CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- ruijie networks co., ltd. rg-est300Multiple versions of RG-EST300 provided by Ruijie Networks provide SSH server functionality. It...8.6 High
- hcl software bigfix mobile, hcltech bigfix modern client management +1 moreHCL BigFix Mobile 3.3 and earlier is affected by improper access control5.3 Medium
- hcl software bigfix modern client management, hcltech bigfix mobile +1 moreHCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control5.3 Medium
- brainstorm force ultimate addons for wpbakeryUltimate Addons for WPBakery Page Builder < 3.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- elemntor ally – web accessibility & usabilityAlly - Web Accessibility & Usability <= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- delta electronics asda-soft, deltaww asda soft +1 moreASDA-Soft Stack-based Buffer Overflow Vulnerability7.8 High
- delta electronics asda-soft, deltaww asda soft +1 moreASDA-Soft Stack-based Buffer Overflow Vulnerability7.8 High
- toddr yaml::syck, yaml\ +1 moreYAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure6.5 Medium
- No product listedA divide-by-zero in VirtIO network device emulation in BitVisor from commit 108df6 (2020-05-20)...5.5 Medium
- No product listedAn out-of-bounds write in VirtIO network device emulation in BitVisor from commit 108df6 (2020-05...8.2 High
- No product listedA Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4...7.1 High
- webminWebmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality ...7.1 High
- myupb ultimate php boardSQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php.6.5 Medium
- myupb ultimate php boardCross site scripting (XSS) vulnerability in Ultimate PHP Board 2.2.7 via the u_name parameter in...6.1 Medium
- No product listedFelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset (magic) links using the...8.2 High
- No product listedAn arbitrary file upload vulnerability in SageMath, Inc CoCalc before commit 0d2ff58 allows...6.5 Medium
- No product listedA hard-coded weak password vulnerability has been discovered in all Magic-branded devices from...6.5 Medium
- No product listedReolink Video Doorbell WiFi DB_566128M5MP_W performs insufficient validation of firmware update...5.1 Medium
- No product listedThe file mexcel.php in the Vfront 0.99.52 codebase contains a vulnerable call to unserialize...6.5 Medium
- No product listedHardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c (2025-05-26).6.5 Medium
- radare radare2radare2 v.5.9.8 and before contains a memory leak in the function _load_relocations.5.5 Medium
- No product listedBoolean SQL injection vulnerability in the web app of Base Digitale Group spa product Centrax...5.4 Medium
- No product listedSQL injection vulnerability in the cmd component of Base Digitale Group spa product Centrax Open...5.4 Medium
- No product listedAggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality,...8.2 High
- google chromeUse after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote...8.8 High
org.opensearch.dataprepper.plugins:geoip-processorMavenGeoIP processor disables SSL certificate validation when downloading databases5.9 Mediumorg.opensearch.dataprepper.plugins:geoip-processorMavenOpenSearch Data Prepper uses deprecated SSL protocol identifier4.8 Medium- apple ipados, macos, tvos +4 more +6 moreA double free issue was addressed with improved memory management. This issue is fixed in macOS...5.5 Medium
- apple macosA logic issue was addressed with improved restrictions. This issue is fixed in macOS Ventura 13.7...5.5 Medium
- apple macosThe issue was addressed with improved authentication. This issue is fixed in macOS Sequoia 15.6....7.8 High
- apple ipados, ios and ipados, iphone os +2 moreThe issue was resolved by not loading remote images This issue is fixed in iOS 18.6 and iPadOS 18...4.7 Medium
- devolutions serverImproper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and...8.8 High
- latchset luksmeta, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreLuksmeta: data corruption when handling luks1 partitions with luksmeta4.4 Medium
- in-toto go-witnessgo-witness Improper Verification of AWS EC2 Identity Documents6.9 Medium
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreAPIs Lack Rate Limiting10.0 Critical
- amazon opensearch data prepper, opensearch-project data-prepper +1 moreOpenSearch Data Prepper plugins trusts all SSL certificates by default7.4 High
- capricorn86 happy-dom--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom9.4 Critical
- ciscoheat sveltekit-superformssveltekit-superforms Prototype Pollution in `parseFormData` function of `formData.js`8.3 High
- blakeblackshear frigateFrigate Vulnerable to Arbitrary File Read via Export Thumbnail "image_path" parameter7.7 High
- hp, inc. sound researchSound Research SECOMNService Escalation of Privilege8.5 High
- hp, inc. sound researchSound Research SECOMNService Escalation of Privilege8.5 High
- eladnava mailgenMailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails2.9 Low
- adobe creative cloud desktop, creative cloud +1 moreCreative Cloud Desktop | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)5.6 Medium
- cisco cyber vision, secure firewall threat defense (ftd) software +1 moreMultiple Cisco Products Snort 3 MIME Denial of Service Vulnerability5.8 Medium
- cisco snort, cyber vision, secure firewall threat defense (ftd) software +1 more +3 moreMultiple Cisco Products Snort 3 MIME Information Disclosure or Denial of Service Vulnerability6.5 Medium
- cisco session initiation protocol (sip) software, desk phone 9841 firmware, desk phone 9851 firmware +15 more +17 moreCisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Cross-Site Scripting Vulnerability6.1 Medium
- cisco session initiation protocol (sip) software, desk phone 9841 firmware, desk phone 9851 firmware +15 more +17 moreCisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Denial of Service Vulnerability7.5 High
- cisco roomos software, roomos, telepresence collaboration endpoint +2 moreCisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure Vulnerability4.9 Medium
- zoom roomsZoom Rooms Clients - Authentication Bypass5.3 Medium
- zoom communications inc. clients for windows, zoom meeting software development kit, rooms +2 more +4 moreZoom Clients for Windows - Command Injection4.1 Medium
- Show moreLoading…