CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- qnap qsync centralQsync Central5.3 Medium
- qnap qsync centralQsync Central5.3 Medium
- qnap qsync centralQsync Central7.1 High
- qnap qsync centralQsync Central7.1 High
- qnap qsync centralQsync Central7.1 High
- qnap qsync centralQsync Central7.1 High
- qnap qsync centralQsync Central5.3 Medium
- qnap video stationVideo Station5.3 Medium
- hcl myxalytics, hcltech dryice myxalytics +1 moreCross Site Scripting vulnerability in the web application7.6 High
- redisLua library commands may lead to integer overflow and potential RCE7.0 High
- anysphere cursorCursor CLI Agent: Sensitive File Overwrite Bypass7.1 High
- anysphere cursorCursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config8.8 High
- anysphere cursorCursor CLI's Cursor Agent MCP OAuth2 Communication is Vulnerable to Remote Code Execution8.8 High
- anysphere cursorCursor is vulnerable to RCE via .code-workspace files using Prompt Injection7.5 High
- autonomy logic openplc runtimeOpenPLC Runtime v3 Persistent DoS7.1 High
- phpmyfaqphpMyFAQ duplicate email registration allows multiple accounts with the same email8.1 High
- qtUse-after-free vulnerability in Qt SVG qsvghandler.cpp allows denial of service via crafted SVG9.4 Critical
- qtUncontrolled recursion in Qt SVG module9.4 Critical
- anthropic claude code, anthropics claude-code +1 moreClaude Code: Permission deny bypass is possible through symlink2.3 Low
- logo software inc. tigerwings erpHardcoded Credentials in Logo Software's TigerWings ERP5.9 Medium
- draytek corporation vigor 2927 lte, vigor1000b, vigor2135 +17 more +19 moreCVE-2025-105479.8 Critical
- zabbixInsufficient permission check for the problem.view.refresh action5.1 Medium
- zabbixDLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration7.3 High
- zabbixUser information disclosure via api_jsonrpc.php on method user.get with param search2.1 Low
- isin basi advertisement information technologies trade inc. it's workifXSS in Isin Basi Advertisement & IT's Workif4.1 Medium
- zabbixLDAP 'Bind password' field value can be leaked by a Zabbix Super Admin4.3 Medium
- mod vvisit counter vvisit counterSQL injection in the mod_vvisit_counter module9.3 Critical
- hameha ultimate viral quizUltimate Viral Quiz <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- hovanesvn ap backgroundAP Background <= 3.8.2 - Cross-Site Request Forgery4.3 Medium
- hovanesvn ap backgroundAP Background <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- hovanesvn ap backgroundAP Background 3.8.1 - 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload via advParallaxBackAdminSaveSlider Function8.8 High
- ekndev wp dispatcherWP Dispatcher <= 1.2.0 - Authenticated (Subscriber+) Arbitrary File Upload7.5 High
- antonshevchuk constructorConstructor <= 1.6.5 - Missing Authorization to Authenticated (Subscriber+) Theme Clean4.3 Medium
- pencilwp x addons for elementorX Addons for Elementor <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Video ID Field6.4 Medium
- odude flexi – guest submitFlexi <= 4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via flexi-form-tag Shortcode6.4 Medium
- wpt00ls schema plugin for divi, gutenberg & shortcodesSchema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation6.3 Medium
- umarbajwa notification barNotification Bar <= 2.2 - Cross-Site Request Forgery4.3 Medium
- mtoolstec auto bulb finder for wordpressAuto Bulb Finder for WordPress <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- contentmx content publisherContentMX Content Publisher <= 1.0.6 - Cross-Site Request Forgery4.3 Medium
- samueljesse wp sinotypeWP SinoType <= 1.0 - Cross-Site Request Forgery4.3 Medium
- ekndev wp dispatcherWP Dispatcher <= 1.2.0 - Authenticated (Contributor+) SQL Injection8.8 High
- ambitioncloud fintelligence calculatorFintelligence Calculator <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- pressmaximum customifyCustomify <= 0.4.11 - Cross-Site Request Forgery4.3 Medium
- gbsdeveloper ultimate multi design video carouselUltimate Multi Design Video Carousel <= 1.4 - Authenticated (Editor+) Stored Cross-Site Scripting5.5 Medium
- nebelhorn blappsta mobile app plugin – your native, mobile iphone app and android appBlappsta Mobile App Plugin – Your native, mobile iPhone App and Android App <= 0.8.8.8 - Unauthenticated SQL Injection7.5 High
- mikemayhem3030 epic bootstrap buttonsEpic Bootstrap Buttons <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icol Parameter6.4 Medium
- devrix restrict user registrationRestrict User Registration <= 1.0.1 - Cross-Site Request Forgery to Settings Update5.3 Medium
- gopiplus woo superb slideshow transition gallery with random effectWoo superb slideshow transition gallery with random effect <= 9.1 - Authenticated (Contributor+) SQL Injection6.5 Medium
- mekshq meks easy mapsMeks Easy Maps <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bsmye paypal formsPayPal Forms <= 1.0.3 - Cross-Site Request Forgery4.3 Medium
- Show moreLoading…