# CVEs published 2025-10-21

147 CVEs were published on October 21, 2025: 12 critical, 36 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-61756](https://cve.now/CVE-2025-61756.md): Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (com (CVSS 7.5, Oracle Financial Services Analytical Applications Infrastru…)
- [CVE-2025-62641](https://cve.now/CVE-2025-62641.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2025-62592](https://cve.now/CVE-2025-62592.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2025-62591](https://cve.now/CVE-2025-62591.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2025-62590](https://cve.now/CVE-2025-62590.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2025-62589](https://cve.now/CVE-2025-62589.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2025-62588](https://cve.now/CVE-2025-62588.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2025-62587](https://cve.now/CVE-2025-62587.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2025-62481](https://cve.now/CVE-2025-62481.md): Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). (CVSS 9.8, Oracle Marketing)
- [CVE-2025-62480](https://cve.now/CVE-2025-62480.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Naming Subsystem). (CVSS 2.7, Oracle ZFS Storage Appliance Kit)
- [CVE-2025-62479](https://cve.now/CVE-2025-62479.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). (CVSS 2.7, Oracle ZFS Storage Appliance Kit)
- [CVE-2025-62478](https://cve.now/CVE-2025-62478.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store). (CVSS 4.9, Oracle ZFS Storage Appliance Kit)
- [CVE-2025-62477](https://cve.now/CVE-2025-62477.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication). (CVSS 4.9, Oracle ZFS Storage Appliance Kit)
- [CVE-2025-62476](https://cve.now/CVE-2025-62476.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication). (CVSS 4.9, Oracle ZFS Storage Appliance Kit)
- [CVE-2025-62475](https://cve.now/CVE-2025-62475.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). (CVSS 4.9, Oracle ZFS Storage Appliance Kit)
- [CVE-2025-62290](https://cve.now/CVE-2025-62290.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). (CVSS 7.2, Oracle ZFS Storage Appliance Kit)
- [CVE-2025-62289](https://cve.now/CVE-2025-62289.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). (CVSS 4.9, Oracle ZFS Storage Appliance Kit)
- [CVE-2025-62288](https://cve.now/CVE-2025-62288.md): Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: Logger). (CVSS 4.9, Oracle Health Sciences Data Management Workbench)
- [CVE-2025-62287](https://cve.now/CVE-2025-62287.md): Vulnerability in the Oracle Life Sciences InForm product of Oracle Health Sciences Applications (component: Web Server). (CVSS 6.1, Oracle Life Sciences InForm)
- [CVE-2025-61885](https://cve.now/CVE-2025-61885.md): Vulnerability in the Oracle Life Sciences InForm product of Oracle Health Sciences Applications (component: Web Server). (CVSS 4.3, Oracle Life Sciences InForm)
- [CVE-2025-61881](https://cve.now/CVE-2025-61881.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 5.9, Oracle Database Server)
- [CVE-2025-61764](https://cve.now/CVE-2025-61764.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 5.3, Oracle WebLogic Server)
- [CVE-2025-61763](https://cve.now/CVE-2025-61763.md): Vulnerability in Oracle Essbase (component: Essbase Web Platform). (CVSS 8.1, Oracle Essbase)
- [CVE-2025-61762](https://cve.now/CVE-2025-61762.md): Vulnerability in the PeopleSoft Enterprise FIN Payables product of Oracle PeopleSoft (component: Payables). (CVSS 6.3, Oracle PeopleSoft Enterprise FIN Payables)
- [CVE-2025-61761](https://cve.now/CVE-2025-61761.md): Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). (CVSS 5.4, Oracle PeopleSoft Enterprise FIN Maintenance Management)
- [CVE-2025-61760](https://cve.now/CVE-2025-61760.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.5, Oracle VM VirtualBox)
- [CVE-2025-61759](https://cve.now/CVE-2025-61759.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.5, Oracle VM VirtualBox)
