CVEs published September 10, 2025
97 CVEs were published on September 10, 2025: 4 critical, 38 high.
- Published
- 97
- Critical
- 4
- High
- 38
- Medium
- 53
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 29
Most affected products
- AxxonSoft AxxonOne C-Werk
- 7
- Dell PowerProtect Data Manager
- 7
- SolaX Power SolaX Cloud
- 4
- Cisco IOS XR Software
- 3
- IBM Security Verify Information Queue
- 3
- UPDF
- 3
- anthropics claude-code · @anthropic-ai/claude-code
- 2
- Google Chrome
- 2
- indico
- 2
- Liferay Portal · Liferay DXP +1
- 2
Critical 4
- CVE-2025-54123Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementationSpectoLabs hoverfly · github.com/SpectoLabs/hoverfly
- CVE-2025-10226PostgreSQL Upgrade from v10 to v17.4 in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier to Address Multiple VulnerabilitiesAxxonSoft AxxonOne C-Werk
- CVE-2025-10220Outdated Third-Party NuGet Packages in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4AxxonSoft AxxonOne C-Werk
- CVE-2025-9943Unauthenticated SQL Injection Vulnerability in Shibboleth Service ProviderShibboleth Service Provider
High 38
- CVE-2025-59052Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakageangular · @angular/platform-server +2
- CVE-2025-54376Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.SpectoLabs hoverfly · github.com/SpectoLabs/hoverfly
- CVE-2025-10201Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypasGoogle Chrome
- CVE-2025-10200Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap coGoogle Chrome
- CVE-2025-59049Mockoon has a Path Traversal and LFI in the static file serving endpointmockoon · @mockoon/commons-server +1
- CVE-2025-8696DoS attack against the Stork UI from an unauthenticated userISC Stork
- CVE-2025-59045Stalwart vulnerable to Memory Exhaustion via CalDAV Event Expansionstalwartlabs stalwart
- CVE-2025-20340Cisco IOS XR Address Resolution Protocol Broadcast Storm VulnerabilityCisco IOS XR Software
- CVE-2025-43887Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Incorrect Default Permissions vulnerability.Dell PowerProtect Data Manager
- CVE-2025-43725Dell PowerProtect Data Manager, Generic Application Agent, version(s) 19.19 and 19.20, contain(s) an Incorrect Default Permissions vulnerabiDell PowerProtect Data Manager
- CVE-2025-43885Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Dell PowerProtect Data Manager
- CVE-2025-43884Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Dell PowerProtect Data Manager
- CVE-2025-43888Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information into Log File vulnerabDell PowerProtect Data Manager
- CVE-2025-59041Claude Code vulnerable to arbitrary code execution caused by maliciously configured git emailanthropics claude-code · @anthropic-ai/claude-code
- CVE-2025-58764Claude Code rg command had Command Injection that allowed bypass of user approval prompt for command executionanthropics claude-code · @anthropic-ai/claude-code
- CVE-2025-10231N-central Incorrect Default Permissions could lead to Privilege EscalationN-able N-central
- CVE-2025-10225Incorrect Memory Allocation in OpenSSL-Based Session Module in AxxonSoft Axxon One (C-Werk)AxxonSoft AxxonOne C-Werk
- CVE-2025-7718Resideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeoverpixel_prime Resideo Plugin for Resideo - Real Estate WordPr…
- CVE-2025-10215DLL search path hijacking vulnerabilityUPDF
- CVE-2025-10214DLL search path hijacking vulnerabilityUPDF
- CVE-2025-10213DLL search path hijacking vulnerabilityUPDF
- CVE-2025-40979DLL search order hijack in Wave by Grandstream NetworksGrandstream Networks Wave
- CVE-2025-36759Sensitive Information Disclosure in SolaX CloudSolaX Power SolaX Cloud
- CVE-2025-41714Path Traversal via 'Upload-Key' in SmartEMS Upload HandlingWelotec SmartEMS Web Application
- CVE-2025-10001Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Uploadwpallimport WP All Import – Drag & Drop Import for CSV, XML…
- CVE-2025-10040WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposuresmackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…
- CVE-2025-7049WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeoverdasinfomedia WPGYM - Wordpress Gym Management System
- CVE-2025-10049Responsive Filterable Portfolio <= 1.0.24 - Authenticated (Admin+) Arbitrary File Uploadnik00726 Responsive Filterable Portfolio
- CVE-2025-50892The eudskacs.sys driver version 20250328 shipped with EaseUs Todo Backup 1.2.0.1 fails to properly validate privileges for I/O requests (IRP
- CVE-2025-55976Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint.
