# CVEs published 2025-09-04

268 CVEs were published on September 4, 2025: 15 critical, 113 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-58362](https://cve.now/CVE-2025-58362.md): Hono contains a flaw in URL path parsing, potentially leading to path confusion (CVSS 7.5, honojs hono · hono)
- [CVE-2025-58359](https://cve.now/CVE-2025-58359.md): frost-core: refresh shares with smaller min\_signers will reduce group security (CVSS 6.0, ZcashFoundation frost · frost-core)
- [CVE-2025-58179](https://cve.now/CVE-2025-58179.md): Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /\_image endpoint (CVSS 7.2, withastro astro · @astrojs/cloudflare)
- [CVE-2025-58352](https://cve.now/CVE-2025-58352.md): Weblate has long session expiry times during second factor verification (CVSS 2.1, WeblateOrg weblate · weblate)
- [CVE-2025-55739](https://cve.now/CVE-2025-55739.md): api: Shared OAuth Signing Key Between Different Instances (CVSS 5.1, FreePBX api)
- [CVE-2025-55241](https://cve.now/CVE-2025-55241.md): Azure Entra ID Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Entra)
- [CVE-2025-55238](https://cve.now/CVE-2025-55238.md): Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability (CVSS 7.5, Microsoft Dynamics 365 FastTrack Implementation)
- [CVE-2025-54914](https://cve.now/CVE-2025-54914.md): Azure Networking Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Networking)
- [CVE-2025-55242](https://cve.now/CVE-2025-55242.md): Xbox Certification Bug Copilot Djando Information Disclosure Vulnerability (CVSS 6.5, Microsoft Xbox Gaming Services)
- [CVE-2025-55244](https://cve.now/CVE-2025-55244.md): Azure Bot Service Elevation of Privilege Vulnerability (CVSS 9.0, Microsoft Azure Bot Service)
- [CVE-2025-55305](https://cve.now/CVE-2025-55305.md): Electron is vulnerable to Code Injection via resource modification (CVSS 6.1, electron)
- [CVE-2025-55209](https://cve.now/CVE-2025-55209.md): FreePBX UCP is Vulnerable to Stored XSS Through its User Control Panel (CVSS 5.1, FreePBX contactmanager)
- [CVE-2025-55190](https://cve.now/CVE-2025-55190.md): Argo CD: Project API Token Exposes Repository Credentials (CVSS 10.0, argoproj argo-cd · github.com/argoproj/argo-cd/v2 +2)
- [CVE-2025-58361](https://cve.now/CVE-2025-58361.md): Promptcraft Forge Studio's incomplete URL check is vulnerable to XSS via SVG (CVSS 9.3, MarceloTessaro promptcraft-forge-studio)
- [CVE-2025-32322](https://cve.now/CVE-2025-32322.md): In onCreate of MediaProjectionPermissionActivity.java , there is a possible way to grant a malicious app a token enabling unauthorized scree (CVSS 7.8, Google Android)
- [CVE-2025-58353](https://cve.now/CVE-2025-58353.md): Promptcraft Forge Studio: Complete Sanitizer Bypass Enables XSS via Overlapping Patterns (CVSS 8.2, MarceloTessaro promptcraft-forge-studio)
- [CVE-2025-26439](https://cve.now/CVE-2025-26439.md): In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to be enabled instead of (CVSS 7.8, Google Android)
- [CVE-2025-26431](https://cve.now/CVE-2025-26431.md): In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility service due to a logic (CVSS 7.8, Google Android)
- [CVE-2025-26419](https://cve.now/CVE-2025-26419.md): In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. (CVSS 3.3, Google Android)
- [CVE-2024-40664](https://cve.now/CVE-2024-40664.md): In setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an enabled accessibility service due to a logi (CVSS 6.2, Google Android)
- [CVE-2025-22415](https://cve.now/CVE-2025-22415.md): In android\_app of Android.bp, there is a possible way to launch any activity as a system user. (CVSS 4.0, Google Android)
- [CVE-2025-22414](https://cve.now/CVE-2025-22414.md): In FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permission check. (CVSS 7.8, Google Android)
- [CVE-2024-49731](https://cve.now/CVE-2024-49731.md): In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new Pixel Watch due to a (CVSS 4.0, Google Android)
- [CVE-2025-48581](https://cve.now/CVE-2025-48581.md): In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in the code. (CVSS 8.4, Google Android)
- [CVE-2025-48563](https://cve.now/CVE-2025-48563.md): In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value. (CVSS 7.8, Google Android)
- [CVE-2025-48562](https://cve.now/CVE-2025-48562.md): In writeContent of RemotePrintDocument.java, there is a possible information disclosure due to a logic error. (CVSS 5.0, Google Android)
- [CVE-2025-48561](https://cve.now/CVE-2025-48561.md): In multiple locations, there is a possible way to access data displayed on the screen due to side channel information disclosure. (CVSS 5.5, Google Android)
- [CVE-2025-48560](https://cve.now/CVE-2025-48560.md): In AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a confused deputy. (CVSS 5.5, Google Android)
- [CVE-2025-48559](https://cve.now/CVE-2025-48559.md): In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. (CVSS 5.5, Google Android)
- [CVE-2025-48558](https://cve.now/CVE-2025-48558.md): In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit inte (CVSS 7.8, Google Android)
