# CVEs published 2025-09-29

119 CVEs were published on September 29, 2025: 21 critical, 31 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-59956](https://cve.now/CVE-2025-59956.md): AgentAPI exposed user chat history via a DNS rebinding attack (CVSS 6.5, coder agentapi · github.com/coder/agentapi)
- [CVE-2024-58040](https://cve.now/CVE-2024-58040.md): Crypt::RandomEncryption for Perl uses insecure rand() function during encryption (CVSS 9.1, QWER Crypt::RandomEncryption)
- [CVE-2025-59954](https://cve.now/CVE-2025-59954.md): Knowage Contains a Remote Code Execution Vulnerability (CVSS 9.3, KnowageLabs Knowage-Server)
- [CVE-2025-59952](https://cve.now/CVE-2025-59952.md): minio-java Client XML Tag is Vulnerable to Value Substitution (CVSS 8.7, minio-java · io.minio:minio)
- [CVE-2025-59950](https://cve.now/CVE-2025-59950.md): FreshRSS: Double clickjacking can lead to privilege escalation (CVSS 6.7, FreshRSS)
- [CVE-2025-61586](https://cve.now/CVE-2025-61586.md): FreshRSS is vulnerable to directory enumeration by setting path in its theme field (CVSS 6.9, FreshRSS)
- [CVE-2025-59948](https://cve.now/CVE-2025-59948.md): FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page (CVSS 6.7, FreshRSS)
- [CVE-2025-59942](https://cve.now/CVE-2025-59942.md): go-f3 module vulnerable to integer overflow leading to panic (CVSS 7.5, filecoin-project go-f3 · github.com/filecoin-project/go-f3)
- [CVE-2025-59941](https://cve.now/CVE-2025-59941.md): go-f3 is Vulnerable to Cached Justification Verification Bypass (CVSS 5.9, filecoin-project go-f3 · github.com/filecoin-project/go-f3)
- [CVE-2025-43817](https://cve.now/CVE-2025-43817.md): Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 throug (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-36245](https://cve.now/CVE-2025-36245.md): IBM InfoSphere Information Server command execution (CVSS 8.8, IBM InfoSphere Information Server)
- [CVE-2025-59940](https://cve.now/CVE-2025-59940.md): mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders (CVSS 6.5, mondeja mkdocs-include-markdown-plugin · mkdocs-include-mar…)
- [CVE-2025-59937](https://cve.now/CVE-2025-59937.md): go-mail has insufficient address encoding when passing mail addresses to the SMTP client (CVSS 8.2, wneessen go-mail · github.com/wneessen/go-mail)
- [CVE-2025-43813](https://cve.now/CVE-2025-43813.md): Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsuppo (CVSS 6.9, Liferay Portal · Liferay DXP +2)
- [CVE-2025-43812](https://cve.now/CVE-2025-43812.md): Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 thro (CVSS 4.8, Liferay Portal · Liferay DXP +2)
- [CVE-2025-59933](https://cve.now/CVE-2025-59933.md): libvips is vulnerable to Buffer Over-Read in poppler-based pdfload (CVSS 5.1, libvips)
- [CVE-2025-43811](https://cve.now/CVE-2025-43811.md): Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Lif (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-59163](https://cve.now/CVE-2025-59163.md): vet MCP Server SSE Transport DNS Rebinding Vulnerability (CVSS 2.1, safedep vet · github.com/safedep/vet)
- [CVE-2025-43820](https://cve.now/CVE-2025-43820.md): Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through (CVSS 4.8, Liferay Portal · Liferay DXP +2)
- [CVE-2025-43818](https://cve.now/CVE-2025-43818.md): Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 thro (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-57769](https://cve.now/CVE-2025-57769.md): FressRSS: Clickjacking can lead to XSS and/or privilege escalation (CVSS 5.3, FreshRSS)
- [CVE-2025-54875](https://cve.now/CVE-2025-54875.md): FreshRSS: Unauthorized creation of admin user when registration is enabled (CVSS 9.8, FreshRSS)
- [CVE-2025-54592](https://cve.now/CVE-2025-54592.md): FreshRSS has Incomplete Session Termination on Logout (CVSS 8.8, FreshRSS)
