CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- wpdeveloper essential addons for elementorWordPress Essential Addons for Elementor plugin <= 6.2.4 - Broken Access Control vulnerability2.7 Low
- rank math seo math seoWordPress Rank Math SEO plugin <= 1.0.252.1 - Sensitive Data Exposure vulnerability4.3 Medium
- rank math seo math seoWordPress Rank Math SEO plugin <= 1.0.252.1 - Broken Access Control vulnerability3.8 Low
- sonicwall sma100, sma 210 firmware, sma 410 firmware +1 more +3 moreA potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances...4.5 Medium
- neo4j community edition, enterprise edition +1 moreUntargeted information leak in Bolt protocol handshake6.3 Medium
- therefore corporation gmbh online and therefore on-premisesTherefore™ Online and Therefore™ On-Premises contains an account impersonation issue, which could potentially allow the attacker to access all the stored data8.8 High
- linuxcomedi: fix divide-by-zero in comedi_buf_munge()No score
- wpclever wpc name your price for woocommerceWPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price Alteration7.5 High
- apos37 eri file libraryERI File Library <= 1.1.0 - Missing Authorization to Unauthenticated Protected File Download5.3 Medium
- open-xchange gmbh ox app suiteMalicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to...5.4 Medium
- open-xchange gmbh ox app suiteMalicious or unintentional API requests can be used to add significant amount of data to caches....7.5 High
- apache apisixApache APISIX: basic-auth logs plaintext credentials at info level7.5 High
- averta depicter — popup & slider builderDepicter <= 4.0.4 - Cross-Site Request Forgery4.3 Medium
- oopspam anti-spam: spam protection for wordpress forms & comments (no captcha)OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header Spoofing5.3 Medium
- stellarwp the events calendarThe Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure4.3 Medium
- abis technology bapsisSQLi in Abis Technology's BAPSIS9.8 Critical
- px-lab zombifyZombify <= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read6.8 Medium
- jma plugins woocommerce designer proWooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read8.6 High
- vanquish wordpress user extra fieldsWordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function8.8 High
- kingaddons king addons for elementor – 4,000+ ready elementor sections, 650+ templates, 70+ free widgets for elementorKing Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalation9.8 Critical
- unknown noo jobmonsterJobmonster - Job Board WordPress Theme <= 4.8.1 - Authentication Bypass9.8 Critical
- unknown realpressRealPress < 1.1.0 - Unauthenticated Content Creation/Email Sending via REST5.3 Medium
- century systems co., ltd. futurenet ip-k series, futurenet ma-e300 series, futurenet ma-p series +2 more +4 moreFutureNet MA and IP-K series provided by Century Systems Co., Ltd. contain an OS command...8.6 High
- century systems co., ltd. futurenet ip-k series, futurenet ma-e300 series, futurenet ma-p series +2 more +4 moreFutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and...6.9 Medium
- qzzr shortcode pluginQzzr Shortcode Plugin <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- fusewp – wordpress user sync to email list & marketing automation (mailchimp, constant contact, activecampaign etc.)FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creati…4.3 Medium
openexrOSS-FuzzHeap-buffer-overflow in generic_unpackNo score- scrapy scrapy/scrapyBrotli decompression bomb DoS in scrapy/scrapy7.5 High
ublock-originDebianublock-origin - security updateNo score- cryptidycryptidy allows code execution via untrusted data due to pickle.loads6.9 Medium
- summerpearlgroup vacation rental management platformSummer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly...6.5 Medium
- summerpearlgroup vacation rental management platformSummer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient...6.3 Medium
- summerpearlgroup vacation rental management platformSummer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a...7.5 High
- totolink lr350 firmwareTotolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid...7.5 High
- totolink lr350 firmwareTotolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the...7.5 High
- totolink lr350 firmwareTotolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid...7.5 High
- totolink lr350 firmwareTotolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password...7.5 High
- totolink lr350 firmwareTotolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid...7.5 High
- totolink lr350 firmwareTotolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid...7.5 High
- totolink lr350 firmwareTotolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the wifiOff...7.5 High
- totolink a7000r firmwareTotolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the wifiOff...7.5 High
- totolink a7000r firmwareTotolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g...7.5 High
- totolink a7000r firmwareTotolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g...7.5 High
- totolink a7000r firmwareTotolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g...7.5 High
- tenda ax1803 firmwareTenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in...7.5 High
- tenda ax3 firmwareTenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the deviceId parameter...7.5 High
- wikimedia foundation visualeditor, mediawiki visual editor +1 moreXSS when pasting into VE0.0 None
- wikimedia foundation visualeditor, mediawiki visual editor +1 moreStored XSS through system messages in VisualEditor0.0 None
- wikimedia foundation textextractsExtension:TextExtracts does not check for authorizeRead when returning extracts2.7 Low
- mediawikiWatchlist group mode reveals authors of edits with hidden authorship1.2 Low
- Show moreLoading…