CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- softwud page blocksPage Blocks <= 1.1.0 - Cross-Site Request Forgery4.3 Medium
- husainahmedqureshi wp easy togglesWP Easy Toggles <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- rico-macchi wp scraperWP Scraper <= 5.8.1 - Authenticated (Administrator+) Server-Side Request Forgery6.8 Medium
- ndiego easy plugin statsEasy Plugin Stats <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- jma plugins woocommerce designer proWooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion9.8 Critical
- widgetpack comment systemWidgetPack Comment System <= 1.6.1 - Cross-Site Request Forgery4.3 Medium
- wpcodefactory stock history & reports manager for woocommerceStock History & Reports Manager for WooCommerce <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- huawei harmonyosVulnerability of improper exception handling in the print module. Successful exploitation of this...5.5 Medium
- huawei harmonyosVulnerability of improper exception handling in the print module. Successful exploitation of this...5.9 Medium
- huawei harmonyosBuffer overflow vulnerability in the device management module. Successful exploitation of this...6.2 Medium
- huawei harmonyosBuffer overflow vulnerability in the device management module. Successful exploitation of this...6.2 Medium
- huawei harmonyosUse After Free (UAF) vulnerability in the storage management module. Successful exploitation of...8.4 High
- huawei harmonyosData processing error vulnerability in the package management module. Successful exploitation of...7.3 High
- ywxbear php basic bookstore website, php-bookstore-website-example +1 moreywxbear PHP-Bookstore-Website-Example Quantity index.php improper validation of specified quantity in input6.9 Medium
- huawei harmonyosBuffer overflow vulnerability in the sensor service. Successful exploitation of this...5.9 Medium
- huawei harmonyosBuffer overflow vulnerability in the development framework module. Successful exploitation of...5.9 Medium
- huawei harmonyosDenial of service (DoS) vulnerability in the office service. Successful exploitation of this...3.3 Low
- huawei harmonyosDenial of service (DoS) vulnerability in the office service. Successful exploitation of this...3.3 Low
- huawei harmonyosDenial of service (DoS) vulnerability in the office service. Successful exploitation of this...3.3 Low
- huawei harmonyosDenial of service (DoS) vulnerability in the office service. Successful exploitation of this...5.5 Medium
- huawei harmonyosUse After Free (UAF) vulnerability in the office service. Successful exploitation of this...7.8 High
- huawei harmonyosDenial of service (DoS) vulnerability in the office service. Successful exploitation of this...3.3 Low
- creativemindssolutions cm registration – tailored tool for seamless login and invitation-based registrationsCM Registration – Tailored tool for seamless login and invitation-based registrations <= 2.5.6 - Open Redirect4.7 Medium
- wpclever wpc smart wishlist for woocommerceWPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation5.3 Medium
- contest-gallery contest gallery – upload & vote photos, media, sell with paypal & stripeContest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection4.3 Medium
- ovatheme events managerOvatheme Events Manager <= 1.8.5 - Unauthenticated Arbitrary File Upload9.8 Critical
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection4.9 Medium
- sergiotrinity trinity audio – text to speech ai audio player to convert content into audioTrinity Audio <= 5.21.0 - Unauthenticated Information Exposure5.3 Medium
- wphocus my auctions allegroMy Auctions Allegro Plugin <= 3.6.31 - Authenticated (Admin+) SQL Injection4.9 Medium
- apustheme wp freeioWP Freeio <= 1.2.21 - Unauthenticated Privilege Escalation9.8 Critical
- dartiss draft listDraft List <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- shortpixel enable media replaceEnable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode6.4 Medium
- code-projects gym management systemCodeAstro Gym Management System delete-equipment.php sql injection5.3 Medium
- code-projects gym management systemCodeAstro Gym Management System edit-equipmentform.php sql injection5.3 Medium
- code-projects gym management systemCodeAstro Gym Management System delete-member.php sql injection5.3 Medium
- huawei harmonyosPermission control vulnerability in the media module. Successful exploitation of this...5.3 Medium
- huawei harmonyosPermission control vulnerability in the network module. Successful exploitation of this...5.9 Medium
- huawei harmonyosPermission control vulnerability in the Wi-Fi module. Successful exploitation of this...5.5 Medium
- huawei harmonyosPermission control vulnerability in the camera module. Successful exploitation of this...2.8 Low
- huawei harmonyosIdentity authentication bypass vulnerability in the Gallery app. Successful exploitation of this...6.2 Medium
- huawei harmonyosPermission verification bypass vulnerability in the Camera app. Successful exploitation of this...4.0 Medium
- everestthemes everest backup – wordpress cloud backup, migration, restore & cloning pluginEverest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure5.9 Medium
- extend themes colibri page builderColibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode6.4 Medium
- huawei harmonyosPermission control vulnerability in the Gallery module. Successful exploitation of this...6.2 Medium
- code-projects gym management systemCodeAstro Gym Management System equipment-entry.php sql injection5.3 Medium
- unisoc (shanghai) technologies co., ltd. t606/t612/t616/t750/t765/t760/t770/t820/s8000/t8300/t9300In modem, there is a possible system crash due to improper input validation. This could lead to...7.5 High
- unisoc (shanghai) technologies co., ltd. t750/t765/t760/t770/t820/s8000/t8300/t9300In modem, there is a possible system crash due to improper input validation. This could lead to...7.5 High
github.com/microstack-tech/parallaxGoParallax is vulnerable to DoS via malicious p2p message7.5 Highflowisenpm,flowise-componentsnpm +1 moreFlowise is vulnerable to arbitrary file exposure through its ReadFileTool7.7 High- authlibAuthlib : JWE zip=DEF decompression bomb enables DoS6.5 Medium
- Show moreLoading…