# CVEs published 2025-10-04

159 CVEs were published on October 4, 2025: 7 critical, 49 high. Days are UTC.

- [CVE-2025-11273](https://cve.now/CVE-2025-11273.md): LaChatterie Verger provider.ts redirectToAuthorization deserialization (CVSS 5.3, LaChatterie Verger)
- [CVE-2025-11272](https://cve.now/CVE-2025-11272.md): SeriaWei ZKEACMS POST Request UrlRedirectionController.cs Delete improper authorization (CVSS 5.3, SeriaWei ZKEACMS)
- [CVE-2023-53616](https://cve.now/CVE-2023-53616.md): jfs: fix invalid free of JFS\_IP(ipimap)-\>i\_imap in diUnmount (CVSS 7.8, Linux)
- [CVE-2023-53615](https://cve.now/CVE-2023-53615.md): scsi: qla2xxx: Fix deletion race condition (CVSS 8.8, Linux)
- [CVE-2023-53614](https://cve.now/CVE-2023-53614.md): mm/ksm: fix race with VMA iteration and mm\_struct teardown (no CVSS, Linux)
- [CVE-2023-53613](https://cve.now/CVE-2023-53613.md): dax: Fix dax\_mapping\_release() use after free (no CVSS, Linux)
- [CVE-2023-53612](https://cve.now/CVE-2023-53612.md): hwmon: (coretemp) Simplify platform device handling (no CVSS, Linux)
- [CVE-2023-53611](https://cve.now/CVE-2023-53611.md): ipmi\_si: fix a memleak in try\_smi\_init() (no CVSS, Linux)
- [CVE-2023-53610](https://cve.now/CVE-2023-53610.md): irqchip: Fix refcount leak in platform\_irqchip\_probe (no CVSS, Linux)
- [CVE-2023-53609](https://cve.now/CVE-2023-53609.md): scsi: Revert "scsi: core: Do not increase scsi\_device's iorequest\_cnt if dispatch failed" (CVSS 7.8, Linux)
- [CVE-2023-53608](https://cve.now/CVE-2023-53608.md): nilfs2: fix potential UAF of struct nilfs\_sc\_info in nilfs\_segctor\_thread() (CVSS 7.8, Linux)
- [CVE-2023-53607](https://cve.now/CVE-2023-53607.md): ALSA: ymfpci: Fix BUG\_ON in probe function (no CVSS, Linux)
- [CVE-2023-53606](https://cve.now/CVE-2023-53606.md): nfsd: clean up potential nfsd\_file refcount leaks in COPY codepath (CVSS 7.5, Linux)
- [CVE-2023-53605](https://cve.now/CVE-2023-53605.md): drm: amd: display: Fix memory leakage (no CVSS, Linux)
- [CVE-2023-53604](https://cve.now/CVE-2023-53604.md): dm integrity: call kmem\_cache\_destroy() in dm\_integrity\_init() error path (no CVSS, Linux)
- [CVE-2023-53603](https://cve.now/CVE-2023-53603.md): scsi: qla2xxx: Avoid fcport pointer dereference (no CVSS, Linux)
- [CVE-2023-53602](https://cve.now/CVE-2023-53602.md): wifi: ath11k: fix memory leak in WMI firmware stats (no CVSS, Linux)
- [CVE-2023-53601](https://cve.now/CVE-2023-53601.md): bonding: do not assume skb mac\_header is set (no CVSS, Linux)
- [CVE-2023-53600](https://cve.now/CVE-2023-53600.md): tunnels: fix kasan splat when generating ipv4 pmtu error (CVSS 9.1, Linux)
- [CVE-2023-53599](https://cve.now/CVE-2023-53599.md): crypto: af\_alg - Fix missing initialisation affecting gcm-aes-s390 (CVSS 7.8, Linux)
- [CVE-2023-53598](https://cve.now/CVE-2023-53598.md): bus: mhi: host: Range check CHDBOFF and ERDBOFF (CVSS 8.4, Linux)
- [CVE-2023-53597](https://cve.now/CVE-2023-53597.md): cifs: fix mid leak during reconnection after timeout threshold (CVSS 7.5, Linux)
- [CVE-2023-53596](https://cve.now/CVE-2023-53596.md): drivers: base: Free devm resources when unregistering a device (no CVSS, Linux)