- [CVE-2025-48556](https://cve.now/CVE-2025-48556.md): In multiple methods of NotificationChannel.java, there is a possible desynchronization from persistence due to improper input validation. (CVSS 7.3, Google Android)
- [CVE-2025-48554](https://cve.now/CVE-2025-48554.md): In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible persistent denial of service due to a logic error in the co (CVSS 6.1, Google Android)
- [CVE-2025-48553](https://cve.now/CVE-2025-48553.md): In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible DoS of a device admin due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-48552](https://cve.now/CVE-2025-48552.md): In saveGlobalProxyLocked of DevicePolicyManagerService.java, there is a possible way to desync from persistence due to a logic error in the (CVSS 7.8, Google Android)
- [CVE-2025-48551](https://cve.now/CVE-2025-48551.md): In multiple locations, there is a possible leak of an image across the Android User isolation boundary due to a confused deputy. (CVSS 5.0, Google Android)
- [CVE-2025-48550](https://cve.now/CVE-2025-48550.md): In testGrantSlicePermission of SliceManagerTest.java, there is a possible permanent denial of service due to a path traversal error. (CVSS 5.5, Google Android)
- [CVE-2025-48549](https://cve.now/CVE-2025-48549.md): In multiple locations, there is a possible way to record audio via a background app due to a missing permission check. (CVSS 7.8, Google Android)
- [CVE-2025-48548](https://cve.now/CVE-2025-48548.md): In multiple functions of AppOpsControllerImpl.java, there is a possible way to record audio without displaying the privacy indicator due to (CVSS 7.3, Google Android)
- [CVE-2025-48547](https://cve.now/CVE-2025-48547.md): In multiple locations, there is a possible one-time permission bypass due to a logic error in the code. (CVSS 7.3, Google Android)
- [CVE-2025-48546](https://cve.now/CVE-2025-48546.md): In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-48545](https://cve.now/CVE-2025-48545.md): In isSystemUid of AccountManagerService.java, there is a possible way for an app to access privileged APIs due to a confused deputy. (CVSS 7.1, Google Android)
- [CVE-2025-48544](https://cve.now/CVE-2025-48544.md): In multiple locations, there is a possible way to read files belonging to other apps due to SQL injection. (CVSS 7.8, Google Android)
- [CVE-2025-48543](https://cve.now/CVE-2025-48543.md): In multiple locations, there is a possible way to escape chrome sandbox to attack android system\_server due to a use after free. (CVSS 8.8, KEV, Google Android)
- [CVE-2025-48542](https://cve.now/CVE-2025-48542.md): In multiple functions of AccountManagerService.java, there is a possible permanent denial of service due to resource exhaustion. (CVSS 5.5, Google Android)
- [CVE-2025-48541](https://cve.now/CVE-2025-48541.md): In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2025-48540](https://cve.now/CVE-2025-48540.md): In processTransactInternal of RpcState.cpp, there is a possible local out of memory write due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-48539](https://cve.now/CVE-2025-48539.md): In SendPacketToPeer of acl\_arbiter.cc, there is a possible out of bounds read due to a use after free. (CVSS 8.0, Google Android)
- [CVE-2025-48538](https://cve.now/CVE-2025-48538.md): In setApplicationHiddenSettingAsUser of PackageManagerService.java, there is a possible way to hide a system critical package due to imprope (CVSS 5.5, Google Android)
- [CVE-2025-48537](https://cve.now/CVE-2025-48537.md): In multiple locations, there is a possible way to persistently DoS the device due to improper input validation. (CVSS 7.1, Google Android)
- [CVE-2025-48535](https://cve.now/CVE-2025-48535.md): In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a lau (CVSS 7.8, Google Android)
- [CVE-2025-48534](https://cve.now/CVE-2025-48534.md): In getDefaultCBRPackageName of CellBroadcastHandler.java, there is a possible escalation of privilege due to a logic error in the code. (CVSS 8.8, Google Android)
- [CVE-2025-48532](https://cve.now/CVE-2025-48532.md): In markMediaAsFavorite of MediaProvider.java, there is a possible way to bypass the WRITE\_EXTERNAL\_STORAGE permission due to a confused depu (CVSS 7.3, Google Android)
- [CVE-2025-48531](https://cve.now/CVE-2025-48531.md): In getCallingPackageName of CredentialStorage, there is a possible permission bypass due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-48529](https://cve.now/CVE-2025-48529.md): In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy. (CVSS 5.5, Google Android)
- [CVE-2025-48528](https://cve.now/CVE-2025-48528.md): In multiple locations, there is a possible way to overlay biometrics due to a tapjacking/overlay attack. (CVSS 4.0, Google Android)
- [CVE-2025-48527](https://cve.now/CVE-2025-48527.md): In multiple locations, there is a possible way to leak hidden work profile notifications due to a logic error in the code. (CVSS 6.2, Google Android)
- [CVE-2025-48526](https://cve.now/CVE-2025-48526.md): In createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another prof (CVSS 4.0, Google Android)
