CVEs published September 17, 2025
218 CVEs were published on September 17, 2025: 18 critical, 66 high. 1 is now in CISA KEV.
- Published
- 218
- Critical
- 18
- High
- 66
- Medium
- 127
- Low
- 6
- Unrated
- 1
- Now in CISA KEV
- 1
- Fix available
- 56
Most affected products
- Linux
- 56
- Ashlar-Vellum Cobalt
- 22
- Ashlar-Vellum Graphite
- 8
- CISA Thorium
- 7
- Portabilis i-Educar
- 7
- SourceCodester Online Exam Form Submission
- 7
- dragonflyoss dragonfly · github.com/dragonflyoss/dragonf… +1
- 6
- dragonflyoss dragonfly · d7y.io/dragonfly/v2 +1
- 5
- NVIDIA Triton Inference Server
- 5
- Dassault Systèmes SOLIDWORKS eDrawings
- 3
Critical 18
- CVE-2025-23316NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause a remote NVIDIA Triton Inference Server
- CVE-2025-10644Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass VulnerabilityWondershare Repairit
- CVE-2025-10643Wondershare Repairit Incorrect Permission Assignment Authentication Bypass VulnerabilityWondershare Repairit
- CVE-2025-59340jinjava Sandbox Bypass via JavaType-Based DeserializationHubSpot jinjava · com.hubspot.jinjava:jinjava
- CVE-2025-58766Dyad Vulnerable to Remote Code Execution via Top-level Navigation in Preview Windowdyad-sh dyad
- CVE-2023-53360NFSv4.2: Rework scratch handling for READ_PLUS (again)Linux
- CVE-2023-53338lwt: Fix return values of BPF xmit opsLinux
- CVE-2022-50373fs: dlm: fix race in lowcommsLinux
- CVE-2022-50363skmsg: pass gfp argument to alloc_sk_msg()Linux
- CVE-2025-8077NeuVector admin account has insecure default passwordSUSE neuvector · github.com/neuvector/neuvector
- CVE-2025-10439SQLi in Yordam Library Automation SystemYordam Informatics Yordam Library Automation System
- CVE-2025-10157PickleScan Bypasses Unsafe Globals Check Using Submodule Importsmmaitre314 picklescan · picklescan
- CVE-2025-10156PickleScan Security Bypass via Bad CRC in ZIP Archivemmaitre314 picklescan · picklescan
- CVE-2025-10155PickleScan Security Bypass Using Misleading File Extensionmmaitre314 picklescan · picklescan
- CVE-2025-9242WatchGuard Firebox iked Out of Bounds Write VulnerabilityWatchGuard Fireware OS
- CVE-2025-9972Planet Technology｜Industrial Cellular Gateway - OS Command InjectionPlanet Technology ICG-2510WG-LTE · Planet Technology ICG-25…
- CVE-2025-9971Planet Technology｜Industrial Cellular Gateway - Missing AuthenticationPlanet Technology ICG-2510WG-LTE · Planet Technology ICG-25…
- CVE-2025-59304A directory traversal issue in Swetrix Web Analytics API 3.1.1 before 7d8b972 allows a remote attacker to achieve Remote Code Execution via
High 66
- CVE-2025-23268NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker may cause an improper input validation issue.NVIDIA Triton Inference Server
- CVE-2025-23329NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause memory corruption by identifyingNVIDIA Triton Inference Server
- CVE-2025-23328NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write through aNVIDIA Triton Inference Server
- CVE-2025-7993Ashlar-Vellum Cobalt LI File Parsing Use-After-Free Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-8006Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-8002Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-8004Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-8005Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-8001Ashlar-Vellum Cobalt CO File Parsing Memory Corruption Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-8003Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-7997Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-8000Ashlar-Vellum Cobalt LI File Parsing Type Confusion Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-7995Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-7996Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-7998Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-7994Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-7999Ashlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-7988Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAshlar-Vellum Graphite
