# CVEs published 2025-09-17

218 CVEs were published on September 17, 2025: 18 critical, 66 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-10627](https://cve.now/CVE-2025-10627.md): SourceCodester Online Exam Form Submission delete\_user.php sql injection (CVSS 5.3, SourceCodester Online Exam Form Submission)
- [CVE-2025-10626](https://cve.now/CVE-2025-10626.md): SourceCodester Online Exam Form Submission update\_s3.php sql injection (CVSS 5.3, SourceCodester Online Exam Form Submission)
- [CVE-2025-10625](https://cve.now/CVE-2025-10625.md): SourceCodester Online Exam Form Submission dashboard.php sql injection (CVSS 5.3, SourceCodester Online Exam Form Submission)
- [CVE-2025-10624](https://cve.now/CVE-2025-10624.md): PHPGurukul User Management System login.php sql injection (CVSS 6.9, PHPGurukul User Management System)
- [CVE-2025-10623](https://cve.now/CVE-2025-10623.md): SourceCodester Hotel Reservation System deleteuser.php sql injection (CVSS 6.9, SourceCodester Hotel Reservation System)
- [CVE-2025-23337](https://cve.now/CVE-2025-23337.md): NVIDIA HGX & DGX GB200, GB300, B300 contain a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with ad (CVSS 6.7, NVIDIA HGX GB200, HGX GB300, HGC B300 · NVIDIA DGX GB200, H…)
- [CVE-2025-23268](https://cve.now/CVE-2025-23268.md): NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker may cause an improper input validation issue. (CVSS 8.0, NVIDIA Triton Inference Server)
- [CVE-2025-10621](https://cve.now/CVE-2025-10621.md): SourceCodester Hotel Reservation System editroomimage.php sql injection (CVSS 6.9, SourceCodester Hotel Reservation System)
- [CVE-2025-23336](https://cve.now/CVE-2025-23336.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause a denial of service by loading a (CVSS 4.4, NVIDIA Triton Inference Server)
- [CVE-2025-23329](https://cve.now/CVE-2025-23329.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause memory corruption by identifying (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2025-23328](https://cve.now/CVE-2025-23328.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write through a (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2025-23316](https://cve.now/CVE-2025-23316.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause a remote (CVSS 9.8, NVIDIA Triton Inference Server)
- [CVE-2025-10620](https://cve.now/CVE-2025-10620.md): itsourcecode Online Clinic Management System editp2.php sql injection (CVSS 5.3, itsourcecode Online Clinic Management System)
- [CVE-2025-59415](https://cve.now/CVE-2025-59415.md): Frappe Learning vulnerable to Malicious Content upload via Profile bio field (CVSS 4.6, frappe lms)
- [CVE-2025-10619](https://cve.now/CVE-2025-10619.md): sequa-ai sequa-mcp OAuth Server Discovery node-oauth-client-provider.ts redirectToAuthorization os command injection (CVSS 5.3, sequa-ai sequa-mcp · @sequa-ai/sequa-mcp)
- [CVE-2025-10618](https://cve.now/CVE-2025-10618.md): itsourcecode Online Clinic Management System transact.php sql injection (CVSS 5.3, itsourcecode Online Clinic Management System)
- [CVE-2025-7993](https://cve.now/CVE-2025-7993.md): Ashlar-Vellum Cobalt LI File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-8006](https://cve.now/CVE-2025-8006.md): Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-8002](https://cve.now/CVE-2025-8002.md): Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-8004](https://cve.now/CVE-2025-8004.md): Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-8005](https://cve.now/CVE-2025-8005.md): Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-8001](https://cve.now/CVE-2025-8001.md): Ashlar-Vellum Cobalt CO File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-8003](https://cve.now/CVE-2025-8003.md): Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-7997](https://cve.now/CVE-2025-7997.md): Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-8000](https://cve.now/CVE-2025-8000.md): Ashlar-Vellum Cobalt LI File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-7995](https://cve.now/CVE-2025-7995.md): Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-7996](https://cve.now/CVE-2025-7996.md): Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-7998](https://cve.now/CVE-2025-7998.md): Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-7994](https://cve.now/CVE-2025-7994.md): Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-7999](https://cve.now/CVE-2025-7999.md): Ashlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-7988](https://cve.now/CVE-2025-7988.md): Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Graphite)