- CVE-2025-56404An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks u
- CVE-2025-56405An issue was discovered in litmusautomation litmus-mcp-server thru 0.0.1 allowing unauthorized attackers to control the target's MCP service
- CVE-2025-56406An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE serv
- CVE-2025-56407A vulnerability has been found in HuangDou UTCMS V9 and classified as critical.
- CVE-2025-56413OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitrary commands via the operation
- CVE-2025-56466Hardcoded credentials in Dietly v1.25.0 for android allows attackers to gain sensitive information.
- CVE-2025-57392BenimPOS Masaustu 3.0.x is affected by insecure file permissions.
- CVE-2025-57642A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the se
Medium, low and unrated 55
- CVE-2025-10234Scada-LTS Data Point Edit data_point_edit.shtm cross site scriptingScada-LTS
- CVE-2025-10233kalcaddle kodbox editor.class.php fileSave path traversalkalcaddle kodbox
- CVE-2025-10232299ko FileManagerAPIController.php delete path traversal299ko
- CVE-2025-10229Freshwork logout redirectFreshwork
- CVE-2025-10218lostvip-com ruoyi-go Background Management SysRoleDao.go SelectListPage sql injectionlostvip-com ruoyi-go
- CVE-2025-10216GrandNode Voucher ConfirmOrder race conditionGrandNode
- CVE-2024-45671IBM Security Verify Information Queue information disclosureIBM Security Verify Information Queue
- CVE-2024-45669IBM Security Verify Information Queue denial of serviceIBM Security Verify Information Queue
- CVE-2024-47120IBM Security Verify Information Queue code executionIBM Security Verify Information Queue
- CVE-2025-43783Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1Liferay Portal · Liferay DXP +1
- CVE-2025-10211yanyutao0402 ChanCMS getArticle CollectController server-side request forgeryyanyutao0402 ChanCMS
- CVE-2025-43784Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 thrLiferay Portal · Liferay DXP +1
- CVE-2025-10210yanyutao0402 ChanCMS Api.js search sql injectionyanyutao0402 ChanCMS
- CVE-2025-9714Stack overflow in libxml2libxml2
- CVE-2025-10209Papermerge DMS Authorization Token improper authorizationPapermerge DMS
- CVE-2025-43785Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2Liferay Portal · Liferay DXP +3
- CVE-2025-43886Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Path Traversal: '.../...//' vulnerability.Dell PowerProtect Data Manager
- CVE-2025-20159Cisco IOS XR Software Management Interface ACL Bypass VulnerabilityCisco IOS XR Software
- CVE-2025-20248Cisco IOS XR Software Image Verification Bypass VulnerabilityCisco IOS XR Software
- CVE-2025-43938Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Plaintext Storage of a Password vulnerability.Dell PowerProtect Data Manager
- CVE-2025-59035Indico vulnerable to Cross-Site Scripting via LaTeX math codeindico
- CVE-2025-59034Indico may disclose unauthorized user details access via legacy APIindico
- CVE-2025-8681Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface componentPegasystems Pega Infinity
- CVE-2025-10227Lack of Encryption in Object Archive in AxxonSoft Axxon One (C-Werk) before 2.0.8AxxonSoft AxxonOne C-Werk
- CVE-2025-10224Incorrect Evaluation of LDAP Nested Groups during Login in AxxonSoft Axxon One (C-Werk)AxxonSoft AxxonOne C-Werk
- CVE-2025-10223Improper Session Cleanup on Role Removal in Web Admin Panel in AxxonSoft Axxon One (C-Werk)AxxonSoft AxxonOne C-Werk
- CVE-2025-10222Sensitive Information Disclosure in Diagnostic Dumps in AxxonSoft Axxon One VMSAxxonSoft AxxonOne C-Werk