- [CVE-2025-48524](https://cve.now/CVE-2025-48524.md): In isSystem of WifiPermissionsUtil.java, there is a possible permission bypass due to a missing permission check. (CVSS 5.5, Google Android)
- [CVE-2025-48523](https://cve.now/CVE-2025-48523.md): In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-48522](https://cve.now/CVE-2025-48522.md): In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-32350](https://cve.now/CVE-2025-32350.md): In maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the ControlsSettingsDialog due to a tapjacking/overla (CVSS 7.8, Google Android)
- [CVE-2025-32349](https://cve.now/CVE-2025-32349.md): In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. (CVSS 7.8, Google Android)
- [CVE-2025-32347](https://cve.now/CVE-2025-32347.md): In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. (CVSS 7.8, Google Android)
- [CVE-2025-32346](https://cve.now/CVE-2025-32346.md): In onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2025-32345](https://cve.now/CVE-2025-32345.md): In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user (CVSS 7.8, Google Android)
- [CVE-2025-32333](https://cve.now/CVE-2025-32333.md): In startSpaActivityForApp of SpaActivity.kt, there is a possible cross-user permission bypass due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-32332](https://cve.now/CVE-2025-32332.md): In multiple locations, there is a possible memory corruption due to a use after free. (CVSS 7.8, Google Android)
- [CVE-2025-32331](https://cve.now/CVE-2025-32331.md): In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-32330](https://cve.now/CVE-2025-32330.md): In generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept the Auracast audio stream due to an insecu (CVSS 5.7, Google Android)
- [CVE-2025-32327](https://cve.now/CVE-2025-32327.md): In multiple functions of PickerDbFacade.java, there is a possible unauthorized data access due to SQL injection. (CVSS 7.8, Google Android)
- [CVE-2025-32326](https://cve.now/CVE-2025-32326.md): In multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2025-32325](https://cve.now/CVE-2025-32325.md): In appendFrom of Parcel.cpp, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 7.8, Google Android)
- [CVE-2025-32324](https://cve.now/CVE-2025-32324.md): In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2025-32323](https://cve.now/CVE-2025-32323.md): In getCallingAppName of Shared.java, there is a possible way to trick users into granting file access via deceptive text in a permission pop (CVSS 7.8, Google Android)
- [CVE-2025-32321](https://cve.now/CVE-2025-32321.md): In isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2025-26464](https://cve.now/CVE-2025-26464.md): In executeAppFunction of AppSearchManagerService.java, there is a possible background activity launch due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-26454](https://cve.now/CVE-2025-26454.md): In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another user due to a confused (CVSS 7.8, Google Android)
- [CVE-2025-0089](https://cve.now/CVE-2025-0089.md): In multiple locations, there is a possible way to hijack the Launcher app due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-0076](https://cve.now/CVE-2025-0076.md): In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. (CVSS 3.3, Google Android)
- [CVE-2024-49714](https://cve.now/CVE-2024-49714.md): In avrc\_vendor\_msg of avrc\_opt.cc, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 7.8, Google Android)
- [CVE-2025-48533](https://cve.now/CVE-2025-48533.md): In multiple locations, there is a possible way to use apps linked from a context menu of a lockscreen app due to a race condition. (CVSS 7.0, Google Android)
- [CVE-2025-48530](https://cve.now/CVE-2025-48530.md): In multiple locations, there is a possible condition that results in OOB accesses due to an incorrect bounds check. (CVSS 8.1, Google Android)
- [CVE-2025-22441](https://cve.now/CVE-2025-22441.md): In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privile (CVSS 7.3, Google Android)
- [CVE-2025-32312](https://cve.now/CVE-2025-32312.md): In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed to (CVSS 7.8, Google Android)
- [CVE-2025-26463](https://cve.now/CVE-2025-26463.md): In allowPackageAccess of multiple files, resource exhaustion is possible when repeatedly adding allowed packages. (CVSS 5.5, Google Android)
- [CVE-2025-26462](https://cve.now/CVE-2025-26462.md): In AccessibilityServiceConnection.java, there is a possible background activity launch due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-26458](https://cve.now/CVE-2025-26458.md): In multiple functions of LocationProviderManager.java, there is a possible background activity launch due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-26456](https://cve.now/CVE-2025-26456.md): In multiple functions of DexUseManagerLocal.java, there is a possible way to crash system server due to a logic error in the code. (CVSS 5.5, Google Android)
- [CVE-2025-26455](https://cve.now/CVE-2025-26455.md): In multiple functions of NdkMediaCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 7.8, Google Android)
