# CVEs published 2025-09-24

125 CVEs were published on September 24, 2025: 10 critical, 68 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2025-54520](https://cve.now/CVE-2025-54520.md): Improper Protection Against Voltage and Clock Glitches in FPGA devices, could allow an attacker with physical access to undervolt the platfo (CVSS 8.6, AMD Kintex™ 7-Series FPGA · AMD Artix™ 7-Series FPGA)
- [CVE-2025-10894](https://cve.now/CVE-2025-10894.md): Nx: nx/devkit: malicious versions of nx and plugins published to npm (CVSS 9.6, nx · nx/devkit +10)
- [CVE-2025-59833](https://cve.now/CVE-2025-59833.md): FlagForgeCTF Hint Exposure via API (CVSS 7.5, FlagForgeCTF flagForge)
- [CVE-2025-59827](https://cve.now/CVE-2025-59827.md): FlagForgeCTF is Missing Authorization in main-v2 (CVSS 8.2, FlagForgeCTF flagForge)
- [CVE-2025-59824](https://cve.now/CVE-2025-59824.md): Omni Wireguard SideroLink potential escape (CVSS 0.5, siderolabs omni · github.com/siderolabs/omni)
- [CVE-2025-59828](https://cve.now/CVE-2025-59828.md): Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions (CVSS 7.7, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2025-59251](https://cve.now/CVE-2025-59251.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.6, Microsoft Edge)
- [CVE-2025-55322](https://cve.now/CVE-2025-55322.md): OmniParser Remote Code Execution Vulnerability (CVSS 7.3, Microsoft OmniParser)
- [CVE-2025-55178](https://cve.now/CVE-2025-55178.md): Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve\_ast\_by\_type function which could potentially allow for re (CVSS 5.3, Meta Platforms Llama Stack · llama-stack)
- [CVE-2025-59525](https://cve.now/CVE-2025-59525.md): Horilla has Improper Input Sanitization Leading to XSS and Admin Account Takeover (CVSS 7.7, horilla-opensource horilla)
- [CVE-2025-59524](https://cve.now/CVE-2025-59524.md): Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel (CVSS 7.7, horilla-opensource horilla)
- [CVE-2025-52907](https://cve.now/CVE-2025-52907.md): TOTOLINK X6000R Security Bypass Vulnerability (CVSS 7.3, TOTOLINK X6000R)
- [CVE-2025-20314](https://cve.now/CVE-2025-20314.md): A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacke (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2025-52906](https://cve.now/CVE-2025-52906.md): TOTOLINK X6000R Command Injection Vulnerability (CVSS 9.3, TOTOLINK X6000R)
- [CVE-2025-59343](https://cve.now/CVE-2025-59343.md): tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball (CVSS 8.7, mafintosh tar-fs · tar-fs)
- [CVE-2025-48867](https://cve.now/CVE-2025-48867.md): Horilla Stored Cross-Site Scripting (XSS) Vulnerability in Project and Task Modules (CVSS 4.8, horilla-opensource horilla)
- [CVE-2025-48869](https://cve.now/CVE-2025-48869.md): Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control (CVSS 7.5, horilla-opensource horilla)
- [CVE-2025-20316](https://cve.now/CVE-2025-20316.md): A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches cou (CVSS 5.3, Cisco IOS XE Software)
- [CVE-2025-20293](https://cve.now/CVE-2025-20293.md): A vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) coul (CVSS 5.3, Cisco IOS XE Software)
- [CVE-2025-20338](https://cve.now/CVE-2025-20338.md): A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute a (CVSS 6.0, Cisco IOS XE Software)
- [CVE-2025-20240](https://cve.now/CVE-2025-20240.md): A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a refl (CVSS 6.1, Cisco IOS XE Software)
- [CVE-2025-20149](https://cve.now/CVE-2025-20149.md): A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected (CVSS 6.5, Cisco IOS)
- [CVE-2025-20313](https://cve.now/CVE-2025-20313.md): Multiple vulnerabilities in Cisco IOS XE Software of could allow an authenticated, local attacker with level-15 privileges or an unauthentic (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2025-20311](https://cve.now/CVE-2025-20311.md): A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthe (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2025-20327](https://cve.now/CVE-2025-20327.md): A vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to cause a denial of s (CVSS 7.7, Cisco IOS)