- [CVE-2025-61758](https://cve.now/CVE-2025-61758.md): Vulnerability in the PeopleSoft Enterprise FIN IT Asset Management product of Oracle PeopleSoft (component: IT Asset Management). (CVSS 6.5, Oracle PeopleSoft Enterprise FIN IT Asset Management)
- [CVE-2025-61757](https://cve.now/CVE-2025-61757.md): Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). (CVSS 9.8, KEV, Oracle Identity Manager)
- [CVE-2025-61755](https://cve.now/CVE-2025-61755.md): Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Compiler). (CVSS 3.7, Oracle GraalVM for JDK)
- [CVE-2025-61754](https://cve.now/CVE-2025-61754.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). (CVSS 6.5, Oracle BI Publisher)
- [CVE-2025-61753](https://cve.now/CVE-2025-61753.md): Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). (CVSS 6.1, Oracle Scripting)
- [CVE-2025-61752](https://cve.now/CVE-2025-61752.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2025-61751](https://cve.now/CVE-2025-61751.md): Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (com (CVSS 8.1, Oracle Financial Services Analytical Applications Infrastru…)
- [CVE-2025-61750](https://cve.now/CVE-2025-61750.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). (CVSS 4.3, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2025-61749](https://cve.now/CVE-2025-61749.md): Vulnerability in the Unified Audit component of Oracle Database Server. (CVSS 2.7, Oracle Database Server)
- [CVE-2025-61748](https://cve.now/CVE-2025-61748.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Librari (CVSS 3.7, Oracle Java SE · Oracle GraalVM for JDK +1)
- [CVE-2025-53072](https://cve.now/CVE-2025-53072.md): Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). (CVSS 9.8, Oracle Marketing)
- [CVE-2025-53071](https://cve.now/CVE-2025-53071.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Upload Attachments). (CVSS 4.3, Oracle Applications Framework)
- [CVE-2025-53070](https://cve.now/CVE-2025-53070.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). (CVSS 5.5, Oracle Solaris)
- [CVE-2025-53069](https://cve.now/CVE-2025-53069.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-53068](https://cve.now/CVE-2025-53068.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). (CVSS 6.5, Oracle Solaris)
- [CVE-2025-53067](https://cve.now/CVE-2025-53067.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-53066](https://cve.now/CVE-2025-53066.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). (CVSS 7.5, Oracle Java SE · Oracle GraalVM for JDK +1)
- [CVE-2025-53065](https://cve.now/CVE-2025-53065.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). (CVSS 5.4, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2025-53064](https://cve.now/CVE-2025-53064.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 4.3, Oracle Applications Framework)
- [CVE-2025-53063](https://cve.now/CVE-2025-53063.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). (CVSS 5.4, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2025-53062](https://cve.now/CVE-2025-53062.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-53061](https://cve.now/CVE-2025-53061.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). (CVSS 5.5, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2025-53060](https://cve.now/CVE-2025-53060.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 6.1, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-53059](https://cve.now/CVE-2025-53059.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). (CVSS 4.9, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2025-53058](https://cve.now/CVE-2025-53058.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Application Logging Interfaces). (CVSS 6.1, Oracle Applications Manager)
- [CVE-2025-53057](https://cve.now/CVE-2025-53057.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Securit (CVSS 5.9, Oracle Java SE · Oracle GraalVM for JDK +1)