- [CVE-2025-26453](https://cve.now/CVE-2025-26453.md): In isContentUriForOtherUser of BluetoothOppSendFileInfo.java, there is a possible cross user data leak due to a logic error in the code. (CVSS 5.5, Google Android)
- [CVE-2025-26452](https://cve.now/CVE-2025-26452.md): In loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2025-26450](https://cve.now/CVE-2025-26450.md): In onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the defa (CVSS 7.8, Google Android)
- [CVE-2025-26449](https://cve.now/CVE-2025-26449.md): In multiple locations, there is a possible permanent denial of service due to resource exhaustion. (CVSS 5.5, Google Android)
- [CVE-2025-26448](https://cve.now/CVE-2025-26448.md): In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. (CVSS 5.5, Google Android)
- [CVE-2025-26445](https://cve.now/CVE-2025-26445.md): In offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission check. (CVSS 5.5, Google Android)
- [CVE-2025-26443](https://cve.now/CVE-2025-26443.md): In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from unknown sources due to (CVSS 7.3, Google Android)
- [CVE-2025-26441](https://cve.now/CVE-2025-26441.md): In add\_attr of sdp\_discovery.cc, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.5, Google Android)
- [CVE-2025-26437](https://cve.now/CVE-2025-26437.md): In CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credentials due to a missing (CVSS 5.5, Google Android)
- [CVE-2025-26432](https://cve.now/CVE-2025-26432.md): In multiple locations, there is a possible way to persistently DoS the device due to a missing length check. (CVSS 5.5, Google Android)
- [CVE-2025-26444](https://cve.now/CVE-2025-26444.md): In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default (CVSS 7.8, Google Android)
- [CVE-2025-26442](https://cve.now/CVE-2025-26442.md): In onCreate of NotificationAccessConfirmationActivity.java, there is a possible incorrect verification of proper intent filters in NLS due t (CVSS 5.5, Google Android)
- [CVE-2025-26440](https://cve.now/CVE-2025-26440.md): In multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a permissions bypass. (CVSS 7.8, Google Android)
- [CVE-2025-26438](https://cve.now/CVE-2025-26438.md): In smp\_process\_secure\_connection\_oob\_data of smp\_act.cc, there is a possible way to bypass SMP authentication due to Incorrect implementatio (CVSS 8.8, Google Android)
- [CVE-2025-26436](https://cve.now/CVE-2025-26436.md): In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an activity from the backgro (CVSS 7.8, Google Android)
- [CVE-2025-26435](https://cve.now/CVE-2025-26435.md): In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user (CVSS 7.8, Google Android)
- [CVE-2025-26430](https://cve.now/CVE-2025-26430.md): In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-26429](https://cve.now/CVE-2025-26429.md): In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. (CVSS 5.5, Google Android)
- [CVE-2025-26428](https://cve.now/CVE-2025-26428.md): In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the code. (CVSS 3.2, Google Android)
- [CVE-2025-26427](https://cve.now/CVE-2025-26427.md): In multiple locations, there is a possible Android/data access due to a path traversal error. (CVSS 4.4, Google Android)
- [CVE-2025-26426](https://cve.now/CVE-2025-26426.md): In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant for the "android" pack (CVSS 5.1, Google Android)
- [CVE-2025-26425](https://cve.now/CVE-2025-26425.md): In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. (CVSS 4.0, Google Android)
- [CVE-2025-26424](https://cve.now/CVE-2025-26424.md): In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. (CVSS 4.0, Google Android)
- [CVE-2025-26423](https://cve.now/CVE-2025-26423.md): In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. (CVSS 6.2, Google Android)
- [CVE-2025-26422](https://cve.now/CVE-2025-26422.md): In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission (CVSS 4.0, Google Android)
- [CVE-2025-26421](https://cve.now/CVE-2025-26421.md): In multiple locations, there is a possible lock screen bypass due to a logic error in the code. (CVSS 4.0, Google Android)
- [CVE-2025-26420](https://cve.now/CVE-2025-26420.md): In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the incorrect permission du (CVSS 4.4, Google Android)
- [CVE-2025-22425](https://cve.now/CVE-2025-22425.md): In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. (CVSS 5.1, Google Android)
- [CVE-2025-0087](https://cve.now/CVE-2025-0087.md): In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check. (CVSS 5.1, Google Android)
- [CVE-2025-0077](https://cve.now/CVE-2025-0077.md): In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. (CVSS 4.0, Google Android)
- [CVE-2024-49739](https://cve.now/CVE-2024-49739.md): In MMapVAccess of pmr\_os.c, there is a possible out of bounds write due to improper input validation. (CVSS 4.0, Google Android)
- [CVE-2023-35657](https://cve.now/CVE-2023-35657.md): In bta\_av\_config\_ind of bta\_av\_aact.cc, there is a possible out of bounds read due to type confusion. (CVSS 4.0, Google Android)
