# CVEs published 2025-10-06

114 CVEs were published on October 6, 2025: 14 critical, 29 high. Days are UTC.

- [CVE-2025-34251](https://cve.now/CVE-2025-34251.md): Tesla Telematics Control Unit (TCU) \< v2025.14 Authentication Bypass (CVSS 8.6, Tesla Telematics Control Unit)
- [CVE-2025-61774](https://cve.now/CVE-2025-61774.md): PyVista has Dependency Confusion Vulnerability in that leads to RCE (CVSS 9.3, pyvista)
- [CVE-2025-43824](https://cve.now/CVE-2025-43824.md): The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2 (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-61768](https://cve.now/CVE-2025-61768.md): Kuno CMS Vulnerable to Server-Side Request Forgery (SSRF) via Unsafe SVG Upload (CVSS 5.1, xuemian168 kuno)
- [CVE-2025-11346](https://cve.now/CVE-2025-11346.md): ILIAS Base64 Decoding unserialize deserialization (CVSS 5.3, ILIAS)
- [CVE-2025-11345](https://cve.now/CVE-2025-11345.md): ILIAS Test Import unserialize deserialization (CVSS 5.1, ILIAS)
- [CVE-2025-11344](https://cve.now/CVE-2025-11344.md): ILIAS Certificate Import code injection (CVSS 5.3, ILIAS)
- [CVE-2025-11343](https://cve.now/CVE-2025-11343.md): code-projects Student Crud Operation delete.php sql injection (CVSS 6.9, code-projects Student Crud Operation)
- [CVE-2025-6985](https://cve.now/CVE-2025-6985.md): XXE Vulnerability in langchain-ai/langchain (CVSS 7.5, langchain-ai/langchain · langchain-text-splitters)
- [CVE-2025-11342](https://cve.now/CVE-2025-11342.md): code-projects Online Course Registration edit-course.php sql injection (CVSS 5.1, code-projects Online Course Registration)
- [CVE-2025-11341](https://cve.now/CVE-2025-11341.md): Jinher OA type xml external entity reference (CVSS 6.9, Jinher OA)
- [CVE-2025-36354](https://cve.now/CVE-2025-36354.md): IBM Security Verify Access command execution (CVSS 7.3, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2025-61778](https://cve.now/CVE-2025-61778.md): Akka.Remote TLS did not properly implement certificate-based authentication (CVSS 9.3, akkadotnet akka.net · Akka.Remote +1)
- [CVE-2025-36355](https://cve.now/CVE-2025-36355.md): IBM Security Verify Access code execution (CVSS 8.5, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2025-36356](https://cve.now/CVE-2025-36356.md): IBM Security Verify Access privilege escalation (CVSS 9.3, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2025-61777](https://cve.now/CVE-2025-61777.md): FlagForge Allows Unauthenticated Badge Template API Access (CVSS 9.4, FlagForgeCTF flagForge)
- [CVE-2025-10363](https://cve.now/CVE-2025-10363.md): Unauthenticated RCE via .NET Deserialization in Topal Finance Software (CVSS 10.0, Topal Solutions AG Topal Finanzbuchhaltung)
- [CVE-2025-11339](https://cve.now/CVE-2025-11339.md): D-Link DI-7100G C1 jhttpd hi\_block.asp sub\_4BD4F8 buffer overflow (CVSS 8.7, D-Link DI-7100G C1)
- [CVE-2025-61769](https://cve.now/CVE-2025-61769.md): Emlog vulnerable to stored XSS in file upload functionality in emlog (CVSS 2.1, emlog)
- [CVE-2025-0038](https://cve.now/CVE-2025-0038.md): In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow acces (CVSS 6.6, AMD Kria(TM) SOM · AMD Zynq UltraScale+ MPSoCs +1)
- [CVE-2025-61766](https://cve.now/CVE-2025-61766.md): Bucket vulnerable to infinite recursion when querying a bucket using the != operator (CVSS 6.5, weirdgloop mediawiki-extensions-Bucket)
- [CVE-2025-61765](https://cve.now/CVE-2025-61765.md): python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments (CVSS 6.4, miguelgrinberg python-socketio · python-socketio)
- [CVE-2025-11338](https://cve.now/CVE-2025-11338.md): D-Link DI-7100G C1 jhttpd login.cgi sub\_4C0990 buffer overflow (CVSS 8.7, D-Link DI-7100G C1)
