CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- essekia tablesome table premiumWordPress Tablesome Table Premium <= 1.1.23 - Broken Access Control Vulnerability7.5 High
- esri arcgis serverBUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.10.0 Critical
- amttgroup hibos, anmei century (beijing) technology co., ltd. hotel broadband operation system (hibos) +1 moreAMTT HiBOS Command Injection RCE via server_ping.php10.0 Critical
- danny-avila danny-avila/librechat, librechat +1 moreHTML Injection in Accept-Language Header in danny-avila/librechat4.8 Medium
linux-cloud-tools-genericTuxCare,linux-cloud-tools-lowlatencyTuxCare,linux-crashdumpTuxCare +9 more +11 moreUpdate of linux-metaNo score- linuxfs/ntfs3: Fix NULL dereference in ni_write_inode5.7 Medium
- linuxsoc: qcom: qmi_encdec: Restrict string length in decode7.8 High
- linuxposix-timers: Ensure timer ID search-loop limit is valid5.7 Medium
- linuxnet/sched: fq_pie: avoid stalls in fq_pie_timer()6.8 Medium
- linuxclocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probeNo score
- linuxmfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()No score
- linuxdrm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspendNo score
- linuxwifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan()5.5 Medium
- linuxnet/mlx5e: Release the label when replacing existing ct entryNo score
- linuxring-buffer: Do not swap cpu_buffer during resize process7.8 High
- linuxwifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex4.6 Medium
- linuxdrm/stm: ltdc: fix late dereference checkNo score
- linuxARM: 9317/1: kexec: Make smp stop calls asynchronous7.8 High
- linuxdrm/amdgpu: Fix integer overflow in amdgpu_cs_pass17.8 High
- linuxHID: amd_sfh: Fix for shift-out-of-boundsNo score
- linuxmedia: max9286: Fix memleak in max9286_v4l2_register()No score
- linuxriscv: move memblock_allow_resize() after linear mapping is readyNo score
- linuxudf: Detect system inodes linked into directory hierarchy7.8 High
- linuxriscv: ftrace: Fixup panic by disabling preemptionNo score
- linuxUSB: gadget: Fix the memory leak in raw_gadget driverNo score
- linuxext4: fix use-after-free read in ext4_find_extent for bigalloc + inline7.8 High
- linuxhfs: fix OOB Read in __hfs_brec_find7.8 High
- linuxarm64: ftrace: fix module PLTs with mcountNo score
- linuxima: Fix memory leak in __ima_inode_hash()No score
- linuxserial: pch: Fix PCI device refcount leak in pch_request_dma()No score
- linuxxen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()No score
- linuxdrm/omap: dss: Fix refcount leak bugsNo score
- linuxwifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource leaksNo score
- linuxASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()No score
- linuxbtrfs: call __btrfs_remove_free_space_cache_locked on cache load failureNo score
- linuxplatform/chrome: fix memory corruption in ioctl7.8 High
- linuxusb: gadget: f_hid: fix f_hidg lifetime vs cdevNo score
- linuxfs: jfs: fix shift-out-of-bounds in dbAllocAG7.8 High
- linuxmtd: Fix device name leak when register device failed in add_mtd_device()7.8 High
- linuxwifi: plfxlc: fix potential memory leak in __lf_x_usb_enable_rx()No score
- linuxs390/netiucv: Fix return type of netiucv_tx()No score
- linuxiio: fix memory leak in iio_device_register_eventset()No score
- linuxdrm/meson: explicitly remove aggregate driver at module unload timeNo score
- linuxclk: imx: scu: fix memleak on platform_device_add() failsNo score
- linuxpinctrl: thunderbay: fix possible memory leak in thunderbay_build_functions()No score
- huggingface smolagents, huggingface/smolagents +1 moreXPath Injection in Hugging Face Smolagents search_item_ctrl_f Function5.4 Medium
- langgenius dify, langgenius/dify +1 moreUser Enumeration via Distinct Error Messages in langgenius/dify-web4.3 Medium
- nlnet labs unboundPossible domain hijacking via promiscuous records in the authority section5.7 Medium
- academylms academy lms proAcademy LMS Pro <= 3.3.7 - Unauthenticated Privilege Escalation via Social Login Addon8.1 High
- codebangers all in one time clock lite – tracking employee time has never been easierAll in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Clocking In/Out4.3 Medium
- Show moreLoading…