CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- 10web map builder for google maps10WebMapBuilder <= 1.0.63 - Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change7.2 High
- the wikimedia foundation mediawiki cargo extensionSQL injection in Cargo via Special:CargoExport2.1 Low
- the wikimedia foundation mediawiki quizgame extensionStored XSS through system messages in QuizGame2.0 Low
- the wikimedia foundation mediawiki pollny extensionStored XSS through system messages in PollNY2.0 Low
- the wikimedia foundation mediawiki webauthn extensionStored XSS in WebAuthn key name5.8 Medium
- shenzhen ruiming technology streamax crocus, streamax crocus +1 moreShenzhen Ruiming Technology Streamax Crocus DeviceFileReport.do download path traversal5.3 Medium
- starcitizentools mediawiki-skins-citizenCitizen vulnerable to stored XSS in sticky header button messages6.5 Medium
- shenzhen ruiming technology streamax crocus, streamax crocus +1 moreShenzhen Ruiming Technology Streamax Crocus Service.do download path traversal5.3 Medium
- shenzhen ruiming technology streamax crocus, streamax crocus +1 moreShenzhen Ruiming Technology Streamax Crocus DeviceState.do Query sql injection5.3 Medium
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreIncorrect Content-Type Header10.0 Critical
- zheny-creator ytgrabber-tuiyt-grabber-tui local arbitrary file overwrite via TOCTOU race in config file creation6.3 Medium
- shenzhen ruiming technology streamax crocus, streamax crocus +1 moreShenzhen Ruiming Technology Streamax Crocus DeviceFault.do Query sql injection5.3 Medium
- shenzhen ruiming technology streamax crocus, streamax crocus +1 moreShenzhen Ruiming Technology Streamax Crocus MemoryState.do query sql injection5.3 Medium
- thingsboardThingsBoard < v4.2.1 SVG Image SSRF6.9 Medium
- thingsboardStored Cross-Site Scripting (XSS) in ThingsBoard6.2 Medium
- shenzhen ruiming technology streamax crocus, streamax crocus +1 moreShenzhen Ruiming Technology Streamax Crocus RepairRecord.do queryLast sql injection5.3 Medium
- shenzhen ruiming technology streamax crocus, streamax crocus +1 moreShenzhen Ruiming Technology Streamax Crocus FileDir.do uploadFile unrestricted upload5.3 Medium
- marsupialtail quokkaRemote Code Execution by Pickle Deserialization via FlightServer in pyquokka9.8 Critical
ibexa/fieldtype-richtextPackagistibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text4.8 Mediumibexa/admin-uiPackagistibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal4.8 Mediumezsystems/ezplatform-admin-uiPackagistezsystems/ezplatform-admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal4.8 Mediumibexa/userPackagistibexa/user login enumerates user accounts6.9 Medium- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5 stored XSS via video/photo fields5.4 Medium
- lobehub lobe-chatSSRF in lobehub/lobe-chat with native web fetch module3.0 Low
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket path traversal vulnerability in template editor allows arbitrary file read and write6.7 Medium
- dataeaseDataEase vulnerable to JDBC URL injection in DB2 and MongoDB data source configuration8.2 High
- dataeaseDataEase vulnerable to remote code execution via H2 JDBC driver bypass8.2 High
- dataeaseDataEase vulnerable to stored cross-site scripting via file upload bypass5.5 Medium
- dataeaseDataEase SQL injection vulnerability8.7 High
- imagemagickImageMagick vulnerable to denial of service via integer overflow in BMP decoder on 32-bit systems5.9 Medium
- squid-cache squidSquid vulnerable to information disclosure via authentication credential leakage in error handling10.0 Critical
- openbaoOpenBao vulnerable to denial of service via malicious JSON request processing7.5 High
- silabs.com gecko sdk, simplicity sdk +1 moreZigbee Green Power Host Buffer Overflow Vulnerability9.4 Critical
rsyncTuxCareUpdate of rsyncNo score- langgenius difyDify MCP OAuth Flow Vulnerable to XSS2.0 Low
- qodo genA path traversal vulnerability in all versions of the Qodo Qodo Gen IDE enables a threat actor to...7.5 High
- chancmsyanyutao0402 ChanCMS gather.js getArticle code injection5.3 Medium
- windsurfA path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read...9.8 Critical
- google kerasKeras framework vulnerable to deserialization of untrusted data9.8 Critical
- chancmsyanyutao0402 ChanCMS hasUse sql injection5.3 Medium
- eclipse threadx netx duo, eclipse foundation netx duo +1 moreWeb http client: Unchecked Server-Side Malicious Packet Issue8.8 High
- jason c. memberlite shortcodesWordPress Memberlite Shortcodes plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- chancmsyanyutao0402 ChanCMS update sql injection5.3 Medium
- chancmsyanyutao0402 ChanCMS findField sql injection5.3 Medium
- ash-project ashAuthorization bypass when bypass policy condition evaluates to true8.6 High
sudoTuxCare,sudo-develTuxCare +1 moreUpdate of sudoNo scorechronySUSESecurity update for chronyNo score- hikvision isecure centerSome versions of Hikvision's iSecure Center Product contain insufficient parameter validation,...9.8 Critical
- hikvision isecure centerSome versions of Hikvision's iSecure Center Product have an improper file upload control...9.8 Critical
- letscms binary mlm planBinary MLM Plan <= 5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference4.3 Medium
- Show moreLoading…