- [CVE-2025-61687](https://cve.now/CVE-2025-61687.md): FlowiseAI/Flosise has File Upload vulnerability (CVSS 8.3, FlowiseAI Flowise · flowise)
- [CVE-2025-59159](https://cve.now/CVE-2025-59159.md): SillyTavern Web Interface Vulnerable to DNS Rebinding (CVSS 9.7, SillyTavern)
- [CVE-2025-59152](https://cve.now/CVE-2025-59152.md): X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting (CVSS 7.5, litestar-org litestar · litestar)
- [CVE-2025-52472](https://cve.now/CVE-2025-52472.md): XWiki Platform vulnerable to HQL injection via wiki and space search REST API (CVSS 9.3, xwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…)
- [CVE-2025-49594](https://cve.now/CVE-2025-49594.md): XWiki OIDC Authenticator vulnerable to creation of token for any user with just \`view\` right (CVSS 9.2, xwiki-contrib oidc · org.xwiki.contrib.oidc:oidc-authentica…)
- [CVE-2023-49886](https://cve.now/CVE-2023-49886.md): IBM Transformation Extender Advanced code execution (CVSS 9.8, IBM Transformation Extender Advanced)
- [CVE-2025-11337](https://cve.now/CVE-2025-11337.md): Four-Faith Water Conservancy Informatization Platform download.do;othersusrlogout.do path traversal (CVSS 6.9, Four-Faith Water Conservancy Informatization Platform)
- [CVE-2025-11336](https://cve.now/CVE-2025-11336.md): Four-Faith Water Conservancy Informatization Platform download.do;otherlogout.do path traversal (CVSS 6.9, Four-Faith Water Conservancy Informatization Platform)
- [CVE-2025-11335](https://cve.now/CVE-2025-11335.md): D-Link DI-7100G C1 jhttpd msp\_info.htm sub\_46409C command injection (CVSS 5.1, D-Link DI-7100G C1)
- [CVE-2025-11334](https://cve.now/CVE-2025-11334.md): Campcodes Online Apartment Visitor Management System visitor-detail.php sql injection (CVSS 6.9, Campcodes Online Apartment Visitor Management System)
- [CVE-2025-11333](https://cve.now/CVE-2025-11333.md): langleyfcu Online Banking System Add Customer customer\_add\_action.php cross site scripting (CVSS 4.8, langleyfcu Online Banking System)
- [CVE-2025-11332](https://cve.now/CVE-2025-11332.md): CmsEasy URL view.php cross site scripting (CVSS 5.1, CmsEasy)
- [CVE-2025-11331](https://cve.now/CVE-2025-11331.md): IdeaCMS Website Name Config.php command injection (CVSS 5.1, IdeaCMS)
- [CVE-2025-11330](https://cve.now/CVE-2025-11330.md): PHPGurukul Beauty Parlour Management System sales-reports-detail.php sql injection (CVSS 5.3, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-0609](https://cve.now/CVE-2025-0609.md): XSS in Logo Software's Logo Cloud (CVSS 4.7, Logo Software Logo Cloud)
- [CVE-2025-0608](https://cve.now/CVE-2025-0608.md): Open Redirect in Logo Software's Logo Cloud (CVSS 5.5, Logo Software Logo Cloud)
- [CVE-2025-0607](https://cve.now/CVE-2025-0607.md): HTML Injection in Logo Software's Logo Cloud (CVSS 4.3, Logo Software Logo Cloud)
- [CVE-2025-0606](https://cve.now/CVE-2025-0606.md): IDOR in Logo Software's Logo Cloud (CVSS 6.0, Logo Software Logo Cloud)
- [CVE-2025-11329](https://cve.now/CVE-2025-11329.md): code-projects Online Course Registration manage-students.php sql injection (CVSS 6.9, code-projects Online Course Registration)
- [CVE-2025-11328](https://cve.now/CVE-2025-11328.md): Tenda AC18 SetDDNSCfg stack-based overflow (CVSS 8.7, Tenda AC18)
- [CVE-2025-59734](https://cve.now/CVE-2025-59734.md): Heap-buffer-overflow write in FFmpeg SANM process\_ftch (CVSS 8.7, FFmpeg)
- [CVE-2025-59733](https://cve.now/CVE-2025-59733.md): Heap-buffer-overflow write in FFmpeg EXR dwa\_uncompress (CVSS 8.7, FFmpeg)
- [CVE-2025-59732](https://cve.now/CVE-2025-59732.md): Heap-buffer-overflow write in FFmpeg EXR dwa\_uncompress (CVSS 8.7, FFmpeg)
