CVEs published October 6, 2025
114 CVEs were published on October 6, 2025: 14 critical, 29 high.
- Published
- 114
- Critical
- 14
- High
- 29
- Medium
- 64
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 41
Most affected products
- Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…
- 8
- FFmpeg
- 6
- SICK AG Baggage Analytics · SICK AG Tire Analytics +2
- 6
- SICK AG Enterprise Analytics
- 5
- Tenda AC18
- 5
- Logo Software Logo Cloud
- 4
- SICK AG Baggage Analytics · SICK AG Tire Analytics +3
- 4
- D-Link DI-7100G C1
- 3
- FlowiseAI Flowise · flowise
- 3
- IBM Security Verify Access Appliance · IBM Security Verify…
- 3
Critical 14
- CVE-2025-61774PyVista has Dependency Confusion Vulnerability in that leads to RCEpyvista
- CVE-2025-61778Akka.Remote TLS did not properly implement certificate-based authenticationakkadotnet akka.net · Akka.Remote +1
- CVE-2025-36356IBM Security Verify Access privilege escalationIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2025-61777FlagForge Allows Unauthenticated Badge Template API AccessFlagForgeCTF flagForge
- CVE-2025-10363Unauthenticated RCE via .NET Deserialization in Topal Finance SoftwareTopal Solutions AG Topal Finanzbuchhaltung
- CVE-2025-59159SillyTavern Web Interface Vulnerable to DNS RebindingSillyTavern
- CVE-2025-52472XWiki Platform vulnerable to HQL injection via wiki and space search REST APIxwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…
- CVE-2025-49594XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` rightxwiki-contrib oidc · org.xwiki.contrib.oidc:oidc-authentica…
- CVE-2023-49886IBM Transformation Extender Advanced code executionIBM Transformation Extender Advanced
- CVE-2025-57247The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorre
- CVE-2025-57515A SQL injection vulnerability has been identified in Uniclare Student Portal v2.
- CVE-2025-60957OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers t
- CVE-2025-60964OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers t
- CVE-2025-60965OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers t
High 29
- CVE-2025-34251Tesla Telematics Control Unit (TCU) < v2025.14 Authentication BypassTesla Telematics Control Unit
- CVE-2025-6985XXE Vulnerability in langchain-ai/langchainlangchain-ai/langchain · langchain-text-splitters
- CVE-2025-36354IBM Security Verify Access command executionIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2025-36355IBM Security Verify Access code executionIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2025-11339D-Link DI-7100G C1 jhttpd hi_block.asp sub_4BD4F8 buffer overflowD-Link DI-7100G C1
- CVE-2025-11338D-Link DI-7100G C1 jhttpd login.cgi sub_4C0990 buffer overflowD-Link DI-7100G C1
- CVE-2025-61687FlowiseAI/Flosise has File Upload vulnerabilityFlowiseAI Flowise · flowise
- CVE-2025-59152X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limitinglitestar-org litestar · litestar
- CVE-2025-11328Tenda AC18 SetDDNSCfg stack-based overflowTenda AC18
- CVE-2025-59734Heap-buffer-overflow write in FFmpeg SANM process_ftchFFmpeg
- CVE-2025-59733Heap-buffer-overflow write in FFmpeg EXR dwa_uncompressFFmpeg
- CVE-2025-59732Heap-buffer-overflow write in FFmpeg EXR dwa_uncompressFFmpeg
- CVE-2025-59728Heap-buffer-overflow write in FFmpeg MDASH resolve_content_pathFFmpeg MPEG-DASH
- CVE-2025-11327Tenda AC18 SetUpnpCfg stack-based overflowTenda AC18
- CVE-2025-11326Tenda AC18 WifiMacFilterSet stack-based overflowTenda AC18
- CVE-2025-11325Tenda AC18 fast_setting_pppoe_set stack-based overflowTenda AC18
- CVE-2025-11324Tenda AC18 setNotUpgrade stack-based overflowTenda AC18
- CVE-2025-11323UTT 1250GW formUserStatusRemark strcpy buffer overflowUTT 1250GW
- CVE-2025-57781The installers of DENSO TEN drive recorder viewer contain an issue with the DLL search path, which may lead to insecurely loading Dynamic LiDENSO TEN Limited. Multiple installers of DENSO TEN drive r…
- CVE-2025-29192Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.FlowiseAI Flowise · flowise
- CVE-2025-50538Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.FlowiseAI Flowise · flowise
- CVE-2025-60956Cross Site Request Forgery (CSRF) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allow
- CVE-2025-60958Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attac
