CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- kingaddons.com king addons for elementorWordPress King Addons for Elementor plugin <= 51.1.61 - Broken Access Control vulnerability6.5 Medium
- kingaddons.com king addons for elementorWordPress King Addons for Elementor plugin <= 51.1.61 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpdevart pricing table builderWordPress Pricing Table builder plugin <= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- rextheme wp vrWordPress WP VR plugin <= 8.5.48 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- elliot sowersby / relywp coupon affiliatesWordPress Coupon Affiliates plugin <= 7.2.0 - Broken Access Control vulnerability5.3 Medium
- premmerce user rolesWordPress Premmerce User Roles plugin <= 1.0.13 - Broken Access Control vulnerability4.3 Medium
- castos seriously simple podcastingWordPress Seriously Simple Podcasting plugin <= 3.13.0 - Broken Access Control vulnerability4.3 Medium
- wp lab wp-lister lite for ebayWordPress WP-Lister Lite for eBay plugin <= 3.8.3 - Broken Access Control vulnerability4.3 Medium
- ajayrandhawa user-management-php-mysql, user-management-php-mysql web +1 moreajayrandhawa User-Management-PHP-MYSQL web cross-site request forgery5.3 Medium
- ajayrandhawa user-management-php-mysqlajayrandhawa User-Management-PHP-MYSQL User Management edit-user.php unrestricted upload5.1 Medium
- gitlabBusiness Logic Errors in GitLab2.7 Low
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- gitlabIncorrect Authorization in GitLab6.5 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab7.5 High
- strongswanIn the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2...8.1 High
- No product listedImproper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on...7.2 High
- No product listedAn issue in MikroTik RouterOS v.7.14.2 and SwitchOS v.2.18 allows a remote attacker to execute...10.0 Critical
pg8000PyPIpg8000 SQL injection vulnerability via a specially crafted Python list input9.6 Critical- No product listedindieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password...8.2 High
- frroutingFRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via...7.5 High
- frroutingFRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via...7.5 High
- frroutingFRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via...7.5 High
- frroutingFRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via...7.5 High
- frroutingFRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via...7.5 High
- No product listedReflected Cross Site Scripting vulnerability in Rubikon Banking Solution 4.0.3 in the "Search For...5.4 Medium
- No product listedIDOR vulnerability in Educare ERP 1.0 (2025-04-22) allows unauthorized access to sensitive data...5.4 Medium
- No product listedEasywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in...6.2 Medium
- nagios fusionNagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the...8.6 High
- nagios fusionA lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2...7.6 High
- No product listedAn issue was discovered in eTimeTrackLite Web thru 12.0 (20250704). There is a permission control...9.1 Critical
- baesystems socet gxpAn issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service fails...6.5 Medium
- baesystems socet gxpAn issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does...6.1 Medium
- baesystems socet gxpAn issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Service does not...8.8 High
- baesystems socet gxpAn issue was discovered in BAE SOCET GXP before 4.6.0.3. It permits external entities in certain...6.5 Medium
- baesystems socet gxpAn XSS issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service...6.1 Medium
- No product listedStarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which...7.5 High
- No product listedStarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a stack overflow via the...8.0 High
- No product listedAn issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows...8.0 High
- rocketsoftware trufusion enterpriseTRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp...7.5 High
- rocketsoftware trufusion enterpriseTRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload...9.8 Critical
- rocketsoftware trufusion enterpriseTRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication...7.5 High
- rocketsoftware trufusion enterpriseTRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to...8.6 High
- No product listedAhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter."8.8 High
- No product listedIncorrect access control in the REST API endpoint of HubSpot v1.29441 allows unauthenticated...5.3 Medium
- gitlabMissing Authorization in GitLab3.7 Low
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreMissing Initial Password Change10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreLack of Input Validation6.9 Medium
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreMail Configuration File Manipulation + Command Execution10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreLogout Functionality not Working6.9 Medium
- Show moreLoading…