CVEs published September 16, 2025
231 CVEs were published on September 16, 2025: 22 critical, 70 high.
- Published
- 231
- Critical
- 22
- High
- 70
- Medium
- 119
- Low
- 10
- Unrated
- 10
- Now in CISA KEV
- 0
- Fix available
- 55
Most affected products
- Linux
- 115
- BMC Control-M/Agent
- 10
- Mozilla Firefox · Mozilla Thunderbird
- 10
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- 9
- Campcodes Grocery Sales and Inventory System
- 5
- Dolusoft Omaspot
- 3
- Ilevia Srl. EVE X1 Server
- 3
- Liferay Portal · Liferay DXP +1
- 3
- Adobe Substance3D - Stager
- 2
- ArgusTech BILGER
- 2
Critical 22
- CVE-2025-34187Ilevia EVE X1/X5 Server 4.7.18.0.eden Reverse RootshellIlevia Srl. EVE X1/X5 Server
- CVE-2025-34186Ilevia EVE X1/X5 Server 4.7.18.0.eden Authentication BypassIlevia Srl. EVE X1/X5 Server
- CVE-2025-34184Ilevia EVE X1 Server 4.7.18.0.eden Neuro-Core Unauthenticated Code InjectionIlevia Srl. EVE X1 Server
- CVE-2025-34183Ilevia EVE X1 Server 4.7.18.0.eden Credentials Leak Through Log DisclosureIlevia Srl. EVE X1 Server
- CVE-2025-59334Linkr allows manifest tampering leading to arbitrary file injectionmohammadzain2008 Linkr
- CVE-2022-50350scsi: target: iscsi: Fix a race condition between login_work and the login threadLinux
- CVE-2025-41243Spring Expression Language property modification using Spring Cloud Gateway Server WebFluxSpring Cloud Gateway · org.springframework.cloud:spring-clo…
- CVE-2009-20007Talkative IRC v0.4.4.16 Response Buffer OverflowTalkative IRC
- CVE-2009-20006osCommerce <= 2.2 Admin File Manager Arbitrary PHP Code ExecutionosCommerce
- CVE-2009-20005InterSystems Caché UtilConfigHome.csp Stack Buffer OverflowInterSystems Caché
- CVE-2024-13149SQLi in Arma Store's ArmalifeArma Store Armalife
- CVE-2025-55116BMC Control-M/Agent buffer overflow local privilege escalationBMC Control-M/Agent
- CVE-2025-55115BMC Control-M/Agent path traversal local privilege escalationBMC Control-M/Agent
- CVE-2025-55113BMC Control-M/Agent unescaped NULL byte in access control list checksBMC Control-M/Agent
- CVE-2025-55109BMC Control-M/Agent default SSL/TLS configuration authenticated bypassBMC Control-M/Agent
- CVE-2025-7743Sensitive Data Exposure in Dolusoft's OmaspotDolusoft Omaspot
- CVE-2025-7744SQLi in Dolusoft's OmaspotDolusoft Omaspot
- CVE-2025-4688SQLi in BGS Interactive's SINAV.LINK Exam Result ModuleBGS Interactive SINAV.LINK Exam Result Module
- CVE-2025-54391A vulnerability in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration (ZCS) allows an attacker with valid user credentials
- CVE-2025-56557An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control Matter devices via the Matter protocol.