- CVE-2025-60959OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers t
- CVE-2025-60960OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers t
- CVE-2025-60962OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers t
- CVE-2025-60963OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers t
- CVE-2025-60967Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00 allows attac
- CVE-2025-61197An issue in Orban Optimod 5950, Optimod 5950HD, Optimod 5750, Optimod 5750HD, Optimod Trio Optimod version 1.0.0.33 - System version 2.5.26
Medium, low and unrated 71
- CVE-2025-43824The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2Liferay Portal · Liferay DXP +1
- CVE-2025-61768Kuno CMS Vulnerable to Server-Side Request Forgery (SSRF) via Unsafe SVG Uploadxuemian168 kuno
- CVE-2025-11346ILIAS Base64 Decoding unserialize deserializationILIAS
- CVE-2025-11345ILIAS Test Import unserialize deserializationILIAS
- CVE-2025-11344ILIAS Certificate Import code injectionILIAS
- CVE-2025-11343code-projects Student Crud Operation delete.php sql injectioncode-projects Student Crud Operation
- CVE-2025-11342code-projects Online Course Registration edit-course.php sql injectioncode-projects Online Course Registration
- CVE-2025-11341Jinher OA type xml external entity referenceJinher OA
- CVE-2025-61769Emlog vulnerable to stored XSS in file upload functionality in emlogemlog
- CVE-2025-0038In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow accesAMD Kria(TM) SOM · AMD Zynq UltraScale+ MPSoCs +1
- CVE-2025-61766Bucket vulnerable to infinite recursion when querying a bucket using the != operatorweirdgloop mediawiki-extensions-Bucket
- CVE-2025-61765python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deploymentsmiguelgrinberg python-socketio · python-socketio
- CVE-2025-11337Four-Faith Water Conservancy Informatization Platform download.do;othersusrlogout.do path traversalFour-Faith Water Conservancy Informatization Platform
- CVE-2025-11336Four-Faith Water Conservancy Informatization Platform download.do;otherlogout.do path traversalFour-Faith Water Conservancy Informatization Platform
- CVE-2025-11335D-Link DI-7100G C1 jhttpd msp_info.htm sub_46409C command injectionD-Link DI-7100G C1
- CVE-2025-11334Campcodes Online Apartment Visitor Management System visitor-detail.php sql injectionCampcodes Online Apartment Visitor Management System
- CVE-2025-11333langleyfcu Online Banking System Add Customer customer_add_action.php cross site scriptinglangleyfcu Online Banking System
- CVE-2025-11332CmsEasy URL view.php cross site scriptingCmsEasy
- CVE-2025-11331IdeaCMS Website Name Config.php command injectionIdeaCMS
- CVE-2025-11330PHPGurukul Beauty Parlour Management System sales-reports-detail.php sql injectionPHPGurukul Beauty Parlour Management System
- CVE-2025-0609XSS in Logo Software's Logo CloudLogo Software Logo Cloud
- CVE-2025-0608Open Redirect in Logo Software's Logo CloudLogo Software Logo Cloud
- CVE-2025-0607HTML Injection in Logo Software's Logo CloudLogo Software Logo Cloud
- CVE-2025-0606IDOR in Logo Software's Logo CloudLogo Software Logo Cloud
- CVE-2025-11329code-projects Online Course Registration manage-students.php sql injectioncode-projects Online Course Registration
- CVE-2025-59731Heap-buffer-overflow write in FFmpeg EXR dwa_uncompressFFmpeg
- CVE-2025-59730Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec48FFmpeg
- CVE-2025-59729Heap-buffer-overflow read in FFmpeg DHAV get_durationFFmpeg
- CVE-2025-58579Username Disclosure Through Missing AuthenticationSICK AG Baggage Analytics · SICK AG Tire Analytics +3
- CVE-2025-58591Path TraversalSICK AG Baggage Analytics · SICK AG Tire Analytics +2
- CVE-2025-58590Path traversalSICK AG Baggage Analytics · SICK AG Tire Analytics +2
- CVE-2025-58589Information Disclosure Through StacktraceSICK AG Baggage Analytics · SICK AG Tire Analytics +2
- CVE-2025-58587Improper Restriction of Excessive Authentication AttemptsSICK AG Baggage Analytics · SICK AG Tire Analytics +3
- CVE-2025-58586User Enumeration by excessive error outputSICK AG Baggage Analytics · SICK AG Tire Analytics +3
- CVE-2025-58585Sensitive Information Disclosure Through Missing AuthenticationSICK AG Baggage Analytics · SICK AG Tire Analytics +2
