# CVEs published 2025-09-07

18 CVEs were published on September 7, 2025: 0 critical, 2 high. Days are UTC.

- [CVE-2025-10073](https://cve.now/CVE-2025-10073.md): Portabilis i-Educar turma improper authorization (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-10072](https://cve.now/CVE-2025-10072.md): Portabilis i-Educar enturmar access control (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-10071](https://cve.now/CVE-2025-10071.md): Portabilis i-Educar cancelar-enturmacao-em-lote access control (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-10070](https://cve.now/CVE-2025-10070.md): Portabilis i-Educar enturmacao-em-lote access control (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-48042](https://cve.now/CVE-2025-48042.md): Before action hooks may execute in certain scenarios despite a request being forbidden (CVSS 7.1, ash-project ash)
- [CVE-2025-39734](https://cve.now/CVE-2025-39734.md): Revert "fs/ntfs3: Replace inode\_trylock with inode\_lock" (no CVSS, Linux)
- [CVE-2025-39733](https://cve.now/CVE-2025-39733.md): team: replace team lock with rtnl lock (no CVSS, Linux)
- [CVE-2025-39732](https://cve.now/CVE-2025-39732.md): wifi: ath11k: fix sleeping-in-atomic in ath11k\_mac\_op\_set\_bitrate\_mask() (CVSS 7.8, Linux)
- [CVE-2025-39731](https://cve.now/CVE-2025-39731.md): f2fs: vm\_unmap\_ram() may be called from an invalid context (no CVSS, Linux)
- [CVE-2025-39730](https://cve.now/CVE-2025-39730.md): NFS: Fix filehandle bounds checking in nfs\_fh\_to\_dentry() (no CVSS, Linux)
- [CVE-2025-39729](https://cve.now/CVE-2025-39729.md): crypto: ccp - Fix dereferencing uninitialized error pointer (no CVSS, Linux)
- [CVE-2025-39727](https://cve.now/CVE-2025-39727.md): mm: swap: fix potential buffer overflow in setup\_clusters() (no CVSS, Linux)
- [CVE-2025-10068](https://cve.now/CVE-2025-10068.md): itsourcecode Online Discussion Forum add\_views.php sql injection (CVSS 6.9, itsourcecode Online Discussion Forum)
- [CVE-2025-10067](https://cve.now/CVE-2025-10067.md): itsourcecode POS Point of Sale System empty\_table.php cross site scripting (CVSS 5.3, itsourcecode POS Point of Sale System)
- [CVE-2025-10066](https://cve.now/CVE-2025-10066.md): itsourcecode POS Point of Sale System dymanic\_table.php cross site scripting (CVSS 5.3, itsourcecode POS Point of Sale System)
- [CVE-2025-36100](https://cve.now/CVE-2025-36100.md): IBM MQ information disclosure (CVSS 5.1, IBM MQ)
- [CVE-2025-10065](https://cve.now/CVE-2025-10065.md): itsourcecode POS Point of Sale System dom\_data\_th.php cross site scripting (CVSS 5.3, itsourcecode POS Point of Sale System)
- [CVE-2025-10064](https://cve.now/CVE-2025-10064.md): itsourcecode POS Point of Sale System dom\_data\_two\_headers.php cross site scripting (CVSS 5.3, itsourcecode POS Point of Sale System)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.