- [CVE-2025-7991](https://cve.now/CVE-2025-7991.md): Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-7992](https://cve.now/CVE-2025-7992.md): Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-7987](https://cve.now/CVE-2025-7987.md): Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Graphite)
- [CVE-2025-7989](https://cve.now/CVE-2025-7989.md): Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-7986](https://cve.now/CVE-2025-7986.md): Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Graphite)
- [CVE-2025-7990](https://cve.now/CVE-2025-7990.md): Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-7985](https://cve.now/CVE-2025-7985.md): Ashlar-Vellum Cobalt VC6 File Parsing Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-7984](https://cve.now/CVE-2025-7984.md): Ashlar-Vellum Cobalt AR File Parsing Uninitialized Variable Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-7983](https://cve.now/CVE-2025-7983.md): Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Graphite)
- [CVE-2025-7981](https://cve.now/CVE-2025-7981.md): Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Graphite)
- [CVE-2025-7979](https://cve.now/CVE-2025-7979.md): Ashlar-Vellum Graphite VC6 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Graphite)
- [CVE-2025-7978](https://cve.now/CVE-2025-7978.md): Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Graphite)
- [CVE-2025-7980](https://cve.now/CVE-2025-7980.md): Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Graphite)
- [CVE-2025-7982](https://cve.now/CVE-2025-7982.md): Ashlar-Vellum Cobalt LI File Parsing Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-7977](https://cve.now/CVE-2025-7977.md): Ashlar-Vellum Cobalt LI File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-10644](https://cve.now/CVE-2025-10644.md): Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability (CVSS 9.4, Wondershare Repairit)
- [CVE-2025-10643](https://cve.now/CVE-2025-10643.md): Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability (CVSS 9.1, Wondershare Repairit)
- [CVE-2025-10617](https://cve.now/CVE-2025-10617.md): SourceCodester Online Polling System positions.php sql injection (CVSS 5.3, SourceCodester Online Polling System)
- [CVE-2025-10616](https://cve.now/CVE-2025-10616.md): itsourcecode E-Commerce Website users.php unrestricted upload (CVSS 5.3, itsourcecode E-Commerce Website)
- [CVE-2025-10615](https://cve.now/CVE-2025-10615.md): itsourcecode E-Commerce Website products.php unrestricted upload (CVSS 5.3, itsourcecode E-Commerce Website)
- [CVE-2025-59340](https://cve.now/CVE-2025-59340.md): jinjava Sandbox Bypass via JavaType-Based Deserialization (CVSS 9.8, HubSpot jinjava · com.hubspot.jinjava:jinjava)
- [CVE-2025-59410](https://cve.now/CVE-2025-59410.md): Dragonfly tiny file download uses hard coded HTTP protocol (CVSS 5.5, dragonflyoss dragonfly · github.com/dragonflyoss/dragonf… +1)
- [CVE-2025-59354](https://cve.now/CVE-2025-59354.md): Dragonfly has weak integrity checks for downloaded files (CVSS 5.5, dragonflyoss dragonfly · github.com/dragonflyoss/dragonf… +1)
- [CVE-2025-59353](https://cve.now/CVE-2025-59353.md): Manager generates mTLS certificates for arbitrary IP addresses (CVSS 7.7, dragonflyoss dragonfly · d7y.io/dragonfly/v2 +1)
- [CVE-2025-59352](https://cve.now/CVE-2025-59352.md): Dragonfly allows arbitrary file read and write on a peer machine (CVSS 6.9, dragonflyoss dragonfly · github.com/dragonflyoss/dragonf… +1)
- [CVE-2025-59351](https://cve.now/CVE-2025-59351.md): Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error (CVSS 2.7, dragonflyoss dragonfly · d7y.io/dragonfly/v2 +1)
- [CVE-2025-59350](https://cve.now/CVE-2025-59350.md): Timing attacks against Proxy’s basic authentication are possible (CVSS 2.7, dragonflyoss dragonfly · d7y.io/dragonfly/v2 +1)
