CVEs published October 1, 2025
243 CVEs were published on October 1, 2025: 5 critical, 78 high.
- Published
- 243
- Critical
- 5
- High
- 78
- Medium
- 52
- Low
- 6
- Unrated
- 102
- Now in CISA KEV
- 0
- Fix available
- 77
Most affected products
- Linux
- 169
- Splunk Enterprise · Splunk Cloud Platform
- 5
- IBM Transformation Extender Advanced
- 4
- OISF suricata
- 4
- argoproj argo-cd · github.com/argoproj/argo-cd +2
- 3
- discourse
- 3
- Cisco Cyber Vision
- 2
- djangoproject Django · django
- 2
- fiora
- 2
- issabel-pbx module Issabel · Issabel, issabel-agenda module…
- 2
Critical 5
- CVE-2025-61588risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`risc0 · risc0-zkvm-platform +3
- CVE-2025-59951Termix' official Docker image contains an authentication bypass vulnerabilityLukeGus Termix
- CVE-2023-53517tipc: do not update mtu if msg_max is too small in mtu negotiationLinux
- CVE-2025-61622Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyforyApache Software Foundation Apache Fory · pyfury +1
- CVE-2020-36852Custom Searchable Data Entry System <= 1.7.1 - Unauthenticated Database Wipingghazale Custom Searchable Data Entry System
High 78
- CVE-2025-61582Ts3 Manager: Unauthenticated Denial of Service possible through specially crafted Unicode inputjoni1802 ts3-manager
- CVE-2025-54811OpenPLC_V3OpenPLC_V3
- CVE-2025-23297NVIDIA Installer for NvAPP for Windows contains a vulnerability in the FrameviewSDK installation process, where an attacker with local unpriNVIDIA App
- CVE-2025-59538Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhookargoproj argo-cd · github.com/argoproj/argo-cd +2
- CVE-2025-59537argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payloadargoproj argo-cd · github.com/argoproj/argo-cd +2
- CVE-2025-59531Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payloadargoproj argo-cd · github.com/argoproj/argo-cd +2
- CVE-2025-59150Suricata: Keyword tls.subjectaltname can lead to NULL-ptr derefOISF suricata
- CVE-2025-59148Suricata's improper use of entropy keyword can lead to a NULL-ptr derefOISF suricata
- CVE-2025-59147Suricata is Vulnerable to Detection Bypass via Crafted Multiple SYN PacketsOISF suricata
- CVE-2025-8679ExtremeGuest Essentials Captive Portal Unauthenticated Brute ForceExtreme Networks ExtremeGuest Essentials
- CVE-2025-20371Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2023-53531null_blk: fix poll request timeout handlingLinux
- CVE-2023-53526jbd2: check 'jh->b_transaction' before removing it from checkpointLinux
- CVE-2023-53520Bluetooth: Fix hci_suspend_sync crashLinux
- CVE-2023-53518PM / devfreq: Fix leak in devfreq_dev_release()Linux
- CVE-2023-53510scsi: ufs: core: Fix handling of lrbp->cmdLinux
- CVE-2023-53506udf: Do not bother merging very long extentsLinux
- CVE-2023-53504RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAFLinux
- CVE-2023-53500xfrm: fix slab-use-after-free in decode_session6Linux
- CVE-2023-53499virtio_net: Fix error unwinding of XDP initializationLinux
- CVE-2023-53495net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc()Linux
- CVE-2023-53494crypto: xts - Handle EBUSY correctlyLinux
- CVE-2023-53493accel/qaic: tighten bounds checking in decode_message()Linux
- CVE-2023-53492netfilter: nf_tables: do not ignore genmask when looking up chain by idLinux
- CVE-2023-53491start_kernel: Add __no_stack_protector function attributeLinux
- CVE-2023-53490mptcp: fix disconnect vs accept raceLinux
- CVE-2022-50459scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()Linux
- CVE-2022-50454drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()Linux
- CVE-2021-4460drm/amdkfd: Fix UBSAN shift-out-of-bounds warningLinux
- CVE-2023-53486fs/ntfs3: Enhance the attribute size checkLinux
- CVE-2023-53485fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLevLinux
- CVE-2023-53484lib: cpu_rmap: Avoid use after free on rmap->obj array entriesLinux
- CVE-2023-53481ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failedLinux
- CVE-2023-53478tracing/synthetic: Fix races on freeing last_cmdLinux
- CVE-2023-53474x86/MCE/AMD: Use an u64 for bank_mapLinux
- CVE-2023-53473ext4: improve error handling from ext4_dirhash()Linux
- CVE-2023-53465soundwire: qcom: fix storing port config out-of-boundsLinux
- CVE-2023-53463ibmvnic: Do not reset dql stats on NON_FATAL errLinux
- CVE-2023-53462hsr: Fix uninit-value access in fill_frame_info()Linux
- CVE-2023-53454HID: multitouch: Correct devm device reference for hidinput input_dev nameLinux
- CVE-2022-50442fs/ntfs3: Validate buffer length while parsing indexLinux
- CVE-2022-50440drm/vmwgfx: Validate the box size for the snooped cursorLinux
- CVE-2022-50437drm/msm/hdmi: fix memory corruption with too many bridgesLinux
- CVE-2022-50432kernfs: fix use-after-free in __kernfs_removeLinux
- CVE-2022-50423ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()Linux
- CVE-2022-50422scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()Linux
- CVE-2022-50421rpmsg: char: Avoid double destroy of default endpointLinux
- CVE-2025-10847DX UIM Probe Improper ACL Handling RCEBroadcom Unified Infrastructure Management
- CVE-2025-39928i2c: rtl9300: ensure data length is within supported rangeLinux
- CVE-2025-39927ceph: fix race condition validating r_parent before applying stateLinux
- CVE-2025-39924erofs: fix invalid algorithm for encoded extentsLinux
- CVE-2025-39922ixgbe: fix incorrect map used in eee linkmodeLinux
- CVE-2025-39919wifi: mt76: mt7996: add missing check for rx wcid entriesLinux
- CVE-2025-39918wifi: mt76: fix linked list corruptionLinux
- CVE-2025-39917bpf: Fix out-of-bounds dynptr write in bpf_crypto_cryptLinux
- CVE-2025-39908net: dev_ioctl: take ops lock in hwtstamp lower pathsLinux
- CVE-2025-39906drm/amd/display: remove oem i2c adapter on finishLinux
- CVE-2025-39905net: phylink: add lock for serializing concurrent pl->phydev writes with resolverLinux
- CVE-2025-39902mm/slub: avoid accessing metadata when pointer is invalid in object_err()Linux
- CVE-2025-39901i40e: remove read access to debugfs filesLinux
- CVE-2025-39897net: xilinx: axienet: Add error handling for RX metadata pointer retrievalLinux
- CVE-2025-39896accel/ivpu: Prevent recovery work from being queued during device removalLinux
- CVE-2025-39894netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirmLinux
- CVE-2025-11226Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and JaninoQOS.CH Sarl Logback-core · ch.qos.logback:logback-core
- CVE-2025-10538Authentication Bypass in LG Innotek CameraLG Innotek Camera Model LND7210 · LG Innotek Camera Model L…
- CVE-2025-28357A CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute arbitrary code via supplying a crafted HTTP
- CVE-2025-46205A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0.10.5 allows attackers to cause a Denial of Servic
- CVE-2025-52039In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request
- CVE-2025-52040In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows
- CVE-2025-52041In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vul
- CVE-2025-52042In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.
- CVE-2025-56515File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality.fiora
- CVE-2025-56588Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the cdolibarr/dolibarr
- CVE-2025-57393A stored cross-site scripting (XSS) in Kissflow Work Platform Kissflow Application Versions 7337 Account v2.0 to v4.2vallows attackers to ex
- CVE-2025-59681An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.djangoproject Django · django
- CVE-2025-59684DigiSign DigiSigner ONE 1.0.4.60 allows DLL Hijacking.
