CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- connectwise automateHTTP Configuration and Encryption in Transit9.6 Critical
- drawing-captcha drawing-captcha-appDrawing-Captcha APP Host Header Injection in `/register` and `/confirm-email` Endpoints8.8 High
- d-link nuclias connectD-Link Nuclias Connect <= v1.3.1.4 Stored Cross-Site Scripting (XSS)5.1 Medium
- d-link nuclias connectD-Link Nuclias Connect <= v1.3.1.4 Forgot Password Account Enumeration6.9 Medium
- d-link nuclias connectD-Link Nuclias Connect <= v1.3.1.4 Login Account Enumeration6.9 Medium
- angular angular-cliServer-Side Request Forgery (SSRF) in Angular SSR8.7 High
- element-hq matrix-authentication-serviceMatrix Authentication Service account password can be changed using an authenticated session without supplying the current password8.3 High
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket V5 Blind SQL injection in the Admin Panel6.7 Medium
- bagistobagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)6.9 Medium
- bagistobagisto - Cross Site Scripting (XSS) in Create New Customer6.9 Medium
- bagistobagisto - Server Side Template Injection (SSTI) in Product Description5.1 Medium
- bagistobagisto - CSV Formula Injection in Create New Product7.1 High
- bagistobagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)6.9 Medium
- emqx mqttxMQTTX vulnerable to cross-site scripting via improper message payload rendering6.1 Medium
- ilevia eve x1 server firmware, ilevia srl. eve x1 server +1 moreIlevia EVE X1 Server 4.7.18.0.eden Absolute Path Traversal8.7 High
- ilevia eve x1 server firmware, ilevia srl. eve x1 server +1 moreIlevia EVE X1 Server 4.7.18.0.eden Authenticated Command Injection8.7 High
- ilevia eve x1 server firmware, ilevia srl. eve x1 server +1 moreIlevia EVE X1 Server 4.7.18.0.eden Insecure Hashing Algorithm8.2 High
- ilevia eve x1 server firmware, ilevia srl. eve x1 server +1 moreIlevia EVE X1 Server 4.7.18.0.eden Reflected XSS5.1 Medium
- ilevia eve x1 server firmware, ilevia srl. eve x1 server +1 moreIlevia EVE X1 Server 4.7.18.0.eden Relative Path Traversal8.7 High
- ilevia eve x1 server firmware, ilevia srl. eve x1 server +1 moreIlevia EVE X1 Server 4.7.18.0.eden Root Privilege Escalation9.3 Critical
- librenmsLibreNMS alert-rules Cross-Site Scripting Vulnerability3.8 Low
- ilevia eve x1 server firmware, ilevia srl. eve x1 server +1 moreIlevia EVE X1 Server 4.7.18.0.eden Unauthenticated Command Injection9.3 Critical
- ilevia eve x1 server firmware, ilevia srl. eve x1 server +1 moreIlevia EVE X1 Server 4.7.18.0.eden Use of Default Credentials9.3 Critical
- envoyproxy envoyEnvoy allows large requests and responses to cause TCP connection pool crash6.6 Medium
- elated-themes frappeFrappe has an Open Redirect on Login Page6.1 Medium
- prestashop checkout, prestashopcorp ps checkout +1 morePrestaShop Checkout Target PayPal merchant account hijacking from backoffice3.8 Low
- prestashop checkout, prestashopcorp ps checkout +1 morePrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure4.1 Medium
- prestashop checkout, prestashopcorp ps checkout +1 morePrestaShop Checkout allows customer account takeover via email9.1 Critical
- icinga, icinga icinga2 +1 moreIcinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user4.0 Medium
- opexus foiaxpressOPEXUS FOIAXpress unauthenticated administrator password reset8.9 High
- icinga, icinga icinga2 +1 moreIcinga 2 Denial of Service (DoS) By Dereferencing Invalid Reference7.1 High
- icinga, icinga icinga2 +1 moreIcinga 2 API users could access restricted values in filter expressions7.1 High
- icinga db web, icingadb-web +1 moreIcinga DB Web hidden/protected custom variables are prone to filter enumeration5.3 Medium
- librenmsStored XSS in Alert Transport name field in LibreNMS5.5 Medium
- ibm mqIBM MQ denial of service7.5 High
- kiteworks security-advisoriesNextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a table6.5 Medium
- strapiStrapi core vulnerable to sensitive data exposure via CORS misconfiguration6.5 Medium
- strapiMissing Maximum Password Length Validation in Strapi Password Hashing6.3 Medium
- strapiStrapi Allows Unauthorized Access to Private Fields via parms.lookup8.2 High
- apeman id71Apeman ID71 set_alias.cgi cross site scripting5.1 Medium
- quickjsInteger overflow in js_bigint_from_string in QuickJS7.1 High
- quickjsType confusion in string addition in QuickJS7.1 High
- quickjsType confusion in string addition in QuickJS7.1 High
- quickjsHeap out-of-bounds read in js_bigint_to_string1 in QuickJS5.9 Medium
- quickjsHeap out-of-bounds read in js_typed_array_indexOf in QuickJS5.9 Medium
- quickjsUse-after-free in js_std_promise_rejection_check in QuickJS8.8 High
- quickjsUse-after-free in js_print_object in QuickJS8.8 High
- shazwazza smidgeShazwazza Smidge Bundle path traversal5.3 Medium
- gnu binutils, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreGNU Binutils ldmisc.c vfinfo out-of-bounds4.8 Medium
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data6.5 Medium
- Show moreLoading…