- [CVE-2025-59349](https://cve.now/CVE-2025-59349.md): Directories created via os.MkdirAll are not checked for permissions (CVSS 2.0, dragonflyoss dragonfly · github.com/dragonflyoss/dragonf… +1)
- [CVE-2025-10614](https://cve.now/CVE-2025-10614.md): itsourcecode E-Logbook with Health Monitoring System for COVID-19 print\_reports\_prev.php cross site scripting (CVSS 5.3, itsourcecode E-Logbook with Health Monitoring System for CO…)
- [CVE-2025-37122](https://cve.now/CVE-2025-37122.md): Unauthenticated Reflected Cross-Site Scripting (CVSS 6.1, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Clear…)
- [CVE-2025-59348](https://cve.now/CVE-2025-59348.md): Dragonfly incorrectly handles a task structure’s usedTraffic field (CVSS 5.5, dragonflyoss dragonfly · github.com/dragonflyoss/dragonf… +1)
- [CVE-2025-59347](https://cve.now/CVE-2025-59347.md): Dragonfly Manager makes requests to external endpoints with disabled TLS authentication (CVSS 2.7, dragonflyoss dragonfly · d7y.io/dragonfly/v2 +1)
- [CVE-2025-59346](https://cve.now/CVE-2025-59346.md): Dragonfly server-side request forgery vulnerability (CVSS 5.5, dragonflyoss dragonfly · d7y.io/dragonfly/v2 +1)
- [CVE-2025-59345](https://cve.now/CVE-2025-59345.md): Dragonfly did not enable authentication for some Manager’s endpoints (CVSS 7.7, dragonflyoss dragonfly · github.com/dragonflyoss/dragonf… +1)
- [CVE-2025-10613](https://cve.now/CVE-2025-10613.md): itsourcecode Student Information System leveledit1.php sql injection (CVSS 5.3, itsourcecode Student Information System)
- [CVE-2025-59416](https://cve.now/CVE-2025-59416.md): The Scratch Channel forks can publish articles (CVSS 7.2, The-Scratch-Channel tsc-web-client)
- [CVE-2025-59414](https://cve.now/CVE-2025-59414.md): Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival (CVSS 3.1, nuxt)
- [CVE-2025-10608](https://cve.now/CVE-2025-10608.md): Portabilis i-Educar enrollment-history access control (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-10607](https://cve.now/CVE-2025-10607.md): Portabilis i-Educar diarioApi information disclosure (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-10606](https://cve.now/CVE-2025-10606.md): Portabilis i-Educar ConfiguracaoMovimentoGeral cross site scripting (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-59342](https://cve.now/CVE-2025-59342.md): esm.sh writes arbitrary files via path traversal in \`X-Zone-Id\` header (CVSS 5.5, esm-dev esm.sh · github.com/esm-dev/esm.sh)
- [CVE-2025-59341](https://cve.now/CVE-2025-59341.md): Local File Inclusion in esm.sh (CVSS 7.7, esm-dev esm.sh · github.com/esm-dev/esm.sh)
- [CVE-2025-59339](https://cve.now/CVE-2025-59339.md): The Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync script (CVSS 4.4, ovh the-bastion)
- [CVE-2025-58767](https://cve.now/CVE-2025-58767.md): REXML has a DoS condition when parsing malformed XML file (CVSS 1.2, ruby rexml · rexml)
- [CVE-2025-58766](https://cve.now/CVE-2025-58766.md): Dyad Vulnerable to Remote Code Execution via Top-level Navigation in Preview Window (CVSS 9.1, dyad-sh dyad)
- [CVE-2025-10605](https://cve.now/CVE-2025-10605.md): Portabilis i-Educar agenda\_preferencias.php cross site scripting (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-10604](https://cve.now/CVE-2025-10604.md): PHPGurukul Online Discussion Forum edit\_member.php sql injection (CVSS 6.9, PHPGurukul Online Discussion Forum)
- [CVE-2025-58432](https://cve.now/CVE-2025-58432.md): ZimaOS Privilege Escalation using localhost calls to File API Upload (CVSS 5.2, IceWhaleTech ZimaOS)
- [CVE-2025-58431](https://cve.now/CVE-2025-58431.md): ZimaOS reads arbitrary files using localhost calls to File API Download (CVSS 4.8, IceWhaleTech ZimaOS)
- [CVE-2025-10603](https://cve.now/CVE-2025-10603.md): PHPGurukul Online Discussion Forum search\_result.php sql injection (CVSS 6.9, PHPGurukul Online Discussion Forum)
- [CVE-2025-10602](https://cve.now/CVE-2025-10602.md): SourceCodester Online Exam Form Submission delete\_s1.php sql injection (CVSS 5.3, SourceCodester Online Exam Form Submission)
- [CVE-2025-35436](https://cve.now/CVE-2025-35436.md): CISA Thorium account verification email error handling (CVSS 5.3, CISA Thorium)
