CVEs published October 2, 2025
120 CVEs were published on October 2, 2025: 17 critical, 39 high.
- Published
- 120
- Critical
- 17
- High
- 39
- Medium
- 62
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 37
Most affected products
- AndSoft e-TMS
- 40
- Canonical LXD · github.com/canonical/lxd
- 6
- LabRedesCefetRJ WeGIA
- 5
- Absolute Security Secure Access
- 4
- Creativeitem Ekushey CRM
- 3
- KEYENCE VT STUDIO
- 3
- SUSE rancher · github.com/rancher/rancher
- 3
- Apache Software Foundation Apache Kylin · org.apache.kyl… +6
- 2
- GTONE ChangeFlow
- 2
- KEYENCE KV STUDIO
- 2
Critical 17
- CVE-2025-61605WeGIA: SQL Injection (Blind Time-Based) Vulnerability in /pet/profile_pet.php EndpointLabRedesCefetRJ WeGIA
- CVE-2025-61603WeGIA: SQL Injection (Blind Time-Based) Vulnerability in API `descricao` ParameterLabRedesCefetRJ WeGIA
- CVE-2025-34210Vasion Print (formerly PrinterLogic) Readable Cleartext PasswordsVasion Print Virtual Appliance Host · Vasion Print Applicat…
- CVE-2025-59743Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59742Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59741Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59740Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59739Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59738Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59737Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59736Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59735Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-41064Incorrect authentication in GTT´s group OpenSIACGTT OpenSIAC
- CVE-2025-9697Ajax WooSearch <= 1.0.0 - Unauthenticated SQL InjectionAjax WooSearch
- CVE-2025-11221Remote Code Execution in GTONE ChangeFlowGTONE ChangeFlow
- CVE-2025-59403The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentication.
- CVE-2025-59407The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow Licens
High 39
- CVE-2025-61668@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous userplone volto · @plone/volto
- CVE-2025-61600Unbounded Memory Allocation in Stalwart IMAP parserstalwartlabs stalwart
- CVE-2025-61666Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config Filetraccar
- CVE-2025-61665WeGIA: Broken Access Control in `get_relatorios_socios.php` EndpointLabRedesCefetRJ WeGIA
- CVE-2025-61604WeGIA: Cross-Site Request Forgery (CSRF) Vulnerability in `control.php` EndpointLabRedesCefetRJ WeGIA
- CVE-2025-10653Raise3D Pro2 Series 3D Printers Authentication Bypass Using an Alternate Path or ChannelRaise3D Pro2 Series
- CVE-2025-61595MANTRA tx gas limit is not enforced in send hooksMANTRA-Chain mantrachain · github.com/MANTRA-Chain/mantr… +3
- CVE-2025-59835LangBot has a cross-directory file upload vulnerability, which could lead to system takeoverlangbot-app LangBot
- CVE-2025-34208Vasion Print (formerly PrinterLogic) Insecure Password HashingVasion Print Virtual Appliance Host · Vasion Print Applicat…
- CVE-2025-59744Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2024-58260Rancher update on users can deny the service to the adminSUSE rancher · github.com/rancher/rancher
- CVE-2024-58267Rancher CLI SAML authentication is vulnerable to phishing attacksSUSE rancher · github.com/rancher/rancher
- CVE-2025-54293Path Traversal in LXD Instance Log File RetrievalCanonical LXD · github.com/canonical/lxd
- CVE-2025-61735Apache Kylin: Server-Side Request ForgeryApache Software Foundation Apache Kylin · org.apache.kyl… +6
- CVE-2025-61733Apache Kylin: Authentication bypassApache Software Foundation Apache Kylin · org.apache.kyl… +1
- CVE-2025-61734Apache Kylin: improper restriction of file readApache Software Foundation Apache Kylin · org.apache.kyl… +6
- CVE-2025-40645Exposure of sensitive information in VidayViDay
- CVE-2025-54289Privilege Escalation via WebSocket Connection Hijacking in LXD Operations APICanonical LXD · github.com/canonical/lxd
- CVE-2025-54287Arbitrary File Read via Template Injection in Snapshot PatternsCanonical LXD · github.com/lxc/lxd +1
- CVE-2025-54286CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UICanonical LXD · github.com/canonical/lxd
- CVE-2025-9587CTL Behance Importer Lite <= 1.0 - Unauthenticated SQL InjectionCTL Behance Importer Lite
- CVE-2025-61690KV STUDIO versions 12.23 and prior contain a buffer underflow vulnerability.KEYENCE KV STUDIO
- CVE-2025-61692VT STUDIO versions 8.53 and prior contain a use after free vulnerability.KEYENCE VT STUDIO
- CVE-2025-61691VT STUDIO versions 8.53 and prior contain an out-of-bounds read vulnerability.KEYENCE VT STUDIO
- CVE-2025-58777VT Studio versions 8.53 and prior contain an access of uninitialized pointer vulnerability.KEYENCE VT STUDIO
- CVE-2025-58776KV Studio versions 12.23 and prior contain a stack-based buffer overflow vulnerability.KEYENCE KV STUDIO
- CVE-2025-58775KV STUDIO and VT5-WX15/WX12 contain a stack-based buffer overflow vulnerability.KEYENCE KV STUDIO · KEYENCE VT5-WX15/WX12
- CVE-2025-11020Remote Code Execution in MarkAny SafePC EnterpriseMarkAny SafePC Enterprise
- CVE-2025-11182File Download in GTONE ChangeFlowGTONE ChangeFlow
- CVE-2023-28760TP-Link AX1800 WiFi 6 Router (Archer AX21) devices allow unauthenticated attackers (on the LAN) to execute arbitrary code as root via the db
- CVE-2025-32942SSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic.SSH Tectia Server
- CVE-2025-49090The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution.Matrix specification
- CVE-2025-54315The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.Matrix specification
- CVE-2025-56161YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module.
