# CVEs published 2025-09-30

103 CVEs were published on September 30, 2025: 12 critical, 35 high. Days are UTC.

- [CVE-2025-24525](https://cve.now/CVE-2025-24525.md): Keysight Ixia Vision Product Family Use of Hard-coded Cryptographic Key (CVSS 7.5, Keysight Ixia Vision Product Family)
- [CVE-2025-55191](https://cve.now/CVE-2025-55191.md): Repository Credentials Race Condition Crashes Argo CD Server (CVSS 6.5, argoproj argo-cd · github.com/argoproj/argo-cd +2)
- [CVE-2025-43826](https://cve.now/CVE-2025-43826.md): Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupporte (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-10659](https://cve.now/CVE-2025-10659.md): MegaSys Enterprises Telenium Online Web Application OS Command Injection (CVSS 9.3, MegaSys Telenium Online Web Application:)
- [CVE-2025-36262](https://cve.now/CVE-2025-36262.md): IBM Planning Analytics Local information disclosure (CVSS 4.9, IBM Planning Analytics Local)
- [CVE-2025-36132](https://cve.now/CVE-2025-36132.md): IBM Planning Analytics Local cross-site scripting (CVSS 5.4, IBM Planning Analytics Local)
- [CVE-2025-43827](https://cve.now/CVE-2025-43827.md): Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported ver (CVSS 5.3, Liferay Portal · Liferay DXP +2)
- [CVE-2025-11195](https://cve.now/CVE-2025-11195.md): Rapid7 AppSpider Project Name Validation Bypass (CVSS 3.3, Rapid7 AppSpider Pro)
- [CVE-2025-23293](https://cve.now/CVE-2025-23293.md): NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause an authorized actio (CVSS 8.7, DLS component of NVIDIA License System)
- [CVE-2025-23292](https://cve.now/CVE-2025-23292.md): NVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Attacker may cause an au (CVSS 4.6, DLS component of NVIDIA License System)
- [CVE-2025-23291](https://cve.now/CVE-2025-23291.md): NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause an authorized actio (CVSS 2.4, DLS component of NVIDIA License System)
- [CVE-2025-10725](https://cve.now/CVE-2025-10725.md): Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster admin (CVSS 9.9, opendatahub-io opendatahub-operator · Red Hat OpenShift AI)
- [CVE-2025-6034](https://cve.now/CVE-2025-6034.md): Out of Bounds Read in DefaultFontOptions() in NI Circuit Design Suite (CVSS 7.8, NI Circuit Design Suite)
- [CVE-2025-6033](https://cve.now/CVE-2025-6033.md): Memory Corruption issue in XML\_Serialize() in NI Circuit Design Suite (CVSS 7.8, NI Circuit Design Suite)
- [CVE-2025-54477](https://cve.now/CVE-2025-54477.md): Joomla! Core - \[20250902\] User-Enumeration in passkey authentication method (CVSS 5.3, Joomla! Project Joomla! CMS)
- [CVE-2025-54476](https://cve.now/CVE-2025-54476.md): Joomla! Core - \[20250901\] Inadequate content filtering within the checkAttribute filter code (CVSS 4.8, Joomla! Project Joomla! CMS · joomla/filter)
- [CVE-2025-7493](https://cve.now/CVE-2025-7493.md): Freeipa: idm: privilege escalation from host to domain admin in freeipa (CVSS 9.1, Red Hat Enterprise Linux)
- [CVE-2025-7779](https://cve.now/CVE-2025-7779.md): Local privilege escalation due to insecure XPC service configuration. (CVSS 8.8, Acronis True Image)
- [CVE-2025-11178](https://cve.now/CVE-2025-11178.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 7.3, Acronis True Image)
- [CVE-2025-57852](https://cve.now/CVE-2025-57852.md): Openshift-ai: privilege escalation via excessive /etc/passwd permissions (CVSS 6.4, Red Hat OpenShift AI)
