CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- code-projects employee management systemTutorials-Website Employee Management System HTTP Request all-applied-leave.php improper authorization6.9 Medium
- givanz vvvebgivanz Vvveb cross-site request forgery5.3 Medium
- flagforgeFlagForgeCTF Exposes User Emails via Public /api/user/[username] API6.9 Medium
- givanz vvvebgivanz Vvveb Image information disclosure6.9 Medium
- givanz vvvebgivanz Vvveb SVG File cross site scripting4.8 Medium
openmlscrates.ioOpenMLS improper persistence of the secret tree during message processing4.1 Medium- givanz vvvebgivanz Vvveb Configuration File information disclosure5.1 Medium
github.com/kcp-dev/kcpGokcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace2.3 Low- apollographql embeddable-explorerApollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass8.2 High
- statamic cms, totaljs total.js +1 moreTotal.js CMS Files Menu cross site scripting4.8 Medium
- nearform get-jwksget-jwks poisoned JWKS cache allows post-fetch issuer validation bypass9.4 Critical
- jupyter jupyterlabJupyterLab LaTeX typesetter links did not enforce `noopener` attribute2.1 Low
- ibm cognos controller, controller +1 moreIBM Controller information disclosure3.7 Low
- ibm aspera http gatewayIBM Aspera HTTP Gateway information disclosure7.5 High
- ankara hosting website design website softwareXSS in Webbeyaz's web site6.1 Medium
- four-faith water conservancy informatization platform, water conservancy informatization +1 moreFour-Faith Water Conservancy Informatization Platform download.do;usrlogout.do.do path traversal6.9 Medium
- ogre3d ogreOGRECave Ogre OgreLogManager.cpp stream null pointer dereference4.8 Medium
- kalcaddle kodboxkalcaddle kodbox index.class.php fileOut path traversal5.3 Medium
- ogrecave ogreOGRECave Ogre OgreSTBICodec.cpp encode mismatched memory management routines4.8 Medium
- suse rancherRancher update on users can deny the service to the admin7.6 High
- suse rancherRancher CLI SAML authentication is vulnerable to phishing attacks8.0 High
- suse rancherRancher sends sensitive information to external services through the `/meta/proxy` endpoint4.7 Medium
- sonarsource sonarqube-scan-actionArgument injection vulnerability in SonarQube Scan Action7.7 High
- vimesoft information technologies and software inc. corporate messaging platformInformation Disclosure in Vimeosoft Information Technologies' Vimesoft Corporate Messaging Platform5.3 Medium
- seagate toolkitIn Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2...7.0 High
- ogre3d ogreOGRECave Ogre Image OgreSTBICodec.cpp encode heap-based overflow4.8 Medium
- behaviortreeBehaviorTree XML Parser xml_parsing.cpp loadDocImpl null pointer dereference4.8 Medium
- behaviortreeBehaviorTree Diagnostic Message script_parser.cpp ParseScript stack-based overflow4.8 Medium
- behaviortreeBehaviorTree json_export.cpp fromJson null pointer dereference4.8 Medium
- libuclvstakhov libucl ucl_util.c ucl_include_common heap-based overflow4.8 Medium
- avepoint compliance guardian, docave, perimeter +2 moreUnrestricted uploading of dangerous file types to AvePoint products8.6 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab4.3 Medium
- gitlabIncorrect Ownership Assignment in GitLab3.5 Low
- gitlabBusiness Logic Errors in GitLab3.5 Low
- gitlabPrivilege Defined With Unsafe Actions in GitLab6.5 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- gitlabInsertion of Sensitive Information Into Sent Data in GitLab7.7 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab3.5 Low
- gitlabMissing Authorization in GitLab3.8 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 extended lifecycle support +12 more +14 moreLibsoup: out-of-bounds read in cookie date handling of libsoup http library7.5 High
- harutheme woocommerce designer proWordPress WooCommerce Designer Pro Plugin <= 1.9.24 - Arbitrary File Upload Vulnerability10.0 Critical
- alex moss google+ commentsWordPress Google+ Comments Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- kontur.us kontur admin styleWordPress kontur Admin Style Plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- terry l. seo search permalinkWordPress SEO Search Permalink Plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- silence silencesoft rss readerWordPress Silencesoft RSS Reader Plugin <= 0.6 - Server Side Request Forgery (SSRF) Vulnerability5.4 Medium
- space studio click & tweetWordPress Click & Tweet Plugin <= 0.8.9 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- rozx recaptcha – wpWordPress Recaptcha – wp Plugin <= 0.2.6 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- ashwani kumar gst for woocommerceWordPress GST for WooCommerce Plugin <= 2.0 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- flytedesk digitalWordPress Flytedesk Digital Plugin <= 20181101 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- Show moreLoading…