CVEs published October 21, 2025
147 CVEs were published on October 21, 2025: 12 critical, 36 high. 1 is now in CISA KEV.
- Published
- 147
- Critical
- 12
- High
- 36
- Medium
- 91
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 19
Most affected products
- Oracle MySQL Server
- 9
- Oracle VM VirtualBox
- 9
- Oracle ZFS Storage Appliance Kit
- 9
- Oracle PeopleSoft Enterprise PeopleTools
- 8
- Oracle Financial Services Analytical Applications Infrastru…
- 6
- Oracle Database Server
- 4
- TP-Link Systems Omada gateways · TP-Link Systems Festa g… +1
- 4
- EfficientLab WorkExaminer Professional
- 3
- Oracle Java SE · Oracle GraalVM for JDK +1
- 3
- DCMTK
- 2
Critical 12
- CVE-2025-62481Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration).Oracle Marketing
- CVE-2025-61757Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).Oracle Identity Manager
- CVE-2025-53072Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration).Oracle Marketing
- CVE-2025-53037Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (comOracle Financial Services Analytical Applications Infrastru…
- CVE-2025-11534Authentication Bypass Using an Alternate Path or Channel in Raisecomm RAX701-GC SeriesRaisecomm RAX701-GC-WP-01 P200R002C52 · Raisecomm RAX701-GC…
- CVE-2025-11625Host verification bypass and credential leakwolfSSL wolfSSH
- CVE-2025-10640Missing Server-Side Authentication Checks in EfficientLab WorkExaminer ProfessionalEfficientLab WorkExaminer Professional
- CVE-2025-12004The compare API module breaks Extension:LockdownThe Wikimedia Foundation Mediawiki - Lockdown Extension
- CVE-2025-10916FormGent < 1.0.4 - Unauthenticated Arbitrary File DeletionFormGent
- CVE-2025-7850Authenticated OS command executionTP-Link Systems Omada gateways · TP-Link Systems Festa g… +1
- CVE-2025-6542OS command injection in multiple parametersTP-Link Systems Omada gateways · TP-Link Systems Festa g… +1
- CVE-2025-60772Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthenticated attacker to
High 36
- CVE-2025-61756Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (comOracle Financial Services Analytical Applications Infrastru…
- CVE-2025-62641Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2025-62590Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2025-62589Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2025-62588Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2025-62587Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2025-62290Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage).Oracle ZFS Storage Appliance Kit
- CVE-2025-61763Vulnerability in Oracle Essbase (component: Essbase Web Platform).Oracle Essbase
- CVE-2025-61760Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2025-61752Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2025-61751Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (comOracle Financial Services Analytical Applications Infrastru…
- CVE-2025-53066Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).Oracle Java SE · Oracle GraalVM for JDK +1
- CVE-2025-53050Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Performance Monitor).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2025-53049Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration).Oracle Business Intelligence Enterprise Edition
- CVE-2025-53043Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog).Oracle Product Hub
- CVE-2025-53036Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (comOracle Financial Services Analytical Applications Infrastru…
- CVE-2025-11757Improper Neutralization of Wildcards or Matching Symbols in CloudEdge Online Cameras and AppCloudEdge App
- CVE-2025-62518astral-tokio-tar Vulnerable to PAX Header Desynchronizationastral-sh tokio-tar · astral-tokio-tar +1
- CVE-2025-22166This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.Atlassian Confluence Data Center
- CVE-2025-9339SQL Injection in SIMPLE.ERPSimple SA SIMPLE.ERP
- CVE-2025-11151Information Disclosure in Beyaz Computer's CityPLusBeyaz Bilgisayar Software Design Industry and Trade Ltd. Ci…
- CVE-2025-10020Command InjectionZohocorp ManageEngine ADManager Plus
- CVE-2025-10641Unencrypted cleartext communication in EfficientLab WorkExaminer ProfessionalEfficientLab WorkExaminer Professional
- CVE-2025-9428SQL InjectionZohocorp Analytics Plus
- CVE-2025-10639Usage of Hardcoded FTP Credentials EfficientLab WorkExaminer ProfessionalEfficientLab WorkExaminer Professional
- CVE-2025-11949Digiwin｜EasyFlow .NET and EasyFlow AiNet - Missing AuthenticationDigiwin EasyFlow .NET · Digiwin EasyFlow AiNet
- CVE-2025-9133A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions fromZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- CVE-2025-8078A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmwaZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- CVE-2025-7851Unauthorized root access via debug functionalityTP-Link Systems Omada gateways · TP-Link Systems Festa g… +1
- CVE-2025-6541OS command injection using information obtained from the web management interfaceTP-Link Systems Omada gateways · TP-Link Systems Festa g… +1
- CVE-2025-52079The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Ch
- CVE-2025-60344A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate inpuD-Link DSR-150
- CVE-2025-60500QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restricti
- CVE-2025-60507Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6.