- [CVE-2025-20312](https://cve.now/CVE-2025-20312.md): A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote att (CVSS 7.7, Cisco IOS XE Software)
- [CVE-2025-20352](https://cve.now/CVE-2025-20352.md): A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the f (CVSS 7.7, KEV, Cisco IOS)
- [CVE-2025-20160](https://cve.now/CVE-2025-20160.md): A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated (CVSS 8.1, Cisco IOS)
- [CVE-2025-20315](https://cve.now/CVE-2025-20315.md): A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2025-20334](https://cve.now/CVE-2025-20334.md): A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with r (CVSS 8.8, Cisco IOS XE Software)
- [CVE-2025-20339](https://cve.now/CVE-2025-20339.md): Cisco SD-WAN vEdge Software Access Control List Bypass Vulnerability (CVSS 5.8, Cisco SD-WAN vEdge Cloud · Cisco SD-WAN vEdge Router)
- [CVE-2025-20365](https://cve.now/CVE-2025-20365.md): A vulnerability in the IPv6 Router Advertisement (RA) packet processing of Cisco Access Point Software could allow an unauthenticated, adjac (CVSS 4.3, Cisco Aironet Access Point Software)
- [CVE-2025-20364](https://cve.now/CVE-2025-20364.md): A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, (CVSS 4.3, Cisco Aironet Access Point Software)
- [CVE-2025-10909](https://cve.now/CVE-2025-10909.md): Mangati NovoSGA SVG File admin cross site scripting (CVSS 4.8, Mangati NovoSGA · novosga/novosga)
- [CVE-2025-10892](https://cve.now/CVE-2025-10892.md): Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, Google Chrome)
- [CVE-2025-10891](https://cve.now/CVE-2025-10891.md): Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, Google Chrome)
- [CVE-2025-10890](https://cve.now/CVE-2025-10890.md): Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a cr (CVSS 9.1, Google Chrome)
- [CVE-2025-10502](https://cve.now/CVE-2025-10502.md): Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2025-10501](https://cve.now/CVE-2025-10501.md): Use after free in WebRTC in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2025-10500](https://cve.now/CVE-2025-10500.md): Use after free in Dawn in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, Google Chrome)
- [CVE-2025-10585](https://cve.now/CVE-2025-10585.md): Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, KEV, Google Chrome)
- [CVE-2025-10360](https://cve.now/CVE-2025-10360.md): Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5 (CVSS 6.9, Perforce Puppet Enterprise)
- [CVE-2025-47329](https://cve.now/CVE-2025-47329.md): Release of Invalid Pointer or Reference in Android Core (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-47328](https://cve.now/CVE-2025-47328.md): Buffer Over-read in WLAN HAL (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-47327](https://cve.now/CVE-2025-47327.md): Use After Free in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-47326](https://cve.now/CVE-2025-47326.md): Buffer Over-read in WLAN HAL (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-47318](https://cve.now/CVE-2025-47318.md): Buffer Over-read in BT Controller (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-47317](https://cve.now/CVE-2025-47317.md): Buffer Over-read in BT Controller (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-47316](https://cve.now/CVE-2025-47316.md): Double Free in Video (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-47315](https://cve.now/CVE-2025-47315.md): Use After Free in Automotive Software platform based on QNX (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-47314](https://cve.now/CVE-2025-47314.md): Improper Input Validation in Automotive Software platform based on QNX (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27077](https://cve.now/CVE-2025-27077.md): Use After Free in Automotive Software platform based on QNX (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27037](https://cve.now/CVE-2025-27037.md): Use After Free in Camera Driver (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27036](https://cve.now/CVE-2025-27036.md): Buffer Over-read in Video (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2025-27034](https://cve.now/CVE-2025-27034.md): Improper Validation of Array Index in Multi-Mode Call Processor (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2025-27033](https://cve.now/CVE-2025-27033.md): Buffer Over-read in Video (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2025-27032](https://cve.now/CVE-2025-27032.md): Improper Access Control Applied to Mirrored or Aliased Memory Regions in Hypervisor (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27030](https://cve.now/CVE-2025-27030.md): Buffer Over-read in Audio (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2025-21488](https://cve.now/CVE-2025-21488.md): Buffer Over-read in Data Network Stack & Connectivity (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2025-21487](https://cve.now/CVE-2025-21487.md): Buffer Over-read in Data Network Stack & Connectivity (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2025-21484](https://cve.now/CVE-2025-21484.md): Buffer Over-read in Data Network Stack & Connectivity (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2025-21483](https://cve.now/CVE-2025-21483.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in Data Network Stack & Connectivity (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2025-21482](https://cve.now/CVE-2025-21482.md): Cryptographic Issues in Core (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2025-21481](https://cve.now/CVE-2025-21481.md): Buffer Copy Without Checking Size of Input in HLOS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21476](https://cve.now/CVE-2025-21476.md): Buffer Copy Without Checking Size of Input in Computer Vision (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-8869](https://cve.now/CVE-2025-8869.md): Fallback tar extraction in pip doesn't check symbolic links point to extraction directory (CVSS 5.9, Python Packaging Authority pip · pip)
- [CVE-2025-48868](https://cve.now/CVE-2025-48868.md): Horilla vulnerable to authenticated RCE via eval() in project\_bulk\_archive (CVSS 7.2, horilla-opensource horilla)
- [CVE-2025-23354](https://cve.now/CVE-2025-23354.md): NVIDIA Megatron-LM for all platforms contains a vulnerability in the ensemble\_classifer script where malicious data created by an attacker m (CVSS 7.8, NVIDIA Megatron-LM)
- [CVE-2025-23353](https://cve.now/CVE-2025-23353.md): NVIDIA Megatron-LM for all platforms contains a vulnerability in the msdp preprocessing script where malicious data created by an attacker m (CVSS 7.8, NVIDIA Megatron-LM)
- [CVE-2025-23349](https://cve.now/CVE-2025-23349.md): NVIDIA Megatron-LM for all platforms contains a vulnerability in the tasks/orqa/unsupervised/nq.py component, where an attacker may cause a (CVSS 7.8, NVIDIA Megatron-LM)
- [CVE-2025-23348](https://cve.now/CVE-2025-23348.md): NVIDIA Megatron-LM for all platforms contains a vulnerability in the pretrain\_gpt script, where malicious data created by an attacker may ca (CVSS 7.8, NVIDIA Megatron-LM)
- [CVE-2025-23346](https://cve.now/CVE-2025-23346.md): NVIDIA CUDA Toolkit contains a vulnerability in cuobjdump, where an unprivileged user can cause a NULL pointer dereference. (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2025-23340](https://cve.now/CVE-2025-23340.md): NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passin (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2025-23339](https://cve.now/CVE-2025-23339.md): NVIDIA CUDA Toolkit for all platforms contains a vulnerability in cuobjdump where an attacker may cause a stack-based buffer overflow by get (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2025-23338](https://cve.now/CVE-2025-23338.md): NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where a user may cause an out-of-bounds write by running nvdisasm (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2025-23308](https://cve.now/CVE-2025-23308.md): NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where an attacker may cause a heap-based buffer overflow by getti (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2025-23275](https://cve.now/CVE-2025-23275.md): NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvJPEG where a local authenticated user may cause a GPU out-of-bounds writ (CVSS 4.2, NVIDIA CUDA Toolkit · NVIDIA nvJPEG)