- [CVE-2023-53595](https://cve.now/CVE-2023-53595.md): octeontx2-pf: mcs: Fix NULL pointer dereferences (no CVSS, Linux)
- [CVE-2023-53594](https://cve.now/CVE-2023-53594.md): driver core: fix resource leak in device\_add() (no CVSS, Linux)
- [CVE-2023-53593](https://cve.now/CVE-2023-53593.md): cifs: Release folio lock on fscache read hit. (no CVSS, Linux)
- [CVE-2023-53592](https://cve.now/CVE-2023-53592.md): gpio: sifive: Fix refcount leak in sifive\_gpio\_probe (no CVSS, Linux)
- [CVE-2023-53591](https://cve.now/CVE-2023-53591.md): net/mlx5e: Fix deadlock in tc route query code (no CVSS, Linux)
- [CVE-2023-53590](https://cve.now/CVE-2023-53590.md): sctp: add a refcnt in sctp\_stream\_priorities to avoid a nested loop (no CVSS, Linux)
- [CVE-2023-53589](https://cve.now/CVE-2023-53589.md): wifi: iwlwifi: mvm: don't trust firmware n\_channels (CVSS 8.8, Linux)
- [CVE-2023-53588](https://cve.now/CVE-2023-53588.md): wifi: mac80211: check for station first in client probe (no CVSS, Linux)
- [CVE-2023-53587](https://cve.now/CVE-2023-53587.md): ring-buffer: Sync IRQ works before buffer destruction (CVSS 7.8, Linux)
- [CVE-2023-53586](https://cve.now/CVE-2023-53586.md): scsi: target: Fix multiple LUN\_RESET handling (CVSS 8.8, Linux)
- [CVE-2023-53585](https://cve.now/CVE-2023-53585.md): bpf: reject unhashed sockets in bpf\_sk\_assign (no CVSS, Linux)
- [CVE-2023-53584](https://cve.now/CVE-2023-53584.md): ubifs: ubifs\_releasepage: Remove ubifs\_assert(0) to valid this process (no CVSS, Linux)
- [CVE-2023-53583](https://cve.now/CVE-2023-53583.md): perf: RISC-V: Remove PERF\_HES\_STOPPED flag checking in riscv\_pmu\_start() (no CVSS, Linux)
- [CVE-2023-53582](https://cve.now/CVE-2023-53582.md): wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds (no CVSS, Linux)
- [CVE-2023-53581](https://cve.now/CVE-2023-53581.md): net/mlx5e: Check for NOT\_READY flag state after locking (no CVSS, Linux)
- [CVE-2023-53580](https://cve.now/CVE-2023-53580.md): USB: Gadget: core: Help prevent panic during UVC unconfigure (CVSS 7.8, Linux)
- [CVE-2022-50508](https://cve.now/CVE-2022-50508.md): wifi: mt76: mt76x0: fix oob access in mt76x0\_phy\_get\_target\_power (CVSS 7.1, Linux)
- [CVE-2022-50507](https://cve.now/CVE-2022-50507.md): fs/ntfs3: Validate data run offset (CVSS 7.8, Linux)
- [CVE-2022-50506](https://cve.now/CVE-2022-50506.md): drbd: only clone bio if we have a backing device (no CVSS, Linux)
- [CVE-2022-50505](https://cve.now/CVE-2022-50505.md): iommu/amd: Fix pci device refcount leak in ppr\_notifier() (no CVSS, Linux)
- [CVE-2022-50504](https://cve.now/CVE-2022-50504.md): powerpc/rtas: avoid scheduling in rtas\_os\_term() (no CVSS, Linux)
- [CVE-2022-50503](https://cve.now/CVE-2022-50503.md): mtd: lpddr2\_nvm: Fix possible null-ptr-deref (no CVSS, Linux)
- [CVE-2022-50501](https://cve.now/CVE-2022-50501.md): media: coda: Add check for dcoda\_iram\_alloc (no CVSS, Linux)
- [CVE-2022-50500](https://cve.now/CVE-2022-50500.md): netdevsim: fix memory leak in nsim\_drv\_probe() when nsim\_dev\_resources\_register() failed (no CVSS, Linux)
