# CVEs published 2025-09-21

17 CVEs were published on September 21, 2025: 1 critical, 1 high. Days are UTC.

- [CVE-2025-10772](https://cve.now/CVE-2025-10772.md): huggingface LeRobot ZeroMQ Socket lekiwi\_remote.py missing authentication (CVSS 5.3, huggingface LeRobot)
- [CVE-2025-10771](https://cve.now/CVE-2025-10771.md): jeecgboot JimuReport DB2 JDBC testConnection deserialization (CVSS 5.3, jeecgboot JimuReport)
- [CVE-2025-10770](https://cve.now/CVE-2025-10770.md): jeecgboot JimuReport MySQL JDBC testConnection deserialization (CVSS 5.3, jeecgboot JimuReport)
- [CVE-2025-10767](https://cve.now/CVE-2025-10767.md): CosmodiumCS OnlyRAT Configuration File main.py remote\_download os command injection (CVSS 2.0, CosmodiumCS OnlyRAT)
- [CVE-2025-53692](https://cve.now/CVE-2025-53692.md): Sitecore Experience Platform Cross-Site Scripting Vulnerability (CVSS 7.1, Sitecore Experience Manager · Sitecore Experience Platform)
- [CVE-2025-10769](https://cve.now/CVE-2025-10769.md): h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization (CVSS 5.3, h2oai h2o-3)
- [CVE-2025-10768](https://cve.now/CVE-2025-10768.md): h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization (CVSS 5.3, h2oai h2o-3)
- [CVE-2025-6544](https://cve.now/CVE-2025-6544.md): Deserialization Vulnerability in h2oai/h2o-3 (CVSS 9.8, h2oai/h2o-3 · ai.h2o:h2o-core +1)
- [CVE-2025-10766](https://cve.now/CVE-2025-10766.md): SeriaWei ZKEACMS EventViewerController.cs Download path traversal (CVSS 5.3, SeriaWei ZKEACMS)
- [CVE-2025-10765](https://cve.now/CVE-2025-10765.md): SeriaWei ZKEACMS SEOSuggestions ZKEACMS.SEOSuggestions.dll server-side request forgery (CVSS 5.1, SeriaWei ZKEACMS)
- [CVE-2025-10764](https://cve.now/CVE-2025-10764.md): SeriaWei ZKEACMS Event Action System PendingTaskController.cs Edit server-side request forgery (CVSS 5.3, SeriaWei ZKEACMS)
- [CVE-2025-10763](https://cve.now/CVE-2025-10763.md): academico-sis academico Profile Picture edit-photo unrestricted upload (CVSS 5.3, academico-sis academico)
- [CVE-2025-10762](https://cve.now/CVE-2025-10762.md): kuaifan DooTask UsersController.php sql injection (CVSS 5.3, kuaifan DooTask)
- [CVE-2025-10761](https://cve.now/CVE-2025-10761.md): Harness Login Endpoint login excessive authentication (CVSS 6.3, Harness)
- [CVE-2025-10760](https://cve.now/CVE-2025-10760.md): Harness lookup\_repo.go LookupRepo server-side request forgery (CVSS 5.3, Harness)
- [CVE-2025-10759](https://cve.now/CVE-2025-10759.md): Webkul QloApps CSRF Token authorization (CVSS 6.9, Webkul QloApps)
- [CVE-2025-10758](https://cve.now/CVE-2025-10758.md): htmly Custom Field post cross site scripting (CVSS 4.8, htmly)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.