# CVEs published 2025-10-12 36 CVEs were published on October 12, 2025: 0 critical, 3 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2025-11651](https://cve.now/CVE-2025-11651.md): UTT 进取 518G formRemoteControl sub\_4247AC buffer overflow (CVSS 8.7, UTT 进取) - [CVE-2025-11650](https://cve.now/CVE-2025-11650.md): Tomofun Furbo 360/Furbo Mini Password shadow weak hash (CVSS 1.0, Tomofun Furbo) - [CVE-2025-11649](https://cve.now/CVE-2025-11649.md): Tomofun Furbo 360/Furbo Mini Root Account hard-coded password (CVSS 7.3, Tomofun Furbo) - [CVE-2025-11648](https://cve.now/CVE-2025-11648.md): Tomofun Furbo 360/Furbo Mini GATT Interface URL TF\_FQDN.json server-side request forgery (CVSS 6.3, Tomofun Furbo) - [CVE-2025-11647](https://cve.now/CVE-2025-11647.md): Tomofun Furbo 360/Furbo Mini GATT Service information disclosure (CVSS 2.3, Tomofun Furbo) - [CVE-2025-11646](https://cve.now/CVE-2025-11646.md): Tomofun Furbo 360/Furbo Mini GATT Service access control (CVSS 5.3, Tomofun Furbo) - [CVE-2025-11645](https://cve.now/CVE-2025-11645.md): Tomofun Furbo Mobile App Authentication Token sensitive information (CVSS 2.4, Tomofun Furbo Mobile App) - [CVE-2025-11644](https://cve.now/CVE-2025-11644.md): Tomofun Furbo 360/Furbo Mini UART sensitive information (CVSS 1.0, Tomofun Furbo) - [CVE-2025-11643](https://cve.now/CVE-2025-11643.md): Tomofun Furbo 360/Furbo Mini MQTT Client Certificate furbo\_img hard-coded credentials (CVSS 6.3, Tomofun Furbo) - [CVE-2025-11642](https://cve.now/CVE-2025-11642.md): Tomofun Furbo 360/Furbo Mini Registration denial of service (CVSS 4.1, Tomofun Furbo) - [CVE-2025-11641](https://cve.now/CVE-2025-11641.md): Tomofun Furbo 360/Furbo Mini Trial Restriction access control (CVSS 1.0, Tomofun Furbo) - [CVE-2025-11640](https://cve.now/CVE-2025-11640.md): Tomofun Furbo 360/Furbo Mini Bluetooth Low Energy cleartext transmission (CVSS 2.3, Tomofun Furbo) - [CVE-2025-11639](https://cve.now/CVE-2025-11639.md): Tomofun Furbo 360/Furbo Mini Debug Log S3 Bucket collect\_logs.sh sensitive information (CVSS 4.8, Tomofun Furbo) - [CVE-2025-11638](https://cve.now/CVE-2025-11638.md): Tomofun Furbo 360/Furbo Mini Bluetooth denial of service (CVSS 5.3, Tomofun Furbo) - [CVE-2025-11637](https://cve.now/CVE-2025-11637.md): Tomofun Furbo 360 Audio race condition (CVSS 5.3, Tomofun Furbo) - [CVE-2025-11636](https://cve.now/CVE-2025-11636.md): Tomofun Furbo 360 Account server-side request forgery (CVSS 6.3, Tomofun Furbo) - [CVE-2025-11635](https://cve.now/CVE-2025-11635.md): Tomofun Furbo 360 File Upload resource consumption (CVSS 5.3, Tomofun Furbo) - [CVE-2025-2138](https://cve.now/CVE-2025-2138.md): IBM Engineering Requirements Management Doors Next data modification (CVSS 3.5, IBM Engineering Requirements Management Doors Next) - [CVE-2025-2139](https://cve.now/CVE-2025-2139.md): IBM Engineering Requirements Management Doors Next security bypass (CVSS 3.5, IBM Engineering Requirements Management Doors Next) - [CVE-2025-2140](https://cve.now/CVE-2025-2140.md): IBM Engineering Requirements Management Doors Next spoofing (CVSS 5.7, IBM Engineering Requirements Management Doors Next) - [CVE-2025-33096](https://cve.now/CVE-2025-33096.md): IBM Engineering Requirements Management Doors Next denial of service (CVSS 6.5, IBM Engineering Requirements Management Doors Next) - [CVE-2025-11634](https://cve.now/CVE-2025-11634.md): Tomofun Furbo 360/Furbo Mini UART information disclosure (CVSS 2.4, Tomofun Furbo) - [CVE-2025-11633](https://cve.now/CVE-2025-11633.md): Tomofun Furbo 360/Furbo Mini HTTP Traffic collect\_logs.sh upload\_file\_to\_s3 certificate validation (CVSS 6.3, Tomofun Furbo) - [CVE-2025-52615](https://cve.now/CVE-2025-52615.md): HCL Unica Platform is impacted by misconfigured security related HTTP headers (CVSS 3.5, HCL Software Unica Platform) - [CVE-2025-11631](https://cve.now/CVE-2025-11631.md): RainyGao DocSys deleteDoc.do path traversal (CVSS 5.3, RainyGao DocSys) - [CVE-2025-52614](https://cve.now/CVE-2025-52614.md): HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability (CVSS 3.5, HCL Software Unica Platform) - [CVE-2025-31969](https://cve.now/CVE-2025-31969.md): HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP) (CVSS 4.0, HCL Software Unica Platform) - [CVE-2025-11630](https://cve.now/CVE-2025-11630.md): RainyGao DocSys File Upload uploadDoc.do updateRealDoc path traversal (CVSS 5.3, RainyGao DocSys) - [CVE-2025-11629](https://cve.now/CVE-2025-11629.md): RainyGao DocSys getUserList.do getUserList sql injection (CVSS 5.3, RainyGao DocSys) - [CVE-2025-31992](https://cve.now/CVE-2025-31992.md): HCL MaxAI Assistant is susceptible to a HTML injection vulnerability (CVSS 4.6, HCL Software MaxAI Assistant) - [CVE-2025-11628](https://cve.now/CVE-2025-11628.md): jimit105 Project-Online-Shopping-Website Product Inventory delete.php sql injection (CVSS 5.1, jimit105 Project-Online-Shopping-Website) - [CVE-2025-52616](https://cve.now/CVE-2025-52616.md): HCL Unica 12.1.10 is affected by an exposure of sensitive information (CVSS 5.3, HCL Software Unica) - [CVE-2025-31998](https://cve.now/CVE-2025-31998.md): HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information (CVSS 3.5, HCL Software Unica Centralized Offer Management) - [CVE-2025-61884](https://cve.now/CVE-2025-61884.md): Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). (CVSS 7.5, KEV, Oracle Configurator) - [CVE-2025-31997](https://cve.now/CVE-2025-31997.md): HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR) (CVSS 4.2, HCL Software Unica Centralized Offer Management) - [CVE-2025-31993](https://cve.now/CVE-2025-31993.md): HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF) (CVSS 3.5, HCL Software Unica Centralized Offer Management) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-10-12 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.