- [CVE-2022-50499](https://cve.now/CVE-2022-50499.md): media: dvb-core: Fix double free in dvb\_register\_device() (no CVSS, Linux)
- [CVE-2022-50498](https://cve.now/CVE-2022-50498.md): eth: alx: take rtnl\_lock on resume (no CVSS, Linux)
- [CVE-2022-50497](https://cve.now/CVE-2022-50497.md): binfmt\_misc: fix shift-out-of-bounds in check\_special\_flags (no CVSS, Linux)
- [CVE-2022-50496](https://cve.now/CVE-2022-50496.md): dm cache: Fix UAF in destroy() (no CVSS, Linux)
- [CVE-2022-50494](https://cve.now/CVE-2022-50494.md): thermal: intel\_powerclamp: Use get\_cpu() instead of smp\_processor\_id() to avoid crash (no CVSS, Linux)
- [CVE-2022-50493](https://cve.now/CVE-2022-50493.md): scsi: qla2xxx: Fix crash when I/O abort times out (CVSS 8.8, Linux)
- [CVE-2022-50492](https://cve.now/CVE-2022-50492.md): drm/msm: fix use-after-free on probe deferral (CVSS 7.8, Linux)
- [CVE-2022-50491](https://cve.now/CVE-2022-50491.md): coresight: cti: Fix hang in cti\_disable\_hw() (no CVSS, Linux)
- [CVE-2022-50490](https://cve.now/CVE-2022-50490.md): bpf: Propagate error from htab\_lock\_bucket() to userspace (CVSS 7.1, Linux)
- [CVE-2022-50489](https://cve.now/CVE-2022-50489.md): drm/mipi-dsi: Detach devices when removing the host (no CVSS, Linux)
- [CVE-2022-50488](https://cve.now/CVE-2022-50488.md): block, bfq: fix possible uaf for 'bfqq-\>bic' (CVSS 7.8, Linux)
- [CVE-2023-53579](https://cve.now/CVE-2023-53579.md): gpio: mvebu: fix irq domain leak (no CVSS, Linux)
- [CVE-2023-53578](https://cve.now/CVE-2023-53578.md): net: qrtr: Fix an uninit variable access bug in qrtr\_tx\_resume() (no CVSS, Linux)
- [CVE-2023-53577](https://cve.now/CVE-2023-53577.md): bpf, cpumap: Make sure kthread is running before map update returns (CVSS 7.8, Linux)
- [CVE-2023-53576](https://cve.now/CVE-2023-53576.md): null\_blk: Always check queue mode setting from configfs (no CVSS, Linux)
- [CVE-2023-53575](https://cve.now/CVE-2023-53575.md): wifi: iwlwifi: mvm: fix potential array out of bounds access (no CVSS, Linux)
- [CVE-2023-53574](https://cve.now/CVE-2023-53574.md): wifi: rtw88: delete timer and free skb queue when unloading (no CVSS, Linux)
- [CVE-2023-53573](https://cve.now/CVE-2023-53573.md): clk: rs9: Fix suspend/resume (no CVSS, Linux)
- [CVE-2023-53572](https://cve.now/CVE-2023-53572.md): clk: imx: scu: use \_safe list iterator to avoid a use after free (CVSS 7.0, Linux)
- [CVE-2023-53571](https://cve.now/CVE-2023-53571.md): drm/i915: Make intel\_get\_crtc\_new\_encoder() less oopsy (no CVSS, Linux)
- [CVE-2023-53570](https://cve.now/CVE-2023-53570.md): wifi: nl80211: fix integer overflow in nl80211\_parse\_mbssid\_elems() (CVSS 7.8, Linux)
- [CVE-2023-53569](https://cve.now/CVE-2023-53569.md): ext2: Check block size validity during mount (no CVSS, Linux)
- [CVE-2023-53568](https://cve.now/CVE-2023-53568.md): s390/zcrypt: don't leak memory if dev\_set\_name() fails (no CVSS, Linux)
- [CVE-2023-53567](https://cve.now/CVE-2023-53567.md): spi: qup: Don't skip cleanup in remove's error path (no CVSS, Linux)
- [CVE-2023-53566](https://cve.now/CVE-2023-53566.md): netfilter: nft\_set\_rbtree: fix null deref on element insertion (CVSS 7.8, Linux)