- CVE-2025-7991Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-7992Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-7987Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAshlar-Vellum Graphite
- CVE-2025-7989Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-7986Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAshlar-Vellum Graphite
- CVE-2025-7990Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-7985Ashlar-Vellum Cobalt VC6 File Parsing Integer Overflow Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-7984Ashlar-Vellum Cobalt AR File Parsing Uninitialized Variable Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-7983Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAshlar-Vellum Graphite
- CVE-2025-7981Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution VulnerabilityAshlar-Vellum Graphite
- CVE-2025-7979Ashlar-Vellum Graphite VC6 File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityAshlar-Vellum Graphite
- CVE-2025-7978Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution VulnerabilityAshlar-Vellum Graphite
- CVE-2025-7980Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAshlar-Vellum Graphite
- CVE-2025-7982Ashlar-Vellum Cobalt LI File Parsing Integer Overflow Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-7977Ashlar-Vellum Cobalt LI File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAshlar-Vellum Cobalt
- CVE-2025-59353Manager generates mTLS certificates for arbitrary IP addressesdragonflyoss dragonfly · d7y.io/dragonfly/v2 +1
- CVE-2025-59345Dragonfly did not enable authentication for some Manager’s endpointsdragonflyoss dragonfly · github.com/dragonflyoss/dragonf… +1
- CVE-2025-59416The Scratch Channel forks can publish articlesThe-Scratch-Channel tsc-web-client
- CVE-2025-59341Local File Inclusion in esm.shesm-dev esm.sh · github.com/esm-dev/esm.sh
- CVE-2023-53363PCI: Fix use-after-free in pci_bus_release_domain_nr()Linux
- CVE-2023-53358ksmbd: fix racy issue under cocurrent smb2 tree disconnectLinux
- CVE-2023-53357md/raid10: check slab-out-of-bounds in md_bitmap_get_counterLinux
- CVE-2023-53354skbuff: skb_segment, Call zero copy functions before using skbuff fragsLinux
- CVE-2023-53340net/mlx5: Collect command failures data only for known commandsLinux
- CVE-2023-53335RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()Linux
- CVE-2022-50368drm/msm/dsi: fix memory corruption with too many bridgesLinux
- CVE-2022-50367fs: fix UAF/GPF bug in nilfs_mdt_destroyLinux
- CVE-2022-50366powercap: intel_rapl: fix UBSAN shift-out-of-bounds issueLinux
- CVE-2022-50365skbuff: Account for tail adjustment during pull operationsLinux
- CVE-2022-50362dmaengine: hisilicon: Add multi-thread support for a DMA channelLinux
- CVE-2022-50355staging: vt6655: fix some erroneous memory clean-up loopsLinux
- CVE-2022-50354drm/amdkfd: Fix kfd_process_device_init_vm error handlingLinux
- CVE-2025-10205Predictable Salt and Weak Hashing AlgorithmABB FLXEON
- CVE-2024-48842Hardcoded passwordsABB FLXEON
- CVE-2025-40933Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurelyKGOLDOV Apache::AuthAny
- CVE-2025-8411XSS in Dokuzsoft Technology's E-Commerce Web Design ProductDokuzsoft Technology E-Commerce Web Design Product
- CVE-2025-59458In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.28JetBrains Junie
- CVE-2025-59457In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on WindowsJetBrains TeamCity
- CVE-2025-9216StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Uploadkodezen StoreEngine — Complete eCommerce Solution with Memb…
- CVE-2025-9450Use of Uninitialized Variable vulnerability affecting the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025Dassault Systèmes SOLIDWORKS eDrawings