- [CVE-2025-9232](https://cve.now/CVE-2025-9232.md): Out-of-bounds read in HTTP client no\_proxy handling (CVSS 5.9, OpenSSL)
- [CVE-2025-9231](https://cve.now/CVE-2025-9231.md): Timing side-channel in SM2 algorithm on 64 bit ARM (CVSS 6.5, OpenSSL)
- [CVE-2025-9230](https://cve.now/CVE-2025-9230.md): Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVSS 7.5, OpenSSL)
- [CVE-2025-34217](https://cve.now/CVE-2025-34217.md): Vasion Print (formerly PrinterLogic) Undocumented Hardcoded SSH Key (CVSS 10.0, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-10859](https://cve.now/CVE-2025-10859.md): Data stored in cookies for non-HTML content while browsing Incognito could be viewed after closing private tabs (CVSS 4.0, Mozilla Firefox for iOS)
- [CVE-2025-11153](https://cve.now/CVE-2025-11153.md): JIT miscompilation in the JavaScript Engine: JIT component (CVSS 7.5, Mozilla Firefox)
- [CVE-2025-11152](https://cve.now/CVE-2025-11152.md): Sandbox escape due to integer overflow in the Graphics: Canvas2D component (CVSS 8.6, Mozilla Firefox)
- [CVE-2025-10217](https://cve.now/CVE-2025-10217.md): A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject craft (CVSS 6.0, Hitachi Energy Asset Suite)
- [CVE-2025-41098](https://cve.now/CVE-2025-41098.md): Insecure Direct Object Reference in GPS BOLD Workplanner (CVSS 7.1, GLOBAL PLANNING SOLUTIONS S.L (GPS) BOLD Workplanner)
- [CVE-2025-41099](https://cve.now/CVE-2025-41099.md): Insecure Direct Object Reference in GPS BOLD Workplanner (CVSS 7.1, GLOBAL PLANNING SOLUTIONS S.L (GPS) BOLD Workplanner)
- [CVE-2025-41097](https://cve.now/CVE-2025-41097.md): Insecure Direct Object Reference in GPS BOLD Workplanner (CVSS 7.1, GLOBAL PLANNING SOLUTIONS S.L (GPS) BOLD Workplanner)
- [CVE-2025-41096](https://cve.now/CVE-2025-41096.md): Insecure Direct Object Reference in GPS BOLD Workplanner (CVSS 7.1, GLOBAL PLANNING SOLUTIONS S.L (GPS) BOLD Workplanner)
- [CVE-2025-41095](https://cve.now/CVE-2025-41095.md): Insecure Direct Object Reference in GPS BOLD Workplanner (CVSS 7.1, GLOBAL PLANNING SOLUTIONS S.L (GPS) BOLD Workplanner)
- [CVE-2025-41094](https://cve.now/CVE-2025-41094.md): Insecure Direct Object Reference in GPS BOLD Workplanner (CVSS 7.1, GLOBAL PLANNING SOLUTIONS S.L (GPS) BOLD Workplanner)
- [CVE-2025-41093](https://cve.now/CVE-2025-41093.md): Insecure Direct Object Reference in GPS BOLD Workplanner (CVSS 7.1, GLOBAL PLANNING SOLUTIONS S.L (GPS) BOLD Workplanner)
- [CVE-2025-41092](https://cve.now/CVE-2025-41092.md): Insecure Direct Object Reference in GPS BOLD Workplanner (CVSS 7.1, GLOBAL PLANNING SOLUTIONS S.L (GPS) BOLD Workplanner)
- [CVE-2025-41091](https://cve.now/CVE-2025-41091.md): Insecure Direct Object Reference in GPS BOLD Workplanner (CVSS 7.1, GLOBAL PLANNING SOLUTIONS S.L (GPS) BOLD Workplanner)
- [CVE-2025-8122](https://cve.now/CVE-2025-8122.md): Blind SQL Injection in PAD CMS (CVSS 8.7, Polska Akademia Dostępności PAD CMS)
- [CVE-2025-8121](https://cve.now/CVE-2025-8121.md): Blind SQL Injection in PAD CMS (CVSS 8.7, Polska Akademia Dostępności PAD CMS)
- [CVE-2025-8120](https://cve.now/CVE-2025-8120.md): Remote Code Execution via Unrestricted File Upload in PAD CMS (CVSS 10.0, Polska Akademia Dostępności PAD CMS)
- [CVE-2025-8119](https://cve.now/CVE-2025-8119.md): Cross-Site Request Forgery in PAD CMS (CVSS 5.1, Polska Akademia Dostępności PAD CMS)
- [CVE-2025-8118](https://cve.now/CVE-2025-8118.md): Bruteforce Protection Bypass in PAD CMS (CVSS 6.9, Polska Akademia Dostępności PAD CMS)
- [CVE-2025-8117](https://cve.now/CVE-2025-8117.md): Account Takeover via Reset Password Functionality in PAD CMS (CVSS 8.7, Polska Akademia Dostępności PAD CMS)
- [CVE-2025-8116](https://cve.now/CVE-2025-8116.md): Reflected XSS in PAD CMS (CVSS 5.1, Polska Akademia Dostępności PAD CMS)
- [CVE-2025-7065](https://cve.now/CVE-2025-7065.md): Remote Code Execution via Unrestricted File Upload in PAD CMS (CVSS 10.0, Polska Akademia Dostępności PAD CMS)
- [CVE-2025-7063](https://cve.now/CVE-2025-7063.md): Remote Code Execution via Unrestricted File Upload in PAD CMS (CVSS 10.0, Polska Akademia Dostępności PAD CMS)
- [CVE-2025-8877](https://cve.now/CVE-2025-8877.md): AffiliateWP \<= 2.28.2 - Unauthenticated SQL Injection (CVSS 7.5, AffiliateWP)
- [CVE-2025-11163](https://cve.now/CVE-2025-11163.md): SmartCrawl SEO checker, analyzer & optimizer \<= 3.14.3 - Missing Authorization to Plugin Settings Update (CVSS 4.3, wpmudev SmartCrawl SEO checker, analyzer & optimizer)
- [CVE-2025-11149](https://cve.now/CVE-2025-11149.md): This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. (CVSS 7.5, node-static · @nubosoftware/node-static)
- [CVE-2025-11148](https://cve.now/CVE-2025-11148.md): All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with (CVSS 9.8, check-branches)
- [CVE-2025-7052](https://cve.now/CVE-2025-7052.md): LatePoint \<= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change\_password() Function (CVSS 8.8, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2025-7038](https://cve.now/CVE-2025-7038.md): LatePoint \<= 5.1.94 - Unauthenticated Authentication Bypass via load\_step Function (CVSS 8.2, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2025-6941](https://cve.now/CVE-2025-6941.md): LatePoint \<= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2025-6815](https://cve.now/CVE-2025-6815.md): LatePoint \<= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2025-59668](https://cve.now/CVE-2025-59668.md): Multiple versions of Central Monitor CNS-6201 contain a NULL pointer dereference vulnerability. (CVSS 7.5, NIHON KOHDEN Central Monitor CNS-6201)
- [CVE-2025-8777](https://cve.now/CVE-2025-8777.md): planetcalc \<= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via language Parameter (CVSS 6.4, planetcalc)
- [CVE-2025-10196](https://cve.now/CVE-2025-10196.md): SurveyAnyplace Plugin \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, sdebois Survey Anyplace)
- [CVE-2025-9946](https://cve.now/CVE-2025-9946.md): LockerPress – WordPress Security Plugin \<= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, LockerPress – WordPress Security Plugin)
- [CVE-2025-8214](https://cve.now/CVE-2025-8214.md): The Pack Elementor addon \<= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typing Letter Widget (CVSS 6.4, webangon The Pack Elementor addon)
- [CVE-2025-10128](https://cve.now/CVE-2025-10128.md): Eulerpool Research Systems \<= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, michaellow Eulerpool Research Systems)
- [CVE-2025-8608](https://cve.now/CVE-2025-8608.md): Mihdan: Elementor Yandex Maps \<= 1.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marker Pins (CVSS 6.4, mihdan Maps from Yandex for Elementor)
- [CVE-2025-10189](https://cve.now/CVE-2025-10189.md): BP Direct Menus \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mrwulf BP Direct Menus)
- [CVE-2025-9991](https://cve.now/CVE-2025-9991.md): Tiny Bootstrap Elements Light \<= 4.3.34 - Unauthenticated Local File Inclusion (CVSS 8.1, migli Tiny Bootstrap Elements Light)
