# CVEs published 2025-09-03

193 CVEs were published on September 3, 2025: 10 critical, 41 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-58355](https://cve.now/CVE-2025-58355.md): Soft Serve is vulnerable to arbitrary file writing through its SSH API (CVSS 7.7, charmbracelet soft-serve · github.com/charmbracelet/soft-se…)
- [CVE-2025-9938](https://cve.now/CVE-2025-9938.md): D-Link DI-8400 yyxz.asp yyxz\_dlink\_asp stack-based overflow (CVSS 8.7, D-Link DI-8400)
- [CVE-2025-9937](https://cve.now/CVE-2025-9937.md): elunez eladmin LocalStorageController deleteFile improper authorization (CVSS 5.3, elunez eladmin)
- [CVE-2025-9936](https://cve.now/CVE-2025-9936.md): fuyang\_lipengjun platform queryAll AdController improper authorization (CVSS 5.3, fuyang\_lipengjun platform)
- [CVE-2025-9935](https://cve.now/CVE-2025-9935.md): TOTOLINK N600R cstecgi.cgi sub\_4159F8 command injection (CVSS 6.9, TOTOLINK N600R)
- [CVE-2025-9934](https://cve.now/CVE-2025-9934.md): TOTOLINK X5000R cstecgi.cgi sub\_410C34 command injection (CVSS 5.3, TOTOLINK X5000R)
- [CVE-2025-9933](https://cve.now/CVE-2025-9933.md): PHPGurukul Beauty Parlour Management System view-appointment.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-58064](https://cve.now/CVE-2025-58064.md): CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package (CVSS 2.3, ckeditor5 · @ckeditor/ckeditor5-clipboard)
- [CVE-2025-9932](https://cve.now/CVE-2025-9932.md): PHPGurukul Beauty Parlour Management System update-image.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-9931](https://cve.now/CVE-2025-9931.md): Jinher OA POST Request login!changePassWord.action cross site scripting (CVSS 5.3, Jinher OA)
- [CVE-2025-58057](https://cve.now/CVE-2025-58057.md): Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack (CVSS 6.9, netty · io.netty:netty-codec-compression +1)
- [CVE-2025-9930](https://cve.now/CVE-2025-9930.md): 1000projects Beauty Parlour Management System contact-us.php sql injection (CVSS 6.9, 1000projects Beauty Parlour Management System)
- [CVE-2025-9929](https://cve.now/CVE-2025-9929.md): code-projects Responsive Blog Site blogs\_view.php cross site scripting (CVSS 4.8, code-projects Responsive Blog Site)
- [CVE-2025-9928](https://cve.now/CVE-2025-9928.md): projectworlds Travel Management System viewcategory.php sql injection (CVSS 6.9, projectworlds Travel Management System)
- [CVE-2025-58056](https://cve.now/CVE-2025-58056.md): Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions (CVSS 2.9, netty · io.netty:netty-codec-http)
- [CVE-2025-9927](https://cve.now/CVE-2025-9927.md): projectworlds Travel Management System viewpackage.php sql injection (CVSS 6.9, projectworlds Travel Management System)
- [CVE-2025-8268](https://cve.now/CVE-2025-8268.md): Ai Engine \<= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion (CVSS 6.5, tigroumeow AI Engine – The Chatbot, AI Framework & MCP for…)
- [CVE-2025-55748](https://cve.now/CVE-2025-55748.md): XWiki Platform's configuration files can be accessed through jsx and sx endpoints (CVSS 9.3, xwiki-platform · org.xwiki.platform:xwiki-platform-skin-ski…)
- [CVE-2025-55747](https://cve.now/CVE-2025-55747.md): XWiki Platform's configuration files can be accessed through the webjars API (CVSS 9.3, xwiki-platform · org.xwiki.platform:xwiki-platform-webja… +1)
- [CVE-2025-53690](https://cve.now/CVE-2025-53690.md): Sitecore Products ViewState Deserialization Vulnerability (CVSS 9.0, KEV, Sitecore Experience Manager · Sitecore Experience Platform)
- [CVE-2025-9926](https://cve.now/CVE-2025-9926.md): projectworlds Travel Management System viewsubcategory.php sql injection (CVSS 6.9, projectworlds Travel Management System)
- [CVE-2025-55162](https://cve.now/CVE-2025-55162.md): Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag (CVSS 6.3, envoyproxy envoy)
- [CVE-2025-9365](https://cve.now/CVE-2025-9365.md): Fuji Electric FRENIC-Loader 4 Deserialization of Untrusted Data (CVSS 8.4, Fuji Electric FRENIC-Loader)
- [CVE-2025-9925](https://cve.now/CVE-2025-9925.md): projectworlds Travel Management System detail.php sql injection (CVSS 6.9, projectworlds Travel Management System)
