CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- emlogEmlog Pro session verification code error due to clearing logic error2.7 Low
- makeplane planePlane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter8.1 High
- honoHono - Vary Header Injection in CORS Middleware6.9 Medium
kernelTuxCare,kernel-abi-stablelistsTuxCare,kernel-coreTuxCare +54 more +56 moreUpdate of kernelNo score- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreUndocumented Administrative Accounts10.0 Critical
chronyopenSUSESecurity update for chronyNo score- xenx86: Incorrect input sanitisation in Viridian hypercalls7.5 High
- xenx86: Incorrect input sanitisation in Viridian hypercalls7.5 High
- suse rancherRancher exposes sensitive information through audit logs4.3 Medium
- karmada-io dashboardKarmada Dashboard API Unauthorized Access Vulnerability8.7 High
- suse rancherRancher user retains access to clusters despite Global Role removal4.3 Medium
- cbk soft software hardware electronic computer systems industry and trade inc. envisionUser Enumeration in CBK Soft's enVision7.5 High
- studio fabryka dobrycmsSQL Injection in DobryCMS9.3 Critical
- dell storage managerDell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing...8.6 High
- dell storage managerDell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper...9.8 Critical
- dell storage managerDell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper...6.5 Medium
- newcodebyte ai chatbot free models – customer support, live chat, virtual assistantAI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant <= 1.6.5 - Unauthenticated CSV Injection4.3 Medium
- linuxvhost: Take a reference on the task in struct vhost_task.7.8 High
- linuxdrm/xe/vf: Don't expose sysfs attributes not applicable for VFs2.0 Low
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morecrypto: af_alg - Fix incorrect boolean values in af_alg_ctx4.8 Medium
- linuxtracing: dynevent: Add a missing lockdown check on dynevent7.8 High
- linuxcan: peak_usb: fix shift-out-of-bounds issue1.0 Low
- linuxcrypto: essiv - Check ssize for decryption and in-place encryption8.5 High
- linuxipvs: Defer ip_vs_ftp unregister during netns cleanup7.8 High
- linuxnet: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode7.8 High
- roxnor popup builder with gamification, multi-step popups, page-level targeting, and woocommerce triggersPopup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery7.5 High
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure4.3 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreSSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products5.9 Medium
- openvpnOpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated...8.8 High
- ibm app connect enterpriseIBM App Connect Enterprise runtime is vulnerable to a lack of authorization on windows environments using IWA6.3 Medium
- bdthemes zoloblocks – gutenberg block editor plugin with advanced blocks, dynamic content, templates & patternsZoloBlocks <= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/Disable5.3 Medium
- devowl real cookie banner: gdpr & eprivacy cookie consentReal Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint6.8 Medium
- aksis technology inc. netty erpSQLi in Aksis Technologies' Netty ERP9.8 Critical
- teyldoan vnpay payment gatewayVNPAY for Woocommerce <= 1.0.0 - Reflected Cross-Site Scripting6.1 Medium
- 10up microsoft azure storage for wordpressMicrosoft Azure Storage for WordPress <= 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion5.4 Medium
- plagiarismchecker check plagiarismCheck Plagiarism <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update4.3 Medium
- originalityai originality.ai ai checkerOriginality.ai AI Checker <= 1.0.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'ai_get_table'4.3 Medium
- originalityai originality.ai ai checkerOriginality.ai AI Checker <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Scan Log Deletion via ' ai_scan_result_remove'4.3 Medium
- getclouder nginx cache optimizerNGINX Cache Optimizer <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Dynamic Caching Exclusion Update4.3 Medium
- edgarrojas aio forms – craft complex forms easilyAIO Forms <= 1.3.18 - Authenticated (Admin+) Arbitrary File Upload via Zip Import7.2 High
- limelightmarketing llm hubspot blog importLLM Hubspot Blog Import <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Hubspot Import4.3 Medium
- prawas simple excel pricelist for woocommerceSimple Excel Pricelist for WooCommerce <= 1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- quickcreator – ai blog writerQuickcreator – AI Blog Writer 0.0.9 - 0.1.17 - Unauthenticated API Key Exposure7.5 High
- indieweb indieauthIndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens8.8 High
- onlinediagnosticbd rapidresultRapidResult <= 1.2 - Authenticated (Contributor+) SQL Injection6.5 Medium
- scottpaterson time clock – a wordpress employee & volunteer time clock pluginTime Clock – A WordPress Employee & Volunteer Time Clock Plugin <= 1.3.1 - Authenticated (Custom+) Stored Cross-Site Scripting6.4 Medium
- tiagohillebrandt supervisorSupervisor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update4.3 Medium
- rupok98 url shortener plugin for wordpressURL Shortener Plugin For WordPress <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Link Manipulation6.3 Medium
- mynamevenu24 disable content editor for specific templateDisable Content Editor For Specific Template <= 2.0 - Cross-Site Request Forgery to Template Configuration Update4.3 Medium
- cnaveenkumar multi item responsive sliderMulti Item Responsive Slider <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- Show moreLoading…