- [CVE-2025-35435](https://cve.now/CVE-2025-35435.md): CISA Thorium download stream divide by zero (CVSS 4.3, CISA Thorium)
- [CVE-2025-35434](https://cve.now/CVE-2025-35434.md): CISA Thorium does not validate TLS connections to Elasticsearch (CVSS 4.2, CISA Thorium)
- [CVE-2025-35433](https://cve.now/CVE-2025-35433.md): CISA Thorium does not properly invalidate previously used tokens (CVSS 5.0, CISA Thorium)
- [CVE-2025-35432](https://cve.now/CVE-2025-35432.md): CISA Thorium does not rate limit account verification email messages (CVSS 5.3, CISA Thorium)
- [CVE-2025-35431](https://cve.now/CVE-2025-35431.md): CISA Thorium LDAP injection (CVSS 5.4, CISA Thorium)
- [CVE-2025-35430](https://cve.now/CVE-2025-35430.md): CISA Thorium insecure downloaded file path validation (CVSS 5.0, CISA Thorium)
- [CVE-2025-10601](https://cve.now/CVE-2025-10601.md): SourceCodester Online Exam Form Submission index.php sql injection (CVSS 6.9, SourceCodester Online Exam Form Submission)
- [CVE-2025-10600](https://cve.now/CVE-2025-10600.md): SourceCodester Online Exam Form Submission register.php unrestricted upload (CVSS 6.9, SourceCodester Online Exam Form Submission)
- [CVE-2025-10599](https://cve.now/CVE-2025-10599.md): itsourcecode Web-Based Internet Laboratory Management System login.php AuthenticateUser sql injection (CVSS 6.9, itsourcecode Web-Based Internet Laboratory Management System)
- [CVE-2025-10598](https://cve.now/CVE-2025-10598.md): SourceCodester Pet Grooming Management Software search\_product.php sql injection (CVSS 6.9, SourceCodester Pet Grooming Management Software)
- [CVE-2025-10597](https://cve.now/CVE-2025-10597.md): kidaze CourseSelectionSystem COUNT2.php sql injection (CVSS 6.9, kidaze CourseSelectionSystem)
- [CVE-2025-10596](https://cve.now/CVE-2025-10596.md): SourceCodester Online Exam Form Submission index.php sql injection (CVSS 6.9, SourceCodester Online Exam Form Submission)
- [CVE-2025-9862](https://cve.now/CVE-2025-9862.md): Ghost 6.0.6 - SSRF via oEmbed Bookmark (CVSS 6.1, Ghost)
- [CVE-2023-53368](https://cve.now/CVE-2023-53368.md): tracing: Fix race issue between cpu buffer write and swap (CVSS 4.7, Linux)
- [CVE-2023-53367](https://cve.now/CVE-2023-53367.md): accel/habanalabs: fix mem leak in capture user mappings (CVSS 5.5, Linux)
- [CVE-2023-53366](https://cve.now/CVE-2023-53366.md): block: be a bit more careful in checking for NULL bdev while polling (CVSS 5.5, Linux)
- [CVE-2023-53365](https://cve.now/CVE-2023-53365.md): ip6mr: Fix skb\_under\_panic in ip6mr\_cache\_report() (CVSS 5.5, Linux)
- [CVE-2023-53364](https://cve.now/CVE-2023-53364.md): regulator: da9063: better fix null deref with partial DT (CVSS 5.5, Linux)
- [CVE-2023-53363](https://cve.now/CVE-2023-53363.md): PCI: Fix use-after-free in pci\_bus\_release\_domain\_nr() (CVSS 7.8, Linux)
- [CVE-2023-53362](https://cve.now/CVE-2023-53362.md): bus: fsl-mc: don't assume child devices are all fsl-mc devices (CVSS 5.5, Linux)
- [CVE-2023-53361](https://cve.now/CVE-2023-53361.md): LoongArch: mm: Add p?d\_leaf() definitions (CVSS 5.5, Linux)
- [CVE-2023-53360](https://cve.now/CVE-2023-53360.md): NFSv4.2: Rework scratch handling for READ\_PLUS (again) (CVSS 9.8, Linux)
- [CVE-2023-53359](https://cve.now/CVE-2023-53359.md): USB: fix memory leak with using debugfs\_lookup() (CVSS 5.5, Linux)
- [CVE-2023-53358](https://cve.now/CVE-2023-53358.md): ksmbd: fix racy issue under cocurrent smb2 tree disconnect (CVSS 8.8, Linux)
- [CVE-2023-53357](https://cve.now/CVE-2023-53357.md): md/raid10: check slab-out-of-bounds in md\_bitmap\_get\_counter (CVSS 7.1, Linux)
- [CVE-2023-53356](https://cve.now/CVE-2023-53356.md): usb: gadget: u\_serial: Add null pointer check in gserial\_suspend (CVSS 5.5, Linux)
- [CVE-2023-53355](https://cve.now/CVE-2023-53355.md): staging: pi433: fix memory leak with using debugfs\_lookup() (CVSS 5.5, Linux)
- [CVE-2023-53354](https://cve.now/CVE-2023-53354.md): skbuff: skb\_segment, Call zero copy functions before using skbuff frags (CVSS 7.8, Linux)
- [CVE-2023-53353](https://cve.now/CVE-2023-53353.md): accel/habanalabs: postpone mem\_mgr IDR destruction to hpriv\_release() (CVSS 5.5, Linux)