- [CVE-2025-43815](https://cve.now/CVE-2025-43815.md): Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay (CVSS 5.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-30247](https://cve.now/CVE-2025-30247.md): An OS command injection vulnerability in user interface in Western Digital My Cloud firmware prior to 5.31.108 on NAS platforms allows remot (CVSS 9.3, Western Digital My Cloud)
- [CVE-2025-54591](https://cve.now/CVE-2025-54591.md): FreshRSS: Unauthenticated users can view default user's information (CVSS 7.5, FreshRSS)
- [CVE-2025-34235](https://cve.now/CVE-2025-34235.md): Vasion Print (formerly PrinterLogic) Weak SSL/TLS Certificate Validation RCE (CVSS 9.5, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34221](https://cve.now/CVE-2025-34221.md): Vasion Print (formerly PrinterLogic) (CVSS 10.0, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34215](https://cve.now/CVE-2025-34215.md): Vasion Print (formerly PrinterLogic) Unauthenticated Firmware Update Endpoint RCE (CVSS 9.4, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34224](https://cve.now/CVE-2025-34224.md): Vasion Print (formerly PrinterLogic) Unauthenticated Device Modification (CVSS 10.0, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34220](https://cve.now/CVE-2025-34220.md): Vasion Print (formerly PrinterLogic) Unauthenticated API Leaks Group Information (CVSS 6.9, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34222](https://cve.now/CVE-2025-34222.md): Vasion Print (formerly PrinterLogic) Unauthenticated Admin APIs Used to Modify SSL Certificates (CVSS 10.0, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34228](https://cve.now/CVE-2025-34228.md): Vasion Print (formerly PrinterLogic) SSRF via Lexmark update.php (CVSS 8.8, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34229](https://cve.now/CVE-2025-34229.md): Vasion Print (formerly PrinterLogic) Blind SSRF via HP installApp.php (CVSS 6.9, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34230](https://cve.now/CVE-2025-34230.md): Vasion Print (formerly PrinterLogic) Blind SSRF via HP log\_off\_single\_sign\_on.php (CVSS 6.9, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34231](https://cve.now/CVE-2025-34231.md): Vasion Print (formerly PrinterLogic) SSRF via HP badgeSetup.php (CVSS 8.8, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34225](https://cve.now/CVE-2025-34225.md): Vasion Print (formerly PrinterLogic) SSRF via console\_release Directory (CVSS 8.8, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34216](https://cve.now/CVE-2025-34216.md): Vasion Print (formerly PrinterLogic) RCE and Password Leaks via API (CVSS 10.0, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34233](https://cve.now/CVE-2025-34233.md): Vasion Print (formerly PrinterLogic) Insecure Use of file\_get\_contents() (CVSS 8.5, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34207](https://cve.now/CVE-2025-34207.md): Vasion Print (formerly PrinterLogic) Insecure SSH Client Configuration (CVSS 7.9, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34223](https://cve.now/CVE-2025-34223.md): Vasion Print (formerly PrinterLogic) Insecure Installation Credentials (CVSS 10.0, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34212](https://cve.now/CVE-2025-34212.md): Vasion Print (formerly PrinterLogic) Insecure Build Pipeline (CVSS 8.7, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34211](https://cve.now/CVE-2025-34211.md): Vasion Print (formerly PrinterLogic) Hardcoded SSL Certificate and Private Keys (CVSS 9.3, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34209](https://cve.now/CVE-2025-34209.md): Vasion Print (formerly PrinterLogic) Hardcoded GPG Private Key (CVSS 9.4, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34234](https://cve.now/CVE-2025-34234.md): Vasion Print (formerly