CVEs published October 10, 2025
124 CVEs were published on October 10, 2025: 4 critical, 39 high.
- Published
- 124
- Critical
- 4
- High
- 39
- Medium
- 73
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 39
Most affected products
- Samsung Mobile Devices
- 12
- FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- 9
- HCL AION
- 7
- Samsung Mobile Samsung Notes
- 6
- Liferay Portal · Liferay DXP +1
- 4
- Samsung Mobile Smart Switch
- 4
- code-projects Online Job Search Engine
- 3
- Synchroweb Kiwire
- 3
- AWS FreeRTOS-Plus-TCP
- 2
- CodeAstro Gym Management System
- 2
Critical 4
- CVE-2025-61929Cherry Studio allows one-click on a specific URL to cause a command to executeCherryHQ cherry-studio
- CVE-2025-60269JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/contro
- CVE-2025-60306code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and per
- CVE-2025-60307code-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where entering a universal password in the Password field on
High 39
- CVE-2025-62162cel-rust May Panic During Parsing of Invalid CEL Expressionscel-rust · cel
- CVE-2025-8093Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098Drupal Authenticator Login · drupal/alogin
- CVE-2025-62159External Secrets Operator's BeyondTrust Provider has Insecure Secret Retrievalexternal-secrets
- CVE-2025-11586Tenda AC7 setNotUpgrade stack-based overflowTenda AC7
- CVE-2025-61930Emlog Pro has CSRF issue that Enables Admin Password Resetemlog
- CVE-2025-61927Happy-DOM has VM Context Escapecapricorn86 happy-dom · happy-dom
- CVE-2025-61920Authlib is vulnerable to Denial of Service via Oversized JOSE Segmentsauthlib
- CVE-2025-61919Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsingrack
- CVE-2025-23282NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to use a race condition to escalate privileges.NVIDIA Virtual GPU Manager · NVIDIA GeForce +3
- CVE-2025-23280NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2025-23309NVIDIA Display Driver contains a vulnerability where an uncontrolled DLL loading path might lead to arbitrary denial of service, escalation NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2025-61689HTTP.jl vulnerable to Header injection/Response splitting via header construction.JuliaWeb HTTP.jl
- CVE-2025-59530quic-go has Client Crash Due to Premature HANDSHAKE_DONE Framequic-go · github.com/quic-go/quic-go
- CVE-2025-48043Bypass and runtime policies that can never pass may be incorrectly applied in filter authorizationash-project ash
- CVE-2025-61864A use after free vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2025-11189CVE-2025-11189Synchroweb Kiwire
- CVE-2025-11188CVE-2025-11188Synchroweb Kiwire
- CVE-2025-61863An out-of-bounds read vulnerability exists in VS6ComFile!CSaveData::delete_mem of V-SFT v6.2.7.0 and earlier.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2025-61862An out-of-bounds read vulnerability exists in VS6ComFile!get_ovlp_element_size of V-SFT v6.2.7.0 and earlier.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2025-61861An out-of-bounds read vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2025-61860An out-of-bounds read vulnerability exists in VS6MemInIF!set_temp_type_default of V-SFT v6.2.7.0 and earlier.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2025-61859An out-of-bounds write vulnerability exists in VS6ComFile!CItemDraw::is_motion_tween of V-SFT v6.2.7.0 and earlier.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2025-61857An out-of-bounds write vulnerability exists in VS6ComFile!CItemExChange::WinFontDynStrCheck of V-SFT v6.2.7.0 and earlier.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2025-61858An out-of-bounds write vulnerability exists in VS6ComFile!set_AnimationItem of V-SFT v6.2.7.0 and earlier.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2025-61856A stack-based buffer overflow vulnerability exists in VS6ComFile!CV7BaseMap::WriteV7DataToRom of V-SFT v6.2.7.0 and earlier.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2025-25017Kibana Stored Cross-Site Scripting (XSS)Elastic Kibana
- CVE-2025-30001Apache StreamPark: Authenticated users can trigger remote command executionApache Software Foundation Apache StreamPark · org.apache.s…
- CVE-2025-25018Kibana Stored Cross-Site Scripting (XSS)Elastic Kibana
- CVE-2025-52650HCL AION is susceptible to Inline script execution allowed in CSP vulnerabilityHCL AION
- CVE-2025-21050Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles.Samsung Mobile Devices
- CVE-2025-21064Improper authentication in Smart Switch prior to version 3.7.66.6 allows adjacent attackers to access transferring data.Samsung Mobile Smart Switch
- CVE-2025-21062Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.67.2 allows local attackers to replace the restoring aSamsung Mobile Smart Switch
- CVE-2025-21061Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access sensitive data.Samsung Mobile Smart Switch
- CVE-2025-21058Improper access control in Routines prior to version 4.8.7.1 in Android 15 and 4.9.6.0 in Android 16 allows local attackers to potentially eSamsung Mobile Routines
- CVE-2025-55903A HTML injection vulnerability exists in Perfex CRM v3.3.1.
