CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- google cloud vertex ai: open models for maas, vertex ai: partner models for maas, vertex ai: self-deployed models +2 moreHTTP Desynchronisation in Vertex AI for certain third-party models6.9 Medium
- pedrolaxe playerzbrPlayerzbr <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Meta Field6.4 Medium
- rene-puchinger responsive progress barResponsive Progress Bar <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- pmbaldha email trackerEmail Tracker <= 5.3.15 - Authenticated (Admin+) SQL Injection4.9 Medium
- dmbarber simple business dataSimple Business Data <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- garyhukkeri simple tableau vizSimple Tableau Viz <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- vbog bg book publisherBg Book Publisher <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- robocasters wp-thumbnailWP-Thumbnail <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- aurelienpierre photographers galleriesPhotographers galleries <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpdrift wp restaurant listingsWP Restaurant Listings <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- madebycinza cinza gridCinza Grid <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Skin Content Field6.4 Medium
- sierramike sm countdown widgetSM CountDown Widget <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- pressmaninc responsive iframe googlemapResponsive iframe GoogleMap <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- matthewmarichiba simple youtube shortcodeSimple Youtube Shortcode <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- vobi wp responsive meet the teamWP Responsive Meet The Team <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- chrishurst name: print button shortcodePrint Button Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- oboxgroup oboxmedia adsOboxmedia Ads <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- mrgeorgegray mixlr shortcodeMixlr Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- andrex84 this-or-thatThis-or-That by André Boekhorst <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- beautifultemplates st categories widgetST Categories Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- nazakatali32 wp-force images downloadWP-Force Images Download <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- mcostales84 material design iconic font integrationMaterial Design Iconic Font Integration <= 2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- jobair jb news tickerJB News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wiellyam wp ad galleryWP AD Gallery <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- oct8ne chatbotStored Cross-Site Scripting (XSS) in Oct8ne Chatbot5.3 Medium
- ghost robotics vision 60, ghostrobotics vision 60 firmware +1 moreImproper Authentication vulnerability in Ghost Robotics' Vision 607.0 High
- ghost robotics vision 60, ghostrobotics vision 60 firmware +1 moreUse of Hard-coded Credentials vulnerability in Ghost Robotics' Vision 608.7 High
- ghost robotics vision 60, ghostrobotics vision 60 firmware +1 moreImproper Authentication vulnerability in Ghost Robotics' Vision 609.2 Critical
- sauter ey-modulo 5 ecos 5 ecos504/505, ey-modulo 5 modu 5 modu524, ey-modulo 5 modu 5 modu525 +3 more +5 moreSauter: Crash via Incomplete SOAP Request7.5 High
- sauter ey-modulo 5 ecos 5 ecos504/505, ey-modulo 5 modu 5 modu524, ey-modulo 5 modu 5 modu525 +3 more +5 moreSauter: Directory Traversal in importFile SOAP Method9.8 Critical
- sauter ey-modulo 5 ecos 5 ecos504/505, ey-modulo 5 modu 5 modu524, ey-modulo 5 modu 5 modu525 +3 more +5 moreSauter: Hard-coded Authentication Credentials7.5 High
- sauter ey-modulo 5 ecos 5 ecos504/505, ey-modulo 5 modu 5 modu524, ey-modulo 5 modu 5 modu525 +3 more +5 moreSauter: Command Injection2.7 Low
- sauter ey-modulo 5 ecos 5 ecos504/505, ey-modulo 5 modu 5 modu524, ey-modulo 5 modu 5 modu525 +3 more +5 moreSauter: Arbitrary File Upload4.3 Medium
- sauter ey-modulo 5 ecos 5 ecos504/505, ey-modulo 5 modu 5 modu524, ey-modulo 5 modu 5 modu525 +3 more +5 moreSauter: Improper Validation of user-controlled data8.8 High
- wpdesk flexible refund and return order for woocommerceFlexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund4.3 Medium
- rpetersen29 simple banner – easily add multiple banners/bars/notifications/announcements to the top or bottom of your websiteSimple Banner <= 3.0.10 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- pixelyoursite – your smart pixel (tag) & api managerPixelYourSite <= 11.1.2 – Cross-Site Request Forgery to GDPR Options Modification4.3 Medium
- unknown meta tag managerMeta Tag Manager < 3.3 - Contributor+ Open Redirect6.5 Medium
- unknown ns maintenance mode for wpNS Maintenance Mode for WP <= 1.3.1 - Unauthenticated Subscribers Export5.3 Medium
- nanbu welcart e-commerceWelcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail5.5 Medium
- atlassian jira software data center, jira software server, jira data center +1 more +3 moreThis High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9...8.7 High
- isc bind 9Resource exhaustion via malformed DNSKEY handling7.5 High
- mercku m6aMercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.8.0 High
- mercku m6aOn Mercku M6a devices through 2.1.0, the authentication system uses predictable session tokens...3.1 Low
- mercku m6aMercku M6a devices through 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request...2.4 Low
- mercku m6aOn Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.3.1 Low
- mercku m6aMercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks.7.5 High
- bestpractical request trackerBest Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via...2.6 Low
- No product listedThe seffaflik thru 0.0.9 is vulnerable to symlink attacks due to incorrect default permissions...7.7 High
- tenda ac6 firmwareMultiple buffer overflows in the AdvSetMacMtuWan function of Tenda AC6 v.15.03.06.50 allows...7.5 High
- Show moreLoading…