- CVE-2025-60991A reflected cross-site scripted (XSS) vulnerability in Codazon Magento Themes v1.1.0.0 to v2.4.7 allows attackers to execute arbitrary Javas
- CVE-2025-61045TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAge
Medium, low and unrated 160
- CVE-2025-61583TS3 Manager is vulnerable to unauthenticated reflected XSS attack due to insecure error handlingjoni1802 ts3-manager
- CVE-2025-61587Weblate integration with Anubis can lead to Open Redirect via redir parameterWeblateOrg weblate · weblate
- CVE-2025-23355NVIDIA Nsight Graphics for Windows contains a vulnerability in an ngfx component, where an attacker could cause a DLL highjacking attack.NVIDIA Nsight Graphics
- CVE-2025-59337Discourse: Cross-Site Data Exposure via Backup Restore Metacommand Injection in Multisite Deploymentsdiscourse
- CVE-2025-59149Suricata: Stack buffer overflow in rule parser when processing long keywords with transformsOISF suricata
- CVE-2025-58769auth0-PHP: Improper File Type Handling in Bulk User Importlaravel-auth0 · auth0/auth0-php
- CVE-2025-58055Discourse AI Suggestions Contain Insecure Direct Object Referencediscourse
- CVE-2025-10578HP Support Assistant - Potential Escalation of PrivilegeHP Support Assistant
- CVE-2025-58054Discourse is vulnerable to XSS when quoting chat messagesdiscourse
- CVE-2023-49883IBM Transformation Extender Advanced information disclosureIBM Transformation Extender Advanced
- CVE-2023-50300IBM Transformation Extender Advanced improper access controlIBM Transformation Extender Advanced
- CVE-2023-49881IBM Transformation Extender Advanced session fixationIBM Transformation Extender Advanced
- CVE-2025-34182Deciso OPNsense < 25.7.4 /interfaces_ppps_edit.php ptpid Stored XSSDeciso OPNsense
- CVE-2025-11233Rust standard library didn't detect all path separators on CygwinRust Project std
- CVE-2025-20357Cisco CyberVision Center Reports Stored Cross-Site Scripting VulnerabilityCisco Cyber Vision
- CVE-2025-20356Cisco CyberVision Center Sensor Explorer Stored Cross-Site Scripting VulnerabilityCisco Cyber Vision
- CVE-2025-20361Cisco Unified Communications Manager Stored Cross-Site Scripting VulnerabilityCisco Unified Communications Manager
- CVE-2025-20368Stored Cross-Site Scripting (XSS) through missing field warning messages in Saved Search and Job Inspector on Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2025-20367Reflected Cross-site Scripting (XSS) in '/app/search/table' endpoint through the 'dataset.command' parameter on Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2025-20370Denial of Service (DoS) through Multiple LDAP Bind Requests in Splunk EnterpriseSplunk Enterprise
- CVE-2025-20366Improper Access Control in Background Job Submission in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2025-20369Extensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2023-50301IBM Transformation Extender Advanced information disclosureIBM Transformation Extender Advanced
- CVE-2025-41421Privilege Escalation via Symbolic Link Spoofing in TeamViewer ClientTeamViewer Full Client · TeamViewer Host
- CVE-2025-40648Stored Cross-Site Scripting (XSS) vulnerability in Issabel productsissabel-pbx module Issabel · Issabel, issabel-agenda module…
- CVE-2025-40647Stored Cross-Site Scripting (XSS) vulnerability in Issabel productsissabel-pbx module Issabel · Issabel, issabel-agenda module…
- CVE-2023-53532wifi: ath11k: fix deinitialization of firmware resourcesLinux
- CVE-2023-53530scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()Linux
- CVE-2023-53529wifi: rtw88: Fix memory leak in rtw88_usbLinux
- CVE-2023-53528RDMA/rxe: Fix unsafe drain work queue codeLinux
- CVE-2023-53527thunderbolt: Fix memory leak in tb_handle_dp_bandwidth_request()Linux
- CVE-2023-53525RDMA/cma: Allow UD qp_type to join multicast onlyLinux
- CVE-2023-53524wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_bufLinux
- CVE-2023-53523can: gs_usb: fix time stamp counter initializationLinux
- CVE-2023-53522cgroup,freezer: hold cpu_hotplug_lock before freezer_mutexLinux
- CVE-2023-53521scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()Linux
- CVE-2023-53519media: v4l2-mem2mem: add lock to protect parameter num_rdyLinux
- CVE-2023-53516macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFFLinux
- CVE-2023-53515virtio-mmio: don't break lifecycle of vm_devLinux
- CVE-2023-53514gpu: host1x: Fix memory leak of device namesLinux
- CVE-2023-53513nbd: fix incomplete validation of ioctl argLinux
- CVE-2023-53512scsi: mpt3sas: Fix a memory leakLinux
- CVE-2023-53511io_uring: fix fget leak when fs don't support nowait buffered readLinux
- CVE-2023-53509qed: allow sleep in qed_mcp_trace_dump()Linux
- CVE-2023-53508ublk: fail to start device if queue setup is interruptedLinux