- CVE-2025-57119An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login
- CVE-2025-57631SQL Injection vulnerability in TDuckCloud v.5.1 allows a remote attacker to execute arbitrary code via the Add a file upload module
High 70
- CVE-2025-37125Broken access control vulnerability in Firewall Configuration Leads to Unauthorized Access to Internal Network ResourcesHewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- CVE-2025-37123Authenticated Command Injection leads to Unauthorized Actions in CLI InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- CVE-2025-37124Unauthenticated Access Vulnerability allows Transit Traffic Misrouting in SD-WAN Edge InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- CVE-2025-37127Authenticated Replay Attack contains Cryptographic VulnerabilityHewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- CVE-2025-37126Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- CVE-2025-34185Ilevia EVE X1 Server 4.7.18.0.eden Unauthenticated File DisclosureIlevia Srl. EVE X1 Server
- CVE-2025-54262Substance3D - Stager | Out-of-bounds Read (CWE-125)Adobe Substance3D - Stager
- CVE-2025-10492Jaspersoft Library Deserialisation VulnerabilityJaspersoft JasperReports Library Community Edition · Jas… +7
- CVE-2025-59050Greenshot — Insecure .NET deserialization via WM_COPYDATA enables local code executiongreenshot
- CVE-2023-53333netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic oneLinux
- CVE-2023-53331pstore/ram: Check start of empty przs during initLinux
- CVE-2023-53322scsi: qla2xxx: Wait for io return on terminate rportLinux
- CVE-2023-53321wifi: mac80211_hwsim: drop short framesLinux
- CVE-2023-53320scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()Linux
- CVE-2023-53316drm/msm/dp: Free resources after unregistering themLinux
- CVE-2023-53315wifi: ath11k: Fix SKB corruption in REO destination ringLinux
- CVE-2023-53314fbdev/ep93xx-fb: Do not assign to struct fb_info.devLinux
- CVE-2023-53311nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iputLinux
- CVE-2023-53308net: fec: Better handle pm_runtime_get() failing in .remove()Linux
- CVE-2023-53307rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() failsLinux
- CVE-2023-53305Bluetooth: L2CAP: Fix use-after-freeLinux
- CVE-2022-50341cifs: fix oops during encryptionLinux
- CVE-2022-50339Bluetooth: avoid hci_dev_test_and_set_flag() in mgmt_init_hdev()Linux
- CVE-2025-4953Podman: build context bind mountpodman · Red Hat Enterprise Linux +6
- CVE-2025-36244IBM AIX privilege escalationIBM AIX · IBM VIOS
- CVE-2024-13174SQLi in E1 Informatics' Web ApplicationE1 Informatics Web Application
- CVE-2025-8894PDF File Parsing Heap-Based Buffer Overflow VulnerabilityAutodesk Revit · Autodesk AutoCAD +2
- CVE-2025-59333@executeautomation/database-server does not properly restrict access, bypassing a "read-only" modeexecuteautomation mcp-database-server · @executeautomation/…
- CVE-2025-8893PDF File Parsing Out-of-Bounds Write VulnerabilityAutodesk Revit · Autodesk AutoCAD +2
- CVE-2025-39836efi: stmm: Fix incorrect buffer allocation methodLinux
- CVE-2025-39827net: rose: include node references in rose_neigh refcountLinux
- CVE-2025-39826net: rose: convert 'use' field to refcount_tLinux
- CVE-2025-39825smb: client: fix race with concurrent opens in rename(2)Linux
- CVE-2025-39821perf: Avoid undefined behavior from stopping/starting inactive eventsLinux
- CVE-2025-39818HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs saveLinux
- CVE-2025-39817efivarfs: Fix slab-out-of-bounds in efivarfs_d_compareLinux
- CVE-2025-39815RISC-V: KVM: fix stack overrun when loading vlenbLinux
- CVE-2025-39810bnxt_en: Fix memory corruption when FW resources change during ifdownLinux
- CVE-2025-39809HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB lengthLinux
- CVE-2025-39806HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()Linux