- [CVE-2025-36193](https://cve.now/CVE-2025-36193.md): IBM Transformation Advisor incorrect permissions (CVSS 8.4, IBM Transformation Advisor)
- [CVE-2025-9924](https://cve.now/CVE-2025-9924.md): projectworlds Travel Management System enquiry.php sql injection (CVSS 6.9, projectworlds Travel Management System)
- [CVE-2025-9923](https://cve.now/CVE-2025-9923.md): Campcodes Sales and Inventory System index.php cross site scripting (CVSS 5.3, Campcodes Sales and Inventory System)
- [CVE-2025-20328](https://cve.now/CVE-2025-20328.md): A vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low… (CVSS 5.4, Cisco Webex Meetings)
- [CVE-2025-20291](https://cve.now/CVE-2025-20291.md): A vulnerability in Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to redirect a targeted Webex Meetings user… (CVSS 4.3, Cisco Webex Meetings)
- [CVE-2025-20335](https://cve.now/CVE-2025-20335.md): Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Information Arbitrary File Write… (CVSS 5.3, Cisco Session Initiation Protocol (SIP) Software)
- [CVE-2025-20336](https://cve.now/CVE-2025-20336.md): Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Information Disclosure Vulnerability (CVSS 5.3, Cisco Session Initiation Protocol (SIP) Software)
- [CVE-2025-20330](https://cve.now/CVE-2025-20330.md): Cisco Unified Communications Manager IM and Presence Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unified Communications Manager IM and Presence Service)
- [CVE-2025-20280](https://cve.now/CVE-2025-20280.md): Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Evolved Programmable Network Manager · Cisco Prime In…)
- [CVE-2025-20326](https://cve.now/CVE-2025-20326.md): Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability (CVSS 4.3, Cisco Unified Communications Manager)
- [CVE-2025-20287](https://cve.now/CVE-2025-20287.md): Cisco Evolved Programmable Network Manager Arbitrary File Upload Vulnerability (CVSS 4.3, Cisco Evolved Programmable Network Manager)
- [CVE-2025-20270](https://cve.now/CVE-2025-20270.md): Cisco Evolved Programmable Network Manager Information Disclosure Vulnerability (CVSS 4.3, Cisco Evolved Programmable Network Manager · Cisco Prime In…)
- [CVE-2025-9922](https://cve.now/CVE-2025-9922.md): Campcodes Sales and Inventory System index.php cross site scripting (CVSS 5.3, Campcodes Sales and Inventory System)
- [CVE-2025-9921](https://cve.now/CVE-2025-9921.md): code-projects POS Pharmacy System products.php cross site scripting (CVSS 4.8, code-projects POS Pharmacy System)
- [CVE-2025-9959](https://cve.now/CVE-2025-9959.md): Sandbox escape in smolagents Local Python execution environment via dunder attributes (CVSS 7.6, smolagents)
- [CVE-2025-9867](https://cve.now/CVE-2025-9867.md): Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI… (CVSS 5.4, Google Chrome)
- [CVE-2025-9866](https://cve.now/CVE-2025-9866.md): Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security… (CVSS 8.8, Google Chrome)
- [CVE-2025-9865](https://cve.now/CVE-2025-9865.md): Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user… (CVSS 5.4, Google Chrome)
- [CVE-2025-9920](https://cve.now/CVE-2025-9920.md): Campcodes Recruitment Management System index.php include file inclusion (CVSS 5.1, Campcodes Recruitment Management System)
- [CVE-2025-9919](https://cve.now/CVE-2025-9919.md): 1000projects Beauty Parlour Management System bwdates-reports-details.php sql injection (CVSS 6.9, 1000projects Beauty Parlour Management System)
- [CVE-2025-0280](https://cve.now/CVE-2025-0280.md): HCL Compass is affected by a security vulnerability (CVSS 7.5, HCL Software Compass)
- [CVE-2025-58460](https://cve.now/CVE-2025-58460.md): A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b\_92b\_cd64 and earlier allows attackers with Overall/Read… (CVSS 4.2, Jenkins Project Jenkins OpenTelemetry Plugin · io.jenkins.p…)
- [CVE-2025-58459](https://cve.now/CVE-2025-58459.md): Jenkins global-build-stats Plugin 322.v22f4db\_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing… (CVSS 4.3, Jenkins Project Jenkins global-build-stats Plugin · org.jen…)
- [CVE-2025-58458](https://cve.now/CVE-2025-58458.md): In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether… (CVSS 4.3, Jenkins Project Jenkins Git client Plugin · org.jenkins-ci.…)
