CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- iliasILIAS Test Import unserialize deserialization5.1 Medium
- iliasILIAS Certificate Import code injection5.3 Medium
- code-projects student crud operation, crud operation system +1 morecode-projects Student Crud Operation delete.php sql injection6.9 Medium
- langchain-ai langchain-ai/langchainXXE Vulnerability in langchain-ai/langchain7.5 High
- code-projects online course registration, fabian online course registration site +1 morecode-projects Online Course Registration edit-course.php sql injection5.1 Medium
- jinher oaJinher OA type xml external entity reference6.9 Medium
- ibm security verify access docker, security verify access, security verify access appliance +2 more +4 moreIBM Security Verify Access command execution7.3 High
- akkadotnet akka.netAkka.Remote TLS did not properly implement certificate-based authentication9.3 Critical
- ibm security verify access docker, security verify access, security verify access appliance +2 more +4 moreIBM Security Verify Access code execution8.5 High
- ibm security verify access docker, security verify access, security verify access appliance +2 more +4 moreIBM Security Verify Access privilege escalation9.3 Critical
- flagforgeFlagForge Allows Unauthenticated Badge Template API Access9.4 Critical
- topal solutions ag finanzbuchhaltungUnauthenticated RCE via .NET Deserialization in Topal Finance Software10.0 Critical
- d-link di-7100g c1, dlink di-7100g c1 firmware +1 moreD-Link DI-7100G C1 jhttpd hi_block.asp sub_4BD4F8 buffer overflow8.7 High
- emlogEmlog vulnerable to stored XSS in file upload functionality in emlog2.1 Low
- amd kria(tm) som, zynq ultrascale+ mpsocs, zynq ultrascale+ rfsocs +2 moreIn AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime...6.6 Medium
- weirdgloop mediawiki-extensions-bucketBucket vulnerable to infinite recursion when querying a bucket using the != operator6.5 Medium
- miguelgrinberg python-socketiopython-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments6.4 Medium
- d-link di-7100g c1, dlink di-7100g c1 firmware +1 moreD-Link DI-7100G C1 jhttpd login.cgi sub_4C0990 buffer overflow8.7 High
- flowiseai flowiseFlowiseAI/Flosise has File Upload vulnerability8.3 High
- sillytavernSillyTavern Web Interface Vulnerable to DNS Rebinding9.7 Critical
- litestar-org litestarX-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting7.5 High
- xwiki xwiki-platformXWiki Platform vulnerable to HQL injection via wiki and space search REST API9.3 Critical
- xwiki-contrib oidcXWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right9.2 Critical
- ibm transformation extender advancedIBM Transformation Extender Advanced code execution9.8 Critical
- four-faith water conservancy informatization platformFour-Faith Water Conservancy Informatization Platform download.do;othersusrlogout.do path traversal6.9 Medium
- four-faith water conservancy informatization platformFour-Faith Water Conservancy Informatization Platform download.do;otherlogout.do path traversal6.9 Medium
- d-link di-7100g c1, dlink di-7100g c1 firmware +1 moreD-Link DI-7100G C1 jhttpd msp_info.htm sub_46409C command injection5.1 Medium
- campcodes online apartment visitor management systemCampcodes Online Apartment Visitor Management System visitor-detail.php sql injection6.9 Medium
- langleyfcu online banking systemlangleyfcu Online Banking System Add Customer customer_add_action.php cross site scripting4.8 Medium
- cmseasyCmsEasy URL view.php cross site scripting5.1 Medium
- ideacmsIdeaCMS Website Name Config.php command injection5.1 Medium
- phpgurukul beauty parlour management systemPHPGurukul Beauty Parlour Management System sales-reports-detail.php sql injection5.3 Medium
- logo software inc. cloudXSS in Logo Software's Logo Cloud4.7 Medium
- logo software inc. cloudOpen Redirect in Logo Software's Logo Cloud5.5 Medium
- logo software inc. cloudHTML Injection in Logo Software's Logo Cloud4.3 Medium
- logo software inc. cloudIDOR in Logo Software's Logo Cloud6.0 Medium
- code-projects online course registration, fabian online course registration site +1 morecode-projects Online Course Registration manage-students.php sql injection6.9 Medium
- tenda ac18, ac18 firmware +1 moreTenda AC18 SetDDNSCfg stack-based overflow8.7 High
- ffmpegHeap-buffer-overflow write in FFmpeg SANM process_ftch8.7 High
- ffmpegHeap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec485.7 Medium
- ffmpegHeap-buffer-overflow read in FFmpeg DHAV get_duration5.7 Medium
- ffmpeg mpeg-dashHeap-buffer-overflow write in FFmpeg MDASH resolve_content_path8.7 High
- tenda ac18, ac18 firmware +1 moreTenda AC18 SetUpnpCfg stack-based overflow8.7 High
- tenda ac18, ac18 firmware +1 moreTenda AC18 WifiMacFilterSet stack-based overflow8.7 High
- sick baggage analytics, enterprise analytics, logistic diagnostic analytics +2 more +4 moreUsername Disclosure Through Missing Authentication5.3 Medium
- sick baggage analytics, logistic diagnostic analytics, package analytics +1 more +3 morePath Traversal6.5 Medium
- sick baggage analytics, logistic diagnostic analytics, package analytics +1 more +3 morePath traversal6.5 Medium
- sick baggage analytics, logistic diagnostic analytics, package analytics +1 more +3 moreInformation Disclosure Through Stacktrace2.7 Low
- sick baggage analytics, enterprise analytics, logistic diagnostic analytics +2 more +4 moreImproper Restriction of Excessive Authentication Attempts6.5 Medium
- sick baggage analytics, enterprise analytics, logistic diagnostic analytics +2 more +4 moreUser Enumeration by excessive error output5.3 Medium
- Show moreLoading…