- CVE-2025-10535Information disclosure, mitigation bypass in the Privacy component in Firefox for AndroidMozilla Firefox
- CVE-2025-10534Spoofing issue in the Site Permissions componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-10537Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-10528Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-10527Sandbox escape due to use-after-free in the Graphics: Canvas2D componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-10533Integer overflow in the SVG componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-55118BMC Control-M/Agent memory corruption in SSL/TLS communicationBMC Control-M/Agent
- CVE-2025-55112BMC Control-M/Agent hardcoded Blowfish keysBMC Control-M/Agent
- CVE-2024-12913SQLi in Megatek Communication System's Azora Wireless Network ManagementMegatek Communication System Azora Wireless Network Managem…
- CVE-2025-41249CVE-2025-41249: Spring Framework Annotation Detection VulnerabilityVMware Spring Framework · org.springframework:spring-core
- CVE-2025-41248CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized typesVMware Spring Security · org.springframework.security:sprin…
- CVE-2025-10016Local Privilege Escalation in Sparkle Autoupdate DaemonSparkle Project Sparkle
- CVE-2023-53297Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rspLinux
- CVE-2023-53286RDMA/mlx5: Return the firmware result upon destroying QP/RQLinux
- CVE-2023-53285ext4: add bounds checking in get_max_inline_xattr_value_size()Linux
- CVE-2023-53282scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware writeLinux
- CVE-2023-53274clk: mediatek: mt8183: Add back SSPM related clocksLinux
- CVE-2023-53272net: ena: fix shift-out-of-bounds in exponential backoffLinux
- CVE-2023-53265ubi: ensure that VID header offset + VID header size <= alloc, sizeLinux
- CVE-2023-53263drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_createLinux
- CVE-2024-12367Information Disclosure in Vegagrup Software's Vega MasterVegagrup Software Vega Master
- CVE-2025-44034SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/
- CVE-2025-52044In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attac
- CVE-2025-56263by-night sms V1.0 has an Arbitrary File Upload vulnerability.
- CVE-2025-56264The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability.
- CVE-2025-56295code-projects Computer Laboratory System 1.0 has a file upload vulnerability.
- CVE-2025-56562An incorrect API discovered in Signify Wiz Connected 1.9.1 allows attackers to remotely launch a DoS on Wiz devices only requiring the MAC a
- CVE-2025-56706Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution (RCE) vulnerability via the Object parameter in the openwrt_getCo
- CVE-2025-57624A DLL hijacking vulnerability in CYRISMA Agent before 444 allows local users to escalate privileges and execute arbitrary code via multiple
- CVE-2025-57625CYRISMA Sensor before 444 for Windows has an Insecure Folder and File Permissions vulnerability.
Medium, low and unrated 139
- CVE-2025-43804Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1Liferay Portal · Liferay DXP +1
- CVE-2025-37128Authenticated Arbitrary Process Termination allows potential System Disruption in ECOSHewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- CVE-2025-37129Authenticated Remote Code Execution allows Exploit in Scripts FeatureHewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- CVE-2025-37130Unrestricted Binary allows File Enumeration in Underlying Operating SystemHewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- CVE-2025-37131Authenticated Arbitrary File Read allows Data Exposure in CLI InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- CVE-2025-43805Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA throughLiferay Portal · Liferay DXP +1
- CVE-2025-10566Campcodes Grocery Sales and Inventory System index.php cross site scriptingCampcodes Grocery Sales and Inventory System