- [CVE-2025-58644](https://cve.now/CVE-2025-58644.md): WordPress LTL Freight Quotes - TQL Edition Plugin \<= 1.2.6 - PHP Object Injection Vulnerability (CVSS 7.2, enituretechnology LTL Freight Quotes - TQL Edition)
- [CVE-2025-58643](https://cve.now/CVE-2025-58643.md): WordPress LTL Freight Quotes – Daylight Edition Plugin \<= 2.2.7 - PHP Object Injection Vulnerability (CVSS 7.2, enituretechnology LTL Freight Quotes – Daylight Edition)
- [CVE-2025-58642](https://cve.now/CVE-2025-58642.md): WordPress LTL Freight Quotes – Day & Ross Edition Plugin \<= 2.1.11 - PHP Object Injection Vulnerability (CVSS 7.2, enituretechnology LTL Freight Quotes – Day & Ross Edition)
- [CVE-2025-58641](https://cve.now/CVE-2025-58641.md): WordPress Exit Intent Popup Plugin \<= 1.0.1 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 5.4, kamleshyadav Exit Intent Popup)
- [CVE-2025-58640](https://cve.now/CVE-2025-58640.md): WordPress Document Engine Plugin \<= 1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, MatrixAddons Document Engine)
- [CVE-2025-58639](https://cve.now/CVE-2025-58639.md): WordPress Contact Form By Mega Forms Plugin \<= 1.6.1 - Broken Access Control Vulnerability (CVSS 5.4, Ali Khallad Contact Form By Mega Forms)
- [CVE-2025-58637](https://cve.now/CVE-2025-58637.md): WordPress immonex Kickstart Plugin \<= 1.11.6 - Local File Inclusion Vulnerability (CVSS 7.5, immonex Kickstart)
- [CVE-2025-58635](https://cve.now/CVE-2025-58635.md): WordPress Support Genix Plugin \<= 1.4.23 - Broken Access Control Vulnerability (CVSS 5.3, DevItems Support Genix)
- [CVE-2025-58634](https://cve.now/CVE-2025-58634.md): WordPress PeachPay Payments Plugin \<= 1.117.4 - Broken Access Control Vulnerability (CVSS 5.3, PeachPay Payments)
- [CVE-2025-58633](https://cve.now/CVE-2025-58633.md): WordPress Booking Ultra Pro Plugin \<= 1.1.21 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Deetronix Booking Ultra Pro)
- [CVE-2025-58632](https://cve.now/CVE-2025-58632.md): WordPress Dadevarzan WordPress Common Plugin \<= 2.2.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Dadevarzan WordPress Common)
- [CVE-2025-58631](https://cve.now/CVE-2025-58631.md): WordPress IssueM Plugin \<= 2.9.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, ZEEN101 IssueM)
- [CVE-2025-58630](https://cve.now/CVE-2025-58630.md): WordPress Simple Matomo Tracking Code Plugin \<= 1.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, rbaer Simple Matomo Tracking Code)
- [CVE-2025-58626](https://cve.now/CVE-2025-58626.md): WordPress RumbleTalk Live Group Chat Plugin \<= 6.3.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, RumbleTalk Live Group Chat)
- [CVE-2025-58625](https://cve.now/CVE-2025-58625.md): WordPress WP Flow Plus Plugin \<= 5.2.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Spiffy Plugins WP Flow Plus)
- [CVE-2025-58624](https://cve.now/CVE-2025-58624.md): WordPress Exchange Rates Plugin \<= 1.2.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, falselight Exchange Rates)
- [CVE-2025-58623](https://cve.now/CVE-2025-58623.md): WordPress Event Feed for Eventbrite Plugin \<= 1.3.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Bohemia Plugins Event Feed for Eventbrite)
- [CVE-2025-58622](https://cve.now/CVE-2025-58622.md): WordPress Mobile Contact Line Plugin \<= 2.4.0 - Broken Access Control Vulnerability (CVSS 4.3, yydevelopment Mobile Contact Line)
- [CVE-2025-58621](https://cve.now/CVE-2025-58621.md): WordPress PuzzleMe for WordPress Plugin \<= 1.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Amuse Labs PuzzleMe for WordPress)
- [CVE-2025-58620](https://cve.now/CVE-2025-58620.md): WordPress PDF for WPForms Plugin \<= 6.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, add-ons.org PDF for WPForms)
- [CVE-2025-58618](https://cve.now/CVE-2025-58618.md): WordPress Pie Calendar Plugin \<= 1.2.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Jonathan Jernigan Pie Calendar)
- [CVE-2025-58617](https://cve.now/CVE-2025-58617.md): WordPress F4 Media Taxonomies Plugin \<= 1.1.4 - Broken Access Control Vulnerability (CVSS 4.3, FAKTOR VIER F4 Media Taxonomies)