- CVE-2025-60751GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode.
- CVE-2025-61220The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unau
Medium, low and unrated 99
- CVE-2025-62592Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2025-62591Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2025-62480Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Naming Subsystem).Oracle ZFS Storage Appliance Kit
- CVE-2025-62479Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage).Oracle ZFS Storage Appliance Kit
- CVE-2025-62478Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store).Oracle ZFS Storage Appliance Kit
- CVE-2025-62477Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication).Oracle ZFS Storage Appliance Kit
- CVE-2025-62476Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication).Oracle ZFS Storage Appliance Kit
- CVE-2025-62475Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).Oracle ZFS Storage Appliance Kit
- CVE-2025-62289Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems).Oracle ZFS Storage Appliance Kit
- CVE-2025-62288Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: Logger).Oracle Health Sciences Data Management Workbench
- CVE-2025-62287Vulnerability in the Oracle Life Sciences InForm product of Oracle Health Sciences Applications (component: Web Server).Oracle Life Sciences InForm
- CVE-2025-61885Vulnerability in the Oracle Life Sciences InForm product of Oracle Health Sciences Applications (component: Web Server).Oracle Life Sciences InForm
- CVE-2025-61881Vulnerability in the Java VM component of Oracle Database Server.Oracle Database Server
- CVE-2025-61764Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2025-61762Vulnerability in the PeopleSoft Enterprise FIN Payables product of Oracle PeopleSoft (component: Payables).Oracle PeopleSoft Enterprise FIN Payables
- CVE-2025-61761Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management).Oracle PeopleSoft Enterprise FIN Maintenance Management
- CVE-2025-61759Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2025-61758Vulnerability in the PeopleSoft Enterprise FIN IT Asset Management product of Oracle PeopleSoft (component: IT Asset Management).Oracle PeopleSoft Enterprise FIN IT Asset Management
- CVE-2025-61755Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Compiler).Oracle GraalVM for JDK
- CVE-2025-61754Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API).Oracle BI Publisher
- CVE-2025-61753Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous).Oracle Scripting
- CVE-2025-61750Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2025-61749Vulnerability in the Unified Audit component of Oracle Database Server.Oracle Database Server
- CVE-2025-61748Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: LibrariOracle Java SE · Oracle GraalVM for JDK +1
- CVE-2025-53071Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Upload Attachments).Oracle Applications Framework
- CVE-2025-53070Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem).Oracle Solaris
- CVE-2025-53069Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services).Oracle MySQL Server
- CVE-2025-53068Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).Oracle Solaris
- CVE-2025-53067Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-53065Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2025-53064Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization).Oracle Applications Framework
- CVE-2025-53063Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2025-53062Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2025-53061Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2025-53060Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-53059Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2025-53058Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Application Logging Interfaces).Oracle Applications Manager
- CVE-2025-53057Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: SecuritOracle Java SE · Oracle GraalVM for JDK +1
- CVE-2025-53056Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Environment Tech).Oracle JD Edwards EnterpriseOne Tools
- CVE-2025-53055Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2025-53054Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2025-53053Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).Oracle MySQL Server
- CVE-2025-53052Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).Oracle Workflow
- CVE-2025-53051Vulnerability in the RDBMS Functional Index component of Oracle Database Server.Oracle Database Server
- CVE-2025-53048Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Rich Text Editor).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2025-53047Vulnerability in the Portable Clusterware component of Oracle Database Server.Oracle Database Server
- CVE-2025-53046Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Analytics).Oracle ZFS Storage Appliance Kit
- CVE-2025-53045Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2025-53044Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2025-53042Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-53041Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart).Oracle iStore
- CVE-2025-53040Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2025-53035Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (comOracle Financial Services Analytical Applications Infrastru…
- CVE-2025-53034Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (comOracle Financial Services Analytical Applications Infrastru…
- CVE-2025-50075Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Oracle Financial Services Revenue Management and Billing
- CVE-2025-50074Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Oracle Financial Services Revenue Management and Billing
- CVE-2025-62661Do permission checking when getting counts of global and local edits, new articles and thanksThe Wikimedia Foundation Mediawiki - Thanks Extension, Medi…
- CVE-2025-62249A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.QLiferay Portal · Liferay DXP +1
- CVE-2025-12031HTTP Security Misconfiguration - Lacking Secure and HTTPOnly AttributeAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-8050External Control of File vulnerability has been discovered in opentext Flipper.opentext Flipper
- CVE-2025-62605Mastodon quotes control can be bypassedmastodon
- CVE-2025-62598WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'action'LabRedesCefetRJ WeGIA
- CVE-2025-62597WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'sql'LabRedesCefetRJ WeGIA
- CVE-2025-62595Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logickoajs koa · koa
- CVE-2025-62250Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 throLiferay Portal · Liferay DXP +1
- CVE-2022-4981DCMTK dcmqrscp dcmqrcnf.cc readPeerList null pointer dereferenceDCMTK
- CVE-2020-36855DCMTK dcmqrscp parseQuota stack-based overflowDCMTK
- CVE-2025-11624Buffer overwrite when processing file handles with the SFTP serverwolfSSH
- CVE-2025-6239Information disclosureZohocorp ManageEngine Applications Manager
- CVE-2025-7473XML InjectionZohocorp Endpoint Central
- CVE-2025-5496Arbitrary File DeletionZohocorp Endpoint Central
- CVE-2025-10612XSS in GiSoft's City GuidegiSoft Information Technologies City Guide
- CVE-2025-26392SolarWinds Observability Self-Hosted SQL Injection VulnerabilitySolarWinds Observability Self-Hosted
- CVE-2025-62701Stored XSS through system messagesThe Wikimedia Foundation Mediawiki - Wikistories
- CVE-2025-62702Stored XSS through system messagesThe Wikimedia Foundation Mediawiki - PageTriage Extension
- CVE-2025-62694Stored XSS through a system messageThe Wikimedia Foundation Mediawiki - WikiLove Extension
- CVE-2025-62695Stored XSS through system messagesThe Wikimedia Foundation Mediawiki - WikiLambda Extension
- CVE-2025-62696Multiple critical security issues in SpringboardThe Wikimedia Foundation Mediawiki Foundation - Springboard…
- CVE-2025-62699Special:Translate tool does not use the correct IP and User-Agent in the CheckUser toolThe Wikimedia Foundation Mediawiki - Translate Extension
- CVE-2025-56450Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the `lead_id` parameter in the `/l2s/api/sel
- CVE-2025-56799Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folde
- CVE-2025-56800Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism.
- CVE-2025-56801The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implement
- CVE-2025-56802The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers
- CVE-2025-57521Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during application startup.
- CVE-2025-59438Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.
- CVE-2025-60280Cross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code into the application
- CVE-2025-60427LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics dat
- CVE-2025-60506Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature.
- CVE-2025-60511Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient
- CVE-2025-60790ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted withoprocesswire/processwire
- CVE-2025-60932Multiple stored cross-site scripting (XSS) vulnerabilities in the Current Goals function of HR Performance Solutions Performance Pro v3.19.1
- CVE-2025-60933Multiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Performance Pro v3.19.17
- CVE-2025-60934Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Performance Pro v3.19.17 a
- CVE-2025-61181daicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature.
- CVE-2025-61194daicuocms V1.3.13 contains a SQL injection vulnerability in the file library\think\db\Builder.php.
- CVE-2025-61255Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting (XSS) vulnerability via the /search parameter, where unsan
- CVE-2025-61457code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php.code16/sharp
- CVE-2025-62763Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.Zimbra Collaboration