CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- ruijie networks co., ltd. rg-uacRuijie RG-UAC nmc_sync.php Command Injection9.3 Critical
- huijietong cloud video platformHuijietong Cloud Video Platform fileDownload Arbitrary File Read8.7 High
- dbl technology (dbltek) goipDBLTek GoIP Telnet Admin Interface Undocumented Backdoor9.3 Critical
- bytevalue (luoyang baiwei intelligent technology co., ltd.) flow control routerBYTEVALUE Intelligent Flow Control Router Command Injection9.3 Critical
- adobe bridgeBridge | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe bridgeBridge | Heap-based Buffer Overflow (CWE-122)5.5 Medium
- adobe animateAnimate | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe animateAnimate | Use After Free (CWE-416)7.8 High
- adobe animateAnimate | Out-of-bounds Read (CWE-125)5.5 Medium
- adobe animateAnimate | NULL Pointer Dereference (CWE-476)5.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSamba: vfs_streams_xattr uninitialized memory write possible4.3 Medium
- creativeitem academy lmsCreativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token...9.4 Critical
- creativeitem academy lmsCreativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on...6.4 Medium
- creativeitem academy lmsCreativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful...2.2 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSamba: command injection in wins server hook script10.0 Critical
- pwncollege dojopwn.college DOJO vulnerable to improper authentication in workspace endpoint allowing unauthorized Windows VM access9.5 Critical
- adobe connectAdobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)9.3 Critical
- adobe connectAdobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)8.1 High
- adobe connectAdobe Connect | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)4.3 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Incorrect Authorization (CWE-863)6.5 Medium
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)4.8 Medium
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Incorrect Authorization (CWE-863)8.1 High
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Incorrect Authorization (CWE-863)5.9 Medium
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)8.1 High
- parse-community parse-sdk-jsParse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs6.4 Medium
github.com/cometbft/cometbftGoCometBFT's invalid BitArray handling can lead to network halt8.7 High- adobe substance3d - stager, substance 3d stager +1 moreSubstance3D - Stager | Integer Overflow or Wraparound (CWE-190)7.8 High
- adobe substance3d - stager, substance 3d stager +1 moreSubstance3D - Stager | Use After Free (CWE-416)7.8 High
- adobe substance3d - stager, substance 3d stager +1 moreSubstance3D - Stager | Out-of-bounds Read (CWE-125)7.8 High
- adobe substance3d - stager, substance 3d stager +1 moreSubstance3D - Stager | Integer Overflow or Wraparound (CWE-190)7.8 High
- adobe substance3d - stager, substance 3d stager +1 moreSubstance3D - Stager | Out-of-bounds Read (CWE-125)7.8 High
- adobe dimensionDimension | Out-of-bounds Read (CWE-125)7.8 High
- adobe dimensionDimension | Out-of-bounds Read (CWE-125)7.8 High
- adobe dimensionDimension | Use After Free (CWE-416)7.8 High
- adobe dimensionDimension | Integer Overflow or Wraparound (CWE-190)7.8 High
- freepbx endpointmanFreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter8.6 High
- flowiseai flowiseFlowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright Packages8.4 High
- elastic endpointFreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters8.6 High
- adobe illustratorIllustrator | Out-of-bounds Write (CWE-787)7.8 High
- adobe illustratorIllustrator | Out-of-bounds Write (CWE-787)7.8 High
- freepbx core, sangoma freepbx +1 moreFreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page8.5 High
- nvidia igx orin, jetson orin series, jetson thor series +2 moreNVIDIA Jetson Linux and IGX OS contain a vulnerability in NvMap, where improper tracking of...5.5 Medium
- adobe framemakerAdobe Framemaker | Heap-based Buffer Overflow (CWE-122)7.8 High
- adobe framemakerAdobe Framemaker | Use After Free (CWE-416)7.8 High
- elastic endpointFreePBX Endpoint Manager command injection via Network Scanning feature8.6 High
- adobe substance3d - modeler, substance 3d modeler +1 moreSubstance3D - Modeler | Out-of-bounds Read (CWE-125)7.8 High
- nvidia jetson orin series, jetson xavier series +1 moreNVIDIA Jetson Linux contains a vulnerability in UEFI, where improper authentication may allow a...7.6 High
- Show moreLoading…