- [CVE-2025-58616](https://cve.now/CVE-2025-58616.md): WordPress Frisbii Pay Plugin \<= 1.8.2.1 - Broken Access Control Vulnerability (CVSS 6.5, Frisbii Pay)
- [CVE-2025-58615](https://cve.now/CVE-2025-58615.md): WordPress WP Bannerize Pro Plugin \<= 1.10.0 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.4, gfazioli WP Bannerize Pro)
- [CVE-2025-58614](https://cve.now/CVE-2025-58614.md): WordPress Tooltipy Plugin \<= 5.5.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Jamel.Z Tooltipy)
- [CVE-2025-58613](https://cve.now/CVE-2025-58613.md): WordPress Posts Table with Search & Sort Plugin \<= 1.4.10 - Broken Access Control Vulnerability (CVSS 5.3, Barn2 Plugins Posts Table with Search & Sort)
- [CVE-2025-58612](https://cve.now/CVE-2025-58612.md): WordPress PropertyHive Plugin \<= 2.1.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Property Hive PropertyHive)
- [CVE-2025-58611](https://cve.now/CVE-2025-58611.md): WordPress Tickera Plugin \<= 3.5.5.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Tickera)
- [CVE-2025-58610](https://cve.now/CVE-2025-58610.md): WordPress Gallery PhotoBlocks Plugin \<= 1.3.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WP Chill Gallery PhotoBlocks)
- [CVE-2025-58609](https://cve.now/CVE-2025-58609.md): WordPress Latest Post Shortcode Plugin \<= 14.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Iulia Cazan Latest Post Shortcode)
- [CVE-2025-58608](https://cve.now/CVE-2025-58608.md): WordPress MediaPress Plugin \<= 1.5.9.1 - Local File Inclusion Vulnerability (CVSS 7.5, BuddyDev MediaPress)
- [CVE-2025-58607](https://cve.now/CVE-2025-58607.md): WordPress Cookie Notice & Consent Banner for GDPR & CCPA Compliance Plugin \<= 1.7.11 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Co…)
- [CVE-2025-58606](https://cve.now/CVE-2025-58606.md): WordPress SaasLauncher Theme \<= 1.3.0 - Broken Access Control Vulnerability (CVSS 5.0, cozythemes SaasLauncher)
- [CVE-2025-58605](https://cve.now/CVE-2025-58605.md): WordPress WP Delicious Plugin \<= 1.8.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WP Delicious)
- [CVE-2025-58604](https://cve.now/CVE-2025-58604.md): WordPress Mail Mint Plugin \<= 1.18.5 - SQL Injection Vulnerability (CVSS 7.6, WPFunnels Mail Mint)
- [CVE-2025-58603](https://cve.now/CVE-2025-58603.md): WordPress Surfer Plugin \<= 1.6.4.574 - Broken Access Control Vulnerability (CVSS 5.3, Surfer)
- [CVE-2025-58602](https://cve.now/CVE-2025-58602.md): WordPress If-So Dynamic Content Personalization Plugin \<= 1.9.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, If-So Dynamic Content Personalization)
- [CVE-2025-58601](https://cve.now/CVE-2025-58601.md): WordPress Classified Listing Plugin \<= 5.0.6 - Broken Access Control Vulnerability (CVSS 4.3, RadiusTheme Classified Listing)
- [CVE-2025-58600](https://cve.now/CVE-2025-58600.md): WordPress Paid Member Subscriptions Plugin \<= 2.15.9 - Broken Access Control Vulnerability (CVSS 5.3, Cozmoslabs Paid Member Subscriptions)
- [CVE-2025-58599](https://cve.now/CVE-2025-58599.md): WordPress Order Delivery Date for WooCommerce Plugin \<= 4.1.0 - Broken Access Control Vulnerability (CVSS 4.3, tychesoftwares Order Delivery Date for WooCommerce)
- [CVE-2025-58598](https://cve.now/CVE-2025-58598.md): WordPress Klarna Order Management for WooCommerce Plugin \<= 1.9.8 - Sensitive Data Exposure Vulnerability (CVSS 6.6, Klarna Order Management for WooCommerce)
- [CVE-2025-58597](https://cve.now/CVE-2025-58597.md): WordPress wpForo Forum Plugin \<= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability (CVSS 4.3, Tomdever wpForo Forum)
- [CVE-2025-58596](https://cve.now/CVE-2025-58596.md): WordPress MailOptin Plugin \<= 1.2.75.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, properfraction MailOptin)
- [CVE-2025-58594](https://cve.now/CVE-2025-58594.md): WordPress Brizy Plugin \<= 2.7.12 - Broken Access Control Vulnerability (CVSS 4.3, themefusecom Brizy)
- [CVE-2025-58593](https://cve.now/CVE-2025-58593.md): WordPress Orbit Fox by ThemeIsle Plugin \<= 3.0.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Orbit Fox by ThemeIsle)
- [CVE-2025-9823](https://cve.now/CVE-2025-9823.md): Reflected XSS in lead:addLeadTags - Quick Add (CVSS 4.8, mautic/core)
