CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- abb coresense™ hm, coresense™ m10 +1 morePath Traversal Vulnerability8.2 High
- the wikimedia foundation mediawiki - lastmodified extensionStored XSS through system messages in LastModified6.9 Medium
- eclipse threadx netx duo, eclipse foundation nextx duo +1 moreIn NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the server DUID from the server reply. With a…6.3 Medium
- microchip time provider 4100, timeprovider 4100 firmware +1 moreRCE on restore configuration password8.9 High
- devolutions server, mongodb +1 moreUse-after-free in the MongoDB server query planner may lead to crash or undefined behavior5.3 Medium
- microchip time provider 4100, timeprovider 4100 firmware +1 moreRCE on backup configuration password8.9 High
- error311 fileriseFileRise insecure folder visibility via name-based mapping and incomplete ACL checks8.1 High
- error311 fileriseFileRise improper ownership/permission validation allowed cross-tenant file operations8.1 High
- abb als-mini-s4 ip, als-mini-s8 ip +1 moreMissing Authentication Vulnerability9.9 Critical
- oatpp oatpp-mcpReuse of session IDs in oatpp-mcp leads to session hijacking and prompt hijacking by remote attackers6.8 Medium
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5 executes arbitrary PHP code7.2 High
- netbird vpn netbirdAdmin with default credentials in NetBird VPN9.3 Critical
- linuxmedia: iris: Fix memory leak by freeing untracked persist buffer6.8 Medium
- linuxmedia: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID2.4 Low
- linuxmedia: stm32-csi: Fix dereference before NULL checkNo score
- linuxASoC: qcom: audioreach: fix potential null pointer dereferenceNo score
- linuxnet/smc: fix warning in smc_rx_splice() when calling get_page()7.8 High
- linuxdrm/gma500: Fix null dereference in hdmi teardownNo score
- linuxafs: Fix potential null pointer dereference in afs_put_server5.5 Medium
- linuxfs/proc/task_mmu: check p->vec_buf for NULL6.8 Medium
- linuxkmsan: fix out-of-bounds access to shadow memory5.7 Medium
- linuxnetfs: fix reference leakNo score
- linuxmm/hugetlb: fix folio is still mapped when deleted7.8 High
- linux, linux kernel +1 morespi: cadence-quadspi: Implement refcount to handle unbind during busy5.5 Medium
- apache syncopeApache Syncope: Remote Code Execution by delegated administrators7.2 High
- vhs electronic software ltd. co. ace centerIDOR in VHS Electronic Software's ACE Center5.5 Medium
- truffle security co. trufflehogAn arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co....7.8 High
- warmcat libwebsocketsOut-of-bounds Write in libwebsockets PNG parsing5.9 Medium
- warmcat libwebsocketsOut-of-bounds Read in libwebsockets PNG parsing5.9 Medium
- warmcat libwebsocketStack-based Buffer Overflow in libwebsockets DNS response parsing7.5 High
- warmcat libwebsocketsUse After Free in libwebsockets WebSocket server6.3 Medium
- tawk live chatCross-Site Scripting (XSS) stored in Tawk Live Chat5.3 Medium
- grupo castilla epsilon rhSQL injection in Epsilon RH9.3 Critical
- oracle graalvm, graalvm for jdk, jdk +4 more +6 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...3.7 Low
- oracle graalvm, graalvm for jdk, jdk +4 more +6 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...7.5 High
- oracle graalvm, graalvm for jdk, jdk +4 more +6 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...5.9 Medium
- honor fcp-an10Tileservice module is affected by information leak vulnerability, successful exploitation of this...2.9 Low
- honor magicosPhoto module is affected by information leak vulnerability, successful exploitation of this...4.0 Medium
- honor magicosSome Honor products are affected by information leak vulnerability, successful exploitation of...4.0 Medium
- galaxy software services vitals espGalaxy Software Services Vitals ESP Forum Module - Unrestricted Upload of File with Dangerous Type9.3 Critical
- motex lanscope endpoint manager, motex inc. lanscope endpoint manager (on-premises) (client program (mr) and detection agent (da)) +1 moreLanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly...9.3 Critical
- fsas technologies inc. eternus sf advancedcopy manager standard edition (for rhel 7/ 8/ 9), eternus sf advancedcopy manager standard edition (for solaris 10/ 11), eternus sf advancedcopy manager standard edition (for windows server 2016/ 2019/ 2022) +5 more +7 moreETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions...8.4 High
- linuxnet/9p: Fix buffer overflow in USB transport layerNo score
- excellent infotek document management systemExcellent Infotek｜Document Management System - Arbitrary File Upload9.3 Critical
quickjsOSS-FuzzUse-of-uninitialized-value in js_create_functionNo score- No product listedAn issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker...7.6 High
- No product listedA Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically...6.1 Medium
- No product listedSQL Injection vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the...9.8 Critical
- No product listedA Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically...6.1 Medium
- tastyigniterTastyIgniter vulnerable to Cross-Site Scripting8.8 High
- Show moreLoading…