CVEs published September 6, 2025
60 CVEs were published on September 6, 2025: 3 critical, 16 high.
- Published
- 60
- Critical
- 3
- High
- 16
- Medium
- 33
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Campcodes Grocery Sales and Inventory System
- 3
- itsourcecode POS Point of Sale System
- 3
- AMD Ryzen™ Threadripper™ 3000 Processors · AMD Ryzen™ T… +23
- 2
- cloudinfrastructureservices Cloud SAML SSO – Single Sign On…
- 2
- sizam REHub - Price Comparison, Multi Vendor Marketplace Wo…
- 2
- alimuzzamanalim Html Social share buttons
- 1
- AMD Athlon™ 3000 Series Mobile Processors with Radeon™… +14
- 1
- AMD EPYC™ 7003 Series Processors · AMD EPYC™ 9004 Series… +3
- 1
- AMD EPYC™ 9004 Series Processors · AMD EPYC™ Embedded 90… +1
- 1
- AMD EPYC™ 9005 Series Processors · AMD Ryzen™ AI 300 Ser… +5
- 1
Critical 3
High 16
- CVE-2025-0032Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microcoAMD EPYC™ 9005 Series Processors · AMD Ryzen™ AI 300 Ser… +5
- CVE-2024-36354Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a sysAMD Ryzen™ Threadripper™ 3000 Processors · AMD Ryzen™ T… +34
- CVE-2024-36352Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to aAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +26
- CVE-2024-36342Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execuAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +38
- CVE-2024-36326Missing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, poteAMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graph…
- CVE-2024-21947Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially reAMD Ryzen™ Threadripper™ 3000 Processors · AMD Ryzen™ T… +23
- CVE-2023-31325Improper isolation of shared resources on System-on-a-chip (SOC) could a privileged attacker to tamper with the contents of the PSP reservedAMD Ryzen™ 8000 Series Desktop Processors · AMD Ryzen™ 7… +2
- CVE-2023-31322Type confusion in the ASP could allow an attacker to pass a malformed argument to the Reliability, Availability, and Serviceability trusted AMD Radeon™ RX 7000 Series Graphics Products · -AMD Radeon™…
- CVE-2025-10034D-Link DIR-825 httpd ping6_response.cg get_ping6_app_stat buffer overflowD-Link DIR-825
- CVE-2025-9961Authenticated RCE by CWMP binaryTP-Link Systems AX10 V1/V1.2/V2/V2.6/V3/V3.6 · TP-Link Syst…
- CVE-2025-7040Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings Actioncloudinfrastructureservices Cloud SAML SSO – Single Sign On…
- CVE-2025-58437Coder's privilege escalation vulnerability could lead to a cross workspace compromisecoder · github.com/coder/coder +1
- CVE-2025-9515Multi Step Form <= 1.7.25 - Authenticated (Admin+) Arbitrary File Uploadmondula2016 Multi Step Form
- CVE-2025-58374Roo Code: Auto-approve allows npm install execution of malicious postinstall scriptsRooCodeInc Roo-Code
- CVE-2025-7366Rehub <= 19.9.7 - Unauthenticated Arbitrary Shortcode Execution via re_filterpostsizam REHub - Price Comparison, Multi Vendor Marketplace Wo…
- CVE-2025-58439ERP: Possibility of SQL injection due to missing validationfrappe erpnext
Medium, low and unrated 41
- CVE-2025-10063itsourcecode POS Point of Sale System deferred_table.php cross site scriptingitsourcecode POS Point of Sale System
- CVE-2025-10062itsourcecode Student Information Management System login.php sql injectionitsourcecode Student Information Management System
- CVE-2025-58445Atlantis Exposes Service Version Publicly on /status API Endpointrunatlantis atlantis · github.com/runatlantis/atlantis
- CVE-2025-58446xgrammar vulnerable to denial of service by huge enum grammarmlc-ai xgrammar · xgrammar
- CVE-2025-0034Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cauAMD Instinct™ MI300X · AMD Instinct™ MI325X
- CVE-2025-0011Improper removal of sensitive information before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address AMD Ryzen™ 8000 Series Desktop Processors · AMD Ryzen™… +17
- CVE-2025-0010An out of bounds write in the Linux graphics driver could allow an attacker to overflow the buffer potentially resulting in loss of confidenAMD Radeon™ RX 5000 Series Graphics Products · AMD Rade… +33
- CVE-2025-0009A NULL pointer dereference in AMD Crash Defender could allow an attacker to write a NULL output to a log file potentially resulting in a sysAMD Ryzen™ 7035 Series Processor with Radeon™ Graphics… +26
- CVE-2024-36346Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input daAMD Instinct™ MI300A · AMD Instinct™ MI300X
- CVE-2024-36331Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulAMD EPYC™ 9004 Series Processors · AMD EPYC™ Embedded 90… +1
- CVE-2024-21970Improper validation of an array index in the AND power Management Firmware could allow a privileged attacker to corrupt AGESA memory potentiAMD Ryzen™ Threadripper™ 3000 Processors · AMD Ryzen™ T… +23