- [CVE-2025-9824](https://cve.now/CVE-2025-9824.md): User Enumeration via Response Timing (CVSS 5.9, mautic/core)
- [CVE-2025-9822](https://cve.now/CVE-2025-9822.md): Secret data extraction via elfinder (CVSS 5.5, mautic/core)
- [CVE-2025-47421](https://cve.now/CVE-2025-47421.md): Privilege escalation via SCP login (CVSS 8.6, CRESTRON TOUCHSCREENS x70)
- [CVE-2025-2416](https://cve.now/CVE-2025-2416.md): OTP Bypass in Akinsoft's LimonDesk (CVSS 8.6, Akinsoft LimonDesk)
- [CVE-2025-0878](https://cve.now/CVE-2025-0878.md): XSS in Akinsoft's LimonDesk (CVSS 4.7, Akinsoft LimonDesk)
- [CVE-2024-13068](https://cve.now/CVE-2024-13068.md): Host Header Injection in Akinsoft's LimonDesk (CVSS 7.3, Akinsoft LimonDesk)
- [CVE-2024-13066](https://cve.now/CVE-2024-13066.md): iFrame Injection in Akinsoft's LimonDesk (CVSS 4.3, Akinsoft LimonDesk)
- [CVE-2025-38678](https://cve.now/CVE-2025-38678.md): netfilter: nf\_tables: reject duplicate device on updates (CVSS 7.8, Linux)
- [CVE-2025-3701](https://cve.now/CVE-2025-3701.md): WordPress Malcure Malware Scanner plugin \<= 16.8 - Broken Access Control vulnerability (CVSS 4.3, Malcure Web Security Malcure Malware Scanner)
- [CVE-2025-53691](https://cve.now/CVE-2025-53691.md): Sitecore Experience Remote Code Execution through Insecure Deserialization (CVSS 8.8, Sitecore Experience Manager · Sitecore Experience Platform)
- [CVE-2025-53693](https://cve.now/CVE-2025-53693.md): HTML Cache Poisoning through Unsafe Reflections (CVSS 9.8, Sitecore Experience Manager · Sitecore Experience Platform)
- [CVE-2025-53694](https://cve.now/CVE-2025-53694.md): Information Disclosure in ItemServices API (CVSS 7.5, Sitecore Experience Manager · Sitecore Experience Platform)
- [CVE-2025-9901](https://cve.now/CVE-2025-9901.md): Libsoup: improper handling of http vary header in libsoup caching (CVSS 5.9, Red Hat Enterprise Linux)
- [CVE-2025-41000](https://cve.now/CVE-2025-41000.md): Cross-Frame Scripting (XFS) in BoomCMS (CVSS 2.1, BoomCMS)
- [CVE-2025-9821](https://cve.now/CVE-2025-9821.md): SSRF via webhook function (CVSS 2.7, mautic/core)
- [CVE-2024-43166](https://cve.now/CVE-2024-43166.md): Incorrect Default Permissions vulnerability in Apache DolphinScheduler. (CVSS 9.8, Apache Software Foundation Apache DolphinScheduler · org.ap…)
- [CVE-2025-2415](https://cve.now/CVE-2025-2415.md): OTP Bypass in Akinsoft's MyRezzta (CVSS 8.6, Akinsoft MyRezzta)
- [CVE-2025-1740](https://cve.now/CVE-2025-1740.md): Authentication Bypass in Akinsoft's MyRezzta (CVSS 9.8, Akinsoft MyRezzta)
- [CVE-2024-13065](https://cve.now/CVE-2024-13065.md): Business Logic Error in Akinsoft's MyRezzta (CVSS 6.3, Akinsoft MyRezzta)
- [CVE-2024-13064](https://cve.now/CVE-2024-13064.md): XSS in Akinsoft's MyRezzta (CVSS 4.3, Akinsoft MyRezzta)
- [CVE-2024-43115](https://cve.now/CVE-2024-43115.md): Apache DolphinScheduler: Alert Script Attack (CVSS 8.8, Apache Software Foundation Apache DolphinScheduler · org.ap…)
- [CVE-2014-125127](https://cve.now/CVE-2014-125127.md): Denial of Service (DoS) vulnerability in mikecao/flight (CVSS 7.5, flightphp mikecao/flight)
- [CVE-2024-13063](https://cve.now/CVE-2024-13063.md): IDOR in Akinsoft's MyRezzta (CVSS 6.8, Akinsoft MyRezzta)
- [CVE-2025-9219](https://cve.now/CVE-2025-9219.md): Post SMTP \<= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update (CVSS 4.3, saadiqbal Post SMTP – Complete Email Deliverability and SMT…)
- [CVE-2025-9817](https://cve.now/CVE-2025-9817.md): NULL Pointer Dereference in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2025-8663](https://cve.now/CVE-2025-8663.md): Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain… (CVSS 8.8, upKeeper Solutions upKeeper Manager)
- [CVE-2025-58210](https://cve.now/CVE-2025-58210.md): WordPress Makeaholic Theme \<= 1.8.5 - Broken Access Control Vulnerability (CVSS 5.3, ThemeMove Makeaholic)
- [CVE-2024-32444](https://cve.now/CVE-2024-32444.md): WordPress RealHomes theme \<= 4.3.6 - Privilege Escalation vulnerability (CVSS 9.8, InspiryThemes RealHomes)
- [CVE-2025-9378](https://cve.now/CVE-2025-9378.md): Vayu Blocks \<= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes (CVSS 6.4, themehunk Vayu Blocks – Website Builder for the Block Editor)
