CVEs published September 21, 2025
17 CVEs were published on September 21, 2025: 1 critical, 1 high.
- Published
- 17
- Critical
- 1
- High
- 1
- Medium
- 14
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- SeriaWei ZKEACMS
- 3
- h2oai h2o-3
- 2
- Harness
- 2
- jeecgboot JimuReport
- 2
- academico-sis academico
- 1
- CosmodiumCS OnlyRAT
- 1
- h2oai/h2o-3 · ai.h2o:h2o-core +1
- 1
- htmly
- 1
- huggingface LeRobot
- 1
- kuaifan DooTask
- 1
Critical 1
High 1
Medium, low and unrated 15
- CVE-2025-10772huggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authenticationhuggingface LeRobot
- CVE-2025-10771jeecgboot JimuReport DB2 JDBC testConnection deserializationjeecgboot JimuReport
- CVE-2025-10770jeecgboot JimuReport MySQL JDBC testConnection deserializationjeecgboot JimuReport
- CVE-2025-10767CosmodiumCS OnlyRAT Configuration File main.py remote_download os command injectionCosmodiumCS OnlyRAT
- CVE-2025-10769h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserializationh2oai h2o-3
- CVE-2025-10768h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserializationh2oai h2o-3
- CVE-2025-10766SeriaWei ZKEACMS EventViewerController.cs Download path traversalSeriaWei ZKEACMS
- CVE-2025-10765SeriaWei ZKEACMS SEOSuggestions ZKEACMS.SEOSuggestions.dll server-side request forgerySeriaWei ZKEACMS
- CVE-2025-10764SeriaWei ZKEACMS Event Action System PendingTaskController.cs Edit server-side request forgerySeriaWei ZKEACMS
- CVE-2025-10763academico-sis academico Profile Picture edit-photo unrestricted uploadacademico-sis academico
- CVE-2025-10762kuaifan DooTask UsersController.php sql injectionkuaifan DooTask
- CVE-2025-10761Harness Login Endpoint login excessive authenticationHarness
- CVE-2025-10760Harness lookup_repo.go LookupRepo server-side request forgeryHarness
- CVE-2025-10759Webkul QloApps CSRF Token authorizationWebkul QloApps
- CVE-2025-10758htmly Custom Field post cross site scriptinghtmly