- [CVE-2025-53056](https://cve.now/CVE-2025-53056.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Environment Tech). (CVSS 6.1, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-53055](https://cve.now/CVE-2025-53055.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). (CVSS 6.1, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2025-53054](https://cve.now/CVE-2025-53054.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2025-53053](https://cve.now/CVE-2025-53053.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2025-53052](https://cve.now/CVE-2025-53052.md): Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). (CVSS 6.1, Oracle Workflow)
- [CVE-2025-53051](https://cve.now/CVE-2025-53051.md): Vulnerability in the RDBMS Functional Index component of Oracle Database Server. (CVSS 2.7, Oracle Database Server)
- [CVE-2025-53050](https://cve.now/CVE-2025-53050.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). (CVSS 7.5, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2025-53049](https://cve.now/CVE-2025-53049.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration). (CVSS 8.4, Oracle Business Intelligence Enterprise Edition)
- [CVE-2025-53048](https://cve.now/CVE-2025-53048.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Rich Text Editor). (CVSS 5.4, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2025-53047](https://cve.now/CVE-2025-53047.md): Vulnerability in the Portable Clusterware component of Oracle Database Server. (CVSS 5.8, Oracle Database Server)
- [CVE-2025-53046](https://cve.now/CVE-2025-53046.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Analytics). (CVSS 4.9, Oracle ZFS Storage Appliance Kit)
- [CVE-2025-53045](https://cve.now/CVE-2025-53045.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-53044](https://cve.now/CVE-2025-53044.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-53043](https://cve.now/CVE-2025-53043.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). (CVSS 8.1, Oracle Product Hub)
- [CVE-2025-53042](https://cve.now/CVE-2025-53042.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-53041](https://cve.now/CVE-2025-53041.md): Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). (CVSS 6.1, Oracle iStore)
- [CVE-2025-53040](https://cve.now/CVE-2025-53040.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-53037](https://cve.now/CVE-2025-53037.md): Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (com (CVSS 9.8, Oracle Financial Services Analytical Applications Infrastru…)
- [CVE-2025-53036](https://cve.now/CVE-2025-53036.md): Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (com (CVSS 8.6, Oracle Financial Services Analytical Applications Infrastru…)
- [CVE-2025-53035](https://cve.now/CVE-2025-53035.md): Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (com (CVSS 6.5, Oracle Financial Services Analytical Applications Infrastru…)
- [CVE-2025-53034](https://cve.now/CVE-2025-53034.md): Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (com (CVSS 5.4, Oracle Financial Services Analytical Applications Infrastru…)
- [CVE-2025-50075](https://cve.now/CVE-2025-50075.md): Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: (CVSS 6.5, Oracle Financial Services Revenue Management and Billing)
- [CVE-2025-50074](https://cve.now/CVE-2025-50074.md): Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: (CVSS 4.9, Oracle Financial Services Revenue Management and Billing)
- [CVE-2025-62661](https://cve.now/CVE-2025-62661.md): Do permission checking when getting counts of global and local edits, new articles and thanks (CVSS 6.9, The Wikimedia Foundation Mediawiki - Thanks Extension, Medi…)
- [CVE-2025-62249](https://cve.now/CVE-2025-62249.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-11757](https://cve.now/CVE-2025-11757.md): Improper Neutralization of Wildcards or Matching Symbols in CloudEdge Online Cameras and App (CVSS 8.7, CloudEdge App)
- [CVE-2025-12031](https://cve.now/CVE-2025-12031.md): HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute (CVSS 5.3, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-8050](https://cve.now/CVE-2025-8050.md): External Control of File vulnerability has been discovered in opentext Flipper. (CVSS 5.3, opentext Flipper)
