CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
shopware/corePackagist,shopware/platformPackagist +1 moreShopware Customer Orders can be canceled, even if refunds are disabled4.3 Mediumshopware/corePackagist,shopware/platformPackagist +1 moreShopware exposes sensitive user information via CSV export mapping4.9 Mediumshopware/corePackagist,shopware/platformPackagist +1 moreShopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice2.7 Lowshopware/corePackagist,shopware/platformPackagist +1 moreShopware vulnerable to path traversal via Plugin upload2.7 Lowshopware/corePackagist,shopware/platformPackagist +1 moreShopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually5.3 Medium- cloudedge appImproper Neutralization of Wildcards or Matching Symbols in CloudEdge Online Cameras and App8.7 High
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreHTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute5.3 Medium
- opentext flipperExternal Control of File vulnerability has been discovered in opentext Flipper.5.3 Medium
- raisecomm rax701-gc-wp-01 p200r002c52, rax701-gc-wp-01 p200r002c53 +1 moreAuthentication Bypass Using an Alternate Path or Channel in Raisecomm RAX701-GC Series9.3 Critical
- joinmastodon mastodonMastodon quotes control can be bypassed4.3 Medium
- labredescefetrj wegiaWeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'action'6.9 Medium
- labredescefetrj wegiaWeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'sql'6.9 Medium
- atlassian confluence data center, confluence server +1 moreThis High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of...8.3 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal fails to verify messages from the cluster network is trusted6.9 Medium
- koajs koaKoa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic4.3 Medium
- offis dcmtkDCMTK dcmqrscp dcmqrcnf.cc readPeerList null pointer dereference4.8 Medium
- offis dcmtkDCMTK dcmqrscp parseQuota stack-based overflow4.8 Medium
- simple sa simple.erpSQL Injection in SIMPLE.ERP7.1 High
- wolfsshHost verification bypass and credential leak9.4 Critical
- beyaz bilgisayar software design industry and trade ltd. co. cityplusInformation Disclosure in Beyaz Computer's CityPLus8.2 High
- wolfsshBuffer overwrite when processing file handles with the SFTP server1.8 Low
- zohocorp manageengine applications managerInformation disclosure6.5 Medium
- zohocorp manageengine admanager plusCommand Injection8.5 High
borrowck_sacrificescrates.ioBorrowck Scarifices exposes uninitialized memory in any_as_u8_slice2.0 Lowncursescrates.ioncurses exposes uninitialized memory in string reading functions5.5 Mediumbinary_vec_iocrates.iobinary_vec_io access memory out-of-bounds in binary_read_to_ref and binary_write_from_ref7.3 Highorx-pinned-veccrates.ioorx-pinned-vec has undefined behavior in index_of_ptr with empty slices2.0 Lowdirect_ring_buffercrates.ioDirect Ring Buffer has uninitialized memory exposure in create_ring_buffer2.0 Low- astral-sh tokio-tarastral-tokio-tar Vulnerable to PAX Header Desynchronization8.1 High
- efficientlab workexaminer professionalUnencrypted cleartext communication in EfficientLab WorkExaminer Professional7.1 High
- efficientlab workexaminer professionalMissing Server-Side Authentication Checks in EfficientLab WorkExaminer Professional9.8 Critical
- zohocorp analytics plus, manageengine analytics plus +1 moreSQL Injection8.3 High
- efficientlab workexaminer professionalUsage of Hardcoded FTP Credentials EfficientLab WorkExaminer Professional8.8 High
- zohocorp endpoint central, manageengine endpoint central +1 moreXML Injection5.2 Medium
- zohocorp endpoint central, manageengine endpoint central +1 moreArbitrary File Deletion3.3 Low
- gisoft information technologies city guideXSS in GiSoft's City Guide6.1 Medium
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted SQL Injection Vulnerability5.4 Medium
- digiwin easyflow .net, easyflow ainet +1 moreDigiwin｜EasyFlow .NET and EasyFlow AiNet - Missing Authentication8.7 High
- the wikimedia foundation mediawiki - lockdown extensionThe compare API module breaks Extension:Lockdown10.0 Critical
- unknown formgentFormGent < 1.0.4 - Unauthenticated Arbitrary File Deletion9.1 Critical
- the wikimedia foundation mediawiki - wikistoriesStored XSS through system messages6.9 Medium
- the wikimedia foundation mediawiki - pagetriage extensionStored XSS through system messages6.9 Medium
- the wikimedia foundation mediawiki - wikilove extensionStored XSS through a system message6.9 Medium
- the wikimedia foundation mediawiki - wikilambda extensionStored XSS through system messages6.9 Medium
- the wikimedia foundation mediawiki foundation - springboard extensionMultiple critical security issues in Springboard6.9 Medium
- the wikimedia foundation mediawiki - translate extensionSpecial:Translate tool does not use the correct IP and User-Agent in the CheckUser tool6.9 Medium
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +2 more +4 moreA missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5...8.1 High
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +2 more +4 moreA post-authentication command injection vulnerability in Zyxel ATP series firmware versions from...7.2 High
- tp-link systems inc. omada gateways, tp-link er605 firmware, er706w-4g firmware +13 more +15 moreUnauthorized root access via debug functionality8.7 High
- tp-link systems inc. omada gateways, tp-link er605 firmware, er706w-4g firmware +13 more +15 moreAuthenticated OS command execution9.3 Critical
- Show moreLoading…