- [CVE-2025-21041](https://cve.now/CVE-2025-21041.md): Insecure Storage of Sensitive Information in Secure Folder prior to Android 16 allows local attackers to access sensitive information. (CVSS 6.2, Samsung Mobile Secure Folder)
- [CVE-2025-21040](https://cve.now/CVE-2025-21040.md): Improper verification of intent by ExternalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify… (CVSS 5.1, Samsung Mobile S Assistant)
- [CVE-2025-21039](https://cve.now/CVE-2025-21039.md): Improper verification of intent by SystemExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to… (CVSS 5.1, Samsung Mobile S Assistant)
- [CVE-2025-21038](https://cve.now/CVE-2025-21038.md): Improper verification of intent by SamsungExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to… (CVSS 5.1, Samsung Mobile S Assistant)
- [CVE-2025-21037](https://cve.now/CVE-2025-21037.md): Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. (CVSS 4.1, Samsung Mobile SamsungNotes)
- [CVE-2025-21036](https://cve.now/CVE-2025-21036.md): Improper access control in Samsung Notes prior to version 4.4.30.63 allows local privileged attackers to access exported note files. (CVSS 5.0, Samsung Mobile Samsung Notes)
- [CVE-2025-21035](https://cve.now/CVE-2025-21035.md): Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical… (CVSS 4.6, Samsung Mobile Samsung Calendar)
- [CVE-2025-21034](https://cve.now/CVE-2025-21034.md): Out-of-bounds write in libsavsvc.so prior to SMR Sep-2025 Release 1 allows local attackers to potentially execute arbitrary code. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21033](https://cve.now/CVE-2025-21033.md): Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive information. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21032](https://cve.now/CVE-2025-21032.md): Improper access control in One UI Home prior to SMR Sep-2025 Release 1 allows physical attackers to bypass Kiosk mode under limited… (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2025-21031](https://cve.now/CVE-2025-21031.md): Improper access control in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to use the privileged APIs. (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2025-21030](https://cve.now/CVE-2025-21030.md): Improper handling of insufficient permission in AppPrelaunchManagerService prior to SMR Sep-2025 Release 1 in Chinese Android 15 allows… (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2025-21029](https://cve.now/CVE-2025-21029.md): Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies… (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21028](https://cve.now/CVE-2025-21028.md): Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items. (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-21027](https://cve.now/CVE-2025-21027.md): Improper verification of intent by broadcast receiver in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to temporarily… (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2025-21026](https://cve.now/CVE-2025-21026.md): Improper handling of insufficient permission in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to interrupt the call. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21025](https://cve.now/CVE-2025-21025.md): Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attackers to be excluded from background… (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2023-21474](https://cve.now/CVE-2023-21474.md): Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary file with system… (CVSS 6.3, Samsung Mobile Devices)
- [CVE-2023-3666](https://cve.now/CVE-2023-3666.md): Sticky Side Buttons \< 2.0.0 - Admin+ Stored XSS (CVSS 3.3, Sticky Side Buttons)
- [CVE-2025-58272](https://cve.now/CVE-2025-58272.md): Cross-site request forgery vulnerability exists in Web Caster V130 versions 1.08 and earlier. (CVSS 3.7, NTT EAST Web Caster · NTT WEST Web Caster)
- [CVE-2023-21483](https://cve.now/CVE-2023-21483.md): Improper Access Control vulnerability in Galaxy Store prior to version 4.5.53.6 allows local attacker to access protected data using… (CVSS 6.4, Samsung Mobile Galaxy Store)
