3 Medium
- wso2 identity server, identity server as key manager, open banking iam +2 moreAuthentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association3.3 Low
- wordpressWordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability4.3 Medium
- wso2 identity serverReflected Cross-Site Scripting (XSS) in WSO2 Identity Server Account Registration Flow6.1 Medium
- Show moreLoading…