CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- wiresharkLoop with Unreachable Exit Condition ('Infinite Loop') in Wireshark5.5 Medium
- cel-rustcel-rust May Panic During Parsing of Invalid CEL Expressions7.5 High
- external-secretsExternal Secrets Operator's BeyondTrust Provider has Insecure Secret Retrieval8.7 High
- hcl software bigfix webuiHCL BigFix WebUI is affected by a host header poisoning vulnerability6.1 Medium
- popplerGHSL-2025-042: Poppler has Use-After-Free6.1 Medium
- python-ldappython-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination5.5 Medium
- python-ldappython-ldap has sanitization bypass in ldap.filter.escape_filter_chars5.5 Medium
- code-projects gym management systemCodeAstro Gym Management System user-payment.php sql injection5.3 Medium
- code-projects gym management systemCodeAstro Gym Management System index.php sql injection5.3 Medium
- tenda ac7, ac7 firmware +1 moreTenda AC7 setNotUpgrade stack-based overflow8.7 High
- code-projects project monitoring systemcode-projects Project Monitoring System useredit.php sql injection6.9 Medium
- code-projects online job search enginecode-projects Online Job Search Engine searchjob.php sql injection6.9 Medium
- frappe learning, lms +1 moreFrappe had attachments made by students to their assignments of type Text set to public2.7 Low
- code-projects online job search enginecode-projects Online Job Search Engine postjob.php sql injection6.9 Medium
- code-projects online job search enginecode-projects Online Job Search Engine registration.php sql injection6.9 Medium
- emlogEmlog Pro has CSRF issue that Enables Admin Password Reset8.1 High
- cherry-ai cherry studio, cherryhq cherry-studio +1 moreCherry Studio allows one-click on a specific URL to cause a command to execute9.7 Critical
- capricorn86 happy-domHappy-DOM has VM Context Escape7.2 High
- astroAstro's `X-Forwarded-Host` is reflected with no validation6.5 Medium
- sinatraSinatra has ReDoS vulnerability in ETag header value generation2.7 Low
- authlibAuthlib is vulnerable to Denial of Service via Oversized JOSE Segments7.5 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to CSRF through publication comments5.1 Medium
- powerjobPowerJob OpenAPIController runJob authorization6.9 Medium
- powerjobPowerJob list authorization6.9 Medium
- nvidia geforce, guest driver, rtx, quadro, nvs +2 more +4 moreNVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to use a...7.0 High
- nvidia geforce, guest driver, rtx, quadro, nvs +1 more +3 moreNVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use...7.0 High
- nvidia geforce, rtx, quadro, nvs, tesla +2 moreNVIDIA Display Driver contains a vulnerability where an uncontrolled DLL loading path might lead...8.2 High
- rackRack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing7.5 High
- amazon freertos-plus-tcpInvalid Pointer Dereference when receiving UDP/IPv6 packets in FreeRTOS-Plus-TCP5.3 Medium
- amazon freertos-plus-tcpBuffer Over-read when receiving IPv6 packets with incorrect payload length in FreeRTOS-Plus-TCP5.3 Medium
- amazon freertos-plus-tcp, aws freertos-plus tcp +1 moreBuffer Over-read when receiving improperly sized ICMPv6 packets in FreeRTOS-Plus-TCP5.3 Medium
- rackRack has Possible Information Disclosure Vulnerability5.8 Medium
- juliaweb http.jlHTTP.jl vulnerable to Header injection/Response splitting via header construction.8.7 High
- quic-goquic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame7.5 High
- ash-project ashBypass and runtime policies that can never pass may be incorrectly applied in filter authorization8.6 High
podofoSUSESecurity update for podofoNo score- usta information systems inc. aybs interaktifIDOR in Usta Information Systems' Aybs Interaktif6.1 Medium
- usta information systems inc. aybs interaktifAuthorization Bypass in Usta Information Systems' Aybs Interaktif6.7 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Commerce is vulnerable to XSS through account "name" field4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's Membership page is vulnerable to XSS through “name“ text field4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to XSS through its workflow process builder4.6 Medium
- No product listedWP JobHunt <= 7.6 Authenticated (Custom+) Authorization Bypass5.4 Medium
- No product listedWP JobHunt <= 7.6 - Authenticated (Candidate+) Stored Cross-Site Scripting via ‘cs_job_title’6.4 Medium
- nwaples rardecodeDoS via Out Of Memory Crash5.3 Medium
- fuji electric co., ltd. / hakko electronics co., ltd. v-sft, fujielectric monitouch v-sft +1 moreA use after free vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier....8.4 High
- synchroweb kiwireCVE-2025-111905.4 Medium
- synchroweb kiwireCVE-2025-111897.3 High
- synchroweb kiwireCVE-2025-111887.3 High
- fuji electric co., ltd. / hakko electronics co., ltd. v-sft, fujielectric monitouch v-sft +1 moreAn out-of-bounds read vulnerability exists in VS6ComFile!CSaveData::delete_mem of V-SFT v6.2.7.0...8.4 High
- fuji electric co., ltd. / hakko electronics co., ltd. v-sft, fujielectric monitouch v-sft +1 moreAn out-of-bounds read vulnerability exists in VS6ComFile!get_ovlp_element_size of V-SFT v6.2.7.0...8.4 High
- Show moreLoading…