- [CVE-2023-21482](https://cve.now/CVE-2023-21482.md): Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 13.1.01.4 in Android… (CVSS 6.1, Samsung Mobile Samsung Camera)
- [CVE-2023-21481](https://cve.now/CVE-2023-21481.md): Improper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote attackers to get… (CVSS 5.4, Samsung Mobile Samsung Account)
- [CVE-2023-21480](https://cve.now/CVE-2023-21480.md): Improper input validation vulnerability in CertByte prior to SMR Apr-2023 Release 1 allows local attackers to launch privileged activities. (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2023-21479](https://cve.now/CVE-2023-21479.md): Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote… (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2023-21478](https://cve.now/CVE-2023-21478.md): Improper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data. (CVSS 6.0, Samsung Mobile Devices)
- [CVE-2023-21477](https://cve.now/CVE-2023-21477.md): Access of Memory Location After End of Buffer vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to… (CVSS 7.9, Samsung Mobile Devices)
- [CVE-2023-21476](https://cve.now/CVE-2023-21476.md): Out-of-bounds Write vulnerability in libaudiosaplus\_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute… (CVSS 8.0, Samsung Mobile Devices)
- [CVE-2023-21475](https://cve.now/CVE-2023-21475.md): Out-of-bounds Write vulnerability in libaudiosaplus\_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute… (CVSS 8.0, Samsung Mobile Devices)
- [CVE-2023-21473](https://cve.now/CVE-2023-21473.md): Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute… (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2023-21472](https://cve.now/CVE-2023-21472.md): Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute… (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2023-21471](https://cve.now/CVE-2023-21471.md): Improper access control vulnerability in SemClipboard prior to SMR Apr-2023 Release 1 allows attackers to read arbitrary files with system… (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-21470](https://cve.now/CVE-2023-21470.md): Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location… (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-21469](https://cve.now/CVE-2023-21469.md): Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location… (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-21468](https://cve.now/CVE-2023-21468.md): Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files with escalated… (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2023-21467](https://cve.now/CVE-2023-21467.md): Error in 3GPP specification implementation in Exynos baseband prior to SMR Apr-2023 Release 1 allows incorrect handling of unencrypted… (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2023-21466](https://cve.now/CVE-2023-21466.md): PendingIntent hijacking vulnerability in CertificatePolicy in framework prior to SMR Apr-2023 Release 1 allows local attackers to access… (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2025-9785](https://cve.now/CVE-2025-9785.md): Misconfigured certificate validation with self-signed certificates for Print Deploy (CVSS 7.7, PaperCut Print Deploy)
- [CVE-2025-58176](https://cve.now/CVE-2025-58176.md): Dive's improper processing of custom urls can lead to Remote Code Execution (CVSS 8.8, OpenAgentPlatform Dive)
- [CVE-2025-58351](https://cve.now/CVE-2025-58351.md): Outline's Local File Storage Feature can Cause CSP Bypass (CVSS 6.8, outline)
- [CVE-2025-7039](https://cve.now/CVE-2025-7039.md): Glib: buffer under-read on glib through glib/gfileutils.c via get\_tmp\_file() (CVSS 3.7, Red Hat Enterprise Linux)
- [CVE-2025-58163](https://cve.now/CVE-2025-58163.md): FreeScout's deserialization of untrusted data can lead to Remote Code Execution (CVSS 8.6, freescout-help-desk freescout)
- [CVE-2025-9848](https://cve.now/CVE-2025-9848.md): ScriptAndTools Real Estate Management System userlist.php redirect (CVSS 6.9, ScriptAndTools Real Estate Management System)
- [CVE-2025-9847](https://cve.now/CVE-2025-9847.md): ScriptAndTools Real Estate Management System register.php unrestricted upload (CVSS 5.3, ScriptAndTools Real Estate Management System)
