CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- mattermost, mattermost desktop +1 moreMattermost Desktop DoS when user has basic authentication server configured6.1 Medium
- ibm sterling b2b integrator, sterling file gateway +1 moreIBM Sterling B2B Integrator information disclosure5.5 Medium
- vmware spring frameworkSpring Framework STOMP CSRF Vulnerability4.3 Medium
- vmware spring cloud gateway server webfluxSpring Cloud Gateway Webflux SpEL Injection Vulnerability Allowing Exposure of Environment Variables7.5 High
- gnu binutils, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreGNU Binutils prdbg.c tg_tag_type return value4.8 Medium
- fortinet fortidlp, fortidlp agent +1 moreA insertion of sensitive information into log file in Fortinet FortiDLP 12.0.0 through 12.0.5, 11...4.2 Medium
- fortinet fortidlp, fortidlp agent +1 moreAn Exposure of Private Personal Information ('Privacy Violation') vulnerability [CWE-359] in...5.1 Medium
- fortinet fortidlp, fortidlp agent +1 moreAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability ...4.9 Medium
- fortinet fortidlp, fortidlp agent +1 moreAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability ...7.2 High
- wso2 api manager, api control plane +1 moreImproper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint9.8 Critical
- wso2 api manager, api manager analytics, api control plane +19 more +21 moreImproper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs9.6 Critical
- wso2 enterprise integrator, enterprise service bus, org.wso2.carbon:org.wso2.carbon.base +1 more +3 moreImproper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration5.7 Medium
- wso2 api control plane, api manager, identity server +8 more +10 morePotential Broken Access Control in Multiple WSO2 Products via System REST APIs9.8 Critical
- strapiLack of JWT Expiration after Log Out in Strapi6.3 Medium
- neojapan inc. desknet's neodesknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an...5.3 Medium
- neojapan inc. desknet's neoImproper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9...5.3 Medium
- neojapan inc. desknet's neoStored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow...4.8 Medium
- neojapan inc. desknet's neoStored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow...4.6 Medium
- neojapan inc. desknet's neoStored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow...4.8 Medium
- neojapan inc. desknet's web serverReflected cross-site scripting (XSS) vulnerability in desknet's Web Server allows execution of...5.1 Medium
- neojapan inc. desknet's neoStored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allow...4.8 Medium
- qtPossible denial of service with multiple incoming connections to a Schannel based server with a TLS backend9.2 Critical
- neojapan inc. chatluckChatLuck contains a cross-site scripting vulnerability in Guest User Sign-up. If exploited, an...5.3 Medium
- neojapan inc. chatluckChatLuck contains an insufficient granularity of access control vulnerability in Invitation of...6.9 Medium
- neojapan inc. chatluckChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary...4.8 Medium
- mattermost, mattermost server +1 moreArbitrary Mattermost Team can be joined by manipulating the OAuth state8.1 High
- apache traffic controlApache Traffic Control: ReDoS issue in Traffic Router configuration7.5 High
- mattermost, mattermost server +1 moreSlack import bypasses email verification for team access controls5.4 Medium
- hcl software bigfix mobile, hcltech bigfix modern client management +1 moreHCL BigFix Mobile is affected by an insecure Content Security Policy (CSP)6.5 Medium
- apache activemq nms amqp, apache software foundation activemq nms amqp client +1 moreApache ActiveMQ NMS AMQP Client: Deserialization of Untrusted Data9.8 Critical
- hcl software bigfix modern client management, hcltech bigfix mobile +1 moreHCL BigFix Modern Client Management (MCM) is affected by an insecure Content Security Policy (CSP)6.5 Medium
- mattermost, mattermost server +1 moreGuest user can add unauthorized team users to private channels3.1 Low
- mattermost, mattermost server +1 moreArbitrary Mattermost Team can be joined by manipulating the SAML RelayState8.1 High
- mattermost, mattermost server +1 moreInsecure string comparison enables timing attacks3.1 Low
- mattermost, mattermost server +1 moreGuest user can discover active public channels4.3 Medium
- sergestec exito, sistick +1 moreStored Cross-Site Scripting (XSS) vulnerability in Sergestec's Exito5.1 Medium
- sergestec exitoInsecure direct object reference (IDOR) vulnerability in Sergestec's Exito7.1 High
- sergestec sistickSQL injection vulnerability in Sergestec's Exito9.3 Critical
- eclipse foundation netx duo, eclipse threadx netx duo +1 morePotential out of bound read in _nx_ip_packet_receive()6.9 Medium
- sergestec exitoSQL injection vulnerability in Sergestec's Exito9.3 Critical
- naver whale browser, navercorp whale +1 moreWhale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a...7.5 High
- naver whale browser, navercorp whale +1 moreWhale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual...7.5 High
- naver whale browser, navercorp whale +1 moreWhale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab...9.8 Critical
- ricetheme felan frameworkFelan Framework <= 1.1.4 - Hardcoded Credentials9.8 Critical
- ricetheme felan frameworkFelan Framework <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation/Deactivation via process_plugin_actions5.3 Medium
- dreamstechnologies truelysell coreTruelysell Core <= 1.8.6 - Unauthenticated Arbitrary User Password Change9.8 Critical
- cridio studio classifiedpro - recommerce wordpress themeClassified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation8.8 High
- eclipse foundation netx duo, eclipse threadx netx duo +1 morePotential out of bound read issue in _nx_ipv4_packet_receive() in NetX Duo6.9 Medium
- eclipse threadx filex, eclipse foundation filex +1 moreEclipse ThreadX FileX RAM disk driver buffer overflow9.2 Critical
- eclipse foundation netx duo, eclipse threadx netx duo +1 moreOut of bound read in _nx_secure_tls_proc_clienthello_supported_versions_extension()6.9 Medium
- Show moreLoading…