CVEs published October 17, 2025
83 CVEs were published on October 17, 2025: 19 critical, 11 high.
- Published
- 83
- Critical
- 19
- High
- 11
- Medium
- 41
- Low
- 12
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- Restaurant Brands International assistant platform
- 10
- Shenzhen Ruiming Technology Streamax Crocus
- 7
- Eclipse Foundation NetX Duo
- 5
- Moxa EDR-G9010 Series · Moxa EDR-8010 Series +5
- 5
- dataease
- 4
- Eclipse Foundation USBX
- 4
- yanyutao0402 ChanCMS
- 4
- Flowring Technology Agentflow
- 2
- Hikvision iSecure Center
- 2
- MacWarrior clipbucket-v5
- 2
Critical 19
- CVE-2025-62515Remote Code Execution by Pickle Deserialization via FlightServer in pyquokkamarsupialtail quokka · pyquokka
- CVE-2025-11925Incorrect Content-Type HeaderAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-62168Squid vulnerable to information disclosure via authentication credential leakage in error handlingsquid-cache squid
- CVE-2025-8414Zigbee Green Power Host Buffer Overflow Vulnerabilitysilabs.com Simplicity SDK · silabs.com Gecko SDK
- CVE-2025-62353A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary local files in and outWindsurf
- CVE-2025-49655Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enablKeras
- CVE-2023-28815Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerabilitHikvision iSecure Center
- CVE-2023-28814Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability.Hikvision iSecure Center
- CVE-2025-11900HGiga｜iSherlock - OS Command InjectionHGiga iSherlock
- CVE-2025-11899Flowring Technology｜Agentflow - Use of Hard-coded Cryptographic KeyFlowring Technology Agentflow
- CVE-2025-6950An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers.Moxa EDR-G9010 Series · Moxa EDR-8010 Series +5
- CVE-2025-6949An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers.Moxa EDR-G9010 Series · Moxa EDR-8010 Series +5
- CVE-2025-6893An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers.Moxa EDR-G9010 Series · Moxa EDR-8010 Series +5
- CVE-2025-56218An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.
- CVE-2025-56221A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack.
- CVE-2025-56316A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execnet.mingsoft:ms-mcms
- CVE-2025-57567A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the def
- CVE-2025-60279A server-side request forgery (SSRF) vulnerability in Illia Cloud illia-Builder before v4.8.5 allows authenticated users to send arbitrary r
- CVE-2025-62645The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token witRestaurant Brands International assistant platform
High 11
- CVE-2025-62419DataEase vulnerable to JDBC URL injection in DB2 and MongoDB data source configurationdataease
- CVE-2025-62420DataEase vulnerable to remote code execution via H2 JDBC driver bypassdataease
- CVE-2025-62422DataEase SQL injection vulnerabilitydataease
- CVE-2025-59043OpenBao vulnerable to denial of service via malicious JSON request processingopenbao · github.com/openbao/openbao
- CVE-2025-62356A path traversal vulnerability in all versions of the Qodo Qodo Gen IDE enables a threat actor to read arbitrary local files in and outside Qodo Gen
- CVE-2025-26625Git LFS may write to arbitrary files via crafted symlinksgit-lfs · github.com/git-lfs/git-lfs +1
- CVE-2025-55085Web http client: Unchecked Server-Side Malicious Packet IssueEclipse Foundation NetX Duo
- CVE-2025-48044Authorization bypass when bypass policy condition evaluates to trueash-project ash
- CVE-2025-11898Flowring Technology｜Agentflow - Arbitrary File Reading through Path TraversalFlowring Technology Agentflow
- CVE-2025-6892An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers.Moxa EDR-G9010 Series · Moxa EDR-8010 Series +5
- CVE-2025-62650The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostRestaurant Brands International assistant platform
Medium, low and unrated 53
- CVE-2025-62655SQL injection in Cargo via Special:CargoExportThe Wikimedia Foundation MediaWiki Cargo extension
- CVE-2025-62654Stored XSS through system messages in QuizGameThe Wikimedia Foundation MediaWiki QuizGame extension
- CVE-2025-62653Stored XSS through system messages in PollNYThe Wikimedia Foundation MediaWiki PollNY extension
- CVE-2025-62652Stored XSS in WebAuthn key nameThe Wikimedia Foundation MediaWiki WebAuthn extension
- CVE-2025-11914Shenzhen Ruiming Technology Streamax Crocus DeviceFileReport.do download path traversalShenzhen Ruiming Technology Streamax Crocus
- CVE-2025-62508Citizen vulnerable to stored XSS in sticky header button messagesStarCitizenTools mediawiki-skins-Citizen · starcitizentools…
- CVE-2025-11913Shenzhen Ruiming Technology Streamax Crocus Service.do download path traversalShenzhen Ruiming Technology Streamax Crocus
- CVE-2025-11912Shenzhen Ruiming Technology Streamax Crocus DeviceState.do Query sql injectionShenzhen Ruiming Technology Streamax Crocus
- CVE-2025-62511yt-grabber-tui local arbitrary file overwrite via TOCTOU race in config file creationzheny-creator YtGrabber-TUI
- CVE-2025-11911Shenzhen Ruiming Technology Streamax Crocus DeviceFault.do Query sql injectionShenzhen Ruiming Technology Streamax Crocus