- CVE-2023-31365An integer overflow in the SMU could allow a privileged attacker to potentially write memory beyond the end of the reserved dRAM area resultAMD Radeon™ RX 7000 Series Graphics Products · AMD Radeo… +1
- CVE-2023-31351Improper restriction of operations in the IOMMU could allow a malicious hypervisor to access guest private memory resulting in loss of integAMD EPYC™ 7003 Series Processors · AMD EPYC™ 9004 Series… +3
- CVE-2023-31330An out-of-bounds read in the ASP could allow a privileged attacker with access to a malicious bootloader to potentially read sensitive memorAMD Ryzen™ Threadripper™ 3000 Processors · AMD Ryzen™ T… +17
- CVE-2023-31326Use of an uninitialized variable in the ASP could allow an attacker to access leftover data from a trusted execution environment (TEE) driveAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ G… +13
- CVE-2023-31306Improper validation of an array index in the AMD graphics driver software could allow an attacker to pass malformed arguments to the dynamicAMD Radeon™ RX 5000 Series Graphics Products · AMD Radeo… +4
- CVE-2023-20516Improper handling of insufficiency privileges in the ASP could allow a privileged attacker to modify Translation Map Registers (TMRs) potentAMD Instinct™ MI250 · AMD Instinct™ MI210 +3
- CVE-2021-46750Failure to validate the address and size in TEE (Trusted Execution Environment) may allow a malicious x86 attacker to send malformed messageAMD Athlon™ 3000 Series Mobile Processors with Radeon™… +14
- CVE-2021-26377Insufficient parameter validation while allocating process space in the Trusted OS (TOS) may allow for a malicious userspace process to trigAMD Ryzen™ 5000 Series Processors with Radeon™ Graphics… +23
- CVE-2025-10033itsourcecode Online Discussion Forum admin sql injectionitsourcecode Online Discussion Forum
- CVE-2025-10032Campcodes Grocery Sales and Inventory System index.php cross site scriptingCampcodes Grocery Sales and Inventory System
- CVE-2025-10031Campcodes Grocery Sales and Inventory System ajax.php sql injectionCampcodes Grocery Sales and Inventory System
- CVE-2025-10030Campcodes Grocery Sales and Inventory System ajax.php sql injectionCampcodes Grocery Sales and Inventory System
- CVE-2025-10029itsourcecode POS Point of Sale System complex_header_2.php cross site scriptingitsourcecode POS Point of Sale System
- CVE-2025-10046ELEX WooCommerce Google Shopping (Google Product Feed) <= 1.4.3 - Authenticated (Admin+) SQL Inejctionelextensions ELEX WooCommerce Google Shopping
- CVE-2025-10028itsourcecode POS Point of Sale System 6776.php cross site scriptingitsourcecode POS Point of Sale System
- CVE-2025-6757Recent Posts Widget Extended <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via rpwe Shortcodethemejunkie Recent Posts Widget Extended
- CVE-2025-8149aThemes Addons for Elementor Lite <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widgetsmub aThemes Addons for Elementor
- CVE-2025-8564SKT Addons for Elementor <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetssonalsinha21 SKT Addons for Elementor
- CVE-2025-7045Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Identity Provider Deletion via delete_config Actioncloudinfrastructureservices Cloud SAML SSO – Single Sign On…
- CVE-2025-9493Admin Menu Editor <= 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder Parameterwhiteshadow Admin Menu Editor
- CVE-2025-9442StreamWeasels Kick Integration <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via vodsChannel ParameterStreamWeasels Kick Integration
- CVE-2025-9126Smart Table Builder <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameterdesignful Smart Table Builder
- CVE-2025-8722Content Views <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Grid and List Widgetspt-guy Content Views – Post Grid & Filter, Recent Posts, Ca…
- CVE-2025-10003UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injectionstiofansisland UsersWP – Front-end login form, User Registr…
- CVE-2025-9853Optio Dentistry <= 2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingOptio Dentistry
- CVE-2025-9085User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injectionwpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2025-8360LA-Studio Element Kit for Elementor <= 1.5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetschoijun LA-Studio Element Kit for Elementor
- CVE-2025-6067Easy Social Feed – Social Photos Gallery – Post Feed – Like Box <= 6.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingsjaved Easy Social Feed – Social Photos Gallery and Post Fe…
- CVE-2025-9849Html Social share buttons <= 2.1.16 - Authenticated (Contributor+) Stored Cross-Site Scriptingalimuzzamanalim Html Social share buttons
- CVE-2025-7368Rehub <= 19.9.7 - Unauthenticated Password Protected Post Disclosuresizam REHub - Price Comparison, Multi Vendor Marketplace Wo…