- [CVE-2025-9636](https://cve.now/CVE-2025-9636.md): Cross-Origin Opener Policy Vulnerability in pgAdmin 4 (CVSS 7.9, pgadmin.org pgAdmin · pgadmin4)
- [CVE-2025-23262](https://cve.now/CVE-2025-23262.md): NVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorizatio (CVSS 6.3, NVIDIA ConnectX GA · NVIDIA ConnectX LTS22 +3)
- [CVE-2025-23261](https://cve.now/CVE-2025-23261.md): NVIDIA Cumulus Linux and NVOS products contain a vulnerability, where hashed user passwords are not properly suppressed in log files, potent (CVSS 5.5, NVIDIA NVOS · NVIDIA Cumulus Linux)
- [CVE-2025-23259](https://cve.now/CVE-2025-23259.md): NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause info (CVSS 6.5, NVIDIA Mellanox DPDK · NVIDIA Upstream DPDK)
- [CVE-2025-23258](https://cve.now/CVE-2025-23258.md): NVIDIA DOCA contains a vulnerability in the collectx-dpeserver Debian package for arm64 that could allow an attacker with low privileges to (CVSS 7.3, NVIDIA DOCA with collectx-dpeserver)
- [CVE-2025-23257](https://cve.now/CVE-2025-23257.md): NVIDIA DOCA contains a vulnerability in the collectx-clxapidev Debian package that could allow an actor with low privileges to escalate priv (CVSS 7.3, NVIDIA DOCA with collectx-clxapidev)
- [CVE-2025-23256](https://cve.now/CVE-2025-23256.md): NVIDIA BlueField contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorizati (CVSS 8.7, NVIDIA BlueField GA · NVIDIA BlueField LTS22 +2)
- [CVE-2025-23302](https://cve.now/CVE-2025-23302.md): NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the LS10 could enable an attacker to set an unsafe debug access level (CVSS 4.2, NVIDIA HGX, DGX Hopper · NVIDIA HGX, DGX Blackwell)
- [CVE-2025-23301](https://cve.now/CVE-2025-23301.md): NVIDIA HGX and DGX contain a vulnerability where a misconfiguration of the VBIOS could enable an attacker to set an unsafe debug access leve (CVSS 4.2, NVIDIA HGX, DGX Hopper · NVIDIA HGX, DGX Blackwell)
- [CVE-2025-38730](https://cve.now/CVE-2025-38730.md): io\_uring/net: commit partial buffers on retry (CVSS 7.8, Linux)
- [CVE-2025-38729](https://cve.now/CVE-2025-38729.md): ALSA: usb-audio: Validate UAC3 power domain descriptors, too (no CVSS, Linux)
- [CVE-2025-38728](https://cve.now/CVE-2025-38728.md): smb3: fix for slab out of bounds on mount to ksmbd (CVSS 9.1, Linux)
- [CVE-2025-38727](https://cve.now/CVE-2025-38727.md): netlink: avoid infinite retry looping in netlink\_unicast() (no CVSS, Linux)
- [CVE-2025-38726](https://cve.now/CVE-2025-38726.md): net: ftgmac100: fix potential NULL pointer access in ftgmac100\_phy\_disconnect (no CVSS, Linux)
- [CVE-2025-38725](https://cve.now/CVE-2025-38725.md): net: usb: asix\_devices: add phy\_mask for ax88772 mdio bus (no CVSS, Linux)
- [CVE-2025-38724](https://cve.now/CVE-2025-38724.md): nfsd: handle get\_client\_locked() failure in nfsd4\_setclientid\_confirm() (CVSS 9.8, Linux)
- [CVE-2025-38723](https://cve.now/CVE-2025-38723.md): LoongArch: BPF: Fix jump offset calculation in tailcall (no CVSS, Linux)
- [CVE-2025-38722](https://cve.now/CVE-2025-38722.md): habanalabs: fix UAF in export\_dmabuf() (CVSS 7.8, Linux)
- [CVE-2025-38721](https://cve.now/CVE-2025-38721.md): netfilter: ctnetlink: fix refcount leak on table dump (no CVSS, Linux)
- [CVE-2025-38720](https://cve.now/CVE-2025-38720.md): net: hibmcge: fix rtnl deadlock issue (no CVSS, Linux)
- [CVE-2025-38719](https://cve.now/CVE-2025-38719.md): net: hibmcge: fix the division by zero issue (no CVSS, Linux)
- [CVE-2025-38718](https://cve.now/CVE-2025-38718.md): sctp: linearize cloned gso packets in sctp\_rcv (CVSS 7.8, Linux)
- [CVE-2025-38717](https://cve.now/CVE-2025-38717.md): net: kcm: Fix race condition in kcm\_unattach() (CVSS 7.8, Linux)
- [CVE-2025-38716](https://cve.now/CVE-2025-38716.md): hfs: fix general protection fault in hfs\_find\_init() (no CVSS, Linux)
- [CVE-2025-38715](https://cve.now/CVE-2025-38715.md): hfs: fix slab-out-of-bounds in hfs\_bnode\_read() (CVSS 7.8, Linux)
- [CVE-2025-38714](https://cve.now/CVE-2025-38714.md): hfsplus: fix slab-out-of-bounds in hfsplus\_bnode\_read() (CVSS 7.8, Linux)
- [CVE-2025-38713](https://cve.now/CVE-2025-38713.md): hfsplus: fix slab-out-of-bounds read in hfsplus\_uni2asc() (CVSS 7.1, Linux)
- [CVE-2025-38712](https://cve.now/CVE-2025-38712.md): hfsplus: don't use BUG\_ON() in hfsplus\_create\_attributes\_file() (no CVSS, Linux)
- [CVE-2025-38711](https://cve.now/CVE-2025-38711.md): smb/server: avoid deadlock when linking with ReplaceIfExists (no CVSS, Linux)
- [CVE-2025-38710](https://cve.now/CVE-2025-38710.md): gfs2: Validate i\_depth for exhash directories (CVSS 7.8, Linux)
- [CVE-2025-38709](https://cve.now/CVE-2025-38709.md): loop: Avoid updating block size under exclusive owner (no CVSS, Linux)
- [CVE-2025-38708](https://cve.now/CVE-2025-38708.md): drbd: add missing kref\_get in handle\_write\_conflicts (CVSS 9.8, Linux)
- [CVE-2025-38707](https://cve.now/CVE-2025-38707.md): fs/ntfs3: Add sanity check for file name (CVSS 7.1, Linux)
- [CVE-2025-38706](https://cve.now/CVE-2025-38706.md): ASoC: core: Check for rtd == NULL in snd\_soc\_remove\_pcm\_runtime() (no CVSS, Linux)