- CVE-2025-60305SourceCodester Online Student Clearance System 1.0 is vulnerable to Incorrect Access Control.
- CVE-2025-60378Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages.
- CVE-2025-60869Publii CMS v0.46.5 (build 17089) allows persistent Cross-Site Scripting (XSS) via unsanitized input in configuration fields such as "Site De
- CVE-2025-60880An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a bagisto/bagisto
Medium, low and unrated 81
- CVE-2025-11626Loop with Unreachable Exit Condition ('Infinite Loop') in WiresharkWireshark Foundation Wireshark
- CVE-2025-9554Owl Carousel 2 - Critical - Unsupported - SA-CONTRIB-2025-104Drupal Owl Carousel · drupal/owlcarousel2
- CVE-2025-9553API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103Drupal API Key manager · drupal/api_key_manager
- CVE-2025-9552Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102Drupal Synchronize composer.json With Contrib Modules · dru…
- CVE-2025-9551Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101Drupal Protected Pages · drupal/protected_pages
- CVE-2025-9550Facets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100Drupal Facets · drupal/facets
- CVE-2025-9549Facets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099Drupal Facets · drupal/facets
- CVE-2025-52647HCL BigFix WebUI is affected by a host header poisoning vulnerabilityHCL Software BigFix WebUI
- CVE-2025-52885GHSL-2025-042: Poppler has Use-After-Freepoppler
- CVE-2025-61912python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Terminationpython-ldap
- CVE-2025-61911python-ldap has sanitization bypass in ldap.filter.escape_filter_charspython-ldap
- CVE-2025-11589CodeAstro Gym Management System user-payment.php sql injectionCodeAstro Gym Management System
- CVE-2025-11588CodeAstro Gym Management System index.php sql injectionCodeAstro Gym Management System
- CVE-2025-11585code-projects Project Monitoring System useredit.php sql injectioncode-projects Project Monitoring System
- CVE-2025-11584code-projects Online Job Search Engine searchjob.php sql injectioncode-projects Online Job Search Engine
- CVE-2025-62158Frappe had attachments made by students to their assignments of type Text set to publicfrappe lms
- CVE-2025-11583code-projects Online Job Search Engine postjob.php sql injectioncode-projects Online Job Search Engine
- CVE-2025-11582code-projects Online Job Search Engine registration.php sql injectioncode-projects Online Job Search Engine
- CVE-2025-61925Astro's `X-Forwarded-Host` is reflected with no validationwithastro astro · astro
- CVE-2025-61921Sinatra has ReDoS vulnerability in ETag header value generationsinatra
- CVE-2025-62245Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023Liferay Portal · Liferay DXP +1
- CVE-2025-11581PowerJob OpenAPIController runJob authorizationPowerJob · tech.powerjob:powerjob-server-starter
- CVE-2025-11580PowerJob list authorizationPowerJob · tech.powerjob:powerjob
- CVE-2025-11618Invalid Pointer Dereference when receiving UDP/IPv6 packets in FreeRTOS-Plus-TCPAWS FreeRTOS-Plus-TCP
- CVE-2025-11617Buffer Over-read when receiving IPv6 packets with incorrect payload length in FreeRTOS-Plus-TCPAWS FreeRTOS-Plus-TCP
- CVE-2025-11616Buffer Over-read when receiving improperly sized ICMPv6 packets in FreeRTOS-Plus-TCPAWS FreeRTOS-Plus_TCP
- CVE-2025-61780Rack has Possible Information Disclosure Vulnerabilityrack
- CVE-2025-8887IDOR in Usta Information Systems' Aybs InteraktifUsta Information Systems Aybs Interaktif
- CVE-2025-8886Authorization Bypass in Usta Information Systems' Aybs InteraktifUsta Information Systems Aybs Interaktif
- CVE-2025-62237Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2Liferay Portal · Liferay DXP +1
- CVE-2025-62238Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, andLiferay Portal · Liferay DXP +1
- CVE-2025-62239Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0Liferay Portal · Liferay DXP +1
- CVE-2025-7374WP JobHunt <= 7.6 Authenticated (Custom+) Authorization BypassWP JobHunt
- CVE-2025-7781WP JobHunt <= 7.6 - Authenticated (Candidate+) Stored Cross-Site Scripting via ‘cs_job_title’WP JobHunt
- CVE-2025-11579DoS via Out Of Memory Crashnwaples rardecode · github.com/nwaples/rardecode +1
- CVE-2025-11190CVE-2025-11190Synchroweb Kiwire
- CVE-2025-52625HCL AION is susceptible to Cacheable SSL Page Found vulnerabilityHCL AION
- CVE-2025-52624HCL AION is susceptible to Bypass of the script allow list configuration vulnerabilityHCL AION
- CVE-2025-52635HCL AION is susceptible to Trusted types in scripts not enforced in CSPHCL AION
- CVE-2025-52632HCL AION is susceptible to Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerabilityHCL AION
- CVE-2025-37727Elasticsearch Insertion of sensitive information in log fileElasticsearch · org.elasticsearch.plugin:reindex-client
- CVE-2025-52630HCL AION is susceptible to Missing or insecure "X-Content-Type-Options" header vulnerabilityHCL AION
