CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- fontforgeFontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.6.5 Medium
- google chromeOut of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote...8.8 High
- booklore-app bookloreBookLore Media API Authentication Bypass8.7 High
- steveseguin vdo.ninjaVDO.Ninja Reflected XSS Vulnerability in control.html6.9 Medium
- fastgptFastGPT File Reading Node SSRF Vulnerability6.9 Medium
- openbaoOpenBao and Vault Leak []byte Fields in Audit Logs5.7 Medium
- sakailms sakaiSakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl5.9 Medium
- py-pdf pypdfpypdf manipulated LZWDecode streams can exhaust RAM6.6 Medium
- py-pdf pypdfpypdf affected by possible infinite loop when reading DCT inline images without EOF marker6.6 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP are Missing Authorization in Collection Provider2.0 Low
- openbaoOpenBao leaks HTTPRawBody in Audit Logs5.7 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)4.8 Medium
- apache activemq-artemis, red hat amq broker 7, rhel-9 based middleware containers +2 moreAmq: privilege escalation via excessive /etc/passwd permissions6.4 Medium
- freebsdSO_REUSEPORT_LB breaks connect(2) for UDP sockets5.4 Medium
- devolutions serverImproper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and...9.0 Critical
- devolutions serverAn improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server...5.1 Medium
- aio-libs aiomysqlaiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server8.2 High
- admidioAdmidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality7.2 High
- secdev scapyScapy before 2.7.0 Insecure Deserialization RCE via Session Files5.4 Medium
- drupal civictheme design systemCivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-1136.1 Medium
- drupal civictheme design systemCivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-1127.5 High
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user without sufficient...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- atlassian jira alignJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected...5.3 Medium
- the wikimedia foundation mediawiki cookieconsent extensionThe CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectors2.1 Low
- honoHono Improperly Authorizes JWT Audience Validation8.1 High
- nvidia bluefield ga, bluefield lts22, bluefield lts23 +6 more +8 moreNVIDIA Bluefield and ConnectX contain a vulnerability in the management interface that could...6.7 Medium
- my-little-forum mylittleforummy little forum vulnerable to SQL Injection in Bookmark Reordering via bookmarks parameter8.8 High
- metersphereMeterSphere logic flaw allows retrieval of arbitrary user information5.3 Medium
- openwrtOpenWrt ubusd vulnerable to heap buffer overflow7.9 High
- openwrtOpenWrt vulnerable to local privilage escalation7.9 High
- eclipse vert.xVert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories6.3 Medium
- eclipse vert.xVert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names2.3 Low
- hamastar technology meetinghubWordPress MeetingHub plugin <= 1.23.9 - Broken Access Control vulnerability4.3 Medium
- rustaurius front end usersWordPress Front End Users plugin <= 3.2.33 - Broken Access Control vulnerability4.3 Medium
- repuso social proof testimonials and reviews by repusoWordPress Social proof testimonials and reviews by Repuso plugin <= 5.29 - Broken Access Control vulnerability4.3 Medium
- wpxpo wowrevenueWordPress WowRevenue plugin <= 1.2.13 - Broken Access Control vulnerability4.3 Medium
- realmag777 mdtfWordPress MDTF plugin <= 1.3.3.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- e2pdfWordPress e2pdf plugin <= 1.28.09 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp travel gutenberg blocksWordPress WP Travel Gutenberg Blocks plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themeruby easy post submissionWordPress Easy Post Submission plugin <= 1.7.0 - Sensitive Data Exposure vulnerability5.3 Medium
- implecode product catalog simpleWordPress Product Catalog Simple plugin <= 1.8.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- Show moreLoading…