- [CVE-2025-38705](https://cve.now/CVE-2025-38705.md): drm/amd/pm: fix null pointer access (no CVSS, Linux)
- [CVE-2025-38704](https://cve.now/CVE-2025-38704.md): rcu/nocb: Fix possible invalid rdp's-\>nocb\_cb\_kthread pointer access (no CVSS, Linux)
- [CVE-2025-38703](https://cve.now/CVE-2025-38703.md): drm/xe: Make dma-fences compliant with the safe access rules (CVSS 7.8, Linux)
- [CVE-2025-38702](https://cve.now/CVE-2025-38702.md): fbdev: fix potential buffer overflow in do\_register\_framebuffer() (no CVSS, Linux)
- [CVE-2025-38701](https://cve.now/CVE-2025-38701.md): ext4: do not BUG when INLINE\_DATA\_FL lacks system.data xattr (no CVSS, Linux)
- [CVE-2025-38700](https://cve.now/CVE-2025-38700.md): scsi: libiscsi: Initialize iscsi\_conn-\>dd\_data only if memory is allocated (no CVSS, Linux)
- [CVE-2025-38699](https://cve.now/CVE-2025-38699.md): scsi: bfa: Double-free fix (no CVSS, Linux)
- [CVE-2025-38698](https://cve.now/CVE-2025-38698.md): jfs: Regular file corruption check (no CVSS, Linux)
- [CVE-2025-38697](https://cve.now/CVE-2025-38697.md): jfs: upper bound check of tree index in dbAllocAG (CVSS 7.8, Linux)
- [CVE-2025-38696](https://cve.now/CVE-2025-38696.md): MIPS: Don't crash in stack\_top() for tasks without ABI or vDSO (no CVSS, Linux)
- [CVE-2025-38695](https://cve.now/CVE-2025-38695.md): scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc\_vport structure (no CVSS, Linux)
- [CVE-2025-38694](https://cve.now/CVE-2025-38694.md): media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p\_rw\_on\_apb() (no CVSS, Linux)
- [CVE-2025-38693](https://cve.now/CVE-2025-38693.md): media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p\_tuner\_write\_serpar and w7090p\_tuner\_read\_serpar (no CVSS, Linux)
- [CVE-2025-38692](https://cve.now/CVE-2025-38692.md): exfat: add cluster chain loop check for dir (no CVSS, Linux)
- [CVE-2025-38691](https://cve.now/CVE-2025-38691.md): pNFS: Fix uninited ptr deref in block/scsi layout (no CVSS, Linux)
- [CVE-2025-38690](https://cve.now/CVE-2025-38690.md): drm/xe/migrate: prevent infinite recursion (no CVSS, Linux)
- [CVE-2025-38689](https://cve.now/CVE-2025-38689.md): x86/fpu: Fix NULL dereference in avx512\_status() (no CVSS, Linux)
- [CVE-2025-38688](https://cve.now/CVE-2025-38688.md): iommufd: Prevent ALIGN() overflow (CVSS 8.8, Linux)
- [CVE-2025-38687](https://cve.now/CVE-2025-38687.md): comedi: fix race between polling and detaching (CVSS 7.3, Linux)
- [CVE-2025-38686](https://cve.now/CVE-2025-38686.md): userfaultfd: fix a crash in UFFDIO\_MOVE when PMD is a migration entry (no CVSS, Linux)
- [CVE-2025-38685](https://cve.now/CVE-2025-38685.md): fbdev: Fix vmalloc out-of-bounds write in fast\_imageblit (CVSS 7.8, Linux)
- [CVE-2025-38684](https://cve.now/CVE-2025-38684.md): net/sched: ets: use old 'nbands' while purging unused classes (no CVSS, Linux)
- [CVE-2025-38683](https://cve.now/CVE-2025-38683.md): hv\_netvsc: Fix panic during namespace deletion with VF (no CVSS, Linux)
- [CVE-2025-38682](https://cve.now/CVE-2025-38682.md): i2c: core: Fix double-free of fwnode in i2c\_unregister\_device() (no CVSS, Linux)
- [CVE-2025-38681](https://cve.now/CVE-2025-38681.md): mm/ptdump: take the memory hotplug lock inside ptdump\_walk\_pgd() (no CVSS, Linux)
- [CVE-2025-38680](https://cve.now/CVE-2025-38680.md): media: uvcvideo: Fix 1-byte out-of-bounds read in uvc\_parse\_format() (no CVSS, Linux)
- [CVE-2025-38679](https://cve.now/CVE-2025-38679.md): media: venus: Fix OOB read due to missing payload bound check (CVSS 7.3, Linux)
- [CVE-2025-25048](https://cve.now/CVE-2025-25048.md): IBM Jazz Foundation path traversal (CVSS 6.5, IBM Jazz Foundation)
- [CVE-2024-43184](https://cve.now/CVE-2024-43184.md): IBM Jazz Foundation cross-site scripting (CVSS 6.1, IBM Jazz Foundation)
- [CVE-2025-2667](https://cve.now/CVE-2025-2667.md): IBM Sterling B2B Integrator information disclosure (CVSS 2.7, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2025-2694](https://cve.now/CVE-2025-2694.md): IBM Sterling B2B Integrator cross-site scripting (CVSS 4.8, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2025-6785](https://cve.now/CVE-2025-6785.md): Tesla Model 3 Physical CAN Bus Injection (CVSS 4.7, Tesla Model)
- [CVE-2025-8311](https://cve.now/CVE-2025-8311.md): dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. (CVSS 9.4, dotCMS Cloud Services)
- [CVE-2025-7388](https://cve.now/CVE-2025-7388.md): Authenticated Command Injection via configuration parameter manipulation in exposed RMI interface (CVSS 8.4, Progress Software OpenEdge)
- [CVE-2025-7385](https://cve.now/CVE-2025-7385.md): SQL Injection in GOV CMS (CVSS 9.3, Concept Intermedia GOV CMS)
- [CVE-2025-41063](https://cve.now/CVE-2025-41063.md): Reflected Cross-Site Scripting vulnerability in appRain CMF (CVSS 4.8, appRain CMF)
- [CVE-2025-41062](https://cve.now/CVE-2025-41062.md): Reflected Cross-Site Scripting vulnerability in appRain CMF (CVSS 4.8, appRain CMF)
