CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- servicenow ai platformReflected Cross Site Scripting in ServiceNow AI Platform5.3 Medium
- servicenow ai platformReflected Cross Site Scripting in ServiceNow AI Platform5.3 Medium
libjxlOSS-FuzzGlobal-buffer-overflow in void jxl::N_SSE4::WriteToOutputStage::StoreUnsignedRow<unsigned char>No score- sonarqubeIn SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users...4.3 Medium
- e107e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The...6.5 Medium
- yogeshojha rengineReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the...6.1 Medium
python-joseUbuntupython-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any...6.5 Medium- webkul bagistoBagisto is vulnerable to XSS through Admin Panel's product creation path8.3 High
- No product listedPublii CMS v0.46.5 (build 17089) allows persistent Cross-Site Scripting (XSS) via unsanitized...7.3 High
alt-design/alt-redirectPackagistAlt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw6.5 Medium- mingsoft mcmsAn arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code...6.5 Medium
- fairsketch rise ultimate project managerStored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject...8.1 High
- fabian simple online hotel reservation systemcode-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS)...4.1 Medium
- carmelo computer laboratory systemcode-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where entering a...9.8 Critical
- code-projects simple car rental systemcode-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege...9.9 Critical
- senior-walter online student clearance systemSourceCodester Online Student Clearance System 1.0 is vulnerable to Incorrect Access Control. The...8.8 High
- huayi-tec jeewmsJEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main...9.4 Critical
- huayi-tec jeewmsAn arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of...6.5 Medium
- No product listedA HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize...8.3 High
- ossf allstarAllstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret4.6 Medium
- avtech security corporation ip camera, nvr, and dvr devicesAVTECH CloudSetup.cgi Authenticated Command Injection8.7 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to XSS through its Calendar Events parameters4.8 Medium
- microsoft 365 copilot chat, 365 copilot's business chat +1 moreCopilot Information Disclosure Vulnerability9.3 Critical
- microsoft 365 copilot chat, 365 copilot's business chat +1 moreCopilot Information Disclosure Vulnerability9.3 Critical
- microsoft azure cache for redis enterprise, azure managed redis, azure cache for redis +2 moreRedis Enterprise Elevation of Privilege Vulnerability8.7 High
- microsoft 365 word copilotM365 Copilot Information Disclosure Vulnerability9.3 Critical
- microsoft azure monitorAzure Monitor Log Analytics Spoofing Vulnerability9.3 Critical
- microsoft azure playfabAzure PlayFab Elevation of Privilege Vulnerability8.8 High
- microsoft entra id, entra +1 moreAzure Entra ID Elevation of Privilege Vulnerability9.8 Critical
- microsoft entra id, entra +1 moreAzure Entra ID Elevation of Privilege Vulnerability9.6 Critical
- akilli commerce software technologies ltd. co. e-commerce websitecode-projects E-Commerce Website user_index_search.php sql injection6.9 Medium
- projectworlds gate pass management systemprojectworlds Gate Pass Management System add-pass.php sql injection6.9 Medium
- confidential-containers trusteeTrustee's attestation-policy endpoint is not protected by admin autentication8.7 High
- apple macosA logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26. An...5.5 Medium
- d-link nuclias connectD-Link Nuclias Connect < v1.3.1.4 Directory Traversal to Arbitrary File Deletion7.2 High
- bigbluebuttonBigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId7.5 High
- carmelo simple leave managercode-projects Simple Leave Manager user.php sql injection6.9 Medium
- campcodes online learning management systemCampcodes Online Learning Management System calendar_of_events.php sql injection6.9 Medium
- bigbluebuttonBigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation7.5 High
- newforma project centerNewforma Info Exchange (NIX) forced NTLMv2 authentication via /NPCSRemoteWeb/LegacyIntegrationServices.asmx8.2 High
- newforma project centerNewforma Info Exchange (NIX) default anonymous access6.9 Medium
- newforma project centerNewforma Info Exchange (NIX) stored XSS via SVG file upload5.1 Medium
- newforma project centerNewforma Info Exchange (NIX) open URL redirect via /DownloadWeb/hyperlinkredirect.aspx5.3 Medium
- newforma project centerNewforma Info Exchange (NIX) forced NTLMv2 authentication via /UserWeb/Common/MarkupServices.ashx8.2 High
- newforma project centerNewforma Info Exchange (NIX) forced NTLMv2 authentication via /RemoteWeb/IntegrationServices.ashx6.0 Medium
- newforma project centerNewforma Info Exchange (NIX) limited file read5.3 Medium
- newforma project centerNewforma Info Exchange (NIX) insecure file upload8.7 High
- newforma project centerNewforma Info Exchange (NIX) insufficiently protected credentials4.8 Medium
- newforma project centerNewforma Info Exchange (NIX) arbitrary file read and delete6.1 Medium
- newforma project centerNewforma Info Exchange (NIX) shared hard-coded secret key6.3 Medium
- Show moreLoading…