- [CVE-2025-23274](https://cve.now/CVE-2025-23274.md): NVIDIA nvJPEG contains a vulnerability in jpeg encoding where a user may cause an out-of-bounds read by providing a maliciously crafted inpu (CVSS 4.5, NVIDIA CUDA Toolkit · NVIDIA nvJPEG)
- [CVE-2025-23273](https://cve.now/CVE-2025-23273.md): NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvJPEG where a local authenticated user may cause a divide by zero error b (CVSS 2.5, NVIDIA CUDA Toolkit · NVIDIA nvJPEG)
- [CVE-2025-23272](https://cve.now/CVE-2025-23272.md): NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. (CVSS 5.7, NVIDIA CUDA Toolkit · NVIDIA nvJPEG)
- [CVE-2025-23271](https://cve.now/CVE-2025-23271.md): NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passin (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2025-23255](https://cve.now/CVE-2025-23255.md): NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary where a user may cause an out-of-bounds read by passi (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2025-23248](https://cve.now/CVE-2025-23248.md): NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passin (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2025-10906](https://cve.now/CVE-2025-10906.md): Magnetism Studios Endurance NSXPC com.MagnetismStudios.endurance.helper loadModuleNamed:WithReply missing authentication (CVSS 8.6, Magnetism Studios Endurance)
- [CVE-2025-9353](https://cve.now/CVE-2025-9353.md): Themify Builder \<= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, themifyme Themify Builder)
- [CVE-2025-9054](https://cve.now/CVE-2025-9054.md): MultiLoca - WooCommerce Multi Locations Inventory Management \<= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim\_settings\_ajax\_handler' (CVSS 9.8, Techspawn MultiLoca - WooCommerce Multi Locations Inventory…)
- [CVE-2025-39890](https://cve.now/CVE-2025-39890.md): wifi: ath12k: fix memory leak in ath12k\_service\_ready\_ext\_event (CVSS 5.5, Linux)
- [CVE-2025-39889](https://cve.now/CVE-2025-39889.md): Bluetooth: l2cap: Check encryption key size on incoming connection (CVSS 8.1, Linux)
- [CVE-2024-58241](https://cve.now/CVE-2024-58241.md): Bluetooth: hci\_core: Disable works on hci\_unregister\_dev (CVSS 7.8, Linux)
- [CVE-2025-58457](https://cve.now/CVE-2025-58457.md): Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands (CVSS 4.3, Apache Software Foundation Apache ZooKeeper · org.apache.zo…)
- [CVE-2025-41716](https://cve.now/CVE-2025-41716.md): Unauthenticated User Enumeration via Missing Authentication (CVSS 5.3, WAGO Solution Builder)
- [CVE-2025-41715](https://cve.now/CVE-2025-41715.md): Missing Authentication for Database Access in Web Application (CVSS 9.8, WAGO Device Sphere · WAGO Solution Builder)
- [CVE-2025-9031](https://cve.now/CVE-2025-9031.md): Timing-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive Web (CVSS 4.3, DivvyDrive Information Technologies DivvyDrive Web)
- [CVE-2025-48392](https://cve.now/CVE-2025-48392.md): Apache IoTDB: DoS Vulnerability (CVSS 7.5, Apache Software Foundation Apache IoTDB · org.apache.iotdb:…)
- [CVE-2025-48459](https://cve.now/CVE-2025-48459.md): Apache IoTDB: Deserialization of untrusted Data (CVSS 5.3, Apache Software Foundation Apache IoTDB · org.apache.iot… +1)
- [CVE-2025-58319](https://cve.now/CVE-2025-58319.md): File Parsing Memory Corruption in CNCSoft-G2 (CVSS 7.8, Delta Electronics CNCSoft-G2)
- [CVE-2025-58317](https://cve.now/CVE-2025-58317.md): File Parsing Memory Corruption in CNCSoft-G2 (CVSS 7.8, Delta Electronics CNCSoft-G2)
- [CVE-2025-43819](https://cve.now/CVE-2025-43819.md): A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4 (CVSS 5.3, Liferay Portal · Liferay DXP +1)
