CVEs published October 3, 2025
157 CVEs were published on October 3, 2025: 10 critical, 39 high.
- Published
- 157
- Critical
- 10
- High
- 39
- Medium
- 103
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 73
Most affected products
- QNAP Systems QTS · QNAP Systems QuTS hero
- 24
- QNAP Systems Qsync Central
- 15
- cursor
- 6
- Delta Electronics DIAScreen
- 4
- redis
- 4
- Zabbix
- 4
- hovanesvn AP Background
- 3
- OpenSupports
- 3
- anthropics claude-code · @anthropic-ai/claude-code
- 2
- ekndev WP Dispatcher
- 2
Critical 10
- CVE-2025-49844Redis Lua Use-After-Free may lead to remote code executionredis
- CVE-2025-10729Use-after-free vulnerability in Qt SVG qsvghandler.cpp allows denial of service via crafted SVGQt
- CVE-2025-10728Uncontrolled recursion in Qt SVG moduleQt
- CVE-2025-10547CVE-2025-10547DrayTek Vigor1000B · DrayTek Vigor2962 +15
- CVE-2025-40636SQL injection in the mod_vvisit_counter modulemod_vvisit_counter
- CVE-2025-7721JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusionbeardev JoomSport – for Sports: Team & League, Football, Ho…
- CVE-2025-9286Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_passwordhancock11 Appy Pie Connect for WooCommerce
- CVE-2025-9209RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWTmagnigenie RestroPress – Online Food Ordering System
- CVE-2025-10726WPRecovery <= 2.0 - Unauthenticated SQL Injection to Arbitrary File Deletionquantumrose WPRecovery
- CVE-2025-6388Spirit Framework <= 1.2.14 - Authentication Bypass to Account Takeover and Privilege EscalationTheme-Spirit Spirit Framework
High 39
- CVE-2025-61679Anyquery Unauthenticated Access Vulnerability Exposes Private Integration Datajulien040 anyquery
- CVE-2025-61673Karapace is vulnerable to Authentication BypassAiven-Open karapace
- CVE-2025-10696OpenSupports 4.11.0 — Insecure Direct Object Reference in supervised listOpenSupports
- CVE-2025-10692OpenSupports 4.11.0 — SQL InjectionOpenSupports
- CVE-2025-59944Cursor IDE: Sensitive File Overwrite Bypass is Possiblecursor
- CVE-2025-59943phpMyFAQ duplicate email registration allows multiple accounts with the same emailthorsten phpMyFAQ · thorsten/phpmyfaq
- CVE-2025-54374Eidos: One-click Remote Code Execution through Custom URL Handlingmayneyao eidos
- CVE-2025-52656HCL MyXalytics product is affected by Mass Assignment vulnerabilityHCL MyXalytics
- CVE-2025-57714NetBak ReplicatorQNAP Systems NetBak Replicator
- CVE-2025-54153Qsync CentralQNAP Systems Qsync Central
- CVE-2025-53595Qsync CentralQNAP Systems Qsync Central
- CVE-2025-44014Qsync CentralQNAP Systems Qsync Central
- CVE-2025-44012Qsync CentralQNAP Systems Qsync Central
- CVE-2025-44007Qsync CentralQNAP Systems Qsync Central
- CVE-2025-44006Qsync CentralQNAP Systems Qsync Central
- CVE-2025-33040Qsync CentralQNAP Systems Qsync Central
- CVE-2025-33039Qsync CentralQNAP Systems Qsync Central
- CVE-2025-52653Cross Site Scripting vulnerability in the web applicationHCL MyXalytics
- CVE-2025-46817Lua library commands may lead to integer overflow and potential RCEredis
- CVE-2025-61593Cursor CLI Agent: Sensitive File Overwrite Bypasscursor
- CVE-2025-61592Cursor CLI: Arbitrary Code Execution Possible through Permissive CLI Configcursor
- CVE-2025-61591Cursor CLI's Cursor Agent MCP OAuth2 Communication is Vulnerable to Remote Code Executioncursor
- CVE-2025-61590Cursor is vulnerable to RCE via .code-workspace files using Prompt Injectioncursor
- CVE-2025-34226OpenPLC Runtime v3 Persistent DoSAutonomy Logic OpenPLC Runtime
- CVE-2025-27237DLL injection in Zabbix Agent and Agent 2 via OpenSSL configurationZabbix
- CVE-2025-9212WP Dispatcher <= 1.2.0 - Authenticated (Subscriber+) Arbitrary File Uploadekndev WP Dispatcher
- CVE-2025-9561AP Background 3.8.1 - 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload via advParallaxBackAdminSaveSlider Functionhovanesvn AP Background