- CVE-2025-58584Plain Text Transmission of Username and Password in the URLSICK AG Baggage Analytics · SICK AG Tire Analytics +3
- CVE-2025-58583User EnumerationSICK AG Enterprise Analytics
- CVE-2025-58582Uncontrolled Resource Consumption via log fileSICK AG Enterprise Analytics
- CVE-2025-58581Information Disclosure Through Stacktrace-/MQTT/Config/changeAllSICK AG Enterprise Analytics
- CVE-2025-58580Injection via log fileSICK AG Enterprise Analytics
- CVE-2025-58578Unlimited user creation by authorized usersSICK AG Enterprise Analytics
- CVE-2025-9914The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unSICK AG Baggage Analytics · SICK AG Tire Analytics +2
- CVE-2025-9913Cross Site Scripting: Session HijackingSICK AG Baggage Analytics · SICK AG Tire Analytics +2
- CVE-2025-9710Responsive Lightbox & Gallery < 2.5.3 - Unauthenticated Stored-XSS via CommentsResponsive Lightbox & Gallery
- CVE-2025-9703Ultimate Addons for Elementor Lite < 2.5.0 - Author+ Stored XSSUltimate Addons for Elementor
- CVE-2025-11322Mangati NovoSGA User Creation new weak passwordMangati NovoSGA · novosga/novosga
- CVE-2025-11321zhuimengshaonian wisdom-education WrongBookController.java authorizationzhuimengshaonian wisdom-education
- CVE-2025-11320zhuimengshaonian wisdom-education UploadController.java uploadFile unrestricted uploadzhuimengshaonian wisdom-education
- CVE-2025-11319nahiduddinahammed Hospital-Management-System-Website delete.php sql injectionnahiduddinahammed Hospital-Management-System-Website
- CVE-2025-11318Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 uploadWxFile.do unrestricted uploadTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…
- CVE-2025-11317Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findSingConfigPage.do findRolePage sql injectionTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…
- CVE-2025-11316Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findCategoryPage.do findCategoryPage sql injectionTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…
- CVE-2025-11315Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findUserPage.do findUserPage sql injectionTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…
- CVE-2025-11314Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findSingConfigPage.do findRolePage sql injectionTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…
- CVE-2025-11313Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findRolePage.do findRolePage sql injectionTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…
- CVE-2025-11312Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findModulePage.do findModulePage sql injectionTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…
- CVE-2025-11311Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findTenantPage.do findTenantPage sql injectionTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…
- CVE-2025-28129Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking.
- CVE-2025-56382A stored Cross-site scripting (XSS) vulnerability exists in the Customer Management Module of LionCoders SalePro POS 5.4.8.
- CVE-2025-59447The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface.YoSmart YoLink Smart Hub
- CVE-2025-59448Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet.YoSmart YoLink ecosystem
- CVE-2025-59449The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowYoSmart YoLink MQTT broker
- CVE-2025-59450The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials.YoSmart YoLink Smart Hub
- CVE-2025-59451The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes.YoSmart YoLink application
- CVE-2025-59452The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secYoSmart YoLink API
- CVE-2025-60961Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attac
- CVE-2025-60969Directory Traversal vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00 allows attackers to
- CVE-2025-61198A stored cross-site scripting (XSS) vulnerability in Optimod 5950 - Optimod 5950HD - Optimod 5750 - Optimod 5750HD - Optimod Trio - Optimod
- CVE-2025-61224Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q pa
- CVE-2025-61984ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leadinOpenBSD OpenSSH
- CVE-2025-61985ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.OpenBSD OpenSSH