- [CVE-2025-57806](https://cve.now/CVE-2025-57806.md): Local Deep Research's API keys are stored in plain text (CVSS 6.9, LearningCircuit local-deep-research)
- [CVE-2025-9845](https://cve.now/CVE-2025-9845.md): code-projects Fruit Shop Management System products.php cross site scripting (CVSS 5.1, code-projects Fruit Shop Management System)
- [CVE-2025-9843](https://cve.now/CVE-2025-9843.md): Das Parking Management System 停车场管理系统 FindAll information disclosure (CVSS 6.9, Das Parking Management System 停车场管理系统)
- [CVE-2025-9842](https://cve.now/CVE-2025-9842.md): Das Parking Management System 停车场管理系统 Search information disclosure (CVSS 6.9, Das Parking Management System 停车场管理系统)
- [CVE-2025-26210](https://cve.now/CVE-2025-26210.md): DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. (CVSS 8.8)
- [CVE-2025-45805](https://cve.now/CVE-2025-45805.md): In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their… (CVSS 7.6)
- [CVE-2025-52494](https://cve.now/CVE-2025-52494.md): Adacore Ada Web Server (AWS) before 25.2 is vulnerable to a denial-of-service (DoS) condition due to improper handling of SSL handshakes… (CVSS 7.5)
- [CVE-2025-55852](https://cve.now/CVE-2025-55852.md): Tenda AC8 v16.03.34.06 is vulnerable to Buffer Overflow in the formWifiBasicSet function via the parameter security or security\_5g. (CVSS 7.5)
- [CVE-2025-55944](https://cve.now/CVE-2025-55944.md): Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. (CVSS 6.1)
- [CVE-2025-56139](https://cve.now/CVE-2025-56139.md): LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user… (CVSS 5.3)
- [CVE-2025-56435](https://cve.now/CVE-2025-56435.md): SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. (CVSS 5.3)
- [CVE-2025-56498](https://cve.now/CVE-2025-56498.md): An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. (CVSS 5.3)
- [CVE-2025-56608](https://cve.now/CVE-2025-56608.md): The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in… (CVSS 4.2)
- [CVE-2025-56689](https://cve.now/CVE-2025-56689.md): One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor… (CVSS 4.6)
- [CVE-2025-56752](https://cve.now/CVE-2025-56752.md): A vulnerability in the Ruijie RG-ES series switch firmware ESW\_1.0(1)B1P39 enables remote attackers to fully bypass authentication… (CVSS 9.4)
- [CVE-2025-56760](https://cve.now/CVE-2025-56760.md): When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path… (CVSS 4.3, github.com/usememos/memos)
- [CVE-2025-56761](https://cve.now/CVE-2025-56761.md): Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. (CVSS 5.4, github.com/usememos/memos)
- [CVE-2025-56803](https://cve.now/CVE-2025-56803.md): Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. (CVSS 8.4)
- [CVE-2025-57052](https://cve.now/CVE-2025-57052.md): cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode\_array\_index\_from\_pointer function in cJSON\_Utils.c, allowing remote… (CVSS 9.8)
- [CVE-2025-57146](https://cve.now/CVE-2025-57146.md): phpgurukul Complaint Management System in PHP 2.0 is vulnerable to SQL Injection in user/reset-password.php via the mobileno parameter. (CVSS 8.1)
- [CVE-2025-57147](https://cve.now/CVE-2025-57147.md): A SQL Injection vulnerability was found in phpgurukul Complaint Management System 2.0. (CVSS 7.5)
- [CVE-2025-57148](https://cve.now/CVE-2025-57148.md): phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the lack of extension… (CVSS 9.1)
- [CVE-2025-57149](https://cve.now/CVE-2025-57149.md): phpgurukul Complaint Management System 2.0 is vulnerable to SQL Injection in /complaint-details.php via the cid parameter. (CVSS 6.5)
- [CVE-2025-57150](https://cve.now/CVE-2025-57150.md): phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/subcategory.php via the… (CVSS 7.2)
- [CVE-2025-57151](https://cve.now/CVE-2025-57151.md): phpgurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/userprofile.php via the fullname parameter. (CVSS 8.8)
- [CVE-2025-57833](https://cve.now/CVE-2025-57833.md): An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. (CVSS 7.1, djangoproject Django · django)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2025-09-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.