CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- mxchat – ai chatbot & content generation for wordpressMxChat – AI Chatbot for WordPress <= 2.4.6 - Unauthenticated Blind Server-Side Request Forgery5.3 Medium
- arksigner software and hardware inc. acbakimzalaLocal File Inclusion in ArkSigner's AcBakImzala9.8 Critical
stackvectorcrates.ioMultiple soundness issues in `stackvector`No score- moodleMoodle: possible to bypass timer in timed assignments5.4 Medium
- moodleMoodle: external cohort search service leaks system cohort data4.3 Medium
- moodleMoodle: hidden group names visible to event creators4.3 Medium
- moodleMoodle: password brute force risk when mobile/web services enabled7.5 High
- moodleMoodle: possible to bypass mfa5.4 Medium
- moodleMoodle: router produces json instead of 404 error for invalid course id5.3 Medium
- moodleMoodle: router (r.php) could expose application directories5.3 Medium
- moodleMoodle: quiz notifications sent to suspended participants4.3 Medium
- moodleMoodle: course access permissions not properly checked in course_output_fragment_course_overview4.3 Medium
- molgenis emx2Open redirection vulnerability in MOLGENIS EMX25.1 Medium
- tesi gandia integra totalPath Traversal in Gandia Integra Total by TESI7.1 High
- energycrm energy crmStored Cross-Site Scripting (XSS) in Energy CRM by Status Tracker5.1 Medium
- opensolution quickcms, quick.cms +1 moreMultiple Stored XSS in QuickCMS4.8 Medium
- opensolution quickcms, quick.cms +1 moreMultiple Stored XSS in QuickCMS4.8 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 10.0 extended update support +4 more +6 moreLibsoup: heap use-after-free in libsoup message queue handling during http/2 read completion7.5 High
- proliz software ltd. co. obs (student affairs information system)Reflected XSS in Proliz's OBS7.6 High
- arksigner software and hardware inc. acbakimzalaReflected XSS in ArkSigner's AcBakImzala5.4 Medium
- i-o data device, inc. narsus app, clone for windows +1 moreNarSuS App registers a Windows service with an unquoted file path. A user with the write...8.4 High
- growi, inc. growiGROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert...5.1 Medium
- six apart ltd. movable type (cloud edition), movable type (software edition), movable type advanced (software edition) +3 more +5 moreMovable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of...4.6 Medium
- six apart ltd. movable type (cloud edition), movable type (software edition), movable type advanced (software edition) +3 more +5 moreMovable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If...4.6 Medium
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreIncorrect Content-Type Header10.0 Critical
- gallagher command centre serverUncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged...5.5 Medium
- gallagher command centre serverCleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could...6.7 Medium
- gallagher command centre serverExposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the...9.9 Critical
- gallagher command centre serverClient-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a...5.5 Medium
- gallagher command centre serverExposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre...5.5 Medium
- mongodb atlas sql odbc driverMongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directories8.8 High
arrowOSS-FuzzHeap-buffer-overflow in std::__1::pair<int, arrow::util::RleBitPackedParser::ControlFlow> arrow::util::RNo score- tryton saoTryton sao allows XSS via an HTML attachment5.4 Medium
- slack nebulaSlack Nebula may accept arbitrary source IP addresses4.9 Medium
- sir gnuboardgnuboard gnuboard4 v4.36.04 and before is vulnerable to Second-order SQL Injection via the...6.5 Medium
- dotnetfoundation piranha cmsPiranha CMS vulnerable to stored cross-site scripting (XSS)6.1 Medium
- No product listedA Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4...7.1 High
- No product listedA Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14...7.1 High
- sir gnuboardCross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 allows authenticated attackers to...6.1 Medium
- No product listedA CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600...6.5 Medium
- mingsoft mcmsMCMS reflected cross-site scripting (XSS) vulnerability6.1 Medium
- No product listedCross site scripting (XSS) vulnerability in 17gz International Student service system 1.0 allows...6.1 Medium
- keenetic keeneticosCross site request forgery (CSRF) vulnerability in KeeneticOS before 4.3 at "/rci" API endpoint...5.3 Medium
- keenetic keeneticosCross site scripting (XSS) vulnerability in KeeneticOS before 4.3 at "Wireless ISP" page allows...6.1 Medium
- keenetic keeneticosCRLF-injection in KeeneticOS before 4.3 at "/auth" API endpoint allows attackers to take over the...6.5 Medium
- baesystems socet gxpAn issue was discovered in BAE SOCET GXP before 4.6.0.2. Some endpoints on the SOCET GXP Job...4.3 Medium
- baesystems socet gxpAn issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact...8.4 High
- baesystems socet gxpAn issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact...6.5 Medium
- fontforgeFontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at ...6.5 Medium
- audiofileAudiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup...7.5 High
- Show moreLoading…