- [CVE-2023-53352](https://cve.now/CVE-2023-53352.md): drm/ttm: check null pointer before accessing when swapping (CVSS 5.5, Linux)
- [CVE-2023-53351](https://cve.now/CVE-2023-53351.md): drm/sched: Check scheduler work queue before calling timeout handling (CVSS 5.5, Linux)
- [CVE-2023-53350](https://cve.now/CVE-2023-53350.md): accel/qaic: Fix slicing memory leak (CVSS 5.5, Linux)
- [CVE-2023-53349](https://cve.now/CVE-2023-53349.md): media: ov2740: Fix memleak in ov2740\_init\_controls() (CVSS 5.5, Linux)
- [CVE-2023-53348](https://cve.now/CVE-2023-53348.md): btrfs: fix deadlock when aborting transaction during relocation with scrub (CVSS 5.5, Linux)
- [CVE-2023-53347](https://cve.now/CVE-2023-53347.md): net/mlx5: Handle pairing of E-switch via uplink un/load APIs (CVSS 5.5, Linux)
- [CVE-2023-53346](https://cve.now/CVE-2023-53346.md): kernel/fail\_function: fix memory leak with using debugfs\_lookup() (CVSS 5.5, Linux)
- [CVE-2023-53345](https://cve.now/CVE-2023-53345.md): rxrpc: Fix potential data race in rxrpc\_wait\_to\_be\_connected() (CVSS 4.7, Linux)
- [CVE-2023-53344](https://cve.now/CVE-2023-53344.md): can: bcm: bcm\_tx\_setup(): fix KMSAN uninit-value in vfs\_write (CVSS 5.5, Linux)
- [CVE-2023-53343](https://cve.now/CVE-2023-53343.md): icmp6: Fix null-ptr-deref of ip6\_null\_entry-\>rt6i\_idev in icmp6\_dev(). (CVSS 5.5, Linux)
- [CVE-2023-53342](https://cve.now/CVE-2023-53342.md): net: marvell: prestera: fix handling IPv4 routes with nhid (CVSS 5.5, Linux)
- [CVE-2023-53341](https://cve.now/CVE-2023-53341.md): of/fdt: run soc memory setup when early\_init\_dt\_scan\_memory fails (CVSS 5.5, Linux)
- [CVE-2023-53340](https://cve.now/CVE-2023-53340.md): net/mlx5: Collect command failures data only for known commands (CVSS 7.8, Linux)
- [CVE-2023-53339](https://cve.now/CVE-2023-53339.md): btrfs: fix BUG\_ON condition in btrfs\_cancel\_balance (no CVSS, Linux)
- [CVE-2023-53338](https://cve.now/CVE-2023-53338.md): lwt: Fix return values of BPF xmit ops (CVSS 9.8, Linux)
- [CVE-2023-53337](https://cve.now/CVE-2023-53337.md): nilfs2: do not write dirty data after degenerating to read-only (CVSS 5.5, Linux)
- [CVE-2023-53336](https://cve.now/CVE-2023-53336.md): media: ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warnings (CVSS 5.5, Linux)
- [CVE-2023-53335](https://cve.now/CVE-2023-53335.md): RDMA/cxgb4: Fix potential null-ptr-deref in pass\_establish() (CVSS 7.5, Linux)
- [CVE-2022-50374](https://cve.now/CVE-2022-50374.md): Bluetooth: hci\_{ldisc,serdev}: check percpu\_init\_rwsem() failure (CVSS 5.5, Linux)
- [CVE-2022-50373](https://cve.now/CVE-2022-50373.md): fs: dlm: fix race in lowcomms (CVSS 9.8, Linux)
- [CVE-2022-50372](https://cve.now/CVE-2022-50372.md): cifs: Fix memory leak when build ntlmssp negotiate blob failed (CVSS 5.5, Linux)
- [CVE-2022-50371](https://cve.now/CVE-2022-50371.md): led: qcom-lpg: Fix sleeping in atomic (CVSS 5.5, Linux)
- [CVE-2022-50370](https://cve.now/CVE-2022-50370.md): i2c: designware: Fix handling of real but unexpected device interrupts (CVSS 5.5, Linux)
- [CVE-2022-50369](https://cve.now/CVE-2022-50369.md): drm/vkms: Fix null-ptr-deref in vkms\_release() (CVSS 5.5, Linux)
- [CVE-2022-50368](https://cve.now/CVE-2022-50368.md): drm/msm/dsi: fix memory corruption with too many bridges (CVSS 7.8, Linux)
- [CVE-2022-50367](https://cve.now/CVE-2022-50367.md): fs: fix UAF/GPF bug in nilfs\_mdt\_destroy (CVSS 7.8, Linux)
- [CVE-2022-50366](https://cve.now/CVE-2022-50366.md): powercap: intel\_rapl: fix UBSAN shift-out-of-bounds issue (CVSS 7.1, Linux)
- [CVE-2022-50365](https://cve.now/CVE-2022-50365.md): skbuff: Account for tail adjustment during pull operations (CVSS 7.5, Linux)
- [CVE-2022-50364](https://cve.now/CVE-2022-50364.md): i2c: mux: reg: check return value after calling platform\_get\_resource() (CVSS 5.5, Linux)
- [CVE-2022-50363](https://cve.now/CVE-2022-50363.md): skmsg: pass gfp argument to alloc\_sk\_msg() (CVSS 9.8, Linux)
- [CVE-2022-50362](https://cve.now/CVE-2022-50362.md): dmaengine: hisilicon: Add multi-thread support for a DMA channel (CVSS 7.8, Linux)
- [CVE-2022-50361](https://cve.now/CVE-2022-50361.md): wifi: wilc1000: add missing unregister\_netdev() in wilc\_netdev\_ifc\_init() (CVSS 5.5, Linux)