- [CVE-2023-53565](https://cve.now/CVE-2023-53565.md): wifi: brcmfmac: Check for probe() id argument being NULL (no CVSS, Linux)
- [CVE-2023-53564](https://cve.now/CVE-2023-53564.md): ocfs2: fix defrag path triggering jbd2 ASSERT (no CVSS, Linux)
- [CVE-2023-53563](https://cve.now/CVE-2023-53563.md): cpufreq: amd-pstate-ut: Fix kernel panic when loading the driver (no CVSS, Linux)
- [CVE-2023-53562](https://cve.now/CVE-2023-53562.md): drm/msm: fix vram leak on bind errors (no CVSS, Linux)
- [CVE-2023-53561](https://cve.now/CVE-2023-53561.md): net: wwan: iosm: fix NULL pointer dereference when removing device (no CVSS, Linux)
- [CVE-2023-53560](https://cve.now/CVE-2023-53560.md): tracing/histograms: Add histograms to hist\_vars if they have referenced variables (CVSS 7.8, Linux)
- [CVE-2023-53559](https://cve.now/CVE-2023-53559.md): ip\_vti: fix potential slab-use-after-free in decode\_session6 (CVSS 7.8, Linux)
- [CVE-2023-53558](https://cve.now/CVE-2023-53558.md): rcu-tasks: Avoid pr\_info() with spin lock in cblist\_init\_generic() (no CVSS, Linux)
- [CVE-2023-53557](https://cve.now/CVE-2023-53557.md): fprobe: Release rethook after the ftrace\_ops is unregistered (CVSS 7.8, Linux)
- [CVE-2023-53556](https://cve.now/CVE-2023-53556.md): iavf: Fix use-after-free in free\_netdev (CVSS 7.8, Linux)
- [CVE-2023-53555](https://cve.now/CVE-2023-53555.md): mm/damon/core: initialize damo\_filter-\>list from damos\_new\_filter() (no CVSS, Linux)
- [CVE-2023-53554](https://cve.now/CVE-2023-53554.md): staging: ks7010: potential buffer overflow in ks\_wlan\_set\_encode\_ext() (CVSS 7.8, Linux)
- [CVE-2023-53553](https://cve.now/CVE-2023-53553.md): HID: hyperv: avoid struct memcpy overrun warning (no CVSS, Linux)
- [CVE-2023-53552](https://cve.now/CVE-2023-53552.md): drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CVSS 7.8, Linux)
- [CVE-2023-53551](https://cve.now/CVE-2023-53551.md): usb: gadget: u\_serial: Add null pointer check in gserial\_resume (no CVSS, Linux)
- [CVE-2023-53550](https://cve.now/CVE-2023-53550.md): cpufreq: amd-pstate: fix global sysfs attribute type (no CVSS, Linux)
- [CVE-2023-53549](https://cve.now/CVE-2023-53549.md): netfilter: ipset: Rework long task execution when adding/deleting entries (no CVSS, Linux)
- [CVE-2023-53548](https://cve.now/CVE-2023-53548.md): net: usbnet: Fix WARNING in usbnet\_start\_xmit/usb\_submit\_urb (no CVSS, Linux)
- [CVE-2023-53547](https://cve.now/CVE-2023-53547.md): drm/amdgpu: Fix sdma v4 sw fini error (no CVSS, Linux)
- [CVE-2023-53546](https://cve.now/CVE-2023-53546.md): net/mlx5: DR, fix memory leak in mlx5dr\_cmd\_create\_reformat\_ctx (no CVSS, Linux)
- [CVE-2023-53545](https://cve.now/CVE-2023-53545.md): drm/amdgpu: unmap and remove csa\_va properly (CVSS 7.8, Linux)
- [CVE-2023-53544](https://cve.now/CVE-2023-53544.md): cpufreq: davinci: Fix clk use after free (no CVSS, Linux)
- [CVE-2023-53543](https://cve.now/CVE-2023-53543.md): vdpa: Add max vqp attr to vdpa\_nl\_policy for nlattr length check (no CVSS, Linux)
- [CVE-2023-53542](https://cve.now/CVE-2023-53542.md): ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy (no CVSS, Linux)