PrinterLogic) Hardcoded Encryption Private Keys (CVSS 9.2, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34218](https://cve.now/CVE-2025-34218.md): Vasion Print (formerly PrinterLogic) Exposed Internal Docker Instance (CVSS 10.0, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34232](https://cve.now/CVE-2025-34232.md): Vasion Print (formerly PrinterLogic) Blind SSRF via Lexmark dellCheck.php (CVSS 6.9, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-45376](https://cve.now/CVE-2025-45376.md): Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8, contains an Improper Handling of Insufficient Permissions or Privileges vulnerabili (CVSS 7.5, Dell Repository Manager)
- [CVE-2025-35034](https://cve.now/CVE-2025-35034.md): Medical Informatics Engineering Enterprise Health reflected cross site scripting via portlet\_user\_id (CVSS 4.3, Medical Informatics Engineering Enterprise Health)
- [CVE-2025-35033](https://cve.now/CVE-2025-35033.md): Medical Informatics Engineering Enterprise Health CSV injection (CVSS 6.3, Medical Informatics Engineering Enterprise Health)
- [CVE-2025-35032](https://cve.now/CVE-2025-35032.md): Medical Informatics Engineering Enterprise Health arbitrary file upload (CVSS 3.4, Medical Informatics Engineering Enterprise Health)
- [CVE-2025-35031](https://cve.now/CVE-2025-35031.md): Medical Informatics Engineering Enterprise Health includes session token in debug output (CVSS 3.3, Medical Informatics Engineering Enterprise Health)
- [CVE-2025-35030](https://cve.now/CVE-2025-35030.md): Medical Informatics Engineering Enterprise Health cross site request forgery (CVSS 8.1, Medical Informatics Engineering Enterprise Health)
- [CVE-2025-34196](https://cve.now/CVE-2025-34196.md): Vasion Print (formerly PrinterLogic) Hardcoded PrinterLogic CA Private Key and Hardcoded Password (CVSS 9.3, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-41252](https://cve.now/CVE-2025-41252.md): Username enumeration vulnerability (CVSS 7.5, VMware NSX)
- [CVE-2025-41251](https://cve.now/CVE-2025-41251.md): Weak password recovery vulnerability (CVSS 8.1, vmware NSX)
- [CVE-2025-57871](https://cve.now/CVE-2025-57871.md): BUG-000174020 - Reflected XSS vulnerability identified in Portal for ArcGIS. (11.3, 11.1, 10.9.1) (CVSS 4.8, Esri Portal for ArcGIS)
- [CVE-2025-57872](https://cve.now/CVE-2025-57872.md): BUG-000174150 - Unvalidated redirect in Portal for ArcGIS. (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2025-57873](https://cve.now/CVE-2025-57873.md): BUG-000175222 - Reflected XSS vulnerability in Portal for ArcGIS. (CVSS 4.8, Esri Portal for ArcGIS)
- [CVE-2025-57874](https://cve.now/CVE-2025-57874.md): BUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS. (11.3, 11.1, 10.9.1) (CVSS 4.8, Esri Portal for ArcGIS)
- [CVE-2025-57875](https://cve.now/CVE-2025-57875.md): BUG-000164122 - Reflected XSS vulnerability in Portal for ArcGIS. (CVSS 4.8, Esri Portal for ArcGIS)
- [CVE-2025-57877](https://cve.now/CVE-2025-57877.md): Reflected XSS vulnerability in Portal for ArcGIS. (CVSS 4.8, Esri Portal for ArcGIS)
- [CVE-2025-57878](https://cve.now/CVE-2025-57878.md): BUG-000174149 - The Portal for ArcGIS has an unvalidated redirect. (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2025-57879](https://cve.now/CVE-2025-57879.md): BUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS. (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2025-57876](https://cve.now/CVE-2025-57876.md): Stored XSS vulnerability in Portal for ArcGIS (CVSS 4.8, Esri Portal for ArcGIS)
- [CVE-2025-36099](https://cve.now/CVE-2025-36099.md): IBM WebSphere Application Server denial of service (CVSS 4.9, IBM WebSphere Application Server)
- [CVE-2025-43400](https://cve.now/CVE-2025-43400.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-41250](https://cve.now/CVE-2025-41250.md): Header injection vulnerability (CVSS 8.5, VMware vCenter · VMware Cloud Foundation +3)
- [CVE-2025-7104](https://cve.now/CVE-2025-7104.md): Mass Assignment in danny-avila/librechat (CVSS 4.3, danny-avila/librechat)
- [CVE-2025-41245](https://cve.now/CVE-2025-41245.md): VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246) (CVSS 4.9, VMware Aria Operations · VMware Cloud Foundation +2)
- [CVE-2025-41244](https://cve.now/CVE-2025-41244.md): VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246) (CVSS 7.8, KEV, VMware VCF operations · VMware tools +4)
- [CVE-2025-41246](https://cve.now/CVE-2025-41246.md): Improper authorisation vulnerability (CVSS 7.6, VMware Tools)
- [CVE-2025-11155](https://cve.now/CVE-2025-11155.md): WEAK ENCODING FOR PASSWORD IN DEVICE SERVER CONFIGURATION (CVSS 6.8, SATO S86-ex 203dpi)
- [CVE-2025-36351](https://cve.now/CVE-2025-36351.md): IBM License Metric Tool bypass security (CVSS 4.3, IBM License Metric Tool)
- [CVE-2025-36352](https://cve.now/CVE-2025-36352.md): IBM License Metric Tool cross-site scripting (CVSS 6.4, IBM License Metric Tool)
- [CVE-2024-13150](https://cve.now/CVE-2024-13150.md): SQLi in Fayton Software's fayton.pro ERP (CVSS 9.8, Fayton Software and Consulting Services fayton.pro ERP)
- [CVE-2025-9648](https://cve.now/CVE-2025-9648.md): Denial of Service in CivetWeb (CVSS 8.7, CivetWeb)
- [CVE-2025-8868](https://cve.now/CVE-2025-8868.md): Chef Automate compliance service SQL Injection Vulnerability (CVSS 9.8, Progress Software Chef Automate)
- [CVE-2025-6724](https://cve.now/CVE-2025-6724.md): Chef Automate SQL Injection Vulnerability (CVSS 8.8, Progress Software Chef Automate)
- [CVE-2025-11147](https://cve.now/CVE-2025-11147.md): Reflected Cross-site scripting (XSS) vulnerability in Apt-Cacher-NG (CVSS 5.1, Apt-Cacher-NG)
- [CVE-2025-11146](https://cve.now/CVE-2025-11146.md): Reflected Cross-site scripting (XSS) vulnerability in Apt-Cacher-NG (CVSS 5.1, Apt-Cacher-NG)
- [CVE-2025-10346](https://cve.now/CVE-2025-10346.md): HTML injection in Perfex CRM (CVSS 5.3, Perfex CRM)
- [CVE-2025-10345](https://cve.now/CVE-2025-10345.md): HTML injection in Perfex CRM (CVSS 5.3, Perfex CRM)
- [CVE-2025-10344](https://cve.now/CVE-2025-10344.md): HTML injection in Perfex CRM (CVSS 5.3, Perfex CRM)
- [CVE-2025-10343](https://cve.now/CVE-2025-10343.md): HTML injection in Perfex CRM (CVSS 5.3, Perfex CRM)
- [CVE-2025-10342](https://cve.now/CVE-2025-10342.md): HTML injection in Perfex CRM (CVSS 5.3, Perfex CRM)
- [CVE-2025-10341](https://cve.now/CVE-2025-10341.md): HTML injection in Perfex CRM (CVSS 5.3, Perfex CRM)
- [CVE-2025-48006](https://cve.now/CVE-2025-48006.md): Improper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier. (CVSS 8.2, Saison Technology Co. DataSpider Servista)
- [CVE-2024-5200](https://cve.now/CVE-2024-5200.md): Postie \< 1.9.71 - Admin+ Stored XSS (CVSS 4.8, Postie)
- [CVE-2025-11141](https://cve.now/CVE-2025-11141.md): Ruijie NBR2100G-E branch\_passw.php listAction os command injection (CVSS 5.1, Ruijie NBR2100G-E)
- [CVE-2025-10504](https://cve.now/CVE-2025-10504.md): Heap Memory Corruption Vulnerability (CVSS 6.9, ABB Terra AC wallbox)
- [CVE-2025-11140](https://cve.now/CVE-2025-11140.md): Bjskzy Zhiyou ERP com.artery.richclient.RichClientService openForm xml external entity reference (CVSS 6.9, Bjskzy Zhiyou ERP)
- [CVE-2025-11139](https://cve.now/CVE-2025-11139.md): Bjskzy Zhiyou ERP com.artery.form.services.FormStudioUpdater uploadStudioFile path traversal (CVSS 5.3, Bjskzy Zhiyou ERP)
- [CVE-2025-11138](https://cve.now/CVE-2025-11138.md): mirweiye wenkucms common.php createPathOne os command injection (CVSS 5.3, mirweiye wenkucms)
- [CVE-2025-11137](https://cve.now/CVE-2025-11137.md): Gstarsoft GstarCAD File Renaming cross site scripting (CVSS 5.1, Gstarsoft GstarCAD)
