CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- langchain-ai langchain-ai/langchainSQL Injection in langchain-ai/langchain7.3 High
pcapplusplusOSS-FuzzUse-of-uninitialized-value in pcpp::byteArrayToHexStringNo score- apache tika, apache software foundation tika core, tika parsers +1 more +3 moreApache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected8.4 High
- virtuemart.net virtuemart component for joomlaExtension - virtuemart.net - XSS in VirtueMart component 1.0.0 - 4.4.10 for Joomla6.1 Medium
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreCSRF Token not Properly Implemented2.1 Low
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreBusybox 1.31.1 - Multiple Known Vulnerabilities10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreVulnerable Components in Azure Access OS10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreWeak Default Credentials10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreSNMP Default Community String (public)6.9 Medium
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreMalicious / Malformed App can be Installed but not Uninstalled10.0 Critical
- dream-theme the7 — website and ecommerce builder for wordpressThe7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'6.4 Medium
- fusewp – wordpress user sync to email list & marketing automation (mailchimp, constant contact, activecampaign etc.)FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Cross-Site Request Forgery to Sync Rule Creation4.3 Medium
- dr-thomas-fuessl spendeonline.orgSpendeOnline.org <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- unknown product filter for woocommerce by wbwProduct Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection7.5 High
- tomdever wpforo forumwpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function7.5 High
- quadlayers social feed gallerySocial Feed Gallery <= 4.9.2 - Missing Authorization to Unauthenticated Information Exposure5.3 Medium
- themeisle stripe payment forms by wp full pay – accept credit card payments, donations & subscriptionsStripe Payment Forms <= 8.3.1 - Unauthenticated SQL Injection7.5 High
- marketingfire discussion board – wordpress forum pluginDiscussion Board – WordPress Forum Plugin <= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution6.3 Medium
- symptote advanced database cleaner – optimize & clean database to speed up site performanceAdvanced Database Cleaner <= 3.1.6 - Cross-Site Request Forgery to Settings Manipulation4.3 Medium
- cyberlord92 password policy manager | password managerPassword Policy Manager | Password Manager <= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Configuration Log Out4.3 Medium
- marketingfire widget options – advanced conditional visibility for gutenberg blocks & classic widgetsWidget Options – The #1 WordPress Widget & Block Control Plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- smub charitable – donation plugin for wordpress – fundraising with recurring donations & moreCharitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- wpwax directorist: ai-powered business directory, listings & classified adsDirectorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move8.1 High
- alignak fast velocity minifyFast Velocity Minify <= 3.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- astoundify simple registration for woocommerceSimple Registration for WooCommerce <= 1.5.8 - Cross-Site Request Forgery to Privilege Escalation via Role Request Approval8.8 High
- rextheme wp vr – 360 panorama and free virtual tour builder for wordpressWP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update4.3 Medium
- themeum tutor lms proTutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments5.4 Medium
- smub userfeedback – create interactive feedback form, user surveys, and polls in secondsUser Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Information Disclosure5.3 Medium
- roxnor shopengine elementor woocommerce builder addon – all in one woocommerce solutionShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update2.7 Low
- edge22 generateblocksGenerateBlocks <= 2.1.1 - Improper Authorization to Authenticated (Contributor+) Arbitrary Options Disclosure6.5 Medium
- studiopress open source genesis frameworkOpen Source Genesis Framework <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes6.4 Medium
- publishpress blocks – block controls, block visibility, block permissionsGutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- saadiqbal password protected — lock entire site, pages, posts, categories, and partial contentPassword Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing3.7 Low
- uapp testimonial carousel for elementorTestimonial Carousel For Elementor <= 11.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- themeum tutor lms – elearning and online course solution, tutor lms +1 moreTutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update5.3 Medium
- purethemes listeo - directory & listings with booking - wordpress themeListeo <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundcloud Shortcode6.4 Medium
- themeum tutor lms – elearning and online course solution, tutor lms +1 moreTutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure4.3 Medium
- bob watu quizWatu Quiz <= 3.4.4 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer7.2 High
- unknown product filter for woocommerce by wbwProduct Filter by WBW <= 3.0.0 - Missing Authorization to Unauthenticated Settings Update5.3 Medium
- hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 moreShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- wp media backwpup – wordpress backup & restore pluginBackWPup <= 5.5.0 - Missing Authorization to Sensitive Information Exposure5.3 Medium
- digitalmeactivecampaign eroom – webinar & meeting plugin for zoom, google meet, microsoft teamseRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.5.6 - Unauthenticated Sensitive Information Exposure5.3 Medium
libjxlOSS-FuzzGlobal-buffer-overflow in void jxl::N_AVX2::WriteToOutputStage::StoreUnsignedRow<unsigned char>No score- light & wonder, inc. / shfl entertainment, inc. / shuffle master, inc. deck mate 1Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution7.0 High
- light & wonder, inc. / shfl entertainment, inc. / shuffle master, inc. deck mate 2Shuffle Master Deck Mate 2 Missing Secure Boot7.0 High
- light & wonder, inc. / shfl entertainment, inc. / shuffle master, inc. deck mate 2Shuffle Master Deck Mate 2 Insecure Update Chain7.0 High
- legion of the bouncy castle inc. bouncy castle for java fips, bouncy castle for java lts +1 moreBouncy Castle Vulnerable to Uncontrolled Resource Consumption5.9 Medium
- watchguard fireware osWatchGuard Firebox leftover debug code vulnerability8.9 High
- naviga global / miles 33 gn4 publishing systemGN4 Publishing System Insecure Direct Object Reference (IDOR) Information Disclosure8.6 High
- flashmqFlashMQ does not release memory of queued QoS messages4.3 Medium
- Show moreLoading…