CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- phoenix contact quint4-ups/24dc/24dc/10/eip, quint4-ups/24dc/24dc/20/eip, quint4-ups/24dc/24dc/40/eip +1 more +3 morePhoenix Contact: Unauthenticated Modbus Service DoS via Crafted Function Code5.3 Medium
- phoenix contact quint4-ups/24dc/24dc/10/eip, quint4-ups/24dc/24dc/20/eip, quint4-ups/24dc/24dc/40/eip +1 more +3 morePhoenix Contact: UPS Shutdown via Unauthenticated Modbus Command7.5 High
- eclipse threadxIncomplete validation of kernel object pointers in system calls5.7 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreLibxslt: type confusion in exsltfuncresultcompfunction of libxslt3.1 Low
- poporon pz-linkcardPz-LinkCard < 2.5.7 - Contributor+ SSRF3.8 Low
- unknown simple seoSimple SEO < 2.0.32 - Contributor+ Stored XSS6.1 Medium
- brainstormforce sureforms – contact form, payment form & other custom form builderSureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure4.3 Medium
- eaton ipp softwareImproper authentication of library files in the Eaton IPP software installer could lead to...8.6 High
- sap se s/4hana (manage processing rules - for bank statements)Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statements)4.3 Medium
- sap se print serviceDirectory Traversal vulnerability in SAP Print Service9.8 Critical
- sap se supplier relationship managementUnrestricted File Upload Vulnerability in SAP Supplier Relationship Management9.0 Critical
- sap se cloud appliance library appliancesSecurity Misconfiguration vulnerability in SAP Cloud Appliance Library Appliances3.0 Low
- sap se netweaver application server for abapCross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP5.4 Medium
- sap se commerce cloudDirectory Traversal vulnerability in SAP Commerce Cloud5.3 Medium
- sap se financial service claims managementUser Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management4.3 Medium
- sap se netweaver as abap and abap platformMemory Corruption vulnerability in SAP Netweaver AS ABAP and ABAP Platform5.3 Medium
- sap se application server for abap (bapi browser)Code Injection vulnerability in SAP Application Server for ABAP (BAPI Browser)5.4 Medium
quickjsOSS-FuzzHeap-use-after-free in JS_DefinePropertyNo scorearrowOSS-FuzzHeap-buffer-overflow in std::__1::pair<int, arrow::util::RleBitPackedParser::ControlFlow> arrow::util::RNo scoredistro-info-dataDebiandistro-info-data - database updateNo scorehttps-everywhereDebianhttps-everywhere - security updateNo score- No product listedkarakeep v0.26.0 to v0.7.0 was discovered to contain a Server-Side Request Forgery (SSRF).6.5 Medium
- No product listedImproper input validation in the component /kafka/ui/serdes/CustomSerdeLoader.java of kafka-ui v0...6.5 Medium
- No product listedAn issue in the Configure New Cluster interface of kafka-ui v0.6.0 to v0.7.2 allows attackers to...7.5 High
- No product listedA Cross-Site Request Forgery (CSRF) in the component /endpoints/currency/currency of Wallos v4.1...7.3 High
- No product listedStored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to inject...6.1 Medium
- No product listedA path traversal vulnerability in FastX3 thru 3.3.67 allows an unauthenticated attacker to read...7.3 High
- No product listedA path traversal in StarNet Communications Corporation FastX v.4 through v4.1.51 allows...6.5 Medium
- creativeitem academy lmsCreativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability...6.5 Medium
- microsoft asp.net core, asp.net core 2.3, asp.net core 8.0 +5 more +7 moreASP.NET Security Feature Bypass Vulnerability9.9 Critical
- microsoft .net, .net framework, .net 8.0 +15 more +17 more.NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability4.8 Medium
- microsoft .net, .net 8.0, .net 9.0 +2 more.NET Elevation of Privilege Vulnerability7.3 High
- No product listedAn incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in...9.0 Critical
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 1448.8 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 1448.8 High
- mozilla firefox, thunderbird +1 morePotential user-assisted code execution in “Copy as cURL” command8.1 High
- mozilla firefox, thunderbird +1 moreAn OBJECT tag type attribute overrode browser behavior on web resources without a content-type6.1 Medium
- mozilla firefox, thunderbird +1 moreSome non-writable Object properties could be modified6.5 Medium
- mozilla firefox, thunderbird +1 moreCross-process information leaked due to malicious IPC messages9.8 Critical
- mozilla firefox, thunderbird +1 moreOut of bounds read/write in a privileged process triggered by WebGL textures9.8 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in MediaTrackGraphImpl::GetInstance()9.8 Critical
gi-docgenAzure Linux,python-gi-docgenopenSUSE +1 moreGi-docgen: reflected dom xss in gi-docgen6.1 Medium- librenmsLibreNMS vulnerable to Reflected-XSS in `report_this` function5.5 Medium
- zheny-creator ytgrabber-tuiyt-grabber-tui allows arbitrary code execution via configurable yt-dlp path7.8 High
- gpp-woo gpp-burgerportaalName and e-mail of employee that has done a publication is discoverable in gpp-burgerportaal6.9 Medium
- labredescefetrj wegiaWeGIA Open Redirect Vulnerability in `control.php` endpoint `nextPage` parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle)4.8 Medium
- labredescefetrj wegiaWeGIA SQL Injection via 'id_dependente' param at endpoint `/html/funcionario/dependente_documento.php`9.4 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay has Incorrect Permission Assignment for Critical Resource4.8 Medium
- labredescefetrj wegiaWeGIA Cross-Site Scripting (XSS) Reflected endpoint id_pet5.3 Medium
- labredescefetrj wegiaWeGIA Reflected XSS to Account TakeOver at /html/configuracao/configuracao_geral.php via log parameter5.4 Medium
- Show moreLoading…