- CVE-2025-9449Use After Free vulnerability affecting the PAR file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025Dassault Systèmes SOLIDWORKS eDrawings
- CVE-2025-9447Out-Of-Bounds Read affecting the PAR file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025Dassault Systèmes SOLIDWORKS eDrawings
- CVE-2025-10057WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injectionsmackcoders WP Import – Ultimate CSV XML Importer for WordP…
- CVE-2025-10058WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletionsmackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…
- CVE-2025-10589N-Partner｜N-Reporter, N-Cloud, N-Probe - OS Command InjectionN-Partner N-Reporter · N-Partner N-Cloud +1
- CVE-2025-58116Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in WN-7D36QR and WN-7D36QR/UE.I-O DATA DEVICE WN-7D36QR · I-O DATA DEVICE WN-7D36QR/UE
- CVE-2025-10143Catch Dark Mode <= 2.0 - Authenticated (Contributor+) Local File Inclusioncatchthemes Catch Dark Mode
- CVE-2025-59518In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail.lemonldap-ng LemonLDAP::NG
Medium, low and unrated 134
- CVE-2025-10627SourceCodester Online Exam Form Submission delete_user.php sql injectionSourceCodester Online Exam Form Submission
- CVE-2025-10626SourceCodester Online Exam Form Submission update_s3.php sql injectionSourceCodester Online Exam Form Submission
- CVE-2025-10625SourceCodester Online Exam Form Submission dashboard.php sql injectionSourceCodester Online Exam Form Submission
- CVE-2025-10624PHPGurukul User Management System login.php sql injectionPHPGurukul User Management System
- CVE-2025-10623SourceCodester Hotel Reservation System deleteuser.php sql injectionSourceCodester Hotel Reservation System
- CVE-2025-23337NVIDIA HGX & DGX GB200, GB300, B300 contain a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with adNVIDIA HGX GB200, HGX GB300, HGC B300 · NVIDIA DGX GB200, H…
- CVE-2025-10621SourceCodester Hotel Reservation System editroomimage.php sql injectionSourceCodester Hotel Reservation System
- CVE-2025-23336NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause a denial of service by loading aNVIDIA Triton Inference Server
- CVE-2025-10620itsourcecode Online Clinic Management System editp2.php sql injectionitsourcecode Online Clinic Management System
- CVE-2025-59415Frappe Learning vulnerable to Malicious Content upload via Profile bio fieldfrappe lms
- CVE-2025-10619sequa-ai sequa-mcp OAuth Server Discovery node-oauth-client-provider.ts redirectToAuthorization os command injectionsequa-ai sequa-mcp · @sequa-ai/sequa-mcp
- CVE-2025-10618itsourcecode Online Clinic Management System transact.php sql injectionitsourcecode Online Clinic Management System
- CVE-2025-10617SourceCodester Online Polling System positions.php sql injectionSourceCodester Online Polling System
- CVE-2025-10616itsourcecode E-Commerce Website users.php unrestricted uploaditsourcecode E-Commerce Website
- CVE-2025-10615itsourcecode E-Commerce Website products.php unrestricted uploaditsourcecode E-Commerce Website
- CVE-2025-59410Dragonfly tiny file download uses hard coded HTTP protocoldragonflyoss dragonfly · github.com/dragonflyoss/dragonf… +1
- CVE-2025-59354Dragonfly has weak integrity checks for downloaded filesdragonflyoss dragonfly · github.com/dragonflyoss/dragonf… +1
- CVE-2025-59352Dragonfly allows arbitrary file read and write on a peer machinedragonflyoss dragonfly · github.com/dragonflyoss/dragonf… +1
- CVE-2025-59351Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an errordragonflyoss dragonfly · d7y.io/dragonfly/v2 +1
- CVE-2025-59350Timing attacks against Proxy’s basic authentication are possibledragonflyoss dragonfly · d7y.io/dragonfly/v2 +1
- CVE-2025-59349Directories created via os.MkdirAll are not checked for permissionsdragonflyoss dragonfly · github.com/dragonflyoss/dragonf… +1