- CVE-2025-9708Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacksKubernetes CSharp Client · KubernetesClient
- CVE-2025-10565Campcodes Grocery Sales and Inventory System ajax.php sql injectionCampcodes Grocery Sales and Inventory System
- CVE-2025-10564Campcodes Grocery Sales and Inventory System ajax.php sql injectionCampcodes Grocery Sales and Inventory System
- CVE-2025-10563Campcodes Grocery Sales and Inventory System ajax.php sql injectionCampcodes Grocery Sales and Inventory System
- CVE-2025-10562Campcodes Grocery Sales and Inventory System ajax.php sql injectionCampcodes Grocery Sales and Inventory System
- CVE-2025-49728Microsoft PC Manager Security Feature Bypass VulnerabilityMicrosoft PC Manager
- CVE-2025-47967Microsoft Edge (Chromium-based) for Android Spoofing VulnerabilityMicrosoft Edge
- CVE-2025-54237Substance3D - Stager | Out-of-bounds Read (CWE-125)Adobe Substance3D - Stager
- CVE-2025-59336Relative Path Traversal in Luanoxlumen-oss luanox
- CVE-2025-59161In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is leftelement-hq element-web
- CVE-2025-59160matrix-js-sdk has insufficient validation when considering a room to be upgraded by anothermatrix-org matrix-js-sdk · matrix-js-sdk
- CVE-2025-58174LAM profile editor stored cross-site scripting vulnerabilityLDAPAccountManager lam
- CVE-2023-53334USB: chipidea: fix memory leak with using debugfs_lookup()Linux
- CVE-2023-53332genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()Linux
- CVE-2023-53330caif: fix memory leak in cfctrl_linkup_request()Linux
- CVE-2023-53329workqueue: fix data race with the pwq->stats[] incrementLinux
- CVE-2023-53328fs/ntfs3: Enhance sanity check while generating attr_listLinux
- CVE-2023-53327iommufd/selftest: Catch overflow of uptr and lengthLinux
- CVE-2023-53326powerpc: Don't try to copy PPR for task with NULL pt_regsLinux
- CVE-2023-53325drm/mediatek: dp: Change logging to dev for mtk_dp_aux_transfer()Linux
- CVE-2023-53324drm/msm/mdp5: Don't leak some plane stateLinux
- CVE-2023-53323ext2/dax: Fix ext2_setsize when len is page alignedLinux
- CVE-2023-53319KVM: arm64: Handle kvm_arm_init failure correctly in finalize_pkvmLinux
- CVE-2023-53318recordmcount: Fix memory leaks in the uwrite functionLinux
- CVE-2023-53317ext4: fix WARNING in mb_find_extentLinux
- CVE-2023-53313md/raid10: fix wrong setting of max_corr_read_errorsLinux
- CVE-2023-53312net: fix net_dev_start_xmit trace event vs skb_transport_offset()Linux
- CVE-2023-53310power: supply: axp288_fuel_gauge: Fix external_power_changed raceLinux
- CVE-2023-53309drm/radeon: Fix integer overflow in radeon_cs_parser_initLinux
- CVE-2023-53306fsdax: force clear dirty mark if CoWLinux
- CVE-2023-53304netfilter: nft_set_rbtree: fix overlap expiration walkLinux
- CVE-2022-50352net: hns: fix possible memory leak in hnae_ae_register()Linux
- CVE-2022-50351cifs: Fix xid leak in cifs_create()Linux
- CVE-2022-50349misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()Linux
- CVE-2022-50348nfsd: Fix a memory leak in an error handling pathLinux
- CVE-2022-50347mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()Linux
- CVE-2022-50346ext4: init quota for 'old.inode' in 'ext4_rename'Linux
- CVE-2022-50344ext4: fix null-ptr-deref in ext4_write_infoLinux
- CVE-2022-50343rapidio: fix possible name leaks when rio_add_device() failsLinux
- CVE-2022-50342floppy: Fix memory leak in do_floppy_init()Linux
- CVE-2022-50340media: vimc: Fix wrong function called when vimc_init() failsLinux
- CVE-2025-43801Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and LLiferay Portal · Liferay DXP +1
- CVE-2025-58749WAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT modebytecodealliance wasm-micro-runtime
- CVE-2025-59270psPAS does not enforce TLS 1.2 within Get-PASSAMLResponsepspete psPAS
- CVE-2025-8057IDOR in Patika Global Technologies' HumanSuitePatika Global Technologies HumanSuite
- CVE-2025-8276HTML Injection in Patika Global Technologies' HumanSuitePatika Global Technologies HumanSuite
