# CVEs published 2025-09-02

138 CVEs were published on September 2, 2025: 10 critical, 63 high. Days are UTC.

- [CVE-2025-54588](https://cve.now/CVE-2025-54588.md): Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults (CVSS 7.5, envoyproxy envoy · github.com/envoyproxy/envoy)
- [CVE-2025-9841](https://cve.now/CVE-2025-9841.md): code-projects Mobile Shop Management System AddNewProduct.php unrestricted upload (CVSS 5.3, code-projects Mobile Shop Management System)
- [CVE-2025-9260](https://cve.now/CVE-2025-9260.md): Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read (CVSS 6.5, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2025-9840](https://cve.now/CVE-2025-9840.md): itsourcecode Sports Management System gametype.php sql injection (CVSS 5.3, itsourcecode Sports Management System)
- [CVE-2025-9839](https://cve.now/CVE-2025-9839.md): itsourcecode Student Information Management System index.php sql injection (CVSS 6.9, itsourcecode Student Information Management System)
- [CVE-2025-9838](https://cve.now/CVE-2025-9838.md): itsourcecode Student Information Management System index.php sql injection (CVSS 6.9, itsourcecode Student Information Management System)
- [CVE-2025-26416](https://cve.now/CVE-2025-26416.md): In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 9.8, Google Android)
- [CVE-2025-22442](https://cve.now/CVE-2025-22442.md): In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created (CVSS 7.0, Google Android)
- [CVE-2025-22439](https://cve.now/CVE-2025-22439.md): In onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps due to a missing per (CVSS 7.3, Google Android)
- [CVE-2025-22438](https://cve.now/CVE-2025-22438.md): In afterKeyEventLockedInterruptable of InputDispatcher.cpp, there is a possible use after free. (CVSS 7.8, Google Android)
- [CVE-2025-22437](https://cve.now/CVE-2025-22437.md): In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in (CVSS 7.8, Google Android)
- [CVE-2025-22435](https://cve.now/CVE-2025-22435.md): In avdt\_msg\_ind of avdt\_msg.cc, there is a possible memory corruption due to type confusion. (CVSS 9.8, Google Android)
- [CVE-2025-22434](https://cve.now/CVE-2025-22434.md): In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-22433](https://cve.now/CVE-2025-22433.md): In canForward of IntentForwarderActivity.java, there is a possible bypass of the cross profile intent filter most commonly used in Work Prof (CVSS 7.8, Google Android)
- [CVE-2025-22431](https://cve.now/CVE-2025-22431.md): In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due (CVSS 5.5, Google Android)
- [CVE-2025-22430](https://cve.now/CVE-2025-22430.md): In isInSignificantPlace of multiple files, there is a possible way to access sensitive information due to a missing permission check. (CVSS 5.5, Google Android)
- [CVE-2025-22429](https://cve.now/CVE-2025-22429.md): In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code. (CVSS 9.8, Google Android)
- [CVE-2025-22428](https://cve.now/CVE-2025-22428.md): In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on the secondary user fr (CVSS 7.8, Google Android)
- [CVE-2025-22427](https://cve.now/CVE-2025-22427.md): In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to grant notification access above the lock screen due t (CVSS 7.3, Google Android)
- [CVE-2025-22423](https://cve.now/CVE-2025-22423.md): In ParseTag of dng\_ifd.cpp, there is a possible way to crash the image renderer due to a missing bounds check. (CVSS 7.5, Google Android)
- [CVE-2025-22422](https://cve.now/CVE-2025-22422.md): In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app when its result will be (CVSS 7.8, Google Android)