- CVE-2025-10614itsourcecode E-Logbook with Health Monitoring System for COVID-19 print_reports_prev.php cross site scriptingitsourcecode E-Logbook with Health Monitoring System for CO…
- CVE-2025-37122Unauthenticated Reflected Cross-Site ScriptingHewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…
- CVE-2025-59348Dragonfly incorrectly handles a task structure’s usedTraffic fielddragonflyoss dragonfly · github.com/dragonflyoss/dragonf… +1
- CVE-2025-59347Dragonfly Manager makes requests to external endpoints with disabled TLS authenticationdragonflyoss dragonfly · d7y.io/dragonfly/v2 +1
- CVE-2025-59346Dragonfly server-side request forgery vulnerabilitydragonflyoss dragonfly · d7y.io/dragonfly/v2 +1
- CVE-2025-10613itsourcecode Student Information System leveledit1.php sql injectionitsourcecode Student Information System
- CVE-2025-59414Nuxt Client-Side Path Traversal in Nuxt Island Payload Revivalnuxt
- CVE-2025-10608Portabilis i-Educar enrollment-history access controlPortabilis i-Educar
- CVE-2025-10607Portabilis i-Educar diarioApi information disclosurePortabilis i-Educar
- CVE-2025-10606Portabilis i-Educar ConfiguracaoMovimentoGeral cross site scriptingPortabilis i-Educar
- CVE-2025-59342esm.sh writes arbitrary files via path traversal in `X-Zone-Id` headeresm-dev esm.sh · github.com/esm-dev/esm.sh
- CVE-2025-59339The Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync scriptovh the-bastion
- CVE-2025-58767REXML has a DoS condition when parsing malformed XML fileruby rexml · rexml
- CVE-2025-10605Portabilis i-Educar agenda_preferencias.php cross site scriptingPortabilis i-Educar
- CVE-2025-10604PHPGurukul Online Discussion Forum edit_member.php sql injectionPHPGurukul Online Discussion Forum
- CVE-2025-58432ZimaOS Privilege Escalation using localhost calls to File API UploadIceWhaleTech ZimaOS
- CVE-2025-58431ZimaOS reads arbitrary files using localhost calls to File API DownloadIceWhaleTech ZimaOS
- CVE-2025-10603PHPGurukul Online Discussion Forum search_result.php sql injectionPHPGurukul Online Discussion Forum
- CVE-2025-10602SourceCodester Online Exam Form Submission delete_s1.php sql injectionSourceCodester Online Exam Form Submission
- CVE-2025-35436CISA Thorium account verification email error handlingCISA Thorium
- CVE-2025-35435CISA Thorium download stream divide by zeroCISA Thorium
- CVE-2025-35434CISA Thorium does not validate TLS connections to ElasticsearchCISA Thorium
- CVE-2025-35433CISA Thorium does not properly invalidate previously used tokensCISA Thorium
- CVE-2025-35432CISA Thorium does not rate limit account verification email messagesCISA Thorium
- CVE-2025-35431CISA Thorium LDAP injectionCISA Thorium
- CVE-2025-35430CISA Thorium insecure downloaded file path validationCISA Thorium
- CVE-2025-10601SourceCodester Online Exam Form Submission index.php sql injectionSourceCodester Online Exam Form Submission
- CVE-2025-10600SourceCodester Online Exam Form Submission register.php unrestricted uploadSourceCodester Online Exam Form Submission
- CVE-2025-10599itsourcecode Web-Based Internet Laboratory Management System login.php AuthenticateUser sql injectionitsourcecode Web-Based Internet Laboratory Management System
- CVE-2025-10598SourceCodester Pet Grooming Management Software search_product.php sql injectionSourceCodester Pet Grooming Management Software
- CVE-2025-10597kidaze CourseSelectionSystem COUNT2.php sql injectionkidaze CourseSelectionSystem
- CVE-2025-10596SourceCodester Online Exam Form Submission index.php sql injectionSourceCodester Online Exam Form Submission
- CVE-2025-9862Ghost 6.0.6 - SSRF via oEmbed BookmarkGhost
- CVE-2023-53368tracing: Fix race issue between cpu buffer write and swapLinux
- CVE-2023-53367accel/habanalabs: fix mem leak in capture user mappingsLinux
- CVE-2023-53366block: be a bit more careful in checking for NULL bdev while pollingLinux
