CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- lfprojects mlflowMLflow Weak Password Requirements Authentication Bypass Vulnerability8.1 High
- lfprojects mlflowMLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability8.1 High
- win-cli-mcp-serverwin-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability9.8 Critical
- razer synapse, synapse 3 +1 moreRazer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability7.8 High
- razer synapse, synapse 3 +1 moreRazer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability7.8 High
- razer synapse, synapse 3 +1 moreRazer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability7.8 High
- berriai litellmLiteLLM Information health API_KEY Information Disclosure Vulnerability3.5 Low
- langchain-ai langgraphLangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore7.3 High
- zitadelZitadel Bypass Second Authentication Factor8.7 High
- d-link dns-343 sharecenter, dlink dns-343 firmware +1 moreD-Link DNS-343 ShareCenter <= 1.05 Command Injection via /goform/Mail_Test9.3 Critical
- zitadelZitadel allows brute-forcing authentication factors7.7 High
- zitadelZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection8.1 High
- ckanCKAN Vulnerable to Session Cookie Fixation6.1 Medium
- rathena fluxcpCSRF in FluxCP account endpoints allows account takeover / state-changing actions8.6 High
- watchguard mobile vpn with ssl clientWatchGuard Mobile VPN with SSL Local Privilege Escallation6.3 Medium
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreSystemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation10.0 Critical
- wazuhWazuh vulnerable to Heap-based Buffer Over-read in w_expression_match6.9 Medium
- wazuhWazuh vulnerable to NULL pointer dereference in DecodeCiscat6.9 Medium
- wazuhWazuh vulnerable to NULL pointer dereference in fim_fetch_attributes_state6.9 Medium
- drupal simple oauth (oauth2) & openid connect, simple oauth project oauth +1 moreSimple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass - SA-CONTRIB-2025-1147.5 High
- wazuhWazuh vulnerable to NULL pointer dereference in fim_alert line 7126.9 Medium
- wazuhWazuh Vulnerable to Heap Use After Free in w_copy_event_for_log6.3 Medium
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreNon-Compliant TLS Configuration10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreServer Version Disclosure10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreResource Lacking AuthN10.0 Critical
- wazuhWazuh Vulnerable to Heap-based Buffer Over-read in DecodeWinevt2.1 Low
- wazuhWazuh Vulnerable to Heap-based Buffer Out-Of-Bounds WRITE in decode_win_permissions6.3 Medium
fastmcpPyPI,rootio-fastmcpRoot +1 moreFastMCP Auth Integration Allows for Confused Deputy Account Takeover7.3 High- wazuhWazuh fillData NULL pointer dereference causes analysisd crash6.9 Medium
- floragunn search guard flxUnauthorized access to fields protected by Field Masking (FM) for fields of type IP6.0 Medium
- revenera installshieldPotential Privilege Escalation in Revenera InstallShield 2023 R17.3 High
- floragunn search guard flxUnauthorized access to fields protected by Field-Level Security (FLS) when those fields are members of an object6.0 Medium
- ckanCKAN stored XSS vulnerability in Markdown description fields6.3 Medium
- progress moveit transferAS2 module allows uncontrolled file uploads8.2 High
- linuxscsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses8.1 High
- linuxALSA: usb-audio: Fix NULL pointer deference in try_to_register_card5.1 Medium
- linuxksmbd: transport_ipc: validate payload size before reading handle7.1 High
- linuxnet/sched: sch_qfq: Fix null-deref in agg_dequeue6.8 Medium
- jenkins publish to bitbucket, jenkins project publish to bitbucket plugin +1 moreJenkins Publish to Bitbucket Plugin is missing a permissions check5.4 Medium
- jenkins publish to bitbucket, jenkins project publish to bitbucket plugin +1 moreJenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check5.4 Medium
- jenkins publish to bitbucket, jenkins project publish to bitbucket plugin +1 moreJenkins Publish to Bitbucket Plugin is missing a permissions check4.3 Medium
- jenkins curseforge publisher, jenkins project curseforge publisher plugin +1 moreJenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form4.3 Medium
- jenkins curseforge publisher, jenkins project curseforge publisher plugin +1 moreJenkins Curseforge Publisher Plugin stores API Keys unencrypted in job config.xml files4.3 Medium
- jenkins byteguard build actions, jenkins project byteguard build actions plugin +1 moreJenkins ByteGuard Build Actions Plugin does not mask API tokens displayed on the job configuration form4.3 Medium
- jenkins byteguard build actions, jenkins project byteguard build actions plugin +1 moreJenkins ByteGuard Build Actions Plugin stores API tokens unencrypted in job config.xml files4.3 Medium
- jenkins openshift pipeline, jenkins project openshift pipeline plugin +1 moreJenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job config.xml files4.3 Medium
- jenkins nexus task runner, jenkins project nexus task runner plugin +1 moreJenkins Nexus Task Runner Plugin is missing a permission check4.3 Medium
- jenkins nexus task runner, jenkins project nexus task runner plugin +1 moreJenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery4.3 Medium
- jenkins azure cli, jenkins project azure cli plugin +1 moreJenkins Azure CLI Plugin does not restrict the commands it executes8.8 High
- jenkins start windocks container, jenkins project start windocks containers plugin +1 moreJenkins Start Windocks Containers Plugin is missing a permission check4.3 Medium
- Show moreLoading…