- [CVE-2023-53541](https://cve.now/CVE-2023-53541.md): mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write (no CVSS, Linux)
- [CVE-2023-53540](https://cve.now/CVE-2023-53540.md): wifi: cfg80211: reject auth/assoc to AP with our address (CVSS 7.1, Linux)
- [CVE-2023-53539](https://cve.now/CVE-2023-53539.md): RDMA/rxe: Fix incomplete state save in rxe\_requester (CVSS 7.8, Linux)
- [CVE-2023-53538](https://cve.now/CVE-2023-53538.md): btrfs: insert tree mod log move in push\_node\_left (no CVSS, Linux)
- [CVE-2023-53537](https://cve.now/CVE-2023-53537.md): f2fs: fix to avoid use-after-free for cached IPU bio (CVSS 7.8, Linux)
- [CVE-2023-53536](https://cve.now/CVE-2023-53536.md): blk-crypto: make blk\_crypto\_evict\_key() more robust (CVSS 7.8, Linux)
- [CVE-2023-53535](https://cve.now/CVE-2023-53535.md): net: bcmgenet: Add a check for oversized packets (CVSS 7.1, Linux)
- [CVE-2023-53534](https://cve.now/CVE-2023-53534.md): drm/mediatek: mtk\_drm\_crtc: Add checks for devm\_kcalloc (no CVSS, Linux)
- [CVE-2023-53533](https://cve.now/CVE-2023-53533.md): Input: raspberrypi-ts - fix refcount leak in rpi\_ts\_probe (no CVSS, Linux)
- [CVE-2022-50486](https://cve.now/CVE-2022-50486.md): net: ethernet: ti: Fix return type of netcp\_ndo\_start\_xmit() (no CVSS, Linux)
- [CVE-2022-50485](https://cve.now/CVE-2022-50485.md): ext4: add EXT4\_IGET\_BAD flag to prevent unexpected bad inode (no CVSS, Linux)
- [CVE-2022-50484](https://cve.now/CVE-2022-50484.md): ALSA: usb-audio: Fix potential memory leaks (no CVSS, Linux)
- [CVE-2022-50483](https://cve.now/CVE-2022-50483.md): net: enetc: avoid buffer leaks on xdp\_do\_redirect() failure (CVSS 7.5, Linux)
- [CVE-2022-50482](https://cve.now/CVE-2022-50482.md): iommu/vt-d: Clean up si\_domain in the init\_dmars() error path (no CVSS, Linux)
- [CVE-2022-50481](https://cve.now/CVE-2022-50481.md): cxl: fix possible null-ptr-deref in cxl\_guest\_init\_afu|adapter() (no CVSS, Linux)
- [CVE-2022-50480](https://cve.now/CVE-2022-50480.md): memory: pl353-smc: Fix refcount leak bug in pl353\_smc\_probe() (no CVSS, Linux)
- [CVE-2022-50479](https://cve.now/CVE-2022-50479.md): drm/amd: fix potential memory leak (no CVSS, Linux)
- [CVE-2022-50478](https://cve.now/CVE-2022-50478.md): nilfs2: fix shift-out-of-bounds/overflow in nilfs\_sb2\_bad\_offset() (no CVSS, Linux)
- [CVE-2022-50477](https://cve.now/CVE-2022-50477.md): rtc: class: Fix potential memleak in devm\_rtc\_allocate\_device() (no CVSS, Linux)
- [CVE-2022-50476](https://cve.now/CVE-2022-50476.md): ntb\_netdev: Use dev\_kfree\_skb\_any() in interrupt context (no CVSS, Linux)
- [CVE-2022-50475](https://cve.now/CVE-2022-50475.md): RDMA/core: Make sure "ib\_port" is valid when access sysfs node (no CVSS, Linux)
- [CVE-2022-50474](https://cve.now/CVE-2022-50474.md): macintosh: fix possible memory leak in macio\_add\_one\_device() (no CVSS, Linux)
- [CVE-2022-50473](https://cve.now/CVE-2022-50473.md): cpufreq: Init completion before kobject\_init\_and\_add() (no CVSS, Linux)