- CVE-2025-52634HCL AION is susceptible to Spring Boot Actuator Endpoints ExposedHCL AION
- CVE-2025-41089Reflected Cross-Site Scripting (XSS) in CMSXibo Signage Xibo CMS
- CVE-2025-41088Stored Cross-Site Scripting (XSS) in CMSXibo Signage Xibo CMS
- CVE-2025-52655HCL MyXalytics is affected by a Cross-Domain Script Include vulnerability.HCL MyXalytics
- CVE-2025-40640Stored Cross-Site Scripting (XSS) in Energy CRM by Status TrackerStatus Tracker Energy CRM
- CVE-2025-21070Out-of-bounds write in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to write out-of-bounds memory.Samsung Mobile Samsung Notes
- CVE-2025-21069Out-of-bounds read in the parsing of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds mSamsung Mobile Samsung Notes
- CVE-2025-21068Out-of-bounds read in the reading of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds mSamsung Mobile Samsung Notes
- CVE-2025-21067Out-of-bounds read in the allocation of image buffer in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bouSamsung Mobile Samsung Notes
- CVE-2025-21066Out-of-bounds read in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory.Samsung Mobile Samsung Notes
- CVE-2025-21065Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands on their own devices.Samsung Mobile Retail Mode
- CVE-2025-21063Improper access control in Samsung Voice Recorder prior to version 21.5.73.12 in Android 15 and 21.5.81.40 in Android 16 allows physical attSamsung Mobile Samsung Voice Recorder
- CVE-2025-21060Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access backup data from appliSamsung Mobile Smart Switch
- CVE-2025-21059Improper authorization in Samsung Health prior to version 6.30.5.105 allows local attackers to access data in Samsung Health.Samsung Mobile Samsung Health
- CVE-2025-21057Use of implicit intent for sensitive communication in Samsung Notes prior to version 4.4.30.63 allows local attackers to access shared notesSamsung Mobile Samsung Notes
- CVE-2025-21055Out-of-bounds read and write in libimagecodec.quram.so prior to SMR Oct-2025 Release 1 allows remote attackers to access out-of-bounds memorSamsung Mobile Devices
- CVE-2025-21054Out-of-bounds read in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to potentialSamsung Mobile Devices
- CVE-2025-21053Out-of-bounds write in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to cause meSamsung Mobile Devices
- CVE-2025-21052Out-of-bounds write under specific condition in the pre-processing of JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows locSamsung Mobile Devices
- CVE-2025-21051Out-of-bounds write in the pre-processing of JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to write outSamsung Mobile Devices
- CVE-2025-21049Improper access control in SecSettings prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information.Samsung Mobile Devices
- CVE-2025-21048Relative path traversal in Knox Enterprise prior to SMR Oct-2025 Release 1 allows local attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2025-21047Improper access control in KnoxGuard prior to SMR Oct-2025 Release 1 allows physical attackers to use the privileged APIs.Samsung Mobile Devices
- CVE-2025-21046Improper access control in WindowManager in Samsung DeX prior to SMR Oct-2025 Release 1 allows physical attackers to temporarily access to rSamsung Mobile Devices
- CVE-2025-21045Insecure storage of sensitive information in Galaxy Watch prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive informaSamsung Mobile Devices
- CVE-2025-21044Out-of-bounds write in fingerprint trustlet prior to SMR Oct-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.Samsung Mobile Devices
- CVE-2025-10124Booking Manager < 2.1.15 - Contributor+ Booking DeletionBooking Manager
- CVE-2025-11570Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficiedrupal-pattern-lab/unified-twig-extensions
- CVE-2025-61871NAS Navigator2 Windows version by BUFFALO INC.BUFFALO NAS Navigator2
- CVE-2025-11449Reflected Cross Site Scripting in ServiceNow AI PlatformServiceNow AI Platform
- CVE-2025-11450Reflected Cross Site Scripting in ServiceNow AI PlatformServiceNow AI Platform
- CVE-2025-60268An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the saveFiles function in
- CVE-2025-60308code-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS) vulnerability in the Add Room function of the onli
- CVE-2025-60838An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file.
- CVE-2025-60868The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enablalt-design/alt-redirect
- CVE-2025-61152python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any cryptographic signature verification.
- CVE-2025-61319ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module.
- CVE-2025-61505e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script.
- CVE-2025-62292In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/useSonarSource SonarQube