- CVE-2025-10582WP Dispatcher <= 1.2.0 - Authenticated (Contributor+) SQL Injectionekndev WP Dispatcher
- CVE-2025-9200Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App <= 0.8.8.8 - Unauthenticated SQL Injectionnebelhorn Blappsta Mobile App Plugin – Your native, mobile…
- CVE-2025-9213TextBuilder 1.0.0 - 1.1.1 - Cross-Site Request Forgery to Privilege Escalation via Account TakeoverTextBuilder
- CVE-2025-11234Qemu-kvm: vnc websocket handshake use-after-freeqemu · Red Hat Enterprise Linux +1
- CVE-2025-0616SQLi in Teknolojik Center Telecommunication's B2B - Netsis PanelTeknolojik Center Telecommunication Industry Trade Co. B2B…
- CVE-2025-11223Installer of Panasonic AutoDownloader version 1.2.8 contains an issue with the DLL search path, which may lead to loading a craftPanasonic AutoDownloader
- CVE-2025-59536Claude Code's startup trust dialog could lead to Command Execution attackanthropics claude-code · @anthropic-ai/claude-code
- CVE-2025-61597Emlog Pro is vulnerable to stored XSS attack through HTML template injectionemlog
- CVE-2025-55972A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS)
- CVE-2025-56551An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with a
- CVE-2025-59489Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code fUnity3D Unity Editor
- CVE-2025-60787MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name.motioneye
Medium, low and unrated 108
- CVE-2025-61685Mastra Docs MCP Server `@mastra/mcp-docs-server` Leads to Information Exposuremastra-ai mastra · @mastra/mcp-docs-server
- CVE-2025-61681Kuno is Vulnerable to Stored XSS Attack via SVG File Uploadxuemian168 kuno
- CVE-2025-61680Minecraft RCON Terminal: Plain Text Password Storage in Configurationjaketcooper Minecraft-rcon
- CVE-2025-61677DataChain: Deserialization of Untrusted Data from Environment Variablesiterative datachain · datachain
- CVE-2025-43825A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3Liferay Portal · Liferay DXP +1
- CVE-2025-10695OpenSupports 4.11.0 — SSRF via test imap and smtp endpointsOpenSupports
- CVE-2025-59829Claude Code: Permission deny bypass is possible through symlinkanthropics claude-code · @anthropic-ai/claude-code
- CVE-2025-53354NiceGUI is vulnerable to Reflected XSS attackzauberzeug nicegui · nicegui
- CVE-2025-46819Redis is vulnerable to DoS via specially crafted LUA scriptsredis
- CVE-2025-46818Redis: Authenticated users can execute LUA scripts as a different userredis
- CVE-2025-52658HCL MyXalytics is affected by the use of vulnerable/outdated versionsHCL Software MyXalytics
- CVE-2025-54154QNAP AuthenticatorQNAP Systems QNAP Authenticator
- CVE-2025-53407QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-53406QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52867Qsync CentralQNAP Systems Qsync Central
- CVE-2025-52866QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52862QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52860QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52859QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52858QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52857QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52855QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52854QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52853QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52433QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52432QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52429QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52654HCL MyXalytics is affected by an HTML InjectionHCL Software HCL MyXalytics
- CVE-2025-52428QTSQNAP Systems QTS
- CVE-2025-52427QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-52424QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-48730QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-48729QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-48728QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-48727QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-48726QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-47214QTSQNAP Systems QTS