- CVE-2024-12796Reflected XSS in Holistic IT, Consultancy Coop.'s Workcube ERPHolistic IT, Consultancy Coop. Workcube ERP
- CVE-2025-39835xfs: do not propagate ENODATA disk errors into xattr codeLinux
- CVE-2025-39834net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flowLinux
- CVE-2025-39833mISDN: hfcpci: Fix warning when deleting uninitialized timerLinux
- CVE-2025-39832net/mlx5: Fix lockdep assertion on sync reset unload eventLinux
- CVE-2025-39831fbnic: Move phylink resume out of service_task and into open/closeLinux
- CVE-2025-39830net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error pathLinux
- CVE-2025-39829trace/fgraph: Fix the warning caused by missing unregister notifierLinux
- CVE-2025-39828atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().Linux
- CVE-2025-39824HID: asus: fix UAF via HID_CLAIMED_INPUT validationLinux
- CVE-2025-39823KVM: x86: use array_index_nospec with indices that come from guestLinux
- CVE-2025-39822io_uring/kbuf: fix signedness in this_len calculationLinux
- CVE-2025-39820drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modesetLinux
- CVE-2025-39819fs/smb: Fix inconsistent refcnt updateLinux
- CVE-2025-39816io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengthsLinux
- CVE-2025-39814ice: fix NULL pointer dereference in ice_unplug_aux_dev() on resetLinux
- CVE-2025-39813ftrace: Fix potential warning in trace_printk_seq during ftrace_dumpLinux
- CVE-2025-39812sctp: initialize more fields in sctp_v6_from_sk()Linux
- CVE-2025-39811drm/xe/vm: Clear the scratch_pt pointer on errorLinux
- CVE-2025-39808HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()Linux
- CVE-2025-39807drm/mediatek: Add error handling for old state CRTC in atomic_disableLinux
- CVE-2025-39805net: macb: fix unregister_netdev call order in macb_remove()Linux
- CVE-2025-7355IDOR in Beefull Energy Technologies' Beefull AppBeefull Energy Technologies Beefull App
- CVE-2025-10290Opening links via the contextual menu in Focus for iOS would not update the toolbar UI correctly, allowing attackers to spoof websitesMozilla Focus for iOS
- CVE-2025-10531Mitigation bypass in the Web Compatibility: Tooling componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-10530Spoofing issue in the WebAuthn component in Firefox for AndroidMozilla Firefox · Mozilla Thunderbird
- CVE-2025-10536Information disclosure in the Networking: Cache componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-10532Incorrect boundary conditions in the JavaScript: GC componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-10529Same-origin policy bypass in the Layout componentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-55117BMC Control-M/Agent buffer overflow in SSL/TLS communicationBMC Control-M/Agent
- CVE-2025-55114BMC Control-M/Agent improper IP address filtering orderBMC Control-M/Agent
- CVE-2025-10546Cross-Site Scripting (XSS) Vulnerability in PPC XPON ONT Wi-Fi RouterPPC Technologies PPC XPON ONT (Optical Network Terminal) 2K…
- CVE-2025-55111BMC Control-M/Agent insecure default file permissionsBMC Control-M/Agent
- CVE-2025-55110BMC Control-M/Agent hardcoded default keystore passwordBMC Control-M/Agent
- CVE-2025-6575XSS in Dolusoft's OmaspotDolusoft Omaspot
- CVE-2025-8446Blaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installblazethemes Blaze Demo Importer
- CVE-2025-10015TCC Bypass via Downloader XPC Service in SparkleSparkle Project Sparkle
- CVE-2025-26711There is an unauthorized access vulnerability in ZTE T5400.ZTE T5400
- CVE-2025-26710There is an an information disclosure vulnerability in ZTE T5400.ZTE T5400
- CVE-2025-10316Cross-Site Scripting in extension "Form to Database" (form_to_database)TYPO3 Extension "Form to Database" · lavitto/typo3-form-to-…
- CVE-2025-2404XSS in Ubit Information Technologies' STOYSUbit Information Technologies STOYS
- CVE-2023-53303net: microchip: vcap api: Fix possible memory leak for vcap_dup_rule()Linux
