CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- liferay dxp, portal, digital experience platform +2 more Liferay Portal and DXP use an incorrect cache-control header 4.6 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 more Qemu-kvm: stack buffer overflow in e1000 device via short frames in loopback mode 6.2 Medium
- microsoft edge (chromium-based), edge chromium +1 more Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability 6.3 Medium
- silabs.com silicon labs z-wave sdk Silicon Labs Z-Wave PIR Sensor Joins Network as Non-Secure 7.6 High
- logicaldoc community edition, logicaldoc +1 more LogicalDOC Community Edition Admin Login login.jsp excessive authentication 6.3 Medium
- logicaldoc community edition, logicaldoc +1 more LogicalDOC Community Edition API Key creation UI cross site scripting 5.1 Medium
- elog ELOG user profile missing authorization 8.7 High
- elog ELOG configuration file authorization bypass 9.3 Critical
- elog ELOG file upload stored XSS 8.6 High
- liferay dxp, portal, digital experience platform +2 more Liferay Portal and DXP affected by multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page 4.6 Medium
- liferay dxp, portal, digital experience platform +2 more Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter 5.1 Medium
- microsoft configuration manager, configuration manager 2403, configuration manager 2409 +1 more +3 more Microsoft Configuration Manager Spoofing Vulnerability 4.8 Medium
- python, python software foundation cpython +1 more Quadratic complexity in os.path.expandvars() with user-controlled template 1.8 Low
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 more Missing Security Headers 6.9 Medium
- bizerba brain2 Scripts for the module Global_Shipping executable on BRAIN2 Server 8.4 High
- bizerba brain2 Unencrypted communication to Active Directory services 8.4 High
- bizerba connect.brain Insecure service configuration – unquoted path 8.8 High
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 more Server Certificate Verification Disabled 10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 more Insufficient Password Policy 6.9 Medium
- iso 15118-2 network and application protocol requirements ev car chargers International Standards Organization ISO 15118-2 Improper Restriction of Communication Channel to Intended Endpoints 5.3 Medium
- agno Agno session state overwrites between different sessions/users 7.1 High
- circutor tcprs1plus INCORRECT SECURITY VALIDATION IN SENDING UDP FRAMES 9.2 Critical
- circutor tcprs1plus EXCHANGE OF SENSITIVE INFORMATION IN CLEAR TEXT 8.3 High
- circutor tcprs1plus Denial of service through specific packets 9.2 Critical
- circutor tcprs1plus CLICKJACKING 5.1 Medium
- opera norway as gamemaker ide Integer overflow in GameMaker IDE below 2024.14.0 version can lead to can lead to application... 7.5 High
- afterlogic aurora Stored XSS vulnerability in Afterlogic Aurora webmail 5.3 Medium
- analytify pro Analytify Pro <= 7.0.3 - Unauthenticated Information Exposure 5.3 Medium
- circutor tcprs1plus HIJACKING OF THE TOKEN AND GAINING ACCESS 7.7 High
- ibm jazz for service management IBM Jazz for Service Management is vulnerable to "filter" cookie not sent over SSL 3.7 Low
- ibm infosphere information server IBM InfoSphere Information Server is vulnerable to privilege escalation 7.8 High
- nagios xi Nagios XI < 2024R1.1 XSS via Missing Page / 404 5.1 Medium
- eset endpoint antivirus, endpoint security for windows, file security for microsoft azure +10 more +12 more Denial-of-service vulnerability in ESET security products for Windows 6.8 Medium
-
rtvm-interpretercrates.io rtvm-interpreter lacks sufficient checks in public API 2.7 Low - xen Incorrect removal of permissions on PCI device unplug 7.5 High
- mikado-themes bard WordPress Bard theme <= 1.6 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium
- adrian tobey groundhogg WordPress Groundhogg plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- stylemix masterstudy lms WordPress MasterStudy LMS plugin <= 3.6.27 - SQL Injection vulnerability 7.6 High
- colabrio ohio extra WordPress Ohio Extra plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- stylemixthemes masterstudy WordPress Masterstudy theme < 4.8.126 - Local File Inclusion vulnerability 7.5 High
- seventhqueen kleo WordPress Kleo theme < 5.5.0 - Local File Inclusion vulnerability 7.5 High
- seventhqueen k elements WordPress K Elements plugin < 5.5.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- stylemixthemes consulting elementor widgets WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- stylemixthemes consulting elementor widgets WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Local File Inclusion vulnerability 7.5 High
- stylemixthemes consulting WordPress Consulting theme < 6.7.5 - Local File Inclusion vulnerability 7.5 High
- webtoffee smart coupons for woocommerce WordPress Smart Coupons for WooCommerce plugin <= 2.2.3 - Broken Access Control vulnerability 4.3 Medium
- younes jfr. advanced database cleaner WordPress Advanced Database Cleaner plugin <= 3.1.6 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium
- f1logic insert php code snippet WordPress Insert PHP Code Snippet plugin <= 1.4.3 - Broken Access Control vulnerability 4.3 Medium
- matias ventura gutenberg WordPress Gutenberg plugin <= 21.8.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
- chouby polylang WordPress Polylang plugin <= 3.7.3 - Deserialization of untrusted data vulnerability 8.8 High
- Show olderLoading…