- [CVE-2022-50360](https://cve.now/CVE-2022-50360.md): drm/msm/dp: fix aux-bus EP lifetime (CVSS 5.5, Linux)
- [CVE-2022-50359](https://cve.now/CVE-2022-50359.md): media: cx88: Fix a null-ptr-deref bug in buffer\_prepare() (CVSS 5.5, Linux)
- [CVE-2022-50358](https://cve.now/CVE-2022-50358.md): brcmfmac: return error when getting invalid max\_flowrings from dongle (CVSS 4.2, Linux)
- [CVE-2022-50357](https://cve.now/CVE-2022-50357.md): usb: dwc3: core: fix some leaks in probe (CVSS 5.5, Linux)
- [CVE-2022-50356](https://cve.now/CVE-2022-50356.md): net: sched: sfb: fix null pointer access issue when sfb\_init() fails (CVSS 5.5, Linux)
- [CVE-2022-50355](https://cve.now/CVE-2022-50355.md): staging: vt6655: fix some erroneous memory clean-up loops (CVSS 7.8, Linux)
- [CVE-2022-50354](https://cve.now/CVE-2022-50354.md): drm/amdkfd: Fix kfd\_process\_device\_init\_vm error handling (CVSS 7.8, Linux)
- [CVE-2022-50353](https://cve.now/CVE-2022-50353.md): mmc: wmt-sdmmc: fix return value check of mmc\_add\_host() (CVSS 5.5, Linux)
- [CVE-2025-10205](https://cve.now/CVE-2025-10205.md): Predictable Salt and Weak Hashing Algorithm (CVSS 8.7, ABB FLXEON)
- [CVE-2024-48842](https://cve.now/CVE-2024-48842.md): Hardcoded passwords (CVSS 7.3, ABB FLXEON)
- [CVE-2025-10595](https://cve.now/CVE-2025-10595.md): SourceCodester Online Student File Management System delete\_user.php sql injection (CVSS 5.3, SourceCodester Online Student File Management System)
- [CVE-2025-40933](https://cve.now/CVE-2025-40933.md): Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely (CVSS 7.5, KGOLDOV Apache::AuthAny)
- [CVE-2025-10594](https://cve.now/CVE-2025-10594.md): SourceCodester Online Student File Management System delete\_student.php sql injection (CVSS 5.3, SourceCodester Online Student File Management System)
- [CVE-2025-10593](https://cve.now/CVE-2025-10593.md): SourceCodester Online Student File Management System update\_student.php sql injection (CVSS 5.3, SourceCodester Online Student File Management System)
- [CVE-2025-59476](https://cve.now/CVE-2025-59476.md): Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified co (CVSS 5.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-59475](https://cve.now/CVE-2025-59475.md): Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, all (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-59474](https://cve.now/CVE-2025-59474.md): Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible t (CVSS 5.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-10592](https://cve.now/CVE-2025-10592.md): itsourcecode Online Public Access Catalog OPAC POST Parameter mysearch.php sql injection (CVSS 5.3, itsourcecode Online Public Access Catalog OPAC)
- [CVE-2025-8463](https://cve.now/CVE-2025-8463.md): IDOR in SecHard Information Technologies' SecHard (CVSS 5.3, SecHard Information Technologies SecHard)
- [CVE-2025-8077](https://cve.now/CVE-2025-8077.md): NeuVector admin account has insecure default password (CVSS 9.8, SUSE neuvector · github.com/neuvector/neuvector)
- [CVE-2025-0879](https://cve.now/CVE-2025-0879.md): XSS in Shopside Software's Shopside App (CVSS 4.7, Shopside Software Shopside App)
- [CVE-2025-54467](https://cve.now/CVE-2025-54467.md): NeuVector process with sensitive arguments lead to leakage (CVSS 5.3, SUSE neuvector · github.com/neuvector/neuvector)
- [CVE-2025-53884](https://cve.now/CVE-2025-53884.md): NeuVector has an insecure password storage vulnerable to rainbow attack (CVSS 5.3, SUSE neuvector · github.com/neuvector/neuvector)
- [CVE-2025-10439](https://cve.now/CVE-2025-10439.md): SQLi in Yordam Library Automation System (CVSS 9.8, Yordam Informatics Yordam Library Automation System)
- [CVE-2025-0546](https://cve.now/CVE-2025-0546.md): XSS in Mevzuattr Software's MevzuatTR (CVSS 4.7, Mevzuattr Software MevzuatTR)
- [CVE-2025-10157](https://cve.now/CVE-2025-10157.md): PickleScan Bypasses Unsafe Globals Check Using Submodule Imports (CVSS 9.3, mmaitre314 picklescan · picklescan)
- [CVE-2025-8999](https://cve.now/CVE-2025-8999.md): Sydney \<= 2.56 - Missing Authorization to Authenticated (Subscriber+) Limited Theme Options Update (CVSS 5.3, athemes Sydney)