- CVE-2023-53302wifi: iwl4965: Add missing check for create_singlethread_workqueue()Linux
- CVE-2023-53301f2fs: fix kernel crash due to null io->bioLinux
- CVE-2023-53300media: hi846: Fix memleak in hi846_init_controls()Linux
- CVE-2023-53299md/raid10: fix leak of 'r10bio->remaining' for recoveryLinux
- CVE-2023-53298nfc: fix memory leak of se_io context in nfc_genl_se_ioLinux
- CVE-2023-53296sctp: check send stream number after wait_for_sndbufLinux
- CVE-2023-53295udf: Do not update file length for failed writes to inline filesLinux
- CVE-2023-53294fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup()Linux
- CVE-2023-53292blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_noneLinux
- CVE-2023-53291rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscaleLinux
- CVE-2023-53290samples/bpf: Fix fout leak in hbm's run_bpf_progLinux
- CVE-2023-53289media: bdisp: Add missing check for create_workqueueLinux
- CVE-2023-53288drm/client: Fix memory leak in drm_client_modeset_probeLinux
- CVE-2023-53287usb: cdns3: Put the cdns set active part outside the spin lockLinux
- CVE-2023-53284drm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init()Linux
- CVE-2023-53281drivers: staging: rtl8723bs: Fix locking in _rtw_join_timeout_handler()Linux
- CVE-2023-53280scsi: qla2xxx: Remove unused nvme_ls_waitq wait queueLinux
- CVE-2023-53279misc: vmw_balloon: fix memory leak with using debugfs_lookup()Linux
- CVE-2023-53278ubifs: Fix memory leak in ubifs_sysfs_init()Linux
- CVE-2023-53277wifi: iwl3945: Add missing check for create_singlethread_workqueueLinux
- CVE-2023-53276ubifs: Free memory for tmpfile nameLinux
- CVE-2023-53275ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()Linux
- CVE-2023-53273Drivers: vmbus: Check for channel allocation before looking up relidsLinux
- CVE-2023-53271ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()Linux
- CVE-2023-53270ext4: fix i_disksize exceeding i_size problem in paritally written caseLinux
- CVE-2023-53269block: ublk: make sure that block size is set correctlyLinux
- CVE-2023-53268ASoC: fsl_mqs: move of_node_put() to the correct locationLinux
- CVE-2023-53267driver: soc: xilinx: fix memory leak in xlnx_add_cb_for_notify_event()Linux
- CVE-2023-53266arm64: acpi: Fix possible memory leak of ffh_ctxtLinux
- CVE-2023-53264clk: imx: clk-imxrt1050: fix memory leak in imxrt1050_clocks_probeLinux
- CVE-2025-5519Information Disclosure in ArgusTech's BILGERArgusTech BILGER
- CVE-2025-5518IDOR in ArgusTech's BILGERArgusTech BILGER
- CVE-2025-9808The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosurestellarwp The Events Calendar
- CVE-2025-30075In Alludo MindManager before 25.0.208 on Windows, attackers could potentially execute code as other local users on the same machine if they Alludo MindManager
- CVE-2025-55834A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information via the logControll
- CVE-2025-56276code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the registration function.
- CVE-2025-56280code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the area where users submit reservation informa
- CVE-2025-56289code-projects Document Management System 1.0 has a Cross Site Scripting (XSS) vulnerability, where attackers can leak admin's cookie informa
- CVE-2025-56293code-projects Human Resource Integrated System 1.0 is vulnerable to Cross Site Scripting (XSS) in the Add Child Information section in the C
- CVE-2025-56697A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara Co
- CVE-2025-57145A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application.
- CVE-2025-59436The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as fedorindutny ip
- CVE-2025-59437The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 0 is improperly categorized as globally rofedorindutny ip
- CVE-2025-59453Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency access.clickstudios Passwordstate