CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- labredescefetrj wegiaWeGIA SQL Injection via 'cpf' param at endpoint `/html/funcionario/cadastro_funcionario_pessoa_existente.php`8.6 High
- ivanti endpoint managerSQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary...6.5 Medium
- ivanti endpoint managerSQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary...6.5 Medium
- ivanti endpoint managerSQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary...6.5 Medium
- ivanti endpoint managerSQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary...6.5 Medium
- labredescefetrj wegiaWeGIA Cross-Site Scripting (XSS) Reflected endpoint '/html/atendido/cadastro_atendido_parentesco_pessoa_nova.php' parameter 'idatendido'3.5 Low
- ivanti endpoint managerSQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary...6.5 Medium
- ivanti endpoint managerSQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary...6.5 Medium
- ivanti endpoint managerSQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary...6.5 Medium
- ivanti endpoint managerSQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary...6.5 Medium
- ivanti endpoint managerSQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary...6.5 Medium
- ivanti endpoint managerSQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary...6.5 Medium
- labredescefetrj wegiaWeGIA vulnerable to SQL Injection via 'id_funcionario' param at endpoint `/html/funcionario/dependente_listar.php`8.6 High
- ivanti endpoint managerSQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary...6.5 Medium
- ivanti endpoint managerPath traversal in Ivanti Endpoint Manager allows a remote unauthenticated attacker to achieve...8.8 High
- ivanti endpoint managerInsecure deserialization in Ivanti Endpoint Manager allows a local authenticated attacker to...7.8 High
- joinmastodon mastodonMastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels4.3 Medium
- joinmastodon mastodonMastodon streaming API fails to disconnect disabled and suspended users4.3 Medium
- joinmastodon mastodonMastodon allows continued access after password reset via CLI3.5 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay is Vulnerable to Authorization Bypass Through User-Controlled Key5.3 Medium
- oobabooga text-generation-webuitext-generation-webui allows arbitrary file read via symbolic link upload6.2 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Mentions Web is Vulnerable to Cross-site Scripting4.8 Medium
tracexeccrates.iotracexec has `env` command argument injection via environment variables starting with dash in traced exec events1.0 Low- siderolabs omniOmni leaks information via the API8.6 High
- siderolabs omniOmni is Vulnerable to DoS via Empty Create/Update Resource Requests5.3 Medium
- mattermost, mattermost desktop +1 moreMattermost Desktop App crashes when clicking on malformed external URL3.5 Low
- liferay dxp, digital experience platform +1 moreLiferay Commerce Order Content Web is Vulnerable to Authorization Bypass Through User-Controlled Key5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key5.3 Medium
- rathenarAthena map-server use-after-free vulnerability in RODEX7.5 High
- underctrl-io commandkitCommandKit exposes incorrect command name in context object for message command aliases6.1 Medium
- whimsies-yat vickeyVickey's unexpired email confirmation link can be reused to send repeated confirmation emails6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Publications is vulnerable to Incorrect Authorization5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Publications vulnerable to Authorization Bypass Through User-Controlled Key4.8 Medium
- mongodb rust driverConfiguration may unexpectedly disable certificate validation8.0 High
- llamaindex, run-llama run-llama/llama index +1 moreWorld-Writable NLTK Cache Directory Vulnerability in run-llama/llama_index7.1 High
- dell supportassist for business pcs, supportassist for home pcs +1 moreSupportAssist for Home PCs versions 4.8.2 and prior and SupportAssist for Business PCs versions 4...6.3 Medium
- linux, linux kernel +1 morexfrm: xfrm_alloc_spi shouldn't use 0 as SPI7.8 High
- linux kernel, linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +6 more +8 morecrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg7.8 High
- elastic cloud enterprise (ece), cloud enterprise +1 moreElastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine9.1 Critical
kernelTuxCare,kernel-abi-stablelistsTuxCare,kernel-coreTuxCare +54 more +56 moreUpdate of kernelNo score- akin software computer import export industry and trade co. ltd. qrmenuIDOR in Akınsoft QRMenu7.5 High
- cats information technology software development technologies aykome license tracking systemSQLi in Cats Informatics' Aykome9.8 Critical
- unknown wp private content plusWP Private Content Plus <= 3.6.2 - Password Protection Bypass6.5 Medium
- asus armoury crateA null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be...6.8 Medium
- asus armoury crateA stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be...6.8 Medium
- qwc-services qwc-registration-guiCross-Site Scripting Vulnerability in QWC2 Registration GUI6.9 Medium
- qgis qwc2Cross-Site Scripting Vulnerability in QWC26.9 Medium
- asus armoury crateA link following vulnerability exists in the UnifyScanner component of Armoury Crate. This...8.5 High
- code-projects automated voting systemcode-projects Automated Voting System update_user.php sql injection5.1 Medium
- ragic enterprise cloud databaseRagic｜Enterprise Cloud Database - Arbitrary File Upload8.6 High
- Show moreLoading…