- CVE-2025-10221Hardcoded Password Exposure in AxxonNet (C-WerkNet) ARP Agent LogsAxxonSoft AxxonNet ARP Agent C-WerkNet
- CVE-2025-40725Reflected Cross-Site Scripting (XSS) in Azon DominatorAzon Dominator PHP script
- CVE-2025-36757Bypass of administrator login screen in SolaX CloudSolaX Power SolaX Cloud
- CVE-2025-36758Bypass of bruteforce protection in SolaX CloudSolaX Power SolaX Cloud
- CVE-2025-36756Device Takeover vulnerability in SolaX CloudSolaX Power SolaX Cloud
- CVE-2025-10142PagBank / PagSeguro Connect para WooCommerce <= 4.44.3 - Authenticated (Shop Manager+) SQL Injectionmartins56 PagBank / PagSeguro Connect para WooCommerce
- CVE-2025-9857Heateor Login – Social Login Plugin <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingHeateor Login – Social Login Plugin
- CVE-2025-10126MyBrain Utilities <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingmarkohoven MyBrain Utilities
- CVE-2025-9888Maspik <= 2.5.6 - Cross-Site Request Forgeryyonifre Maspik – Ultimate Spam Protection
- CVE-2025-9622WP Blast | SEO & Performance Booster <= 1.8.6 - Cross-Site Request Forgery to Cache Clearingwpblast WP Blast | SEO & Performance Booster
- CVE-2025-7843Auto Save Remote Images (Drafts) <= 1.0.9 - Authenticated (Contributor+) Server-Side Request Forgeryfernandiez Auto Save Remote Images
- CVE-2025-7826Testimonial <= 2.3 - Authenticated (Contributor+) SQL Injectionlaki_patel Testimonial
- CVE-2025-9367Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scriptinguscnanbu Welcart e-Commerce
- CVE-2025-9979Maspik <= 2.5.6 - Authenticated (Subscriber+) Missing Authorization to Spam Log Exportyonifre Maspik – Ultimate Spam Protection
- CVE-2025-8778NitroPack <= 1.18.4 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update via nitropack_set_compression_ajax FunctionNitroPack – Performance, Page Speed & Cache Plugin for Core…
- CVE-2025-9463Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net <= 1.117.5 - Authenticated (Contributor+) SQL Injection via order_by ParameterPeachPay — Payments & Express Checkout for WooCommerce
- CVE-2025-6189Duplicate Page and Post <= 2.9.5 - Authenticated (Contributor+) SQL Injection via meta_key Parameterarjunthakur Duplicate Page and Post
- CVE-2025-8388PowerPack Lite for Elementor <= 2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Via 'cursor_url'ideaboxcreations PowerPack Addons for Elementor
- CVE-2025-10197HJSoft HCM Human Resources Management System downlawbase sql injectionHJSoft HCM Human Resources Management System
- CVE-2025-10195Seismic App com.seismic.doccenter AndroidManifest.xml improper export of android application componentsSeismic App
- CVE-2025-29592oasys v1.1 is vulnerable to Directory Traversal in ProcedureController.
- CVE-2025-56578An issue in RTSPtoWeb v.2.4.3 allows a remote attacker to obtain sensitive information and executearbitrary code via the lack of authenticat
- CVE-2025-57520A Cross Site Scripting (XSS) vulnerability exists in Decap CMS thru 3.8.3.decap-cms
- CVE-2025-57569Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the portList parameter in /goform/setNAT.
- CVE-2025-57570Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the QosList parameter in goform/setQoS.
- CVE-2025-57571Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow.
- CVE-2025-57572Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the onlineList parameter in goform/setParentControl.
- CVE-2025-57573Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the wifiTimeClose parameter in goform/setWifi.