- [CVE-2025-8411](https://cve.now/CVE-2025-8411.md): XSS in Dokuzsoft Technology's E-Commerce Web Design Product (CVSS 7.1, Dokuzsoft Technology E-Commerce Web Design Product)
- [CVE-2025-10591](https://cve.now/CVE-2025-10591.md): Portabilis i-Educar Editar Função educar\_funcao\_cad.php cross site scripting (CVSS 5.1, Portabilis i-Educar)
- [CVE-2025-10590](https://cve.now/CVE-2025-10590.md): Portabilis i-Educar educar\_usuario\_det.php cross site scripting (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-10156](https://cve.now/CVE-2025-10156.md): PickleScan Security Bypass via Bad CRC in ZIP Archive (CVSS 9.3, mmaitre314 picklescan · picklescan)
- [CVE-2025-10155](https://cve.now/CVE-2025-10155.md): PickleScan Security Bypass Using Misleading File Extension (CVSS 9.3, mmaitre314 picklescan · picklescan)
- [CVE-2025-0420](https://cve.now/CVE-2025-0420.md): XSS in Mikrogrup's Paraşüt (CVSS 4.7, Paraşüt Software Paraşüt)
- [CVE-2025-59458](https://cve.now/CVE-2025-59458.md): In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.28 (CVSS 8.3, JetBrains Junie)
- [CVE-2025-59457](https://cve.now/CVE-2025-59457.md): In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows (CVSS 7.7, JetBrains TeamCity)
- [CVE-2025-59456](https://cve.now/CVE-2025-59456.md): In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload (CVSS 5.5, JetBrains TeamCity)
- [CVE-2025-59455](https://cve.now/CVE-2025-59455.md): In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition (CVSS 4.2, JetBrains TeamCity)
- [CVE-2025-0419](https://cve.now/CVE-2025-0419.md): XSS in Mikrogrup's Zirve Nova (CVSS 4.7, Zirve Information Technologies Zirve Nova)
- [CVE-2025-9242](https://cve.now/CVE-2025-9242.md): WatchGuard Firebox iked Out of Bounds Write Vulnerability (CVSS 9.3, KEV, WatchGuard Fireware OS)
- [CVE-2025-9972](https://cve.now/CVE-2025-9972.md): Planet Technology｜Industrial Cellular Gateway - OS Command Injection (CVSS 9.3, Planet Technology ICG-2510WG-LTE · Planet Technology ICG-25…)
- [CVE-2025-9971](https://cve.now/CVE-2025-9971.md): Planet Technology｜Industrial Cellular Gateway - Missing Authentication (CVSS 9.3, Planet Technology ICG-2510WG-LTE · Planet Technology ICG-25…)
- [CVE-2025-9565](https://cve.now/CVE-2025-9565.md): Blocksy Companion \<= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy\_newsletter\_subscribe Shortcode (CVSS 6.4, creativethemeshq Blocksy Companion)
- [CVE-2025-9216](https://cve.now/CVE-2025-9216.md): StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More \<= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, kodezen StoreEngine — Complete eCommerce Solution with Memb…)
- [CVE-2025-9203](https://cve.now/CVE-2025-9203.md): Media Player Addons for Elementor \<= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields (CVSS 6.4, bplugins Media Player Addons for Elementor – Audio and Vide…)
- [CVE-2025-9215](https://cve.now/CVE-2025-9215.md): StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More \<= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download (CVSS 6.5, kodezen StoreEngine — Complete eCommerce Solution with Memb…)
- [CVE-2025-9450](https://cve.now/CVE-2025-9450.md): Use of Uninitialized Variable vulnerability affecting the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 (CVSS 7.8, Dassault Systèmes SOLIDWORKS eDrawings)
- [CVE-2025-9449](https://cve.now/CVE-2025-9449.md): Use After Free vulnerability affecting the PAR file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 (CVSS 7.8, Dassault Systèmes SOLIDWORKS eDrawings)
- [CVE-2025-9447](https://cve.now/CVE-2025-9447.md): Out-Of-Bounds Read affecting the PAR file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 (CVSS 7.8, Dassault Systèmes SOLIDWORKS eDrawings)
- [CVE-2025-10057](https://cve.now/CVE-2025-10057.md): WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection (CVSS 8.8, smackcoders WP Import – Ultimate CSV XML Importer for WordP…)
- [CVE-2025-10058](https://cve.now/CVE-2025-10058.md): WP Import – Ultimate CSV XML Importer for WordPress \<= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1, smackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…)
- [CVE-2025-10042](https://cve.now/CVE-2025-10042.md): Quiz Maker \<= 6.7.0.56 - Unauthenticated SQL Injection (CVSS 5.9, ays-pro Quiz Maker)
