CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- difyDify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component...5.3 Medium
- nicehash quickminerNiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital...9.8 Critical
- syauqi collegetivityAn Insecure Direct Object Reference (IDOR) in the /dashboard/notes endpoint of Syaqui...8.1 High
- chipsalliance rocket-chipAn issue was discovered in Chipsalliance Rocket-Chip commit...7.5 High
- No product listedA security flaw in the '_transfer' function of a smart contract implementation for Money Making...6.5 Medium
- validator project validatorvalidator.js has a URL validation bypass vulnerability in its isURL function6.1 Medium
- liquidfilesLiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset...7.3 High
- senior-walter web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System V1.0 is vulnerable to Cross Site...6.1 Medium
- formcmsFormCMS has an improper access control vulnerability in the /api/schemas/history/[schemaId] endpoint6.5 Medium
- frappe erpnextIn Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext...6.5 Medium
- frappe erpnextIn Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype...6.5 Medium
- frappe erpnextIn Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py...6.5 Medium
- frappe erpnextIn Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype...6.5 Medium
- phpgurukul user registration \& login and user management systemA Reflected Cross-Site Scripting (XSS) vulnerability was found in loginsystem/edit-profile.php of...4.8 Medium
- No product listedAccount Takeover in Corezoid 6.6.0 in the OAuth2 implementation via an open redirect in the...7.5 High
- qwer crypt::randomencryption, crypt\ +1 moreCrypt::RandomEncryption for Perl uses insecure rand() function during encryption9.1 Critical
- eng knowage, knowagelabs knowage-server +1 moreKnowage Contains a Remote Code Execution Vulnerability9.3 Critical
- freshrssFreshRSS: Double clickjacking can lead to privilege escalation6.7 Medium
- freshrssFreshRSS is vulnerable to directory enumeration by setting path in its theme field6.9 Medium
- freshrssFreshRSS is vulnerable to XSS due to lack of CSP on HTML query page6.7 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter4.8 Medium
- ibm infosphere information serverIBM InfoSphere Information Server command execution8.8 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to cross-site scripting in the web content template4.8 Medium
- libvipslibvips is vulnerable to Buffer Over-Read in poppler-based pdfload5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to cross-site scripting in the related asset selector4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to cross-site scripting in the Calendar widget4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to cross-site scripting in the Calendar widget4.8 Medium
- freshrssFressRSS: Clickjacking can lead to XSS and/or privilege escalation5.3 Medium
- freshrssFreshRSS: Unauthorized creation of admin user when registration is enabled9.8 Critical
- freshrssFreshRSS has Incomplete Session Termination on Logout8.8 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to reflected cross-site scripting on the page configuration page5.1 Medium
- western digital my cloudAn OS command injection vulnerability in user interface in Western Digital My Cloud firmware...9.3 Critical
- freshrssFreshRSS: Unauthenticated users can view default user's information7.5 High
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) Weak SSL/TLS Certificate Validation RCE9.5 Critical
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic)10.0 Critical
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) Unauthenticated Firmware Update Endpoint RCE9.4 Critical
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) Unauthenticated Device Modification10.0 Critical
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) Unauthenticated API Leaks Group Information6.9 Medium
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) Unauthenticated Admin APIs Used to Modify SSL Certificates10.0 Critical
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) SSRF via Lexmark update.php8.8 High
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) Blind SSRF via HP installApp.php6.9 Medium
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) Blind SSRF via HP log_off_single_sign_on.php6.9 Medium
- coder agentapiAgentAPI exposed user chat history via a DNS rebinding attack6.5 Medium
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) SSRF via HP badgeSetup.php8.8 High
- filecoin go-f3go-f3 module vulnerable to integer overflow leading to panic7.5 High
- filecoin go-f3go-f3 is Vulnerable to Cached Justification Verification Bypass5.9 Medium
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) SSRF via console_release Directory8.8 High
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) RCE and Password Leaks via API10.0 Critical
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) Insecure Use of file_get_contents()8.5 High
- Show moreLoading…