CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- hashgraph guardian, nozomi networks cmc +1 moreAuthenticated SQL Injection on Smart Polling functionality in Guardian/CMC before 25.2.06.0 Medium
- hashgraph guardian, nozomi networks cmc +1 moreIncorrect authorization for CLI in Guardian/CMC before 25.2.07.2 High
- hashgraph guardian, nozomi networks cmc +1 moreClient-side path traversal in Guardian/CMC before 25.2.05.8 Medium
- bbmri-eric negotiatorMúltiples vulnerabilidades en Negotiator de BBMRI-ERIC5.3 Medium
- bbmri-eric negotiatorMúltiples vulnerabilidades en Negotiator de BBMRI-ERIC5.1 Medium
- phpgurukul cyber cafe management systemPHPGurukul Cyber Cafe Management System POST Parameter search.php cross site scripting5.3 Medium
- callvision healthcare emergency codeSQLi in Callvision Healthcare's Callvision Emergency Code9.8 Critical
- tenda ac15, ac15 firmware +1 moreTenda AC15 saveAutoQos stack-based overflow8.7 High
- tenda ac15, ac15 firmware +1 moreTenda AC15 setNotUpgrade stack-based overflow8.7 High
- tenda ac15, ac15 firmware +1 moreTenda AC15 fast_setting_pppoe_set stack-based overflow8.7 High
- tenda ac15, ac15 firmware +1 moreTenda AC15 POST Parameter SetDDNSCfg stack-based overflow8.7 High
- tenda ac20, ac20 firmware +1 moreTenda AC20 fast_setting_wifi_set sscanf buffer overflow8.7 High
- jakowenko double-takejakowenko double-take API app.js app.use cross site scripting5.3 Medium
- code-projects simple banking systemcode-projects Simple Banking System transfermoney.php sql injection5.3 Medium
- webfactory wp resetWP Reset <= 2.05 - Unauthenticated Sensitive Information Exposure via wf-licensing.log5.3 Medium
- code-projects simple banking systemcode-projects Simple Banking System removeuser.php sql injection5.3 Medium
MozillaFirefoxopenSUSESecurity update for MozillaFirefoxNo scoregstreamer-plugins-rsSUSESecurity update for gstreamer-plugins-rsNo score- code-projects simple banking systemcode-projects Simple Banking System createuser.php sql injection5.3 Medium
- marceljm featured image from url (fifu)Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields6.4 Medium
- tenda ac23, ac23 firmware +1 moreTenda AC23 SetStaticRouteCfg sscanf buffer overflow8.7 High
- utt 1250gw, 1250gw firmware +1 moreUTT 1250GW aspChangeChannel strcpy buffer overflow8.7 High
- code-projects online hotel reservation systemcode-projects Online Hotel Reservation System addslideexec.php unrestricted upload5.3 Medium
- nmedia admin and customer messages after order for woocommerce: orderconvoOrderConvo <= 15.1 - Unauthenticated Arbitrary File Read8.6 High
- code-projects online hotel reservation systemcode-projects Online Hotel Reservation System addgalleryexec.php unrestricted upload5.3 Medium
- code-projects online hotel reservation systemcode-projects Online Hotel Reservation System addexec.php unrestricted upload5.3 Medium
- pdfmakepdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding8.7 High
- code-projects online hotel reservation systemcode-projects Online Hotel Reservation System editpicexec.php unrestricted upload5.3 Medium
- campcodes online apartment visitor management systemCampcodes Online Apartment Visitor Management System bwdates-reports-details.php sql injection6.9 Medium
- campcodes online apartment visitor management systemCampcodes Online Apartment Visitor Management System search-visitor.php sql injection6.9 Medium
- campcodes online apartment visitor management systemCampcodes Online Apartment Visitor Management System index.php sql injection6.9 Medium
- code-projects student crud operation, crud operation system +1 morecode-projects Student Crud Operation Add Student Page/Edit Student add.php move_uploaded_file unrestricted upload6.9 Medium
libwebpOSS-FuzzUse-of-uninitialized-value in HasAlpha32b_SSE2No scorearrowOSS-FuzzHeap-buffer-overflow in std::__1::pair<int, arrow::util::RleBitPackedParser::ControlFlow> arrow::util::RNo score- ankitects ankiIn Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written...2.9 Low
- ankitects ankiAnkitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary...6.7 Medium
- ankitects ankiIn Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable...6.7 Medium
- element-hq synapseSynapse: Invalid device keys degrade federation functionality5.3 Medium
- rems markdown to html converterSourcecodester Markdown to HTML Converter v1.0 is vulnerable to a Cross-Site Scripting (XSS) in...6.1 Medium
- No product listedCubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into...8.2 High
- puneethreddyhc event management systemA Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC...6.1 Medium
- No product listedA SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online...9.8 Critical
- No product listedClash Verge Rev thru 2.2.3 forces the installation of system services(clash-verge-service) by...7.8 High
- nagios log serverNagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to...8.5 High
- nagios log serverNagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext...9.9 Critical
- tesla telematics control unit (tcu)Tesla Telematics Control Unit (TCU) < v2025.14 Authentication Bypass8.6 High
- pyvistaPyVista has Dependency Confusion Vulnerability in that leads to RCE9.3 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Profile Widget does not prevent vCard extension spoofing4.8 Medium
- xuemian168 kunoKuno CMS Vulnerable to Server-Side Request Forgery (SSRF) via Unsafe SVG Upload5.1 Medium
- iliasILIAS Base64 Decoding unserialize deserialization5.3 Medium
- Show moreLoading…