- CVE-2025-11910Shenzhen Ruiming Technology Streamax Crocus MemoryState.do query sql injectionShenzhen Ruiming Technology Streamax Crocus
- CVE-2025-34282ThingsBoard < v4.2.1 SVG Image SSRFThingsBoard
- CVE-2025-34281Stored Cross-Site Scripting (XSS) in ThingsBoardthingsboard · org.thingsboard:application
- CVE-2025-11909Shenzhen Ruiming Technology Streamax Crocus RepairRecord.do queryLast sql injectionShenzhen Ruiming Technology Streamax Crocus
- CVE-2025-11908Shenzhen Ruiming Technology Streamax Crocus FileDir.do uploadFile unrestricted uploadShenzhen Ruiming Technology Streamax Crocus
- CVE-2025-62505SSRF in lobehub/lobe-chat with native web fetch modulelobehub lobe-chat · @lobehub/chat
- CVE-2025-62430ClipBucket v5 stored XSS via video/photo fieldsMacWarrior clipbucket-v5
- CVE-2025-62424ClipBucket path traversal vulnerability in template editor allows arbitrary file read and writeMacWarrior clipbucket-v5
- CVE-2025-62421DataEase vulnerable to stored cross-site scripting via file upload bypassdataease
- CVE-2025-62171ImageMagick vulnerable to denial of service via integer overflow in BMP decoder on 32-bit systemsImageMagick · Magick.NET-Q16-AnyCPU +5
- CVE-2025-58747Dify MCP OAuth Flow Vulnerable to XSSlanggenius dify
- CVE-2025-11905yanyutao0402 ChanCMS gather.js getArticle code injectionyanyutao0402 ChanCMS
- CVE-2025-11904yanyutao0402 ChanCMS hasUse sql injectionyanyutao0402 ChanCMS
- CVE-2025-48087WordPress Memberlite Shortcodes plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityJason C. Memberlite Shortcodes
- CVE-2025-11903yanyutao0402 ChanCMS update sql injectionyanyutao0402 ChanCMS
- CVE-2025-11902yanyutao0402 ChanCMS findField sql injectionyanyutao0402 ChanCMS
- CVE-2025-11895Binary MLM Plan <= 5.0 - Authenticated (Subscriber+) Insecure Direct Object Referenceletscms Binary MLM Plan
- CVE-2025-55087In NextX Duo's snmp addon versions before 6.4.4, a part of the Eclipse Foundation ThreadX, an attacker could cause an out-of-bound read by aEclipse Foundation NextX Duo
- CVE-2025-55100Potential out-of-bounds read in _ux_host_class_audio10_sam_parse_func()Eclipse Foundation USBX
- CVE-2025-55099Potential out-of-bounds read in _ux_host_class_audio_alternate_setting_locate()Eclipse Foundation USBX
- CVE-2025-55098Potential out-of-bounds read in _ux_host_class_audio_device_type_get()Eclipse Foundation USBX
- CVE-2025-55097Potential out-of-bounds read in _ux_host_class_audio_streaming_sampling_get()Eclipse Foundation USBX
- CVE-2025-55096Inadequate bounds check and potential underflow in _ux_host_class_hid_report_descriptor_get()Eclipse Foundation NetX Duo
- CVE-2025-55094Potential out-of-bounds read in _nx_icmpv6_validate_options()Eclipse Foundation NetX Duo
- CVE-2025-55093Out of bound read and write in _nx_ipv4_packet_receive() when handling unicast DHCP messagesEclipse Foundation NetX Duo
- CVE-2025-55092Potential out of bound read in _nx_ipv4_option_process()Eclipse Foundation NetX Duo
- CVE-2025-11849Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of thmammoth · org.zwobble.mammoth:mammoth
- CVE-2025-6894An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers.Moxa EDR-G9010 Series · Moxa EDR-8010 Series +5
- CVE-2024-31573XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transXMLUnit for Java · org.xmlunit:xmlunit-core
- CVE-2025-56320CobbleStone Enterprise Contract Management Portal v.22.4.0 is vulnerable to Stored Cross-Site Scripting (XSS) in its chat box component.
- CVE-2025-57164Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field.flowise
- CVE-2025-60359radare2 v5.9.8 and before contains a memory leak in the function r_bin_object_new.
- CVE-2025-60360radare2 v5.9.8 and before contains a memory leak in the function r2r_subprocess_init.
- CVE-2025-60361radare2 v5.9.8 and before contains a memory leak in the function bochs_open.
- CVE-2025-60514Tillywork v0.1.3 and below is vulnerable to SQL Injection in app/common/helpers/query.builder.helper.ts.
- CVE-2025-62642The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does notRestaurant Brands International assistant platform
- CVE-2025-62643The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail mesRestaurant Brands International assistant platform
- CVE-2025-62644The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal informatioRestaurant Brands International assistant platform
- CVE-2025-62646The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of converRestaurant Brands International assistant platform
- CVE-2025-62647The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be usRestaurant Brands International assistant platform
- CVE-2025-62648The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio vRestaurant Brands International assistant platform
- CVE-2025-62649The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for submission of equipRestaurant Brands International assistant platform
- CVE-2025-62651The Restaurant Brands International (RBI) assistant platform through 2025-09-06 does not implement access control for the bathroom rating inRestaurant Brands International assistant platform