CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- linuxcoresight: trbe: Return NULL pointer for allocation failures5.7 Medium
- linuxcoresight: Fix incorrect handling for return value of devm_kzallocNo score
- linuxiommu/vt-d: Disallow dirty tracking if incoherent page walk8.8 High
- linuxptp: Add a upper bound on max_vclocks7.8 High
- linuxvhost: vringh: Fix copy_to_iter return value checkNo score
- linuxocfs2: fix double free in user_cluster_connect()7.3 High
- linuxf2fs: fix UAF issue in f2fs_merge_page_bio()7.8 High
- linuxnet: dlink: handle copy_thresh allocation failure7.5 High
- linuxsmb: client: fix crypto buffers in non-linear memory5.7 Medium
- linuxvhost: vringh: Modify the return value check7.8 High
- linuxbpf: Skip scalar adjustment for BPF_NEG if dst is a pointer8.4 High
- linuxSquashfs: fix uninit-value in squashfs_get_parent4.6 Medium
- linuxuio_hv_generic: Let userspace take care of interrupt mask7.5 High
- linuxio_uring/waitid: always prune wait queue entry in io_waitid_wait()7.8 High
- linuxio_uring/zcrx: fix overshooting recv limit8.6 High
- linuxASoC: codecs: wcd937x: set the comp soundwire port correctly7.8 High
- linuxfs: udf: fix OOB read in lengthAllocDescs handling7.8 High
- linuxnet: nfc: nci: Add parameter validation for packet data8.8 High
- linuxtracing: Fix race condition in kprobe initialization causing NULL pointer dereference5.6 Medium
- linuxLoongArch: BPF: Sign-extend struct ops return values properly7.8 High
- linux, linux kernel +1 moremm/ksm: fix flag-dropping behavior in ksm_madvise7.8 High
- linux, linux kernel +1 moreksmbd: Fix race condition in RPC handle list access8.8 High
- linuxKVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid7.1 High
- linuxfbdev: simplefb: Fix use after free in simplefb_detach_genpds()No score
- linuxmisc: fastrpc: fix possible map leak in fastrpc_put_argsNo score
- linuxInput: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak4.6 Medium
- linuxPCI/AER: Avoid NULL pointer dereference in aer_ratelimit()8.7 High
- linuxremoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()No score
- linuxPCI: endpoint: pci-epf-test: Add NULL check for DMA channels before releaseNo score
- linuxtee: fix register_shm_helper()No score
- linuxpinctrl: check the return value of pinmux_ops::get_function_name()7.8 High
- linuxbus: fsl-mc: Check return value of platform_get_resource()No score
- jdownloads.com jdownloads component for joomlaExtension - jdownloads.com - CSRF vectors in jDownloads component 1.0.0 - 4.0.47 for Joomla5.4 Medium
- linuxbinder: fix double-free in dbitmap7.8 High
- linuxnet/9p: fix double req put in p9_fd_cancelled7.8 High
- linuxKVM: x86: Don't (re)check L1 intercepts when completing userspace I/O7.9 High
- linuxf2fs: fix to do sanity check on node footer for non inode dnode7.8 High
- ccn-cert microclaudiaImproper Access Control in CCN-CERT microCLAUDIA7.6 High
- suse container suse/manager/4.3/proxy-httpd:latest, container suse/manager/5.0/x86 64/proxy-httpd:latest, container suse/multi-linux-manager/5.1/x86 64/proxy-httpd:latest +1 more +3 moresusemanager-tftpsync-recv allows arbitrary file creation and deletion due to path traversal8.7 High
- suse manager server lts 4.3, container suse manager 5.0 +1 morespacewalk-java has various XSS issues on search page9.3 Critical
- softing smartlink hw-dp, smartlink hw-pn +1 moreMalicious TCP/IP thread locking leads into diverse malfunctions7.2 High
- softing smartlink hw-dp, smartlink hw-pn +1 moreWebserver crash caused by scanning on TCP port 808.7 High
- code-projects simple food ordering systemcode-projects Simple Food Ordering System addproduct.php unrestricted upload6.9 Medium
- realmag777 husky – products filter professional for woocommerceHUSKY – Products Filter Professional for WooCommerce <= 1.3.7.1 - Unauthenticated SQL Injection via `phrase` Parameter7.5 High
- planex communications inc. mzk-dp300nUse of Hard-Coded Credentials issue exists in MZK-DP300N version 1.07 and earlier, which may...8.7 High
- keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.4 +2 moreOrg.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console3.7 Low
- max-3000 maxsite cms, maxsite cms +1 moreMaxSite CMS save-file-ajax.php unrestricted upload5.3 Medium
- max-3000 maxsite cms, maxsite cms +1 moreMaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted upload5.3 Medium
- yonyou u8 cloudYonyou U8 Cloud Request Header NCloudGatewayServlet unrestricted upload5.3 Medium
- serdar bayram ghost hot spotSerdar Bayram Ghost Hot Spot Login Auth.php sql injection6.9 Medium
- Show moreLoading…