- [CVE-2025-43779](https://cve.now/CVE-2025-43779.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q (CVSS 6.9, Liferay Portal · Liferay DXP)
- [CVE-2025-56241](https://cve.now/CVE-2025-56241.md): Aztech DSL5005EN firmware 1.00.AZ\_2013-05-10 and possibly other versions allows unauthenticated attackers to change the administrator passwo (CVSS 7.5)
- [CVE-2025-56815](https://cve.now/CVE-2025-56815.md): Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transf (CVSS 7.1)
- [CVE-2025-56816](https://cve.now/CVE-2025-56816.md): Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. (CVSS 8.8)
- [CVE-2025-56819](https://cve.now/CVE-2025-56819.md): An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter. (CVSS 9.8)
- [CVE-2025-57318](https://cve.now/CVE-2025-57318.md): A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.pro (CVSS 7.5, csvjson)
- [CVE-2025-57319](https://cve.now/CVE-2025-57319.md): fast-redact is a package that provides do very fast object redaction. (CVSS 7.5)
- [CVE-2025-57320](https://cve.now/CVE-2025-57320.md): json-schema-editor-visual is a package that provides jsonschema editor. (CVSS 6.5, json-schema-editor-visual)
- [CVE-2025-57321](https://cve.now/CVE-2025-57321.md): A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to inj (CVSS 9.8, magix-combine-ex)
- [CVE-2025-57323](https://cve.now/CVE-2025-57323.md): mpregular is a package that provides a small program development framework based on RegularJS. (CVSS 7.5, mpregular)
- [CVE-2025-57324](https://cve.now/CVE-2025-57324.md): parse is a package designed to parse JavaScript SDK. (CVSS 6.5, parse)
- [CVE-2025-57325](https://cve.now/CVE-2025-57325.md): rollbar is a package designed to effortlessly track and debug errors in JavaScript applications. (CVSS 7.5, rollbar)
- [CVE-2025-57326](https://cve.now/CVE-2025-57326.md): A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties (CVSS 7.5, sassdoc-extras)
- [CVE-2025-57327](https://cve.now/CVE-2025-57327.md): spmrc is a package that provides the rc manager for spm. (CVSS 7.5, spmrc)
- [CVE-2025-57328](https://cve.now/CVE-2025-57328.md): toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other obj (CVSS 7.5, toggle-array)
- [CVE-2025-57329](https://cve.now/CVE-2025-57329.md): web3-core-method is a package designed to creates the methods on the web3 modules. (CVSS 7.5, web3-core-method)
- [CVE-2025-57330](https://cve.now/CVE-2025-57330.md): The web3-core-subscriptions is a package designed to manages web3 subscriptions. (CVSS 7.5, web3-core-subscriptions)
- [CVE-2025-57347](https://cve.now/CVE-2025-57347.md): A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which (CVSS 9.8)
- [CVE-2025-57348](https://cve.now/CVE-2025-57348.md): The node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allow (CVSS 6.5, node-cube)
- [CVE-2025-57349](https://cve.now/CVE-2025-57349.md): The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype polluti (CVSS 7.5, messageformat)
- [CVE-2025-57350](https://cve.now/CVE-2025-57350.md): The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnera (CVSS 8.6, csvtojson)
- [CVE-2025-57351](https://cve.now/CVE-2025-57351.md): A prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation of user-provided ke (CVSS 6.5, ts-fns)
- [CVE-2025-57352](https://cve.now/CVE-2025-57352.md): A vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in the (CVSS 5.3, min-document)
- [CVE-2025-57353](https://cve.now/CVE-2025-57353.md): The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. (CVSS 5.3, @messageformat/runtime)
- [CVE-2025-57354](https://cve.now/CVE-2025-57354.md): A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input in (CVSS 6.5, counterpart)
- [CVE-2025-59305](https://cve.now/CVE-2025-59305.md): Improper authorization in the background migration endpoints of Langfuse 3.1 before d67b317 allows any authenticated user to invoke migratio (CVSS 7.6)
- [CVE-2025-60020](https://cve.now/CVE-2025-60020.md): nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data. (CVSS 6.4, NNCP)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.