- [CVE-2025-59307](https://cve.now/CVE-2025-59307.md): RAID Manager provided by Century Corporation registers a Windows service with an unquoted file path. (CVSS 6.7, Century RAID Manager)
- [CVE-2025-10125](https://cve.now/CVE-2025-10125.md): Memberlite Shortcodes \<= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, strangerstudios Memberlite Shortcodes)
- [CVE-2025-10188](https://cve.now/CVE-2025-10188.md): The Hack Repair Guy's Plugin Archiver \<= 2.0.4 - Cross-Site Request Forgery to Arbitrary Directory Deletion in /wp-content (CVSS 5.4, tvcnet The Hack Repair Guy's Plugin Archiver)
- [CVE-2025-10589](https://cve.now/CVE-2025-10589.md): N-Partner｜N-Reporter, N-Cloud, N-Probe - OS Command Injection (CVSS 8.7, N-Partner N-Reporter · N-Partner N-Cloud +1)
- [CVE-2025-58116](https://cve.now/CVE-2025-58116.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in WN-7D36QR and WN-7D36QR/UE. (CVSS 7.2, I-O DATA DEVICE WN-7D36QR · I-O DATA DEVICE WN-7D36QR/UE)
- [CVE-2025-55075](https://cve.now/CVE-2025-55075.md): Hidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. (CVSS 4.9, I-O DATA DEVICE WN-7D36QR · I-O DATA DEVICE WN-7D36QR/UE)
- [CVE-2025-9818](https://cve.now/CVE-2025-9818.md): Vulnerability caused by unquoted file paths of Windows services registered by the Uninterruptible Power Supply (UPS) management application (CVSS 6.7, OMRON SOCIAL SOLUTIONS CO. PowerAttendant Standard Editi… +3)
- [CVE-2025-10584](https://cve.now/CVE-2025-10584.md): Portabilis i-Educar educar\_calendario\_anotacao\_cad.php cross site scripting (CVSS 5.1, Portabilis i-Educar)
- [CVE-2025-8153](https://cve.now/CVE-2025-8153.md): Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.1 (CVSS 5.1, NEC UNIVERGE IX · NEC UNIVERGE IX-R/IX-V)
- [CVE-2025-9891](https://cve.now/CVE-2025-9891.md): User Sync – Remote User Sync \<= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation (CVSS 4.3, cyberlord92 User Sync)
- [CVE-2025-9629](https://cve.now/CVE-2025-9629.md): USS Upyun \<= 1.5.0 - Cross-Site Request Forgery (CVSS 4.3, shenyanzhi USS Upyun)
- [CVE-2025-10050](https://cve.now/CVE-2025-10050.md): Developer Loggers for Simple History \<= 0.5 - Authenticated (Admin+) Local File Inclusion (CVSS 6.6, eskapism Developer Loggers for Simple History)
- [CVE-2025-9851](https://cve.now/CVE-2025-9851.md): Appointmind \<= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, gentlesource Appointmind)
- [CVE-2025-10143](https://cve.now/CVE-2025-10143.md): Catch Dark Mode \<= 2.0 - Authenticated (Contributor+) Local File Inclusion (CVSS 7.5, catchthemes Catch Dark Mode)
- [CVE-2025-8394](https://cve.now/CVE-2025-8394.md): Productive Style \<= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via display\_productive\_breadcrumb Shortcode (CVSS 6.4, productiveminds Productive Style – Optimisations & Content…)
- [CVE-2025-10166](https://cve.now/CVE-2025-10166.md): Social Media Shortcodes \<= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, tw2113 Social Media Shortcodes)
- [CVE-2025-50709](https://cve.now/CVE-2025-50709.md): An issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a GET parameter (CVSS 4.3)
- [CVE-2025-54390](https://cve.now/CVE-2025-54390.md): A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbra (CVSS 6.3)
- [CVE-2025-55904](https://cve.now/CVE-2025-55904.md): Open5GS v2.7.5, prior to commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615, is vulnerable to a NULL pointer dereference when a multipart/relat (CVSS 4.0)
- [CVE-2025-56648](https://cve.now/CVE-2025-56648.md): npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. (CVSS 6.5, @parcel/reporter-dev-server)
- [CVE-2025-57055](https://cve.now/CVE-2025-57055.md): WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. (CVSS 6.5)
- [CVE-2025-59304](https://cve.now/CVE-2025-59304.md): A directory traversal issue in Swetrix Web Analytics API 3.1.1 before 7d8b972 allows a remote attacker to achieve Remote Code Execution via (CVSS 9.8)
- [CVE-2025-59518](https://cve.now/CVE-2025-59518.md): In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. (CVSS 8.0, lemonldap-ng LemonLDAP::NG)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.