- [CVE-2025-41061](https://cve.now/CVE-2025-41061.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41060](https://cve.now/CVE-2025-41060.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41059](https://cve.now/CVE-2025-41059.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41058](https://cve.now/CVE-2025-41058.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41057](https://cve.now/CVE-2025-41057.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41056](https://cve.now/CVE-2025-41056.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41055](https://cve.now/CVE-2025-41055.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41054](https://cve.now/CVE-2025-41054.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41053](https://cve.now/CVE-2025-41053.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41052](https://cve.now/CVE-2025-41052.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41051](https://cve.now/CVE-2025-41051.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41050](https://cve.now/CVE-2025-41050.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41049](https://cve.now/CVE-2025-41049.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41048](https://cve.now/CVE-2025-41048.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41047](https://cve.now/CVE-2025-41047.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41046](https://cve.now/CVE-2025-41046.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41045](https://cve.now/CVE-2025-41045.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41044](https://cve.now/CVE-2025-41044.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41043](https://cve.now/CVE-2025-41043.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41042](https://cve.now/CVE-2025-41042.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41041](https://cve.now/CVE-2025-41041.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41040](https://cve.now/CVE-2025-41040.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41039](https://cve.now/CVE-2025-41039.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41038](https://cve.now/CVE-2025-41038.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41037](https://cve.now/CVE-2025-41037.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41036](https://cve.now/CVE-2025-41036.md): Stored Cross-Site Scripting vulnerability in appRain CMF (CVSS 5.1, appRain CMF)
- [CVE-2025-41035](https://cve.now/CVE-2025-41035.md): Path Traversal vulnerability in appRain CMF (CVSS 7.1, appRain CMF)
- [CVE-2025-41034](https://cve.now/CVE-2025-41034.md): SQL injection vulnerability in appRain CMF (CVSS 8.7, appRain CMF)
- [CVE-2025-41033](https://cve.now/CVE-2025-41033.md): SQL injection vulnerability in appRain CMF (CVSS 8.7, appRain CMF)
- [CVE-2025-41032](https://cve.now/CVE-2025-41032.md): SQL injection vulnerability in appRain CMF (CVSS 8.7, appRain CMF)
- [CVE-2024-34598](https://cve.now/CVE-2024-34598.md): Improper export of component in GoodLock prior to version 2.2.04.95 allows local attackers to install arbitrary applications from Galaxy Sto (CVSS 7.7, Samsung Mobile GoodLock)
- [CVE-2022-39888](https://cve.now/CVE-2022-39888.md): Improper access control vulnerability in retrieveExternalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local attacker to access (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2025-6085](https://cve.now/CVE-2025-6085.md): Make Connector \<= 1.5.10 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2, integromat Make Connector)
- [CVE-2025-9616](https://cve.now/CVE-2025-9616.md): PopAd \<= 1.0.4 - Cross-Site Request Forgery to Settings Update (CVSS 5.3, alobaidi PopAd)
- [CVE-2025-2411](https://cve.now/CVE-2025-2411.md): OTP Bypass in Akinsoft's TaskPano (CVSS 8.6, Akinsoft TaskPano)
- [CVE-2024-13073](https://cve.now/CVE-2024-13073.md): XSS in Akinsoft's TaskPano (CVSS 4.7, Akinsoft TaskPano)
- [CVE-2025-6984](https://cve.now/CVE-2025-6984.md): Sensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchain (CVSS 7.5, langchain-ai/langchain · langchain-community)
- [CVE-2025-2417](https://cve.now/CVE-2025-2417.md): OTP Bypass in Akinsoft's e-Mutabakat (CVSS 8.6, Akinsoft e-Mutabakat)
- [CVE-2024-13071](https://cve.now/CVE-2024-13071.md): XSS in Akinsoft's e-Mutabakat (CVSS 4.3, Akinsoft e-Mutabakat)
- [CVE-2025-9467](https://cve.now/CVE-2025-9467.md): Possibility to bypass file upload validation on the server-side (CVSS 5.3, vaadin · vaadin-upload-flow +1)
- [CVE-2025-36887](https://cve.now/CVE-2025-36887.md): In wl\_cfgscan\_update\_v3\_schedscan\_results() of wl\_cfgscan.c, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, Google Android)
- [CVE-2024-56190](https://cve.now/CVE-2024-56190.md): In wl\_update\_hidden\_ap\_ie() of wl\_cfgscan.c, there is a possible out of bounds write due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2024-56189](https://cve.now/CVE-2024-56189.md): In SAEMM\_DiscloseMsId of SAEMM\_RadioMessageCodec.c, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.5, Google Android)
- [CVE-2025-36909](https://cve.now/CVE-2025-36909.md): Information disclosure (CVSS 5.3, Google Android)
- [CVE-2025-36908](https://cve.now/CVE-2025-36908.md): In lwis\_top\_register\_io of lwis\_device\_top.c, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 6.7, Google Android)
