CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- automattic woocommerceWooCommerce <= 7.8.2 - Sensitive Information Exposure5.3 Medium
- unknown doppler formsDoppler Forms <= 2.5.1 - Subscriber+ Limited Plugin Installation6.5 Medium
- automattic woocommerceWordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wireless tsukamoto co., ltd. wtw eagle (for windows)The installer of WTW EAGLE (for Windows) 3.0.8.0 contains an issue with the DLL search path,...8.4 High
- scheeeli anti-malware security and brute-force firewallAnti-Malware Security and Brute-Force Firewall <= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read6.5 Medium
- facebook for woocommerceWordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerability5.3 Medium
- ays pro popup boxWordPress Popup box plugin <= 5.5.4 - Cross Site Request Forgery (CSRF) vulnerability5.3 Medium
- fabian online complaint siteA vulnerability was found in code-projects Online Complaint Site 1.0. This issue affects some...9.8 Critical
- No product listedInsecure Direct Object Reference (IDOR) in /tenants/{id} API endpoint in Inforcer Platform...5.0 Medium
- No product listedAn issue in NCR Atleos Terminal Manager (ConfigApp) v3.4.0 allows attackers to escalate...8.8 High
- No product listedIncorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by...7.5 High
- No product listedDLL hijacking vulnerability in Evope Collector 1.1.6.9.0 and related components load the wtsapi32...8.4 High
- No product listedIncorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows...7.8 High
- No product listedAn unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri...5.8 Medium
- No product listedSPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution.8.2 High
typeormnpm,@rootio/typeormRoot +1 moreTypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update6.5 Medium- No product listedmemoQ 10.1.13.ef1b2b52aae and earlier contains an unquoted service path vulnerability in the...6.7 Medium
- powerdns recursorCrafted delegations or IP fragments can poison cached delegations in Recursor6.5 Medium
- powerdns recursorCrafted delegations or IP fragments can poison cached delegations in Recursor8.2 High
- No product listedAn unquoted service path in Kingosoft Technology Ltd Kingo ROOT v1.5.8.3353 allows attackers to...7.8 High
- dyson mqtt serverAn issue discovered in Dyson App v6.1.23041-23595 allows unauthenticated attackers to control...3.0 Low
- isc keaInvalid characters cause assert7.5 High
- No product listedA stack-based buffer overflow issue was discovered in the phddns client in Blu-Castle BCUM221E 1...9.8 Critical
- No product listedA CSRF issue was discovered in the administrative web GUI in Blu-Castle BCUM221E 1.0.0P220507....4.6 Medium
- wordpress contact form 7 database addon cfdb7 by arshid cfdb7WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre...9.6 Critical
- dnnsoftware dotnetnuke, dnn.platform +1 moreDNN Insufficient Access Control - Image Upload allows for Site Content Overwrite10.0 Critical
- dnnsoftware dotnetnuke, dnn.platform +1 moreDNN vulnerable to stored cross-site-scripting (XSS) via SVG upload6.4 Medium
- dnnsoftware dotnetnuke, dnn.platform +1 moreDNN CKEditor Provider allows unauthenticated upload out-of-the-box4.3 Medium
- jlowin fastmcpFastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name5.4 Medium
- jlowin fastmcpFastMCP vulnerable to reflected XSS in client's callback page5.3 Medium
- code16 sharpSharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax5.4 Medium
- richardoc github-workflow-updater-extensionGitHub Workflow Updater stored the optional Github token in plaintext3.8 Low
- hp thinpro, hp inc. thinpro 8.1 +1 moreHP ThinPro 8.1 SP8 Security Updates8.5 High
- discourseDiscourse is missing Cache-Control response header on error responses6.3 Medium
- hashicorp consul, consul enterprise +1 moreConsul's KV endpoint is vulnerable to denial of service6.5 Medium
- encode starletteStarlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse7.5 High
- privatebinPrivateBin persistent HTML injection in attachment filename enables redirect and defacement5.8 Medium
- hashicorp consul, consul enterprise +1 moreConsul's event endpoint is vulnerable to denial of service6.5 Medium
- taigaio taiga-backTaiga Authenticated Remote Code Execution9.1 Critical
- taigaio taiga-backTaiga Blind SQL Injection Time Based4.8 Medium
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreLocal Privilege Escalation10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 morePrivilege Escalation through SUID-bit Binary10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreDenial of Service - Protocol Manipulation10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreVulnerable Upgrade Feature (Arbitrary File Write)10.0 Critical
- edgelesssys contrastContrast before 1.12.1 Insecure LUKS2 Persistent Storage6.9 Medium
- astroastro allows bypass of image proxy domain validation leading to SSRF and potential XSS7.2 High
- bishopfox sliverSliver does not restricted traffic between Wireguard clients.6.3 Medium
- ibm maximo application suiteThere is a vulnerability in the IBM Maximo Manage application in IBM Maximo Application Suite for Cognos Analytics9.8 Critical
- ibm concertMultiple Vulnerabilities in IBM Concert Software.5.4 Medium
- ibm concert, concert software +1 moreMultiple Vulnerabilities in IBM Concert Software.6.2 Medium
- Show moreLoading…