- CVE-2025-47213QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-47212QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-47211QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2025-47210Qsync CentralQNAP Systems Qsync Central
- CVE-2025-44011Qsync CentralQNAP Systems Qsync Central
- CVE-2025-44010Qsync CentralQNAP Systems Qsync Central
- CVE-2025-44009Qsync CentralQNAP Systems Qsync Central
- CVE-2025-44008Qsync CentralQNAP Systems Qsync Central
- CVE-2025-33034Qsync CentralQNAP Systems Qsync Central
- CVE-2024-56804Video StationQNAP Systems Video Station
- CVE-2025-10609Hardcoded Credentials in Logo Software's TigerWings ERPLogo Software TigerWings ERP
- CVE-2025-49641Insufficient permission check for the problem.view.refresh actionZabbix
- CVE-2025-27236User information disclosure via api_jsonrpc.php on method user.get with param searchZabbix
- CVE-2025-0876XSS in Isin Basi Advertisement & IT's WorkifIsin Basi Advertisement Information Technologies Trade IT's…
- CVE-2025-27231LDAP 'Bind password' field value can be leaked by a Zabbix Super AdminZabbix
- CVE-2025-10302Ultimate Viral Quiz <= 1.0 - Cross-Site Request Forgery to Settings Updatehameha Ultimate Viral Quiz
- CVE-2025-10165AP Background <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scriptinghovanesvn AP Background
- CVE-2025-9897AP Background <= 3.8.2 - Cross-Site Request Forgeryhovanesvn AP Background
- CVE-2025-9194Constructor <= 1.6.5 - Missing Authorization to Authenticated (Subscriber+) Theme Cleanantonshevchuk Constructor
- CVE-2025-9204X Addons for Elementor <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Video ID Fieldpencilwp X Addons for Elementor
- CVE-2025-9129Flexi <= 4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via flexi-form-tag Shortcodeodude Flexi – Guest Submit
- CVE-2025-7825Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiationwpt00ls Schema Plugin For Divi, Gutenberg & Shortcodes
- CVE-2025-9895Notification Bar <= 2.2 - Cross-Site Request Forgeryumarbajwa Notification Bar
- CVE-2025-9858Auto Bulb Finder for WordPress <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingmtoolstec Auto Bulb Finder for WordPress
- CVE-2025-9630WP SinoType <= 1.0 - Cross-Site Request Forgerysamueljesse WP SinoType
- CVE-2025-9889ContentMX Content Publisher <= 1.0.6 - Cross-Site Request ForgeryContentMX Content Publisher
- CVE-2025-8669Customify <= 0.4.11 - Cross-Site Request Forgerypressmaximum Customify
- CVE-2025-9859Fintelligence Calculator <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingambitioncloud Fintelligence Calculator
- CVE-2025-8776Epic Bootstrap Buttons <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icol Parametermikemayhem3030 Epic Bootstrap Buttons
- CVE-2025-9372Ultimate Multi Design Video Carousel <= 1.4 - Authenticated (Editor+) Stored Cross-Site Scriptinggbsdeveloper Ultimate Multi Design Video Carousel
- CVE-2025-9892Restrict User Registration <= 1.0.1 - Cross-Site Request Forgery to Settings Updatedevrix Restrict User Registration
- CVE-2025-9199Woo superb slideshow transition gallery with random effect <= 9.1 - Authenticated (Contributor+) SQL Injectiongopiplus Woo superb slideshow transition gallery with rando…
- CVE-2025-10309PayPal Forms <= 1.0.3 - Cross-Site Request Forgerybsmye PayPal Forms
- CVE-2025-10053TableGen – Data Table Generator <= 1.3.1 - Authenticated (Admin+) Stored Cross-Site Scriptingexlac TableGen – Data Table Generator
- CVE-2025-9206Meks Easy Maps <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingmekshq Meks Easy Maps
- CVE-2025-9080Generic Elements <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingbdevs Generic Elements
- CVE-2025-9854A Simple Multilanguage Plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingpiupiiu A Simple Multilanguage Plugin
- CVE-2025-9945Optimize More! – CSS <= 1.0.3 - Cross-Site Request Forgery to Plugin Settings Resetaryadhiratara Optimize More! – CSS
- CVE-2025-10306Backup Bolt <= 1.4.1 - Authenticated (Admin+) Arbitrary File Downloadbackupbolt Backup Bolt
- CVE-2025-10192WP Photo Effects <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodemuhammad-rehman WP Photo Effects
- CVE-2025-9884Mobile Site Redirect <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scriptingwebdevabq Mobile Site Redirect
- CVE-2025-9077Ultra Addons Lite for Elementor <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Fieldultrapressorg Ultra Addons Lite for Elementor
- CVE-2025-9332Interactive Medical Drawing of Human Body <= 2.6 - Authenticated (Admin+) Stored Cross-Site Scriptingclickanatomy Interactive Human Anatomy with Clickable Body…
- CVE-2025-9876Ird Slider <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scriptinginforrada Ird Slider
- CVE-2025-9875Event Tickets, RSVPs, Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingticketspot Event Tickets, RSVPs, Calendar
- CVE-2025-9198Wp cycle text announcement <= 8.1 - Authenticated (Contributor+) SQL Injectiongopi_plus Wp cycle text announcement
- CVE-2025-9885MPWizard – Create Mercado Pago Payment Links <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletionlaudanumsoft MPWizard – Create Mercado Pago Payment Links
- CVE-2025-9333Smart Docs <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scriptingibachal Smart Docs
- CVE-2025-9130Unify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcodecodeclouds Unify
- CVE-2025-10311Comment Info Detector <= 1.0.5 - Cross-Site Request Forgery to Settings Updatetom_riddle Comment Info Detector
- CVE-2025-9045Easy Elementor Addons <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scriptinghashthemes Easy Elementor Addons – Addons Pack for Elemento…
- CVE-2025-10212SiteAlert (Formerly WP Health) <= 1.9.8 - Missing Authorization to Unauthenticated Site Health Information ExposureSiteAlert
- CVE-2025-61589Cursor: Potential Information Leakage via Mermaid Diagramcursor
- CVE-2025-61599Emlog is Vulnerable to Stored Cross-Site Scripting (XSS) in "Twitter" Feature via Markdown Inputemlog
- CVE-2025-59300File Parsing Out-Of-Bounds Write Vulnerability in DIAScreenDelta Electronics DIAScreen
- CVE-2025-59299File Parsing Out-Of-Bounds Write Vulnerability in DIAScreenDelta Electronics DIAScreen
- CVE-2025-59298File Parsing Out-Of-Bounds Write Vulnerability in DIAScreenDelta Electronics DIAScreen
- CVE-2025-59297File Parsing Out-Of-Bounds Write Vulnerability in DIAScreenDelta Electronics DIAScreen
- CVE-2025-11241Yoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingYoast SEO Premium
- CVE-2021-42193nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id].
- CVE-2025-55971TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthentic
- CVE-2025-57423A SQL injection vulnerability was discovered in the /articles endpoint of MyClub 0.5, affecting the query parameters Content, GroupName, Per
- CVE-2025-60445A stored Cross-Site Scripting (XSS) vulnerability has been discovered in XunRuiCMS version 4.7.1.
- CVE-2025-60447A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19.
- CVE-2025-60448A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19.
- CVE-2025-60449An information disclosure vulnerability has been discovered in SeaCMS 13.1.
- CVE-2025-60450A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.
- CVE-2025-60451A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.
- CVE-2025-60452A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.
- CVE-2025-60453A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.
- CVE-2025-60454A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.