- [CVE-2025-11136](https://cve.now/CVE-2025-11136.md): YiFang CMS Backend File.php webUploader unrestricted upload (CVSS 5.1, YiFang CMS)
- [CVE-2025-11135](https://cve.now/CVE-2025-11135.md): pmTicket Project-Management-Software Cookie class.database.php loadLanguage deserialization (CVSS 6.9, pmTicket Project-Management-Software)
- [CVE-2025-11134](https://cve.now/CVE-2025-11134.md): Cudy TR1200 Wireless Settings config cross site scripting (CVSS 4.8, Cudy TR1200)
- [CVE-2025-7698](https://cve.now/CVE-2025-7698.md): Out-of-bounds read vulnerabilities in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Pl (CVSS 5.9, Canon Generic Plus PCL6 Printer Driver · Canon Generic… +11)
- [CVE-2025-9904](https://cve.now/CVE-2025-9904.md): Unallocated memory access vulnerability in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Gener (CVSS 5.3, Canon Generic Plus PCL6 Printer Driver · Canon Generic… +11)
- [CVE-2025-9903](https://cve.now/CVE-2025-9903.md): Out-of-bounds write vulnerabilities in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic P (CVSS 5.9, Canon Generic Plus PCL6 Printer Driver · Canon Generic… +11)
- [CVE-2025-11130](https://cve.now/CVE-2025-11130.md): iHongRen pptp-vpn XPC Service HelperTool.m shouldAcceptNewConnection missing authentication (CVSS 8.6, iHongRen pptp-vpn)
- [CVE-2025-11126](https://cve.now/CVE-2025-11126.md): Apeman ID71 system.ini hard-coded credentials (CVSS 9.3, Apeman ID71)
- [CVE-2024-57412](https://cve.now/CVE-2024-57412.md): An issue in SunOS Omnios v5.11 allows attackers to cause a Denial of Service (DoS) via repeatedly sending crafted TCP packets. (CVSS 7.5)
- [CVE-2025-51495](https://cve.now/CVE-2025-51495.md): An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. (CVSS 7.5)
- [CVE-2025-55795](https://cve.now/CVE-2025-55795.md): The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during e (CVSS 3.5)
- [CVE-2025-56233](https://cve.now/CVE-2025-56233.md): Openindiana, kernel SunOS 5.11 has a denial of service vulnerability. (CVSS 7.5)
- [CVE-2025-56234](https://cve.now/CVE-2025-56234.md): AT\_NA2000 from Nanda Automation Technology vendor has a denial-of-service vulnerability. (CVSS 7.5)
- [CVE-2025-56449](https://cve.now/CVE-2025-56449.md): A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. (CVSS 8.2)
- [CVE-2025-56764](https://cve.now/CVE-2025-56764.md): Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning different error mess (CVSS 5.3)
- [CVE-2025-56795](https://cve.now/CVE-2025-56795.md): Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality. (CVSS 9.0)
- [CVE-2025-56807](https://cve.now/CVE-2025-56807.md): A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaSc (CVSS 6.1)
- [CVE-2025-57197](https://cve.now/CVE-2025-57197.md): In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change featu (CVSS 6.0)
- [CVE-2025-57266](https://cve.now/CVE-2025-57266.md): An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attackers t (CVSS 9.8)
- [CVE-2025-57424](https://cve.now/CVE-2025-57424.md): A stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within the LTA number profile field. (CVSS 7.3)
- [CVE-2025-57428](https://cve.now/CVE-2025-57428.md): Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gain access to the debug (CVSS 6.5)
- [CVE-2025-57483](https://cve.now/CVE-2025-57483.md): A reflected cross-site scripting (XSS) vulnerability in tawk.to chatbox widget v4 allows attackers to execute arbitrary Javascript in the co (CVSS 8.1)
- [CVE-2025-57516](https://cve.now/CVE-2025-57516.md): OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary com (CVSS 8.2)
- [CVE-2025-61659](https://cve.now/CVE-2025-61659.md): bash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name. (CVSS 6.8, magicmonty bash-git-prompt)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.