- CVE-2025-59405The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate
- CVE-2025-59409Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartex
- CVE-2025-60660Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the mac parameter in the fromAdvSetMacMtuWan function.
- CVE-2025-60662Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanSpeed parameter in the fromAdvSetMacMtuWan function.
- CVE-2025-60663Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanMTU parameter in the fromAdvSetMacMtuWan function.
Medium, low and unrated 64
- CVE-2025-61606WeGIA: Open Redirect Vulnerability in `control.php` endpointLabRedesCefetRJ WeGIA
- CVE-2025-54089Cross-site Scripting vulnerability in Secure Access prior to 14.10Absolute Security Secure Access
- CVE-2025-54088Open Redirect in Secure Access prior to 14.10Absolute Security Secure Access
- CVE-2025-54087Server-side request forgery in Secure AccessAbsolute Security Secure Access
- CVE-2025-54086Excess Permissions in WarehouseAbsolute Security Secure Access
- CVE-2025-59774Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59773Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59772Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59771Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59770Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59769Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59768Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59767Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59766Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59765Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59764Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59763Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59762Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59761Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59760Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59759Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59758Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59757Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59756Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59755Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59754Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59753Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59752Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59751Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59750Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59749Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59748Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59747Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59746Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-59745Multiple vulnerabilities in AndSoft's e-TMSAndSoft e-TMS
- CVE-2025-53881SUSE-specific logrotate configuration allows escalation from mail user/group to rootopenSUSE Tumbleweed
- CVE-2025-22862An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.Fortinet FortiProxy · Fortinet FortiOS
- CVE-2025-0642Hard-coded Credentials in PosCube's AssistPosCube Hardware Software and Consulting Ltd. Assist
- CVE-2025-11240Open redirect vulnerability in KNIME Business HubKNIME Business Hub
- CVE-2025-11239Job details are visible to all team members on KNIME Business HubKNIME Business Hub
- CVE-2025-41010Cross-origin resource sharing (CORS) in Hiberus SintraHiberus Sintra
- CVE-2025-40992Stored XSS in Creativeitem SocioproCreativeitem Sociopro
- CVE-2025-40991Stored XSS in Creativeitem Ekushey CRMCreativeitem Ekushey CRM
- CVE-2025-40990Stored XSS in Creativeitem Ekushey CRMCreativeitem Ekushey CRM
- CVE-2025-40989Stored XSS in Creativeitem Ekushey CRMCreativeitem Ekushey CRM
- CVE-2025-54468Rancher sends sensitive information to external services through the `/meta/proxy` endpointSUSE rancher · github.com/rancher/rancher
- CVE-2025-40646Exposure of sensitive information in VidayViDay
- CVE-2025-54292Client-Side Path Traversal in LXD-UICanonical LXD
- CVE-2025-54291Project existence disclosure in LXD images APICanonical LXD · github.com/canonical/lxd
- CVE-2025-54290Project Existence Disclosure via Error Handling in LXD Image ExportCanonical LXD · github.com/canonical/lxd
- CVE-2025-54288Source Container Identification Vulnerability via cmdline Spoofing in devLXD ServerCanonical LXD · github.com/canonical/lxd
- CVE-2025-56019An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to co
- CVE-2025-56154htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application.
- CVE-2025-56162YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint.
- CVE-2025-56379A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scr
- CVE-2025-56380Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value
- CVE-2025-56381ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via
- CVE-2025-57305VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp.
- CVE-2025-57443FrostWire 6.14.0-build-326 for macOS contains permissive entitlements (allow-dyld-environment-variables, disable-library-validation) that al
- CVE-2025-59406The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers
- CVE-2025-60661Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the cloneType parameter in the fromAdvSetMacMtuWan function.
- CVE-2025-60782PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) stored Cross-Site Scripting (XSS) vulnerability in the topics managem
- CVE-2025-61087SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer M
- CVE-2025-61096PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping/login.php via the fullname parameter.