- [CVE-2025-10168](https://cve.now/CVE-2025-10168.md): Any News Ticker \<= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mucasoft Any News Ticker)
- [CVE-2025-9948](https://cve.now/CVE-2025-9948.md): Chat by Chatwee \<= 2.1.3 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, paulq Chat by Chatwee)
- [CVE-2025-10182](https://cve.now/CVE-2025-10182.md): dbview \<= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, john-ackers dbview)
- [CVE-2025-8559](https://cve.now/CVE-2025-8559.md): All in One Music Player \<= 1.3.1 - Authenticated (Contributor+) Path Traversal via theme Parameter (CVSS 6.5, sanzeeb3 All in One Music Player)
- [CVE-2025-8624](https://cve.now/CVE-2025-8624.md): Nexa Blocks \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget (CVSS 6.4, wpdive Nexa Blocks – Gutenberg Blocks, Page Builder for Gut…)
- [CVE-2025-10191](https://cve.now/CVE-2025-10191.md): Big Post Shipping for WooCommerce \<= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, fusedsoftware Big Post Shipping for WooCommerce)
- [CVE-2025-8623](https://cve.now/CVE-2025-8623.md): WeedMaps Menu for WordPress \<= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via weedmaps\_menu Shortcode (CVSS 6.4, bmoredrew WeedMaps Menu for WordPress)
- [CVE-2025-9762](https://cve.now/CVE-2025-9762.md): Post By Email \<= 1.0.4b - Unauthenticated Arbitrary File Upload via Email Attachments (CVSS 9.8, westi Post By Email)
- [CVE-2025-10131](https://cve.now/CVE-2025-10131.md): All Social Share Options \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, codiblog All Social Share Options)
- [CVE-2025-9993](https://cve.now/CVE-2025-9993.md): Bei Fen – WordPress Backup Plugin \<= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion (CVSS 8.1, d3rd4v1d Bei Fen – WordPress Backup Plugin)
- [CVE-2025-9852](https://cve.now/CVE-2025-9852.md): Yoga Schedule Momoyoga \<= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, momostefan Yoga Schedule Momoyoga)
- [CVE-2025-8560](https://cve.now/CVE-2025-8560.md): FancyTabs \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter (CVSS 6.4, ghosttoast FancyTabs)
- [CVE-2025-10000](https://cve.now/CVE-2025-10000.md): Qyrr – simply and modern QR-Code creation \<= 2.0.7 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 6.4, wpchill Qyrr – simply and modern QR-Code creation)
- [CVE-2025-10130](https://cve.now/CVE-2025-10130.md): Layers \<= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, stripeswp Layers)
- [CVE-2025-8625](https://cve.now/CVE-2025-8625.md): Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution (CVSS 9.8, copypressdev Copypress Rest API)
- [CVE-2025-10179](https://cve.now/CVE-2025-10179.md): My AskAI \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, myaskai My AskAI)
- [CVE-2025-8566](https://cve.now/CVE-2025-8566.md): GutenBee – Gutenberg Blocks \<= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, cssigniterteam GutenBee – Gutenberg Blocks)
- [CVE-2025-61584](https://cve.now/CVE-2025-61584.md): serverless-dns is vulnerable to Command Injection through pr.yml GitHub Action Workflow (CVSS 9.3, serverless-dns)
- [CVE-2025-10991](https://cve.now/CVE-2025-10991.md): Root Access via UART (CVSS 7.0, TP-Link Systems Tapo D230S1)
- [CVE-2024-55017](https://cve.now/CVE-2024-55017.md): Account Takeover in Corezoid 6.6.0 in the OAuth2 implementation via an open redirect in the redirect\_uri parameter allows attackers to inter (CVSS 7.5)