- [CVE-2025-22421](https://cve.now/CVE-2025-22421.md): In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due (CVSS 5.5, Google Android)
- [CVE-2025-22419](https://cve.now/CVE-2025-22419.md): In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overla (CVSS 7.3, Google Android)
- [CVE-2025-22418](https://cve.now/CVE-2025-22418.md): In multiple locations, there is a possible confused deputy due to Intent Redirect. (CVSS 7.8, Google Android)
- [CVE-2025-22417](https://cve.now/CVE-2025-22417.md): In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack. (CVSS 7.3, Google Android)
- [CVE-2025-22416](https://cve.now/CVE-2025-22416.md): In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2024-49730](https://cve.now/CVE-2024-49730.md): In FuseDaemon.cpp, there is a possible out of bounds write due to memory corruption. (CVSS 7.8, Google Android)
- [CVE-2024-49728](https://cve.now/CVE-2024-49728.md): In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. (CVSS 5.5, Google Android)
- [CVE-2024-49722](https://cve.now/CVE-2024-49722.md): In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. (CVSS 5.5, Google Android)
- [CVE-2024-49720](https://cve.now/CVE-2024-49720.md): In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic e (CVSS 7.8, Google Android)
- [CVE-2024-40653](https://cve.now/CVE-2024-40653.md): In multiple functions of ConnectionServiceWrapper.java, there is a possible way to retain a permission forever in the background due to a lo (CVSS 7.3, Google Android)
- [CVE-2025-9837](https://cve.now/CVE-2025-9837.md): itsourcecode Student Information Management System index.php sql injection (CVSS 6.9, itsourcecode Student Information Management System)
- [CVE-2025-9836](https://cve.now/CVE-2025-9836.md): macrozheng mall paySuccess authorization (CVSS 5.3, macrozheng mall)
- [CVE-2025-9835](https://cve.now/CVE-2025-9835.md): macrozheng mall cancelUserOrder cancelOrder authorization (CVSS 5.3, macrozheng mall)
- [CVE-2025-9834](https://cve.now/CVE-2025-9834.md): PHPGurukul Small CRM registration.php cross site scripting (CVSS 5.1, PHPGurukul Small CRM)
- [CVE-2025-9833](https://cve.now/CVE-2025-9833.md): SourceCodester Online Farm Management System login.php sql injection (CVSS 6.9, SourceCodester Online Farm Management System)
- [CVE-2025-9832](https://cve.now/CVE-2025-9832.md): SourceCodester Food Ordering Management System register-router.php sql injection (CVSS 6.9, SourceCodester Food Ordering Management System)
- [CVE-2025-9831](https://cve.now/CVE-2025-9831.md): PHPGurukul Beauty Parlour Management System edit-services.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-9330](https://cve.now/CVE-2025-9330.md): Foxit PDF Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2025-9323](https://cve.now/CVE-2025-9323.md): Foxit PDF Reader JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2025-9324](https://cve.now/CVE-2025-9324.md): Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2025-9325](https://cve.now/CVE-2025-9325.md): Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2025-9326](https://cve.now/CVE-2025-9326.md): Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2025-9327](https://cve.now/CVE-2025-9327.md): Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2025-9328](https://cve.now/CVE-2025-9328.md): Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2025-9329](https://cve.now/CVE-2025-9329.md): Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2025-8300](https://cve.now/CVE-2025-8300.md): Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability (CVSS 8.8, Realtek rtl81xx SDK)
- [CVE-2025-8299](https://cve.now/CVE-2025-8299.md): Realtek rtl81xx SDK Wi-Fi Driver MgntActSet\_TEREDO\_SET\_RS\_PACKET Heap-based Buffer Overflow Local Privilege Escalation Vulnerability (CVSS 8.8, Realtek rtl81xx SDK)
- [CVE-2025-8298](https://cve.now/CVE-2025-8298.md): Realtek RTL8811AU rtwlanu.sys N6CQueryInformationHandleCustomized11nOids Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.8, Realtek RTL8811AU)
- [CVE-2025-8301](https://cve.now/CVE-2025-8301.md): Realtek RTL8811AU rtwlanu.sys N6CSet\_DOT11\_CIPHER\_DEFAULT\_KEY Heap-based Buffer Overflow Local Privilege Escalation Vulnerability (CVSS 7.8, Realtek RTL8811AU)
- [CVE-2025-8302](https://cve.now/CVE-2025-8302.md): Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability (CVSS 8.8, Realtek rtl81xx SDK)
- [CVE-2025-9830](https://cve.now/CVE-2025-9830.md): PHPGurukul Beauty Parlour Management System add-customer-services.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-9276](https://cve.now/CVE-2025-9276.md): Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability (CVSS 9.8, Cockroach Labs cockroach-k8s-request-cert)
- [CVE-2025-9275](https://cve.now/CVE-2025-9275.md): Oxford Instruments Imaris Viewer IMS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Oxford Instruments Imaris Viewer)
- [CVE-2025-9274](https://cve.now/CVE-2025-9274.md): Oxford Instruments Imaris Viewer IMS File Parsing Uninitialized Pointer Remote Code Execution Vulnerability (CVSS 7.8, Oxford Instruments Imaris Viewer)
- [CVE-2025-9273](https://cve.now/CVE-2025-9273.md): CData API Server MySQL Misconfiguration Information Disclosure Vulnerability (CVSS 4.3, CData API Server)
- [CVE-2025-8613](https://cve.now/CVE-2025-8613.md): Vacron Camera ping Command Injection Remote Code Execution Vulnerability (CVSS 7.2, Vacron Camera)
- [CVE-2025-6685](https://cve.now/CVE-2025-6685.md): ATEN eco DC Missing Authorization Privilege Escalation Vulnerability (CVSS 8.8, ATEN eco DC)
- [CVE-2025-7976](https://cve.now/CVE-2025-7976.md): Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, Anritsu ShockLine)
- [CVE-2025-7975](https://cve.now/CVE-2025-7975.md): Anritsu ShockLine CHX File Parsing Directory Traversal Remote Code Execution Vulnerability (CVSS 7.8, Anritsu ShockLine)
- [CVE-2025-8614](https://cve.now/CVE-2025-8614.md): NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.8, NoMachine)
- [CVE-2025-7974](https://cve.now/CVE-2025-7974.md): rocket.chat Incorrect Authorization Information Disclosure Vulnerability (CVSS 3.7, rocket.chat)
- [CVE-2025-36162](https://cve.now/CVE-2025-36162.md): IBM DevOps Deploy / IBM UrbanCode Deploy information disclosure (CVSS 4.3, IBM UrbanCode Deploy)
- [CVE-2025-9829](https://cve.now/CVE-2025-9829.md): PHPGurukul Beauty Parlour Management System signup.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-43726](https://cve.now/CVE-2025-43726.md): Dell Alienware Command Center 5.x (AWCC), versions prior to 5.10.2.0, contains an Improper Link Resolution Before File Access ('Link Followi (CVSS 6.7, Dell Alienware Command Center 5.x)
- [CVE-2025-57777](https://cve.now/CVE-2025-57777.md): Out Of Bounds Write in displ2.dll when parsing a DSB file with Digilent DASYLab (CVSS 7.8, Digilent DASYLab)
- [CVE-2025-57775](https://cve.now/CVE-2025-57775.md): Heap-based Buffer Overflow when parsing a DSB file with Digilent DASYLab (CVSS 7.8, Digilent DASYLab)
- [CVE-2025-9188](https://cve.now/CVE-2025-9188.md): Deserialization of Untrusted Data when parsing a DSB file with Digilent DASYLab (CVSS 7.8, Digilent DASYLab)
- [CVE-2025-57778](https://cve.now/CVE-2025-57778.md): Out Of Bounds Write to invalid source address when parsing a DSB file with Digilent DASYLab (CVSS 7.8, Digilent DASYLab)
- [CVE-2025-57776](https://cve.now/CVE-2025-57776.md): Out Of Bounds Write to invalid address when parsing a DSB file with Digilent DASYLab (CVSS 7.8, Digilent DASYLab)
- [CVE-2025-57774](https://cve.now/CVE-2025-57774.md): Out Of Bounds Write of invalid data when parsing a DSB file with Digilent DASYLab (CVSS 7.8, Digilent DASYLab)
- [CVE-2025-9189](https://cve.now/CVE-2025-9189.md): Out Of Bounds Write when parsing a DSB file with Digilent DASYLab (CVSS 7.8, Digilent DASYLab · measX DASYLab)
- [CVE-2025-9828](https://cve.now/CVE-2025-9828.md): Tenda CP6 uhttp sub\_2B7D04 risky encryption (CVSS 6.3, Tenda CP6)
- [CVE-2025-9696](https://cve.now/CVE-2025-9696.md): Use of Hard-coded Credentials in SunPower PVS6 (CVSS 9.4, SunPower PVS6)
- [CVE-2025-9784](https://cve.now/CVE-2025-9784.md): Undertow: undertow madeyoureset http/2 ddos vulnerability (CVSS 7.5, undertow · Red Hat build of Apache Camel 4.14.2 for Spr… +11)
- [CVE-2025-2413](https://cve.now/CVE-2025-2413.md): OTP Bypass in Akinsoft's ProKuafor (CVSS 8.6, Akinsoft ProKuafor)
- [CVE-2025-0670](https://cve.now/CVE-2025-0670.md): IDOR in Akinsoft's ProKuafor (CVSS 4.7, Akinsoft ProKuafor)
- [CVE-2024-12974](https://cve.now/CVE-2024-12974.md): XSS in Akinsoft's ProKuaför (CVSS 4.3, Akinsoft ProKuaför)
- [CVE-2024-58259](https://cve.now/CVE-2024-58259.md): Rancher affected by unauthenticated Denial of Service (CVSS 8.2, SUSE rancher · github.com/rancher/rancher)
- [CVE-2025-2414](https://cve.now/CVE-2025-2414.md): OTP Bypass in Akinsoft's OctoCloud (CVSS 8.6, Akinsoft OctoCloud)
- [CVE-2024-52284](https://cve.now/CVE-2024-52284.md): Rancher Fleet Helm Values are stored inside BundleDeployment in plain text (CVSS 7.7, SUSE Rancher · github.com/rancher/fleet)
- [CVE-2025-0640](https://cve.now/CVE-2025-0640.md): IDOR in Akinsoft's OctoCloud (CVSS 4.7, Akinsoft OctoCloud)
- [CVE-2024-12973](https://cve.now/CVE-2024-12973.md): Host Header Injection in Akinsoft's OctoCloud (CVSS 4.7, Akinsoft OctoCloud)
- [CVE-2024-12972](https://cve.now/CVE-2024-12972.md): XSS in Akinsoft's OctoCloud (CVSS 4.3, Akinsoft OctoCloud)
- [CVE-2025-46810](https://cve.now/CVE-2025-46810.md): A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate (CVSS 8.5, openSUSE Tumbleweed)
- [CVE-2025-52551](https://cve.now/CVE-2025-52551.md): Proprietary protocol allows for unauthenticated file operations (CVSS 9.3, Copeland LP E2 Facility Management System)
- [CVE-2025-52550](https://cve.now/CVE-2025-52550.md): Firmware upgrade packages are unsigned (CVSS 8.6, Copeland LP E3 Supervisory Control)
- [CVE-2025-52549](https://cve.now/CVE-2025-52549.md): Predictable root linux password generation (CVSS 9.2, Copeland LP E3 Supervisory Control)
- [CVE-2025-52548](https://cve.now/CVE-2025-52548.md): Enabling SSH and Shellinabox on the vulnerable machine (CVSS 6.9, Copeland LP E3 Supervisory Control)
- [CVE-2025-52547](https://cve.now/CVE-2025-52547.md): DoS to the application services (CVSS 8.7, Copeland LP E3 Supervisory Control)
- [CVE-2025-52546](https://cve.now/CVE-2025-52546.md): Stored XSS by uploading a specially crafted floor plan file (CVSS 5.1, Copeland LP E3 Supervisory Control)
- [CVE-2025-52545](https://cve.now/CVE-2025-52545.md): Privilege escalation in the application services (CVSS 7.7, Copeland LP E3 Supervisory Control)
- [CVE-2025-52544](https://cve.now/CVE-2025-52544.md): Arbitrary read file from the filesystem (CVSS 8.8, Copeland LP E3 Supervisory Control)
- [CVE-2025-52543](https://cve.now/CVE-2025-52543.md): Login to the application services using only the password hash (CVSS 5.3, Copeland LP E3 Supervisory Control)
- [CVE-2025-6519](https://cve.now/CVE-2025-6519.md): Consistent predictable generation of the password for the default admin user "ONEDAY" to the application services (CVSS 9.3, Copeland LP E3 Supervisory Control)
- [CVE-2025-5662](https://cve.now/CVE-2025-5662.md): Deserialization Vulnerability in h2oai/h2o-3 (CVSS 9.8, h2oai/h2o-3)
- [CVE-2025-9573](https://cve.now/CVE-2025-9573.md): Command Injection in extension "TYPO3 Backup Plus" (ns\_backup) (CVSS 8.6, Extension "TYPO3 Backup Plus")
- [CVE-2025-41031](https://cve.now/CVE-2025-41031.md): Multiple vulnerabilities in Deporsite by T-INNOVA (CVSS 6.9, T-INNOVA Deporsite)
- [CVE-2025-41030](https://cve.now/CVE-2025-41030.md): Multiple vulnerabilities in Deporsite by T-INNOVA (CVSS 6.9, T-INNOVA Deporsite)
- [CVE-2025-41690](https://cve.now/CVE-2025-41690.md): Endress+Hauser: Proline 10 Maintenance credentials may be exposed under certain conditions (CVSS 7.4, Endress+Hauser Promag 10 with HART · Endress+Hauser Prom… +4)
- [CVE-2025-44017](https://cve.now/CVE-2025-44017.md): "Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. (CVSS 4.3, "Gunosy" App for Android · "Gunosy" App for iOS)
- [CVE-2025-9815](https://cve.now/CVE-2025-9815.md): alaneuler batteryKid NSXPCListener PrivilegeHelper.swift missing authentication (CVSS 8.5, alaneuler batteryKid)
- [CVE-2025-9814](https://cve.now/CVE-2025-9814.md): PHPGurukul Beauty Parlour Management System contact-us.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-9813](https://cve.now/CVE-2025-9813.md): Tenda CH22 SetSambaConf formSetSambaConf buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-9812](https://cve.now/CVE-2025-9812.md): Tenda CH22 exeCommand formexeCommand buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-9811](https://cve.now/CVE-2025-9811.md): Campcodes Farm Management System reviewInput.php sql injection (CVSS 6.9, Campcodes Farm Management System)
- [CVE-2025-8662](https://cve.now/CVE-2025-8662.md): OpenAM (OpenAM Consortium Edition) contains a vulnerability that may cause it to malfunction as a SAML IdP due to a tampered request.This is (CVSS 2.3, OpenAM consortium OpenAM)
- [CVE-2025-58178](https://cve.now/CVE-2025-58178.md): Command Injection via sonarqube-scan-action GitHub Action (CVSS 7.8, SonarSource sonarqube-scan-action)
- [CVE-2025-58162](https://cve.now/CVE-2025-58162.md): MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction (CVSS 6.5, Mobile-Security-Framework-MobSF · mobsf)
- [CVE-2025-58161](https://cve.now/CVE-2025-58161.md): MobSF Path Traversal in GET /download/\<filename\> using absolute filenames (CVSS 1.3, Mobile-Security-Framework-MobSF · mobsf)
- [CVE-2025-9806](https://cve.now/CVE-2025-9806.md): Tenda F1202 Administrative shadow hard-coded credentials (CVSS 1.8, Tenda F1202)
- [CVE-2025-57808](https://cve.now/CVE-2025-57808.md): ESP-IDF web\_server basic auth bypass using empty or incomplete Authorization header (CVSS 8.1, esphome)
- [CVE-2025-9805](https://cve.now/CVE-2025-9805.md): SimStudioAI sim route.ts server-side request forgery (CVSS 5.3, SimStudioAI sim)
- [CVE-2024-48705](https://cve.now/CVE-2024-48705.md): Wavlink AC1200 with firmware versions M32A3\_V1410\_230602 and M32A3\_V1410\_240222 are vulnerable to a post-authentication command injection wh (CVSS 6.5)
- [CVE-2024-51423](https://cve.now/CVE-2024-51423.md): Cross Site Scripting vulnerability in Infor Global HR GHR v.11.23.03.00.21 and before allows a remote attacker to execute arbitrary code via (CVSS 6.1)
- [CVE-2025-32098](https://cve.now/CVE-2025-32098.md): An issue was discovered in Samsung Magician 6.3 through 8.3 on Windows. (CVSS 5.3)
- [CVE-2025-32100](https://cve.now/CVE-2025-32100.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, (CVSS 6.5)