- [CVE-2025-36907](https://cve.now/CVE-2025-36907.md): In draw\_surface\_image() of abl/android/lib/draw/draw.c, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 7.3, Google Android)
- [CVE-2025-36906](https://cve.now/CVE-2025-36906.md): In ConvertReductionOp of darwinn\_mlir\_converter\_aidl.cc, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 7.8, Google Android)
- [CVE-2025-36905](https://cve.now/CVE-2025-36905.md): In gxp\_mapping\_create of gxp\_mapping.c, there is a possible privilege escalation due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-36904](https://cve.now/CVE-2025-36904.md): WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384. (CVSS 9.8, Google Android)
- [CVE-2025-36903](https://cve.now/CVE-2025-36903.md): In lwis\_io\_buffer\_write, there is a possible OOB read/write due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2025-36902](https://cve.now/CVE-2025-36902.md): In syna\_cdev\_ioctl\_store\_pid() of syna\_tcm2\_sysfs.c, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 6.7, Google Android)
- [CVE-2025-36901](https://cve.now/CVE-2025-36901.md): WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396462223. (CVSS 8.8, Google Android)
- [CVE-2025-36900](https://cve.now/CVE-2025-36900.md): In lwis\_test\_register\_io of lwis\_device\_test.c, there is a possible OOB Write due to an integer overflow. (CVSS 6.7, Google Android)
- [CVE-2025-36899](https://cve.now/CVE-2025-36899.md): There is a possible escalation of privilege due to test/debugging code left in a production build. (CVSS 8.4, Google Android)
- [CVE-2025-36898](https://cve.now/CVE-2025-36898.md): There is a possible escalation of privilege due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-36897](https://cve.now/CVE-2025-36897.md): In unknown of cd\_CnMsgCodecUserApi.cpp, there is a possible out of bounds write due to a missing bounds check. (CVSS 9.8, Google Android)
- [CVE-2025-36896](https://cve.now/CVE-2025-36896.md): WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106. (CVSS 9.8, Google Android)
- [CVE-2025-36895](https://cve.now/CVE-2025-36895.md): Information disclosure (CVSS 7.5, Google Android)
- [CVE-2025-36894](https://cve.now/CVE-2025-36894.md): In TBD of TBD, there is a possible DoS due to a missing null check. (CVSS 7.5, Google Android)
- [CVE-2025-36893](https://cve.now/CVE-2025-36893.md): In ReadTachyonCommands of gxp\_main\_actor.cc, there is a possible information leak due to uninitialized data. (CVSS 5.5, Google Android)
- [CVE-2025-36892](https://cve.now/CVE-2025-36892.md): Denial of service (CVSS 7.5, Google Android)
- [CVE-2025-36891](https://cve.now/CVE-2025-36891.md): Elevation of privilege (CVSS 8.8, Google Android)
- [CVE-2025-36890](https://cve.now/CVE-2025-36890.md): Elevation of Privilege (CVSS 9.8, Google Android)
- [CVE-2025-9519](https://cve.now/CVE-2025-9519.md): Easy Timer \<= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode (CVSS 7.2, kleor Easy Timer)
- [CVE-2025-9517](https://cve.now/CVE-2025-9517.md): atec Debug \<= 1.2.22 - Authenticated (Administrator+) Remote Code Execution (CVSS 7.2, docjojo atec Debug)
- [CVE-2025-9516](https://cve.now/CVE-2025-9516.md): atec Debug \<= 1.2.22 - Authenticated (Administrator+) Arbitrary File Read (CVSS 4.9, docjojo atec Debug)
- [CVE-2025-9518](https://cve.now/CVE-2025-9518.md): atec Debug \<= 1.2.22 - Authenticated (Administrator+) Arbitrary File Deletion (CVSS 7.2, docjojo atec Debug)
- [CVE-2025-43772](https://cve.now/CVE-2025-43772.md): Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions (CVSS 7.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-58358](https://cve.now/CVE-2025-58358.md): Markdownify is vulnerable to command injection through pptx-to-markdown tool (CVSS 7.5, zcaceres markdownify-mcp · mcp-markdownify-server)
- [CVE-2025-9942](https://cve.now/CVE-2025-9942.md): CodeAstro Real Estate Management System submitproperty.php unrestricted upload (CVSS 5.3, CodeAstro Real Estate Management System)
- [CVE-2025-9941](https://cve.now/CVE-2025-9941.md): CodeAstro Real Estate Management System register.php unrestricted upload (CVSS 5.3, CodeAstro Real Estate Management System)
- [CVE-2025-58357](https://cve.now/CVE-2025-58357.md): 5ire Chat Message XSS Vulnerability Enables Remote Code Execution (CVSS 9.7, nanbingxyz 5ire)
- [CVE-2025-9940](https://cve.now/CVE-2025-9940.md): CodeAstro Real Estate Management System feature.php cross site scripting (CVSS 5.1, CodeAstro Real Estate Management System)
- [CVE-2025-9939](https://cve.now/CVE-2025-9939.md): CodeAstro Real Estate Management System propertyview.php cross site scripting (CVSS 5.1, CodeAstro Real Estate Management System)
- [CVE-2025-57263](https://cve.now/CVE-2025-57263.md): An authenticated SQL injection vulnerability in VX Guestbook 1.07 allows attackers with admin access to inject malicious SQL payloads via th (CVSS 7.2)
- [CVE-2025-57576](https://cve.now/CVE-2025-57576.md): PHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) in /admin/updateorder.php. (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.