CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- tp-link er605 firmware, er706w-4g firmware, er706w firmware +13 more +15 moreOS command injection in multiple parameters9.3 Critical
- tp-link er605 firmware, er706w-4g firmware, er706w firmware +13 more +15 moreOS command injection using information obtained from the web management interface8.6 High
- zimbra collaborationZimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat...5.0 Medium
code16/sharpPackagistcode16 Sharp vulnerable to Cross Site Scripting (XSS)6.1 Medium- phpgurukul bank locker management systemBank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting (XSS)...6.1 Medium
- No product listedThe incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows...7.5 High
- daicuodaicuocms V1.3.13 contains a SQL injection vulnerability in the file library\think\db\Builder.php.6.5 Medium
- daicuodaicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature.6.5 Medium
- No product listedMultiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR...6.1 Medium
- No product listedMultiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR...6.1 Medium
- No product listedMultiple stored cross-site scripting (XSS) vulnerabilities in the Current Goals function of HR...6.1 Medium
- processwireProcessWire CMS vulnerable to resource-exhaustion Denial of Service6.5 Medium
- No product listedImproper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017,...9.8 Critical
geographiclibDebianGeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode.7.5 High- No product listedMoodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object...4.3 Medium
- No product listedCross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated...8.9 High
- No product listedMoodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the...5.4 Medium
- qdocs smart schoolQDocs Smart School Management System 7.1 allows authenticated users with roles such as ...7.2 High
- No product listedLibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a...6.5 Medium
- d-link dsr-150An unauthenticated Local File Inclusion (LFI) vulnerability in D-Link DSR series routers allows...8.6 High
- hockeycomputindo bang restoCross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject...6.1 Medium
- arm mbed tlsMbed TLS through 3.6.4 has an Observable Timing Discrepancy.5.3 Medium
- No product listedBambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code...6.1 Medium
- reolinkThe Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt...5.1 Medium
- reolinkThe Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization...5.1 Medium
- reolinkReolink desktop application 8.18.12 contains a vulnerability in its local authentication...5.1 Medium
- reolinkReolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled...6.5 Medium
- No product listedLog2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via...6.5 Medium
- dlink dir-820l firmwareThe administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control...8.8 High
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreIncorrect Content-Type Header10.0 Critical
- bdthemes element pack – widgets, templates & addons for elementorElement Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery5.0 Medium
- geovision inc. embedded ip devices, gv-bx1500, gv-mfd1501 +2 moreGeoVision Command Injection RCE via /PictureCatch.cgi10.0 Critical
- the wikimedia foundation mediawiki watchanalytics extensionSQL injection in WatchAnalytics through Special:ClearPendingReviews7.5 High
- the wikimedia foundation mediawiki pageforms extensionStored XSS through system messages in PageForms5.8 Medium
- the wikimedia foundation mediawiki globalblocking extensionGlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSS5.8 Medium
- remram44 taguetteTaguette cross-site scripting vulnerability via tag name, tag description, document name and document description5.4 Medium
- remram44 taguetteTaguette vulnerable to password reset link poisoning7.1 High
uptime-kumanpmUptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read6.5 Medium- opentext flipperHQL Injection vulnerability has been discovered in Opentext Flipper.1.0 Low
- opentext flipperExternal Control of File path vulnerability has been discovered on Openext Flipper.5.3 Medium
- opentext flipperInsufficient Access Control vulnerability has been discovered in OpenText Flipper.2.3 Low
- opentext flipperPath traversal validation vulnerability has been discovered in opentext Flipper.5.3 Medium
- opentext flipperInsufficient access control vulnerability has been discovered in Opentext Flipper.1.0 Low
- vitejs vitevite allows server.fs.deny bypass via backslash on Windows6.0 Medium
- the wikimedia foundation mediawiki - languageselector extensionImproperly sanitized style parameter in LanguageSelector8.8 High
- abb terra ac wallbox (jp), terra ac wallbox (mid/ ce) -terra ac juno ce, terra ac wallbox (mid/ ce) -terra ac mid +3 more +5 moreHeap Memory Corruption Vulnerability6.1 Medium
- the wikimedia foundation mediawiki - externalguidanceStored XSS through system messages in ExternalGuidance6.9 Medium
@actual-app/sync-servernpmActual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers4.2 Medium- the wikimedia foundation mediawiki - multiboilerplate extensionmasteStored XSS through a system message in MultiBoilerplate6.9 Medium
- microchip time provider 4100, timeprovider 4100 firmware +1 moreSQL Injection in web resource7.1 High
- Show moreLoading…