- [CVE-2025-46047](https://cve.now/CVE-2025-46047.md): A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to (CVSS 6.5, org.silverpeas.core:silverpeas-core)
- [CVE-2025-50565](https://cve.now/CVE-2025-50565.md): Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker. (CVSS 6.5)
- [CVE-2025-50755](https://cve.now/CVE-2025-50755.md): Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set\_sys\_cmd function via the command parameter. (CVSS 6.5)
- [CVE-2025-50757](https://cve.now/CVE-2025-50757.md): Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set\_sys\_adm function via the username parameter. (CVSS 6.5)
- [CVE-2025-51966](https://cve.now/CVE-2025-51966.md): A cross-site scripting (XSS) vulnerability exists in the PDF preview functionality of uTools thru 7.1.1. (CVSS 6.1)
- [CVE-2025-54599](https://cve.now/CVE-2025-54599.md): The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, whe (CVSS 7.5)
- [CVE-2025-55372](https://cve.now/CVE-2025-55372.md): An arbitrary file upload vulnerability in Beakon Application before v5.4.3 allows attackers to execute arbitrary code via uploading a crafte (CVSS 5.3)
- [CVE-2025-55373](https://cve.now/CVE-2025-55373.md): Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges (CVSS 5.3)
- [CVE-2025-55472](https://cve.now/CVE-2025-55472.md): SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API endpoint. (CVSS 6.5)
- [CVE-2025-55473](https://cve.now/CVE-2025-55473.md): Asian Arts Talents Foundation (AATF) Website v5.1.x and Docker version 2024.12.8.1 are vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2025-55474](https://cve.now/CVE-2025-55474.md): Many Notes 0.10.1 is vulnerable to Cross Site Scripting (XSS), which allows malicious Markdown files to execute JavaScript when viewed. (CVSS 6.1)
- [CVE-2025-55476](https://cve.now/CVE-2025-55476.md): FireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the endpoint: GET /api/videos/pu (CVSS 6.5)
- [CVE-2025-55824](https://cve.now/CVE-2025-55824.md): ModStartCMS v9.5.0 has an arbitrary file write vulnerability, which allows attackers to write malicious files and execute malicious commands (CVSS 6.5)
- [CVE-2025-56254](https://cve.now/CVE-2025-56254.md): PHPGurukul Employee Leave Management System 2.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in leave-details.php. (CVSS 4.3)
- [CVE-2025-57140](https://cve.now/CVE-2025-57140.md): rsbi-pom 4.7 is vulnerable to SQL Injection in the /bi/service/model/DatasetService path. (CVSS 9.8)
- [CVE-2025-57611](https://cve.now/CVE-2025-57611.md): An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the dump() method allows an att (CVSS 5.3)
- [CVE-2025-57612](https://cve.now/CVE-2025-57612.md): An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the name() method allows an att (CVSS 7.5)
- [CVE-2025-57613](https://cve.now/CVE-2025-57613.md): An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A null pointer dereference vulnerability in the input() constructor funct (CVSS 7.5)
- [CVE-2025-57614](https://cve.now/CVE-2025-57614.md): An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Integer overflow and invalid input vulnerability in the cached method all (CVSS 7.5)
- [CVE-2025-57615](https://cve.now/CVE-2025-57615.md): An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) An integer overflow vulnerability in the Vector::new constructor function (CVSS 7.5)
- [CVE-2025-57616](https://cve.now/CVE-2025-57616.md): An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A use-after-free vulnerability in the write\_interleaved method allows an (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.