- [CVE-2025-28016](https://cve.now/CVE-2025-28016.md): A Reflected Cross-Site Scripting (XSS) vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login a (CVSS 4.8)
- [CVE-2025-52043](https://cve.now/CVE-2025-52043.md): In Frappe ERPNext v15.57.5, the function import\_coa() at erpnext/accounts/doctype/chart\_of\_accounts\_importer/chart\_of\_accounts\_importer.py i (CVSS 6.5)
- [CVE-2025-52047](https://cve.now/CVE-2025-52047.md): In Frappe ErpNext v15.57.5, the function get\_income\_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows (CVSS 6.5)
- [CVE-2025-52049](https://cve.now/CVE-2025-52049.md): In Frappe ErpNext v15.57.5, the function get\_timesheet\_detail\_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL (CVSS 6.5)
- [CVE-2025-52050](https://cve.now/CVE-2025-52050.md): In Frappe ERPNext 15.57.5, the function get\_loyalty\_program\_details\_with\_points() at erpnext/accounts/doctype/loyalty\_program/loyalty\_progra (CVSS 6.5)
- [CVE-2025-55797](https://cve.now/CVE-2025-55797.md): An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/\[schemaId\] endpoint allows unauthenticated attackers (CVSS 6.5, FormCMS)
- [CVE-2025-56018](https://cve.now/CVE-2025-56018.md): SourceCodester Web-based Pharmacy Product Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in Category Management via the (CVSS 6.1)
- [CVE-2025-56132](https://cve.now/CVE-2025-56132.md): LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. (CVSS 7.3)
- [CVE-2025-56200](https://cve.now/CVE-2025-56200.md): A URL validation bypass vulnerability exists in validator.js through version 13.15.15. (CVSS 6.1, validator)
- [CVE-2025-56207](https://cve.now/CVE-2025-56207.md): A security flaw in the '\_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an Ethereum ERC721 Non-Fu (CVSS 6.5)
- [CVE-2025-56301](https://cve.now/CVE-2025-56301.md): An issue was discovered in Chipsalliance Rocket-Chip commit f517abbf41abb65cea37421d3559f9739efd00a9 (2025-01-29) allowing attackers to corr (CVSS 7.5)
- [CVE-2025-56392](https://cve.now/CVE-2025-56392.md): An Insecure Direct Object Reference (IDOR) in the /dashboard/notes endpoint of Syaqui Collegetivity v1.0.0 allows attackers to impersonate o (CVSS 8.1)
- [CVE-2025-56513](https://cve.now/CVE-2025-56513.md): NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. (CVSS 9.8)
- [CVE-2025-56520](https://cve.now/CVE-2025-56520.md): Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote\_files.RemoteFileUplo (CVSS 5.3)
- [CVE-2025-56571](https://cve.now/CVE-2025-56571.md): Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. (CVSS 7.5, financejs)
- [CVE-2025-56572](https://cve.now/CVE-2025-56572.md): An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter. (CVSS 7.5, financejs)
- [CVE-2025-56675](https://cve.now/CVE-2025-56675.md): The EKEN video doorbell T6 BT60PLUS\_MAIN\_V1.0\_GC1084\_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive informa (CVSS 3.5, EKEN video doorbell T6)
- [CVE-2025-56676](https://cve.now/CVE-2025-56676.md): TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. (CVSS 5.4)
- [CVE-2025-57254](https://cve.now/CVE-2025-57254.md): An SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital Management System (HMS) 1.0 allows remote attackers (CVSS 6.5)
- [CVE-2025-61792](https://cve.now/CVE-2025-61792.md): Quadient DS-700 iQ devices through 2025-09-30 might have a race condition during the quick clicking of (in order) the Question Mark button, (CVSS 6.4, Quadient DS-700 iQ)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.