- CVE-2023-53365ip6mr: Fix skb_under_panic in ip6mr_cache_report()Linux
- CVE-2023-53364regulator: da9063: better fix null deref with partial DTLinux
- CVE-2023-53362bus: fsl-mc: don't assume child devices are all fsl-mc devicesLinux
- CVE-2023-53361LoongArch: mm: Add p?d_leaf() definitionsLinux
- CVE-2023-53359USB: fix memory leak with using debugfs_lookup()Linux
- CVE-2023-53356usb: gadget: u_serial: Add null pointer check in gserial_suspendLinux
- CVE-2023-53355staging: pi433: fix memory leak with using debugfs_lookup()Linux
- CVE-2023-53353accel/habanalabs: postpone mem_mgr IDR destruction to hpriv_release()Linux
- CVE-2023-53352drm/ttm: check null pointer before accessing when swappingLinux
- CVE-2023-53351drm/sched: Check scheduler work queue before calling timeout handlingLinux
- CVE-2023-53350accel/qaic: Fix slicing memory leakLinux
- CVE-2023-53349media: ov2740: Fix memleak in ov2740_init_controls()Linux
- CVE-2023-53348btrfs: fix deadlock when aborting transaction during relocation with scrubLinux
- CVE-2023-53347net/mlx5: Handle pairing of E-switch via uplink un/load APIsLinux
- CVE-2023-53346kernel/fail_function: fix memory leak with using debugfs_lookup()Linux
- CVE-2023-53345rxrpc: Fix potential data race in rxrpc_wait_to_be_connected()Linux
- CVE-2023-53344can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_writeLinux
- CVE-2023-53343icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().Linux
- CVE-2023-53342net: marvell: prestera: fix handling IPv4 routes with nhidLinux
- CVE-2023-53341of/fdt: run soc memory setup when early_init_dt_scan_memory failsLinux
- CVE-2023-53339btrfs: fix BUG_ON condition in btrfs_cancel_balanceLinux
- CVE-2023-53337nilfs2: do not write dirty data after degenerating to read-onlyLinux
- CVE-2023-53336media: ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warningsLinux
- CVE-2022-50374Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failureLinux
- CVE-2022-50372cifs: Fix memory leak when build ntlmssp negotiate blob failedLinux
- CVE-2022-50371led: qcom-lpg: Fix sleeping in atomicLinux
- CVE-2022-50370i2c: designware: Fix handling of real but unexpected device interruptsLinux
- CVE-2022-50369drm/vkms: Fix null-ptr-deref in vkms_release()Linux
- CVE-2022-50364i2c: mux: reg: check return value after calling platform_get_resource()Linux
- CVE-2022-50361wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init()Linux
- CVE-2022-50360drm/msm/dp: fix aux-bus EP lifetimeLinux
- CVE-2022-50359media: cx88: Fix a null-ptr-deref bug in buffer_prepare()Linux
- CVE-2022-50358brcmfmac: return error when getting invalid max_flowrings from dongleLinux
- CVE-2022-50357usb: dwc3: core: fix some leaks in probeLinux
- CVE-2022-50356net: sched: sfb: fix null pointer access issue when sfb_init() failsLinux
- CVE-2022-50353mmc: wmt-sdmmc: fix return value check of mmc_add_host()Linux
- CVE-2025-10595SourceCodester Online Student File Management System delete_user.php sql injectionSourceCodester Online Student File Management System
- CVE-2025-10594SourceCodester Online Student File Management System delete_student.php sql injectionSourceCodester Online Student File Management System
- CVE-2025-10593SourceCodester Online Student File Management System update_student.php sql injectionSourceCodester Online Student File Management System
- CVE-2025-59476Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified coJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-59475Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-59474Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible tJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-10592itsourcecode Online Public Access Catalog OPAC POST Parameter mysearch.php sql injectionitsourcecode Online Public Access Catalog OPAC
- CVE-2025-8463IDOR in SecHard Information Technologies' SecHardSecHard Information Technologies SecHard
