CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
openjdk17-liteAlpaquitaNo score- wpmudev smartcrawl seo checker, analyzer & optimizerSmartCrawl SEO checker, analyzer & optimizer <= 3.14.3 - Missing Authorization to Plugin Settings Update4.3 Medium
node-staticDebian,@nubosoftware/node-staticnpm +1 more@nubosoftware/node-static failure to catch exception can result in server crash7.5 Highcheck-branchesnpmcheck-branches is vulnerable to command Injection9.8 Critical- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function8.8 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function8.2 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting5.5 Medium
- nihon kohden corporation central monitor cns-6201Multiple versions of Central Monitor CNS-6201 contain a NULL pointer dereference vulnerability....8.7 High
- planetcalcplanetcalc <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via language Parameter6.4 Medium
- lockerpress – wordpress security pluginLockerPress – WordPress Security Plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- sdebois survey anyplaceSurveyAnyplace Plugin <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- mihdan maps from yandex for elementorMihdan: Elementor Yandex Maps <= 1.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marker Pins6.4 Medium
- webangon the pack elementor addonThe Pack Elementor addon <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typing Letter Widget6.4 Medium
- michaellow eulerpool research systemsEulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- migli tiny bootstrap elements lightTiny Bootstrap Elements Light <= 4.3.34 - Unauthenticated Local File Inclusion8.1 High
- mrwulf bp direct menusBP Direct Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- mucasoft any news tickerAny News Ticker <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- paulq chat by chatweeChat by Chatwee <= 2.1.3 - Cross-Site Request Forgery to Settings Update4.3 Medium
- john-ackers dbviewdbview <= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpdive nexa blocks – gutenberg blocks, page builder for gutenberg editor & fseNexa Blocks <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget6.4 Medium
- sanzeeb3 all in one music playerAll in One Music Player <= 1.3.1 - Authenticated (Contributor+) Path Traversal via theme Parameter6.5 Medium
- westi post by emailPost By Email <= 1.0.4b - Unauthenticated Arbitrary File Upload via Email Attachments9.8 Critical
- bmoredrew weedmaps menu for wordpressWeedMaps Menu for WordPress <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via weedmaps_menu Shortcode6.4 Medium
- fusedsoftware big post shipping for woocommerceBig Post Shipping for WooCommerce <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- d3rd4v1d bei fen – wordpress backup pluginBei Fen – WordPress Backup Plugin <= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion8.1 High
- momostefan yoga schedule momoyogaYoga Schedule Momoyoga <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- codiblog all social share optionsAll Social Share Options <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- ghosttoast fancytabsFancyTabs <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter6.4 Medium
- patrickposner qyrr – simply and modern qr-code creationQyrr – simply and modern QR-Code creation <= 2.0.7 - Authenticated (Contributor+) Arbitrary File Upload6.4 Medium
- copypressdev copypress rest apiCopypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution9.8 Critical
- stripeswp layersLayers <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- cssigniterteam gutenbee – gutenberg blocksGutenBee – Gutenberg Blocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- myaskai my askaiMy AskAI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- serverless-dnsserverless-dns is vulnerable to Command Injection through pr.yml GitHub Action Workflow9.3 Critical
- tp-link systems inc. tapo d230s1 v1.20Root Access via UART7.0 High
libwebpOSS-FuzzHeap-buffer-overflow in ProcessRowsNo scorelibwebpOSS-FuzzHeap-buffer-overflow in AddGreenToBlueAndRed_AVX2No scorelibcommons-lang3-javaDebianlibcommons-lang3-java - regression updateNo scorelibcommons-lang-javaDebianlibcommons-lang-java - regression updateNo score- openssl, siemens ruggedcom rst2428p, ruggedcom rst2428p firmware +27 more +29 moreOut-of-bounds read in HTTP client no_proxy handling5.9 Medium
- openssl, siemens ruggedcom rst2428p, ruggedcom rst2428p firmware +20 more +22 moreTiming side-channel in SM2 algorithm on 64 bit ARM5.9 Medium
- openssl, debian linux, siemens ruggedcom rst2428p +27 more +29 moreOut-of-bounds read & write in RFC 3211 KEK Unwrap9.8 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 extended lifecycle support +13 more +15 moreFreeipa: idm: privilege escalation from host to domain admin in freeipa9.1 Critical
- quadient ds-700 iqQuadient DS-700 iQ devices through 2025-09-30 might have a race condition during the quick...6.4 Medium
- No product listedAn SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital...6.5 Medium
- titansystems zenderTitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset...5.4 Medium
- eken video doorbell t6The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to...3.5 Low
- ebradyjobory finance.jsFinance.js vulnerable to DoS via the seekZero() parameter7.5 High
- ebradyjobory finance.jsFinance.js vulnerable to DoS via the IRR function’s depth parameter7.5 High
- Show moreLoading…