- CVE-2023-53507net/mlx5: Unregister devlink params in case interface is downLinux
- CVE-2023-53505clk: tegra: tegra124-emc: Fix potential memory leakLinux
- CVE-2023-53503ext4: allow ext4_get_group_info() to failLinux
- CVE-2023-53501iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbindLinux
- CVE-2023-53498drm/amd/display: Fix potential null dereferenceLinux
- CVE-2023-53497media: vsp1: Replace vb2_is_streaming() with vb2_start_streaming_called()Linux
- CVE-2023-53496x86/platform/uv: Use alternate source for socket to node dataLinux
- CVE-2023-53489tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.Linux
- CVE-2023-53488IB/hfi1: Fix possible panic during hotplug removeLinux
- CVE-2022-50469staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw()Linux
- CVE-2022-50468platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init()Linux
- CVE-2022-50467scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_IDLinux
- CVE-2022-50466fs/binfmt_elf: Fix memory leak in load_elf_binary()Linux
- CVE-2022-50465ext4: fix leaking uninitialized memory in fast-commit journalLinux
- CVE-2022-50464mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2()Linux
- CVE-2022-50463powerpc/52xx: Fix a resource leak in an error handling pathLinux
- CVE-2022-50462MIPS: vpe-mt: fix possible memory leak while module exitingLinux
- CVE-2022-50461net: ethernet: ti: am65-cpsw: Fix PM runtime leakage in am65_cpsw_nuss_ndo_slave_open()Linux
- CVE-2022-50460cifs: Fix xid leak in cifs_flock()Linux
- CVE-2022-50458clk: tegra: Fix refcount leak in tegra210_clock_initLinux
- CVE-2022-50457mtd: core: Fix refcount error in del_mtd_device()Linux
- CVE-2022-50456btrfs: fix resolving backrefs for inline extent followed by preallocLinux
- CVE-2022-50453gpiolib: cdev: fix NULL-pointer dereferencesLinux
- CVE-2022-50452net: sched: cake: fix null pointer access issue when cake_init() failsLinux
- CVE-2022-50451fs/ntfs3: Fix memory leak on ntfs_fill_super() error pathLinux
- CVE-2022-50449clk: samsung: Fix memory leak in _samsung_clk_register_pll()Linux
- CVE-2022-50448mm/uffd: fix warning without PTE_MARKER_UFFD_WP compiled inLinux
- CVE-2022-50447Bluetooth: hci_conn: Fix crash on hci_create_cis_syncLinux
- CVE-2022-50446ARC: mm: fix leakage of memory allocated for PTELinux
- CVE-2022-50445xfrm: Reinject transport-mode packets through workqueueLinux
- CVE-2023-53487powerpc/rtas_flash: allow user copy to flash block cache objectsLinux
- CVE-2023-53483ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup()Linux
- CVE-2023-53482iommu: Fix error unwind in iommu_group_alloc()Linux
- CVE-2023-53480kobject: Add sanity check for kset->kobj.ktype in kset_register()Linux
- CVE-2023-53479cxl/acpi: Fix a use-after-free in cxl_parse_cfmws()Linux
- CVE-2023-53477ipv6: Add lwtunnel encap size of all siblings in nexthop calculationLinux
- CVE-2023-53476iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()Linux
- CVE-2023-53475usb: xhci: tegra: fix sleep in atomic callLinux
- CVE-2023-53472pwm: lpc32xx: Remove handling of PWM channelsLinux
- CVE-2023-53471drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx rasLinux
- CVE-2023-53470ionic: catch failure from devlink_allocLinux
- CVE-2023-53468ubifs: Fix memory leak in alloc_wbufs()Linux
- CVE-2023-53467wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie()Linux
- CVE-2023-53466wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exitLinux
- CVE-2023-53464scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()Linux
- CVE-2023-53461io_uring: wait interruptibly for request completions on exitLinux
- CVE-2023-53460wifi: rtw88: fix memory leak in rtw_usb_probe()Linux
- CVE-2023-53459HID: mcp-2221: prevent UAF in delayed workLinux
- CVE-2023-53458media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()Linux
- CVE-2023-53457FS: JFS: Fix null-ptr-deref Read in txBeginLinux
- CVE-2023-53456scsi: qla4xxx: Add length check when parsing nlattrsLinux
- CVE-2023-53455drm/vc4: drop all currently held locks if deadlock happensLinux
- CVE-2023-53453drm/radeon: free iio for atombios when driver shutdownLinux
- CVE-2023-53452wifi: rtw89: fix potential race condition between napi_init and napi_enableLinux
- CVE-2023-53451scsi: qla2xxx: Fix potential NULL pointer dereferenceLinux
- CVE-2023-53450ext4: remove a BUG_ON in ext4_mb_release_group_pa()Linux
- CVE-2023-53449s390/dasd: Fix potential memleak in dasd_eckd_init()Linux
- CVE-2023-53448fbdev: imxfb: Removed unneeded release_mem_regionLinux
- CVE-2022-50444clk: tegra20: Fix refcount leak in tegra20_clock_initLinux
- CVE-2022-50443drm/rockchip: lvds: fix PM usage counter unbalance in poweronLinux
- CVE-2022-50441net/mlx5: Lag, fix failure to cancel delayed bond workLinux
- CVE-2022-50439ASoC: mediatek: mt8173: Enable IRQ when pdata is readyLinux
- CVE-2022-50438net: hinic: fix memory leak when reading function tableLinux