- CVE-2025-0879XSS in Shopside Software's Shopside AppShopside Software Shopside App
- CVE-2025-54467NeuVector process with sensitive arguments lead to leakageSUSE neuvector · github.com/neuvector/neuvector
- CVE-2025-53884NeuVector has an insecure password storage vulnerable to rainbow attackSUSE neuvector · github.com/neuvector/neuvector
- CVE-2025-0546XSS in Mevzuattr Software's MevzuatTRMevzuattr Software MevzuatTR
- CVE-2025-8999Sydney <= 2.56 - Missing Authorization to Authenticated (Subscriber+) Limited Theme Options Updateathemes Sydney
- CVE-2025-10591Portabilis i-Educar Editar Função educar_funcao_cad.php cross site scriptingPortabilis i-Educar
- CVE-2025-10590Portabilis i-Educar educar_usuario_det.php cross site scriptingPortabilis i-Educar
- CVE-2025-0420XSS in Mikrogrup's ParaşütParaşüt Software Paraşüt
- CVE-2025-59456In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive uploadJetBrains TeamCity
- CVE-2025-59455In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race conditionJetBrains TeamCity
- CVE-2025-0419XSS in Mikrogrup's Zirve NovaZirve Information Technologies Zirve Nova
- CVE-2025-9565Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcodecreativethemeshq Blocksy Companion
- CVE-2025-9203Media Player Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fieldsbplugins Media Player Addons for Elementor – Audio and Vide…
- CVE-2025-9215StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Downloadkodezen StoreEngine — Complete eCommerce Solution with Memb…
- CVE-2025-10042Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injectionays-pro Quiz Maker
- CVE-2025-59307RAID Manager provided by Century Corporation registers a Windows service with an unquoted file path.Century RAID Manager
- CVE-2025-10125Memberlite Shortcodes <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingstrangerstudios Memberlite Shortcodes
- CVE-2025-10188The Hack Repair Guy's Plugin Archiver <= 2.0.4 - Cross-Site Request Forgery to Arbitrary Directory Deletion in /wp-contenttvcnet The Hack Repair Guy's Plugin Archiver
- CVE-2025-55075Hidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE.I-O DATA DEVICE WN-7D36QR · I-O DATA DEVICE WN-7D36QR/UE
- CVE-2025-9818Vulnerability caused by unquoted file paths of Windows services registered by the Uninterruptible Power Supply (UPS) management applicationOMRON SOCIAL SOLUTIONS CO. PowerAttendant Standard Editi… +3
- CVE-2025-10584Portabilis i-Educar educar_calendario_anotacao_cad.php cross site scriptingPortabilis i-Educar
- CVE-2025-8153Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.1NEC UNIVERGE IX · NEC UNIVERGE IX-R/IX-V
- CVE-2025-9891User Sync – Remote User Sync <= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivationcyberlord92 User Sync
- CVE-2025-9629USS Upyun <= 1.5.0 - Cross-Site Request Forgeryshenyanzhi USS Upyun
- CVE-2025-10050Developer Loggers for Simple History <= 0.5 - Authenticated (Admin+) Local File Inclusioneskapism Developer Loggers for Simple History
- CVE-2025-9851Appointmind <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptinggentlesource Appointmind
- CVE-2025-8394Productive Style <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_productive_breadcrumb Shortcodeproductiveminds Productive Style – Optimisations & Content…
- CVE-2025-10166Social Media Shortcodes <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingtw2113 Social Media Shortcodes
- CVE-2025-50709An issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a GET parameter
- CVE-2025-54390A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbra
- CVE-2025-55904Open5GS v2.7.5, prior to commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615, is vulnerable to a NULL pointer dereference when a multipart/relat
- CVE-2025-56648npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability.@parcel/reporter-dev-server
- CVE-2025-57055WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality.