CVEs published September 24, 2025
125 CVEs were published on September 24, 2025: 10 critical, 68 high. 2 are now in CISA KEV.
- Published
- 125
- Critical
- 10
- High
- 68
- Medium
- 37
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 34
Most affected products
- Qualcomm Snapdragon
- 23
- Cisco IOS XE Software
- 10
- NVIDIA CUDA Toolkit
- 8
- Google Chrome
- 7
- horilla-opensource horilla
- 5
- Cisco IOS
- 4
- NVIDIA CUDA Toolkit · NVIDIA nvJPEG
- 4
- NVIDIA Megatron-LM
- 4
- Linux
- 3
- Cisco Aironet Access Point Software
- 2
Critical 10
- CVE-2025-10894Nx: nx/devkit: malicious versions of nx and plugins published to npmnx · nx/devkit +10
- CVE-2025-52906TOTOLINK X6000R Command Injection VulnerabilityTOTOLINK X6000R
- CVE-2025-10890Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a crGoogle Chrome
- CVE-2025-27034Improper Validation of Array Index in Multi-Mode Call ProcessorQualcomm Snapdragon
- CVE-2025-21483Improper Restriction of Operations within the Bounds of a Memory Buffer in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2025-9054MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim_settings_ajax_handler'Techspawn MultiLoca - WooCommerce Multi Locations Inventory…
- CVE-2025-41715Missing Authentication for Database Access in Web ApplicationWAGO Device Sphere · WAGO Solution Builder
- CVE-2025-56819An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.
- CVE-2025-57321A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to injmagix-combine-ex
- CVE-2025-57347A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which
High 68
- CVE-2025-54520Improper Protection Against Voltage and Clock Glitches in FPGA devices, could allow an attacker with physical access to undervolt the platfoAMD Kintex™ 7-Series FPGA · AMD Artix™ 7-Series FPGA
- CVE-2025-59833FlagForgeCTF Hint Exposure via APIFlagForgeCTF flagForge
- CVE-2025-59827FlagForgeCTF is Missing Authorization in main-v2FlagForgeCTF flagForge
- CVE-2025-59828Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versionsanthropics claude-code · @anthropic-ai/claude-code
- CVE-2025-59251Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2025-55322OmniParser Remote Code Execution VulnerabilityMicrosoft OmniParser
- CVE-2025-59525Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeoverhorilla-opensource horilla
- CVE-2025-59524Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panelhorilla-opensource horilla
- CVE-2025-52907TOTOLINK X6000R Security Bypass VulnerabilityTOTOLINK X6000R
- CVE-2025-59343tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarballmafintosh tar-fs · tar-fs
- CVE-2025-48869Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Controlhorilla-opensource horilla
- CVE-2025-20311A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unautheCisco IOS XE Software
- CVE-2025-20327A vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to cause a denial of sCisco IOS
- CVE-2025-20312A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attCisco IOS XE Software
- CVE-2025-20352A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the fCisco IOS
- CVE-2025-20160A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticatedCisco IOS
- CVE-2025-20315A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote Cisco IOS XE Software
- CVE-2025-20334A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with rCisco IOS XE Software
- CVE-2025-10892Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2025-10891Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2025-10502Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2025-10501Use after free in WebRTC in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2025-10500Use after free in Dawn in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2025-10585Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2025-47329Release of Invalid Pointer or Reference in Android CoreQualcomm Snapdragon
- CVE-2025-47328Buffer Over-read in WLAN HALQualcomm Snapdragon
- CVE-2025-47327Use After Free in CameraQualcomm Snapdragon
- CVE-2025-47326Buffer Over-read in WLAN HALQualcomm Snapdragon
- CVE-2025-47318Buffer Over-read in BT ControllerQualcomm Snapdragon
- CVE-2025-47317Buffer Over-read in BT ControllerQualcomm Snapdragon
- CVE-2025-47316Double Free in VideoQualcomm Snapdragon
- CVE-2025-47315Use After Free in Automotive Software platform based on QNXQualcomm Snapdragon
- CVE-2025-47314Improper Input Validation in Automotive Software platform based on QNXQualcomm Snapdragon
- CVE-2025-27077Use After Free in Automotive Software platform based on QNXQualcomm Snapdragon
- CVE-2025-27037Use After Free in Camera DriverQualcomm Snapdragon
- CVE-2025-27032Improper Access Control Applied to Mirrored or Aliased Memory Regions in HypervisorQualcomm Snapdragon
- CVE-2025-21488Buffer Over-read in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2025-21487Buffer Over-read in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2025-21484Buffer Over-read in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2025-21482Cryptographic Issues in CoreQualcomm Snapdragon
- CVE-2025-21481Buffer Copy Without Checking Size of Input in HLOSQualcomm Snapdragon
- CVE-2025-21476Buffer Copy Without Checking Size of Input in Computer VisionQualcomm Snapdragon
- CVE-2025-48868Horilla vulnerable to authenticated RCE via eval() in project_bulk_archivehorilla-opensource horilla
- CVE-2025-23354NVIDIA Megatron-LM for all platforms contains a vulnerability in the ensemble_classifer script where malicious data created by an attacker mNVIDIA Megatron-LM
- CVE-2025-23353NVIDIA Megatron-LM for all platforms contains a vulnerability in the msdp preprocessing script where malicious data created by an attacker mNVIDIA Megatron-LM
- CVE-2025-23349NVIDIA Megatron-LM for all platforms contains a vulnerability in the tasks/orqa/unsupervised/nq.py component, where an attacker may cause a NVIDIA Megatron-LM
- CVE-2025-23348NVIDIA Megatron-LM for all platforms contains a vulnerability in the pretrain_gpt script, where malicious data created by an attacker may caNVIDIA Megatron-LM
- CVE-2025-10906Magnetism Studios Endurance NSXPC com.MagnetismStudios.endurance.helper loadModuleNamed:WithReply missing authenticationMagnetism Studios Endurance
- CVE-2025-39889Bluetooth: l2cap: Check encryption key size on incoming connectionLinux
- CVE-2024-58241Bluetooth: hci_core: Disable works on hci_unregister_devLinux
- CVE-2025-48392Apache IoTDB: DoS VulnerabilityApache Software Foundation Apache IoTDB · org.apache.iotdb:…
- CVE-2025-58319File Parsing Memory Corruption in CNCSoft-G2Delta Electronics CNCSoft-G2
- CVE-2025-58317File Parsing Memory Corruption in CNCSoft-G2Delta Electronics CNCSoft-G2
- CVE-2025-56241Aztech DSL5005EN firmware 1.00.AZ_2013-05-10 and possibly other versions allows unauthenticated attackers to change the administrator passwo
- CVE-2025-56815Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transf
- CVE-2025-56816Datart 1.0.0-rc.3 is vulnerable to Directory Traversal.
- CVE-2025-57318A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.procsvjson
- CVE-2025-57319fast-redact is a package that provides do very fast object redaction.
- CVE-2025-57323mpregular is a package that provides a small program development framework based on RegularJS.mpregular
- CVE-2025-57325rollbar is a package designed to effortlessly track and debug errors in JavaScript applications.rollbar
- CVE-2025-57326A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject propertiessassdoc-extras
- CVE-2025-57327spmrc is a package that provides the rc manager for spm.spmrc
- CVE-2025-57328toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objtoggle-array
- CVE-2025-57329web3-core-method is a package designed to creates the methods on the web3 modules.web3-core-method
- CVE-2025-57330The web3-core-subscriptions is a package designed to manages web3 subscriptions.web3-core-subscriptions
- CVE-2025-57349The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollutimessageformat
- CVE-2025-57350The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulneracsvtojson
- CVE-2025-59305Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317 allows any authenticated user to invoke migratio
Medium, low and unrated 47
- CVE-2025-59824Omni Wireguard SideroLink potential escapesiderolabs omni · github.com/siderolabs/omni
- CVE-2025-55178Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could potentially allow for reMeta Platforms Llama Stack · llama-stack
- CVE-2025-20314A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attackeCisco IOS XE Software
- CVE-2025-48867Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Moduleshorilla-opensource horilla
- CVE-2025-20316A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches couCisco IOS XE Software
- CVE-2025-20293A vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) coulCisco IOS XE Software
- CVE-2025-20338A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute aCisco IOS XE Software
- CVE-2025-20240A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflCisco IOS XE Software
- CVE-2025-20149A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affectedCisco IOS
- CVE-2025-20313Multiple vulnerabilities in Cisco IOS XE Software of could allow an authenticated, local attacker with level-15 privileges or an unauthenticCisco IOS XE Software
- CVE-2025-20339Cisco SD-WAN vEdge Software Access Control List Bypass VulnerabilityCisco SD-WAN vEdge Cloud · Cisco SD-WAN vEdge Router
- CVE-2025-20365A vulnerability in the IPv6 Router Advertisement (RA) packet processing of Cisco Access Point Software could allow an unauthenticated, adjacCisco Aironet Access Point Software
- CVE-2025-20364A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated,Cisco Aironet Access Point Software
- CVE-2025-10909Mangati NovoSGA SVG File admin cross site scriptingMangati NovoSGA · novosga/novosga
- CVE-2025-10360Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5Perforce Puppet Enterprise
- CVE-2025-27036Buffer Over-read in VideoQualcomm Snapdragon
- CVE-2025-27033Buffer Over-read in VideoQualcomm Snapdragon
- CVE-2025-27030Buffer Over-read in AudioQualcomm Snapdragon
- CVE-2025-8869Fallback tar extraction in pip doesn't check symbolic links point to extraction directoryPython Packaging Authority pip · pip
- CVE-2025-23346NVIDIA CUDA Toolkit contains a vulnerability in cuobjdump, where an unprivileged user can cause a NULL pointer dereference.NVIDIA CUDA Toolkit
- CVE-2025-23340NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passinNVIDIA CUDA Toolkit
- CVE-2025-23339NVIDIA CUDA Toolkit for all platforms contains a vulnerability in cuobjdump where an attacker may cause a stack-based buffer overflow by getNVIDIA CUDA Toolkit
- CVE-2025-23338NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where a user may cause an out-of-bounds write by running nvdisasmNVIDIA CUDA Toolkit
- CVE-2025-23308NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where an attacker may cause a heap-based buffer overflow by gettiNVIDIA CUDA Toolkit
- CVE-2025-23275NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvJPEG where a local authenticated user may cause a GPU out-of-bounds writNVIDIA CUDA Toolkit · NVIDIA nvJPEG
- CVE-2025-23274NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds read by providing a maliciously crafted inpuNVIDIA CUDA Toolkit · NVIDIA nvJPEG
- CVE-2025-23273NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvJPEG where a local authenticated user may cause a divide by zero error bNVIDIA CUDA Toolkit · NVIDIA nvJPEG
- CVE-2025-23272NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file.NVIDIA CUDA Toolkit · NVIDIA nvJPEG
- CVE-2025-23271NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passinNVIDIA CUDA Toolkit
- CVE-2025-23255NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary where a user may cause an out-of-bounds read by passiNVIDIA CUDA Toolkit
- CVE-2025-23248NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passinNVIDIA CUDA Toolkit
- CVE-2025-9353Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemifyme Themify Builder
- CVE-2025-39890wifi: ath12k: fix memory leak in ath12k_service_ready_ext_eventLinux
- CVE-2025-58457Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore CommandsApache Software Foundation Apache ZooKeeper · org.apache.zo…
- CVE-2025-41716Unauthenticated User Enumeration via Missing AuthenticationWAGO Solution Builder
- CVE-2025-9031Timing-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive WebDivvyDrive Information Technologies DivvyDrive Web
- CVE-2025-48459Apache IoTDB: Deserialization of untrusted DataApache Software Foundation Apache IoTDB · org.apache.iot… +1
- CVE-2025-43819A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4Liferay Portal · Liferay DXP +1
- CVE-2025-43779A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.QLiferay Portal · Liferay DXP
- CVE-2025-57320json-schema-editor-visual is a package that provides jsonschema editor.json-schema-editor-visual
- CVE-2025-57324parse is a package designed to parse JavaScript SDK.parse
- CVE-2025-57348The node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allownode-cube
- CVE-2025-57351A prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation of user-provided kets-fns
- CVE-2025-57352A vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in themin-document
- CVE-2025-57353The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability.@messageformat/runtime
- CVE-2025-57354A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input incounterpart
- CVE-2025-60020nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.NNCP