- [CVE-2025-59731](https://cve.now/CVE-2025-59731.md): Heap-buffer-overflow write in FFmpeg EXR dwa\_uncompress (CVSS 6.9, FFmpeg)
- [CVE-2025-59730](https://cve.now/CVE-2025-59730.md): Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old\_codec48 (CVSS 5.7, FFmpeg)
- [CVE-2025-59729](https://cve.now/CVE-2025-59729.md): Heap-buffer-overflow read in FFmpeg DHAV get\_duration (CVSS 5.7, FFmpeg)
- [CVE-2025-59728](https://cve.now/CVE-2025-59728.md): Heap-buffer-overflow write in FFmpeg MDASH resolve\_content\_path (CVSS 8.7, FFmpeg MPEG-DASH)
- [CVE-2025-11327](https://cve.now/CVE-2025-11327.md): Tenda AC18 SetUpnpCfg stack-based overflow (CVSS 8.7, Tenda AC18)
- [CVE-2025-11326](https://cve.now/CVE-2025-11326.md): Tenda AC18 WifiMacFilterSet stack-based overflow (CVSS 8.7, Tenda AC18)
- [CVE-2025-58579](https://cve.now/CVE-2025-58579.md): Username Disclosure Through Missing Authentication (CVSS 5.3, SICK AG Baggage Analytics · SICK AG Tire Analytics +3)
- [CVE-2025-58591](https://cve.now/CVE-2025-58591.md): Path Traversal (CVSS 6.5, SICK AG Baggage Analytics · SICK AG Tire Analytics +2)
- [CVE-2025-58590](https://cve.now/CVE-2025-58590.md): Path traversal (CVSS 6.5, SICK AG Baggage Analytics · SICK AG Tire Analytics +2)
- [CVE-2025-58589](https://cve.now/CVE-2025-58589.md): Information Disclosure Through Stacktrace (CVSS 2.7, SICK AG Baggage Analytics · SICK AG Tire Analytics +2)
- [CVE-2025-58587](https://cve.now/CVE-2025-58587.md): Improper Restriction of Excessive Authentication Attempts (CVSS 6.5, SICK AG Baggage Analytics · SICK AG Tire Analytics +3)
- [CVE-2025-58586](https://cve.now/CVE-2025-58586.md): User Enumeration by excessive error output (CVSS 5.3, SICK AG Baggage Analytics · SICK AG Tire Analytics +3)
- [CVE-2025-11325](https://cve.now/CVE-2025-11325.md): Tenda AC18 fast\_setting\_pppoe\_set stack-based overflow (CVSS 8.7, Tenda AC18)
- [CVE-2025-58585](https://cve.now/CVE-2025-58585.md): Sensitive Information Disclosure Through Missing Authentication (CVSS 5.3, SICK AG Baggage Analytics · SICK AG Tire Analytics +2)
- [CVE-2025-58584](https://cve.now/CVE-2025-58584.md): Plain Text Transmission of Username and Password in the URL (CVSS 5.3, SICK AG Baggage Analytics · SICK AG Tire Analytics +3)
- [CVE-2025-58583](https://cve.now/CVE-2025-58583.md): User Enumeration (CVSS 5.3, SICK AG Enterprise Analytics)
- [CVE-2025-58582](https://cve.now/CVE-2025-58582.md): Uncontrolled Resource Consumption via log file (CVSS 5.3, SICK AG Enterprise Analytics)
- [CVE-2025-58581](https://cve.now/CVE-2025-58581.md): Information Disclosure Through Stacktrace-/MQTT/Config/changeAll (CVSS 4.3, SICK AG Enterprise Analytics)
- [CVE-2025-58580](https://cve.now/CVE-2025-58580.md): Injection via log file (CVSS 6.5, SICK AG Enterprise Analytics)
- [CVE-2025-58578](https://cve.now/CVE-2025-58578.md): Unlimited user creation by authorized users (CVSS 3.8, SICK AG Enterprise Analytics)
- [CVE-2025-9914](https://cve.now/CVE-2025-9914.md): The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain un (CVSS 4.3, SICK AG Baggage Analytics · SICK AG Tire Analytics +2)
- [CVE-2025-9913](https://cve.now/CVE-2025-9913.md): Cross Site Scripting: Session Hijacking (CVSS 4.5, SICK AG Baggage Analytics · SICK AG Tire Analytics +2)
- [CVE-2025-11324](https://cve.now/CVE-2025-11324.md): Tenda AC18 setNotUpgrade stack-based overflow (CVSS 8.7, Tenda AC18)
- [CVE-2025-11323](https://cve.now/CVE-2025-11323.md): UTT 1250GW formUserStatusRemark strcpy buffer overflow (CVSS 8.7, UTT 1250GW)
- [CVE-2025-9710](https://cve.now/CVE-2025-9710.md): Responsive Lightbox & Gallery \< 2.5.3 - Unauthenticated Stored-XSS via Comments (CVSS 6.3, Responsive Lightbox & Gallery)