- CVE-2022-50436ext4: don't set up encryption key during jbd2 transactionLinux
- CVE-2022-50435ext4: avoid crash when inline data creation follows DIO writeLinux
- CVE-2022-50434blk-mq: fix possible memleak when register 'hctx' failedLinux
- CVE-2022-50433efi: ssdt: Don't free memory if ACPI table was loaded successfullyLinux
- CVE-2022-50431ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()Linux
- CVE-2022-50430mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNINGLinux
- CVE-2022-50429memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()Linux
- CVE-2022-50428ext4: fix off-by-one errors in fast-commit block fillingLinux
- CVE-2022-50427ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()Linux
- CVE-2022-50426remoteproc: imx_dsp_rproc: Add mutex protection for workqueueLinux
- CVE-2022-50425x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctlyLinux
- CVE-2022-50424wifi: mt76: mt7921: resource leaks at mt7921_check_offload_capability()Linux
- CVE-2022-50420crypto: hisilicon/hpre - fix resource leak in remove processLinux
- CVE-2025-39926genetlink: fix genl_bind() invoking bind() after -EPERMLinux
- CVE-2025-39925can: j1939: implement NETDEV_UNREGISTER notification handlerLinux
- CVE-2025-39923dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/eesLinux
- CVE-2025-39921spi: microchip-core-qspi: stop checking viability of op->max_freq in supports_op callbackLinux
- CVE-2025-39920pcmcia: Add error handling for add_interval() in do_validate_mem()Linux
- CVE-2025-39916mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()Linux
- CVE-2025-39915net: phy: transfer phy_config_inband() locking responsibility to phylinkLinux
- CVE-2025-39914tracing: Silence warning when chunk allocation fails in trace_pid_writeLinux
- CVE-2025-39913tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.Linux
- CVE-2025-39912nfs/localio: restore creds before releasing pageio dataLinux
- CVE-2025-39911i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error pathLinux
- CVE-2025-39910mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()Linux
- CVE-2025-39909mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters()Linux
- CVE-2025-39907mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC bufferLinux
- CVE-2025-39904arm64: kexec: initialize kexec_buf struct in load_other_segments()Linux
- CVE-2025-39903of_numa: fix uninitialized memory nodes causing kernel panicLinux
- CVE-2025-39900net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=yLinux
- CVE-2025-39899mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTELinux
- CVE-2025-39895sched: Fix sched_numa_find_nth_cpu() if mask offlineLinux
- CVE-2025-39893spi: spi-qpic-snand: unregister ECC engine on probe error and device removeLinux
- CVE-2025-39892ASoC: soc-core: care NULL dirver name on snd_soc_lookup_component_nolocked()Linux
- CVE-2025-39891wifi: mwifiex: Initialize the chan_stats array to zeroLinux
- CVE-2025-9512Schema & Structured Data for WP & AMP < 1.50 - Unauthenticated Stored-XSSSchema & Structured Data for WP & AMP
- CVE-2025-9075ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns <= 2.3.10 - Authenticated (Contributor+) Stored Cross-Site Scriptingbdthemes ZoloBlocks – Gutenberg Block Editor Plugin with Ad…
- CVE-2025-10735Block For Mailchimp – Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgerybplugins Block for Mailchimp – Add Email Subscription Forms…
- CVE-2025-10744File Manager, Code editor, backup by Managefy <= 1.6.1 - Unauthenticated Information Exposuresoftdiscover File Manager, Code Editor, and Backup by Manag…
- CVE-2024-57494Cross Site Scripting vulnerability in Neto E-Commerce CMS v.6.313.0 through v.6.3115 allows a remote attacker to escalate privileges via the
- CVE-2025-43718Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such asfreedesktop Poppler
- CVE-2025-56514Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rfiora
- CVE-2025-57275Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.spdk
- CVE-2025-57389A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to exe
- CVE-2025-57444An authenticated cross-site scripting (XSS) vulnerability in the Administrative interface of Radware AlteonOS Web UI Management v33.0.4.50 a
- CVE-2025-59682An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.djangoproject Django · django
- CVE-2025-59685Kazaar 1.25.12 allows a JWT with none in the alg field.
- CVE-2025-59686Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id.
- CVE-2025-59687IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and noti
- CVE-2025-61044TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyM
- CVE-2025-61188Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability.
- CVE-2025-61189Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability.