CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreBIG-IP Configuration utility XSS vulnerability8.4 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreBIG-IP Configuration utility vulnerability6.9 Medium
- f5 big-ip, big-ip access policy manager, big-ip ssl orchestrator +2 moreBIG-IP APM and SSL Orchestrator vulnerability7.1 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreBIG-IP iRules vulnerability8.7 High
- oct8ne chatbotStored Cross-Site Scripting (XSS) in Oct8ne Chatbot5.3 Medium
- alloy-rs coreAlloy Core has a DoS vulnerability on `alloy_dyn_abi::TypedData` hashing7.5 High
- eclipse foundation netx duo, eclipse threadx netx duo +1 morePotential out of bound read and info leak in_nx_secure_tls_psk_identity_find()6.9 Medium
- eclipse threadx netx duo, eclipse foundation netx duo +1 morePotential out of bound read in _nx_secure_tls_process_clienthello()6.9 Medium
- tariffuxxTARIFFUXX <= 1.4 - Authenticated (Contributor+) SQL Injection via tariffuxx_configurator Shortcode6.5 Medium
- quicoto zip attachmentsZip Attachments <= 1.6 - Missing Authorization to Unauthenticated Private And Password-Protected Posts Attachment Disclosure5.3 Medium
- eflyjason shortcode buttonShortcode Button <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- digisellerDigiseller <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- oceanpayment creditcard gatewayOceanpayment CreditCard Gateway <= 6.0 - Missing Authentication to Unauthenticated Order Status Update5.3 Medium
- miunosoft task schedulerTask Scheduler <= 1.6.3 - Authenticated (Admin+) Blind Server-Side Request Forgery4.4 Medium
- tbenyon external loginExternal Login <= 1.11.2 - Authenticated (Subscriber+) Sensitive Data Exposure via Test Connection4.3 Medium
- jankimoradiya find and replace content for wordpressFind And Replace content for WordPress <= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting7.2 High
- steadycontent content writerContent Writer <= 3.6.8 - Unauthenticated Information Exposure via Log File5.3 Medium
- victornavarro ownid passwordless loginOwnID Passwordless Login <= 1.3.4 - Authentication Bypass9.8 Critical
- gsayed786 orion sms otp verification.Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeover9.8 Critical
- quicoto zip attachmentsZip Attachments <= 1.6 - Missing Authorization to Limited File Deletion5.3 Medium
- andreiigna quick social loginQuick Social Login <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- akbrohi wp google map pluginWP Google Map Plugin <= 1.0 - Authenticated (Contributor+) SQL Injection6.5 Medium
- steve-forster theme importerTheme Importer <= 1.0 - Cross-Site Request Forgery4.3 Medium
- owthub library management systemLibrary Management System <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Manipulation4.3 Medium
- fmeaddons topbarTopBar <= 1.0.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- falldeaf wp viewstlWP ViewSTL <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- letscms binary mlm planBinary MLM Plan <= 3.0 - Unauthenticated Limited Privilege Escalation6.5 Medium
- ikhodal woocommerce category and products accordion panelCategory and Products Accordion Panel <= 1.0 - Authenticated (Contributor+) Local File Inclusion7.5 High
- maycorolbuche1 outdoorOutdoor <= 1.3.2 - Unauthenticated SQL Injection7.5 High
- dash8x dhivehi textDhivehi Text <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- hakik bifröst – instant passwordless temporary login linksWPBifröst – Instant Passwordless Temporary Login Links <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation8.8 High
- salamzadeh urlyar url shortnerURLYar <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- tbenyon external loginExternal Login <= 1.11.2 - Unauthenticated SQL Injection via log7.5 High
- themeinwp demo import kitDemo Import Kit <= 1.1.0 - Authenticated (Admin+) Arbitrary File Upload7.2 High
- ajitdas flex qr code generatorFlex QR Code Generator <= 1.2.5 - Unauthenticated Arbitrary File Upload9.8 Critical
- ivycat wp jquery pagerWP jQuery Pager <= 1.4.0 - Authenticated (Contributor+) SQL Injection via Shortcode6.5 Medium
- jjlemstra whydonate – free donate button – crowdfunding – fundraisingWhyDonate – FREE Donate button – Crowdfunding – Fundraising <= 4.0.15 - Missing Authorization to Unauthenticated wp_wdplugin_style Rww Deletion5.3 Medium
- gopiplushotmailcom wp tabber widgetWp tabber widget <= 4.0 - Authenticated (Contributor+) SQL Injection6.5 Medium
- flenskiproject funkitoolsFunKItools <= 1.0.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- onofficeweb onoffice for wp-websitesonOffice for WP-Websites <= 6.5.1 - Authenticated (Editor+) SQL Injection4.9 Medium
- jayce53 rich snippet site reportRich Snippet Site Report <= 2.0.0105 - Authenticated (Admin+) SQL Injection4.9 Medium
- nicholasbosch wp dashboard chatWP Dashboard Chat <= 1.0.3 - Authenticated (Contributor+) SQL Injection via id6.5 Medium
- cyberlord92 login with yourmembership – ym sso loginLogin with YourMembership - YM SSO Login <= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym_display_test_attributes'5.3 Medium
- nexist keyy two factor authentication (like clef)Keyy Two Factor Authentication (like Clef) <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover8.8 High
- geolocationtechnology docodoco store locatorDocoDoco Store Locator <= 1.0.1 - Authenticated (Editor+) Arbitrary File Upload7.2 High
- remko wp bookwidgetsWP BookWidgets <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- linuxwifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()8.8 High
- linuxblk-mq: fix blk_mq_tags double free while nr_requests grownNo score
- linuxscsi: target: target_core_configfs: Add length check to avoid buffer overflow7.1 High
- linux, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreALSA: usb-audio: fix race condition to UAF in snd_usbmidi_freeNo score
- Show moreLoading…