- [CVE-2025-9703](https://cve.now/CVE-2025-9703.md): Ultimate Addons for Elementor Lite \< 2.5.0 - Author+ Stored XSS (CVSS 4.3, Ultimate Addons for Elementor)
- [CVE-2025-11322](https://cve.now/CVE-2025-11322.md): Mangati NovoSGA User Creation new weak password (CVSS 6.3, Mangati NovoSGA · novosga/novosga)
- [CVE-2025-57781](https://cve.now/CVE-2025-57781.md): The installers of DENSO TEN drive recorder viewer contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Li (CVSS 7.8, DENSO TEN Limited. Multiple installers of DENSO TEN drive r…)
- [CVE-2025-11321](https://cve.now/CVE-2025-11321.md): zhuimengshaonian wisdom-education WrongBookController.java authorization (CVSS 5.3, zhuimengshaonian wisdom-education)
- [CVE-2025-11320](https://cve.now/CVE-2025-11320.md): zhuimengshaonian wisdom-education UploadController.java uploadFile unrestricted upload (CVSS 5.3, zhuimengshaonian wisdom-education)
- [CVE-2025-11319](https://cve.now/CVE-2025-11319.md): nahiduddinahammed Hospital-Management-System-Website delete.php sql injection (CVSS 5.3, nahiduddinahammed Hospital-Management-System-Website)
- [CVE-2025-11318](https://cve.now/CVE-2025-11318.md): Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 uploadWxFile.do unrestricted upload (CVSS 6.9, Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…)
- [CVE-2025-11317](https://cve.now/CVE-2025-11317.md): Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findSingConfigPage.do findRolePage sql injection (CVSS 6.9, Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…)
- [CVE-2025-11316](https://cve.now/CVE-2025-11316.md): Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findCategoryPage.do findCategoryPage sql injection (CVSS 6.9, Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…)
- [CVE-2025-11315](https://cve.now/CVE-2025-11315.md): Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findUserPage.do findUserPage sql injection (CVSS 6.9, Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…)
- [CVE-2025-11314](https://cve.now/CVE-2025-11314.md): Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findSingConfigPage.do findRolePage sql injection (CVSS 6.9, Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…)
- [CVE-2025-11313](https://cve.now/CVE-2025-11313.md): Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findRolePage.do findRolePage sql injection (CVSS 6.9, Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…)
- [CVE-2025-11312](https://cve.now/CVE-2025-11312.md): Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findModulePage.do findModulePage sql injection (CVSS 6.9, Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…)
- [CVE-2025-11311](https://cve.now/CVE-2025-11311.md): Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findTenantPage.do findTenantPage sql injection (CVSS 6.9, Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…)
- [CVE-2025-28129](https://cve.now/CVE-2025-28129.md): Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking. (CVSS 5.4)
- [CVE-2025-29192](https://cve.now/CVE-2025-29192.md): Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log. (CVSS 8.2, FlowiseAI Flowise · flowise)
- [CVE-2025-50538](https://cve.now/CVE-2025-50538.md): Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log. (CVSS 8.2, FlowiseAI Flowise · flowise)
- [CVE-2025-56382](https://cve.now/CVE-2025-56382.md): A stored Cross-site scripting (XSS) vulnerability exists in the Customer Management Module of LionCoders SalePro POS 5.4.8. (CVSS 6.1)
- [CVE-2025-57247](https://cve.now/CVE-2025-57247.md): The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorre (CVSS 9.1)
