CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- marceljm featured image from url (fifu)Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection4.9 Medium
- openbabel open babelOpen Babel PQSformat.cpp ReadMolecule null pointer dereference4.8 Medium
- qriouslad system dashboardSystem Dashboard <= 2.8.20 - Cross-Site Request Forgery4.3 Medium
- mapster wp mapsMapster WP Maps <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- specialk banhammer – monitor site traffic, block bad users and botsBanhammer – Monitor Site Traffic, Block Bad Users and Bots <= 3.4.8 - Unauthenticated Protection Mechanism Bypass5.3 Medium
- roxnor shopengine elementor woocommerce builder addon – all in one woocommerce solutionShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings Update2.7 Low
- openbabel open babelOpen Babel cacaoformat.cpp SetHilderbrandt null pointer dereference4.8 Medium
- openbabel open babelOpen Babel chemkinformat.cpp ReadReactionQualifierLines null pointer dereference4.8 Medium
- openbabel open babelOpen Babel chemkinformat.cpp CheckSpecies heap-based overflow4.8 Medium
- openbabel open babelOpen Babel smilesformat.cpp ParseSmiles heap-based overflow4.8 Medium
- openbabel open babelOpen Babel zipstreamimpl.h underflow memory corruption4.8 Medium
- openbabel open babelOpen Babel gamessformat.cpp ReadMolecule use after free4.8 Medium
- kraftplugins mega elements – addons for elementorMega Elements – Addons for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget6.4 Medium
- cyberlord92 oauth single sign on – sso (oauth client)OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Cross-Site Request Forgery4.3 Medium
- trustindex widgets for tiktok feedWidgets for Tiktok Feed <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- creativemindssolutions cm business directory – optimise and showcase local businessCM Business Directory <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- muyucmsMuYuCMS Template Management admin.php code injection5.1 Medium
- roncoo roncoo-payroncoo roncoo-pay lookupList improper authorization6.9 Medium
- ruoyiyangzongzhuan RuoYi selectAll improper authorization5.3 Medium
- iocoder ruoyi-vue-proYunaiV ruoyi-vue-pro transfer improper authorization5.3 Medium
gpacOSS-FuzzHeap-buffer-overflow in inspect_processNo score- iocoder yudao-cloudYunaiV yudao-cloud HTTP Request transfer improper authorization5.3 Medium
- jeecg bootJeecgBoot exportXls improper authorization5.3 Medium
- unitree b2, g1, go2 +1 more +3 moreUnitree Go2, G1, H1, and B2 devices through 2025-09-20 accept any handshake secret with the...5.0 Medium
- unitree b2, g1, go2 +1 more +3 moreUnitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the...4.7 Medium
- unitree b2, g1, go2 +1 more +3 moreUnitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the...8.2 High
- squid-cache squidSquid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_objid in...4.0 Medium
- doxense watchdocIn DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active...7.1 High
- No product listedIn DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code...10.0 Critical
- dotnetfoundation piranha cmsPiranhaCMS stored XSS6.8 Medium
- doist todoistTodoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload...6.1 Medium
- mercusys mw305r firmwareMercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key...6.8 Medium
- No product listedNotepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to...8.4 High
- dlink dir-823x firmwareAn issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the...8.8 High
- wavlink wl-wn586x3a firmwareWavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings...8.8 High
- drivelockIn DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can...9.9 Critical
- arandasoft passrecoveryAn issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active...7.5 High
- remyandrade employee management systemSourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via ...6.1 Medium
- jeecg bootJeecgBoot exportXls improper authorization5.3 Medium
- jeecg bootJeecgBoot exportXls improper authorization5.3 Medium
- jeecg bootJeecgBoot Filter exportXls improper authorization5.3 Medium
- jeecg bootJeecgBoot deleteBatch improper authorization2.3 Low
- jeecg bootJeecgBoot getDepartUserList improper authorization2.3 Low
- guanxinglu vlarlGuanxingLu vlarl ZeroMQ reasoning_server.py run_reasoning_server deserialization5.3 Medium
- giantspatula sewkinectgiantspatula SewKinect Endpoint calculate pickle.loads deserialization5.3 Medium
- dell idrac9, emc nx440, emc storage nx3240 +222 more +224 moreDell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure...4.9 Medium
- jackiedyh resume-management-systemJackieDYH Resume-management-system show.php sql injection6.9 Medium
- totolink x6000r, x6000r firmware +1 moreTOTOLINK X6000R Unauthenticated Command Injection Vulnerability9.3 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP vulnerable to a memory leak6.9 Medium
- mufen-mker php-usermmMuFen-mker PHP-Usermm chkuser.php sql injection6.9 Medium
- Show moreLoading…