- [CVE-2022-50472](https://cve.now/CVE-2022-50472.md): IB/mad: Don't call to function that might sleep while in atomic context (CVSS 7.5, Linux)
- [CVE-2022-50471](https://cve.now/CVE-2022-50471.md): xen/gntdev: Accommodate VMA splitting (no CVSS, Linux)
- [CVE-2022-50470](https://cve.now/CVE-2022-50470.md): xhci: Remove device endpoints from bandwidth list when freeing the device (no CVSS, Linux)
- [CVE-2025-39953](https://cve.now/CVE-2025-39953.md): cgroup: split cgroup\_destroy\_wq into 3 workqueues (no CVSS, Linux)
- [CVE-2025-39952](https://cve.now/CVE-2025-39952.md): wifi: wilc1000: avoid buffer overflow in WID string configuration (CVSS 8.8, Linux)
- [CVE-2025-39951](https://cve.now/CVE-2025-39951.md): um: virtio\_uml: Fix use-after-free after put\_device in probe (CVSS 7.8, Linux)
- [CVE-2025-39950](https://cve.now/CVE-2025-39950.md): net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP\_REPAIR (no CVSS, Linux)
- [CVE-2025-39949](https://cve.now/CVE-2025-39949.md): qed: Don't collect too many protection override GRC elements (CVSS 7.8, Linux)
- [CVE-2025-39948](https://cve.now/CVE-2025-39948.md): ice: fix Rx page leak on multi-buffer frames (CVSS 9.8, Linux)
- [CVE-2025-39947](https://cve.now/CVE-2025-39947.md): net/mlx5e: Harden uplink netdev access against device unbind (no CVSS, Linux)
- [CVE-2025-39946](https://cve.now/CVE-2025-39946.md): tls: make sure to abort the stream if headers are bogus (CVSS 9.8, Linux)
- [CVE-2025-39945](https://cve.now/CVE-2025-39945.md): cnic: Fix use-after-free bugs in cnic\_delete\_task (CVSS 7.8, Linux)
- [CVE-2025-39944](https://cve.now/CVE-2025-39944.md): octeontx2-pf: Fix use-after-free bugs in otx2\_sync\_tstamp() (CVSS 7.8, Linux)
- [CVE-2025-39943](https://cve.now/CVE-2025-39943.md): ksmbd: smbdirect: validate data\_offset and data\_length field of smb\_direct\_data\_transfer (CVSS 9.4, Linux)
- [CVE-2025-39942](https://cve.now/CVE-2025-39942.md): ksmbd: smbdirect: verify remaining\_data\_length respects max\_fragmented\_recv\_size (CVSS 7.5, Linux)
- [CVE-2025-39941](https://cve.now/CVE-2025-39941.md): zram: fix slot write race condition (CVSS 7.8, Linux)
- [CVE-2025-39940](https://cve.now/CVE-2025-39940.md): dm-stripe: fix a possible integer overflow (no CVSS, Linux)
- [CVE-2025-39939](https://cve.now/CVE-2025-39939.md): iommu/s390: Fix memory corruption when using identity domain (CVSS 7.8, Linux)
- [CVE-2025-39938](https://cve.now/CVE-2025-39938.md): ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (no CVSS, Linux)
- [CVE-2025-39937](https://cve.now/CVE-2025-39937.md): net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (no CVSS, Linux)
- [CVE-2025-39936](https://cve.now/CVE-2025-39936.md): crypto: ccp - Always pass in an error pointer to \_\_sev\_platform\_shutdown\_locked() (no CVSS, Linux)
- [CVE-2025-39935](https://cve.now/CVE-2025-39935.md): ASoC: codec: sma1307: Fix memory corruption in sma1307\_setting\_loaded() (CVSS 7.8, Linux)
- [CVE-2025-39934](https://cve.now/CVE-2025-39934.md): drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (no CVSS, Linux)
- [CVE-2025-39933](https://cve.now/CVE-2025-39933.md): smb: client: let recv\_done verify data\_offset, data\_length and remaining\_data\_length (CVSS 9.4, Linux)