- [CVE-2025-57515](https://cve.now/CVE-2025-57515.md): A SQL injection vulnerability has been identified in Uniclare Student Portal v2. (CVSS 9.8)
- [CVE-2025-59447](https://cve.now/CVE-2025-59447.md): The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. (CVSS 2.2, YoSmart YoLink Smart Hub)
- [CVE-2025-59448](https://cve.now/CVE-2025-59448.md): Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. (CVSS 4.7, YoSmart YoLink ecosystem)
- [CVE-2025-59449](https://cve.now/CVE-2025-59449.md): The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allow (CVSS 4.9, YoSmart YoLink MQTT broker)
- [CVE-2025-59450](https://cve.now/CVE-2025-59450.md): The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials. (CVSS 4.3, YoSmart YoLink Smart Hub)
- [CVE-2025-59451](https://cve.now/CVE-2025-59451.md): The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes. (CVSS 3.5, YoSmart YoLink application)
- [CVE-2025-59452](https://cve.now/CVE-2025-59452.md): The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-sec (CVSS 5.8, YoSmart YoLink API)
- [CVE-2025-60956](https://cve.now/CVE-2025-60956.md): Cross Site Request Forgery (CSRF) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allow (CVSS 8.0)
- [CVE-2025-60957](https://cve.now/CVE-2025-60957.md): OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers t (CVSS 9.9)
- [CVE-2025-60958](https://cve.now/CVE-2025-60958.md): Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attac (CVSS 7.3)
- [CVE-2025-60959](https://cve.now/CVE-2025-60959.md): OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers t (CVSS 8.2)
- [CVE-2025-60960](https://cve.now/CVE-2025-60960.md): OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers t (CVSS 8.2)
- [CVE-2025-60961](https://cve.now/CVE-2025-60961.md): Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attac (CVSS 6.1)
- [CVE-2025-60962](https://cve.now/CVE-2025-60962.md): OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers t (CVSS 8.2)
- [CVE-2025-60963](https://cve.now/CVE-2025-60963.md): OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers t (CVSS 8.2)
- [CVE-2025-60964](https://cve.now/CVE-2025-60964.md): OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers t (CVSS 9.1)
- [CVE-2025-60965](https://cve.now/CVE-2025-60965.md): OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers t (CVSS 9.1)
- [CVE-2025-60967](https://cve.now/CVE-2025-60967.md): Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00 allows attac (CVSS 7.3)
- [CVE-2025-60969](https://cve.now/CVE-2025-60969.md): Directory Traversal vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00 allows attackers to (CVSS 5.7)
- [CVE-2025-61197](https://cve.now/CVE-2025-61197.md): An issue in Orban Optimod 5950, Optimod 5950HD, Optimod 5750, Optimod 5750HD, Optimod Trio Optimod version 1.0.0.33 - System version 2.5.26 (CVSS 8.9)
- [CVE-2025-61198](https://cve.now/CVE-2025-61198.md): A stored cross-site scripting (XSS) vulnerability in Optimod 5950 - Optimod 5950HD - Optimod 5750 - Optimod 5750HD - Optimod Trio - Optimod (CVSS 5.4)
- [CVE-2025-61224](https://cve.now/CVE-2025-61224.md): Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'\[56.1\] allows a remote attacker to execute arbitrary code via the q pa (CVSS 6.5)
- [CVE-2025-61984](https://cve.now/CVE-2025-61984.md): ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leadin (CVSS 3.6, OpenBSD OpenSSH)
- [CVE-2025-61985](https://cve.now/CVE-2025-61985.md): ssh in OpenSSH before 10.1 allows the '\\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used. (CVSS 3.6, OpenBSD OpenSSH)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.