- [CVE-2025-39932](https://cve.now/CVE-2025-39932.md): smb: client: let smbd\_destroy() call disable\_work\_sync(&info-\>post\_send\_credits\_work) (CVSS 9.8, Linux)
- [CVE-2025-39931](https://cve.now/CVE-2025-39931.md): crypto: af\_alg - Set merge to zero early in af\_alg\_sendmsg (CVSS 7.8, Linux)
- [CVE-2025-39929](https://cve.now/CVE-2025-39929.md): smb: client: fix smbdirect\_recv\_io leak in smbd\_negotiate() error path (CVSS 7.5, Linux)
- [CVE-2025-9886](https://cve.now/CVE-2025-9886.md): Trinity Audio \<= 5.20.2 - Cross-Site Request Forgery (CVSS 4.3, sergiotrinity Trinity Audio – Text to Speech AI audio playe…)
- [CVE-2025-10383](https://cve.now/CVE-2025-10383.md): Contest Gallery – Upload, Vote & Sell with PayPal and Stripe \<= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, contest-gallery Contest Gallery – Upload & Vote Photos, Med…)
- [CVE-2025-9952](https://cve.now/CVE-2025-9952.md): Trinity Audio \<= 5.20.2 - Reflected Cross-Site Scripting (CVSS 6.1, sergiotrinity Trinity Audio – Text to Speech AI audio playe…)
- [CVE-2025-9029](https://cve.now/CVE-2025-9029.md): WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder \<= 1.2.16 - Missing Authentication via wdkit\_handle\_review\_submission Function (CVSS 4.3, posimyththemes WDesignKit – Elementor & Gutenberg Starter T…)
- [CVE-2025-9030](https://cve.now/CVE-2025-9030.md): Majestic Before After Image \<= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, maneshtimilsina Majestic Before After Image)
- [CVE-2025-11228](https://cve.now/CVE-2025-11228.md): GiveWP – Donation Plugin and Fundraising Platform \<= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association (CVSS 5.3, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2025-9485](https://cve.now/CVE-2025-9485.md): OAuth Single Sign On – SSO (OAuth Client) \<= 6.26.12 - Authentication Bypass via get\_resource\_owner\_from\_id\_token() (CVSS 9.8, cyberlord92 OAuth Single Sign On – SSO)
- [CVE-2025-10746](https://cve.now/CVE-2025-10746.md): Integrate Dynamics 365 CRM \<= 1.0.9 - Missing Authorization (CVSS 6.5, cyberlord92 Integrate Dynamics 365 CRM)
- [CVE-2025-9243](https://cve.now/CVE-2025-9243.md): Cost Calculator Builder \<= 3.5.32 - Authenticated (Subscriber+) Missing Authorization via get\_cc\_orders/update\_order\_status Functions (CVSS 8.1, stylemix Cost Calculator Builder)
- [CVE-2025-8726](https://cve.now/CVE-2025-8726.md): WP Photo Album Plus \<= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa\_user\_upload (CVSS 5.4, opajaap WP Photo Album Plus)
- [CVE-2025-11227](https://cve.now/CVE-2025-11227.md): GiveWP – Donation Plugin and Fundraising Platform \<= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure (CVSS 6.5, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2025-10751](https://cve.now/CVE-2025-10751.md): MacForge 1.2.0 Beta 1 - Local Privilege Escalation (CVSS 8.5, MacEnhance MacForge)
- [CVE-2025-61962](https://cve.now/CVE-2025-61962.md): In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. (CVSS 5.9, fetchmail)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.