- [CVE-2025-11534](https://cve.now/CVE-2025-11534.md): Authentication Bypass Using an Alternate Path or Channel in Raisecomm RAX701-GC Series (CVSS 9.3, Raisecomm RAX701-GC-WP-01 P200R002C52 · Raisecomm RAX701-GC…)
- [CVE-2025-62605](https://cve.now/CVE-2025-62605.md): Mastodon quotes control can be bypassed (CVSS 4.3, mastodon)
- [CVE-2025-62598](https://cve.now/CVE-2025-62598.md): WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar\_info\_pessoal.php' Parameter 'action' (CVSS 6.9, LabRedesCefetRJ WeGIA)
- [CVE-2025-62597](https://cve.now/CVE-2025-62597.md): WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar\_info\_pessoal.php' Parameter 'sql' (CVSS 6.9, LabRedesCefetRJ WeGIA)
- [CVE-2025-62595](https://cve.now/CVE-2025-62595.md): Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic (CVSS 4.3, koajs koa · koa)
- [CVE-2025-62518](https://cve.now/CVE-2025-62518.md): astral-tokio-tar Vulnerable to PAX Header Desynchronization (CVSS 8.1, astral-sh tokio-tar · astral-tokio-tar +1)
- [CVE-2025-22166](https://cve.now/CVE-2025-22166.md): This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. (CVSS 8.3, Atlassian Confluence Data Center)
- [CVE-2025-62250](https://cve.now/CVE-2025-62250.md): Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 thro (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2022-4981](https://cve.now/CVE-2022-4981.md): DCMTK dcmqrscp dcmqrcnf.cc readPeerList null pointer dereference (CVSS 4.8, DCMTK)
- [CVE-2020-36855](https://cve.now/CVE-2020-36855.md): DCMTK dcmqrscp parseQuota stack-based overflow (CVSS 4.8, DCMTK)
- [CVE-2025-9339](https://cve.now/CVE-2025-9339.md): SQL Injection in SIMPLE.ERP (CVSS 7.1, Simple SA SIMPLE.ERP)
- [CVE-2025-11625](https://cve.now/CVE-2025-11625.md): Host verification bypass and credential leak (CVSS 9.4, wolfSSL wolfSSH)
- [CVE-2025-11151](https://cve.now/CVE-2025-11151.md): Information Disclosure in Beyaz Computer's CityPLus (CVSS 8.2, Beyaz Bilgisayar Software Design Industry and Trade Ltd. Ci…)
- [CVE-2025-11624](https://cve.now/CVE-2025-11624.md): Buffer overwrite when processing file handles with the SFTP server (CVSS 1.8, wolfSSH)
- [CVE-2025-6239](https://cve.now/CVE-2025-6239.md): Information disclosure (CVSS 6.5, Zohocorp ManageEngine Applications Manager)
- [CVE-2025-10020](https://cve.now/CVE-2025-10020.md): Command Injection (CVSS 8.5, Zohocorp ManageEngine ADManager Plus)
- [CVE-2025-10641](https://cve.now/CVE-2025-10641.md): Unencrypted cleartext communication in EfficientLab WorkExaminer Professional (CVSS 7.1, EfficientLab WorkExaminer Professional)
- [CVE-2025-10640](https://cve.now/CVE-2025-10640.md): Missing Server-Side Authentication Checks in EfficientLab WorkExaminer Professional (CVSS 9.8, EfficientLab WorkExaminer Professional)
- [CVE-2025-9428](https://cve.now/CVE-2025-9428.md): SQL Injection (CVSS 8.3, Zohocorp Analytics Plus)
- [CVE-2025-10639](https://cve.now/CVE-2025-10639.md): Usage of Hardcoded FTP Credentials EfficientLab WorkExaminer Professional (CVSS 8.8, EfficientLab WorkExaminer Professional)
- [CVE-2025-7473](https://cve.now/CVE-2025-7473.md): XML Injection (CVSS 5.2, Zohocorp Endpoint Central)
- [CVE-2025-5496](https://cve.now/CVE-2025-5496.md): Arbitrary File Deletion (CVSS 3.3, Zohocorp Endpoint Central)
- [CVE-2025-10612](https://cve.now/CVE-2025-10612.md): XSS in GiSoft's City Guide (CVSS 6.1, giSoft Information Technologies City Guide)
- [CVE-2025-26392](https://cve.now/CVE-2025-26392.md): SolarWinds Observability Self-Hosted SQL Injection Vulnerability (CVSS 5.4, SolarWinds Observability Self-Hosted)
- [CVE-2025-11949](https://cve.now/CVE-2025-11949.md): Digiwin｜EasyFlow .NET and EasyFlow AiNet - Missing Authentication (CVSS 8.7, Digiwin EasyFlow .NET · Digiwin EasyFlow AiNet)
- [CVE-2025-12004](https://cve.now/CVE-2025-12004.md): The compare API module breaks Extension:Lockdown (CVSS 10.0, The Wikimedia Foundation Mediawiki - Lockdown Extension)
- [CVE-2025-10916](https://cve.now/CVE-2025-10916.md): FormGent \< 1.0.4 - Unauthenticated Arbitrary File Deletion (CVSS 9.1, FormGent)
- [CVE-2025-62701](https://cve.now/CVE-2025-62701.md): Stored XSS through system messages (CVSS 6.9, The Wikimedia Foundation Mediawiki - Wikistories)
- [CVE-2025-62702](https://cve.now/CVE-2025-62702.md): Stored XSS through system messages (CVSS 6.9, The Wikimedia Foundation Mediawiki - PageTriage Extension)
- [CVE-2025-62694](https://cve.now/CVE-2025-62694.md): Stored XSS through a system message (CVSS 6.9, The Wikimedia Foundation Mediawiki - WikiLove Extension)
- [CVE-2025-62695](https://cve.now/CVE-2025-62695.md): Stored XSS through system messages (CVSS 6.9, The Wikimedia Foundation Mediawiki - WikiLambda Extension)
- [CVE-2025-62696](https://cve.now/CVE-2025-62696.md): Multiple critical security issues in Springboard (CVSS 6.9, The Wikimedia Foundation Mediawiki Foundation - Springboard…)
- [CVE-2025-62699](https://cve.now/CVE-2025-62699.md): Special:Translate tool does not use the correct IP and User-Agent in the CheckUser tool (CVSS 6.9, The Wikimedia Foundation Mediawiki - Translate Extension)
- [CVE-2025-9133](https://cve.now/CVE-2025-9133.md): A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from (CVSS 8.1, Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2)
- [CVE-2025-8078](https://cve.now/CVE-2025-8078.md): A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmwa (CVSS 7.2, Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2)
- [CVE-2025-7851](https://cve.now/CVE-2025-7851.md): Unauthorized root access via debug functionality (CVSS 8.7, TP-Link Systems Omada gateways · TP-Link Systems Festa g… +1)
- [CVE-2025-7850](https://cve.now/CVE-2025-7850.md): Authenticated OS command execution (CVSS 9.3, TP-Link Systems Omada gateways · TP-Link Systems Festa g… +1)
- [CVE-2025-6542](https://cve.now/CVE-2025-6542.md): OS command injection in multiple parameters (CVSS 9.3, TP-Link Systems Omada gateways · TP-Link Systems Festa g… +1)
- [CVE-2025-6541](https://cve.now/CVE-2025-6541.md): OS command injection using information obtained from the web management interface (CVSS 8.6, TP-Link Systems Omada gateways · TP-Link Systems Festa g… +1)
- [CVE-2025-52079](https://cve.now/CVE-2025-52079.md): The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Ch (CVSS 8.8)
- [CVE-2025-56450](https://cve.now/CVE-2025-56450.md): Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the \`lead\_id\` parameter in the \`/l2s/api/sel (CVSS 6.5)
- [CVE-2025-56799](https://cve.now/CVE-2025-56799.md): Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folde (CVSS 6.5)
- [CVE-2025-56800](https://cve.now/CVE-2025-56800.md): Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. (CVSS 5.1)
- [CVE-2025-56801](https://cve.now/CVE-2025-56801.md): The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implement (CVSS 5.1)
- [CVE-2025-56802](https://cve.now/CVE-2025-56802.md): The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers (CVSS 5.1)
- [CVE-2025-57521](https://cve.now/CVE-2025-57521.md): Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during application startup. (CVSS 6.1)
- [CVE-2025-59438](https://cve.now/CVE-2025-59438.md): Mbed TLS through 3.6.4 has an Observable Timing Discrepancy. (CVSS 5.3)
- [CVE-2025-60280](https://cve.now/CVE-2025-60280.md): Cross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code into the application (CVSS 6.1)
- [CVE-2025-60344](https://cve.now/CVE-2025-60344.md): A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate inpu (CVSS 8.6, D-Link DSR-150)
- [CVE-2025-60427](https://cve.now/CVE-2025-60427.md): LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics dat (CVSS 6.5)
- [CVE-2025-60500](https://cve.now/CVE-2025-60500.md): QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restricti (CVSS 7.2)
- [CVE-2025-60506](https://cve.now/CVE-2025-60506.md): Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. (CVSS 5.4)
- [CVE-2025-60507](https://cve.now/CVE-2025-60507.md): Cross site scripting vulnerability in Moodle GeniAI plugin (local\_geniai) 2.3.6. (CVSS 8.9)
- [CVE-2025-60511](https://cve.now/CVE-2025-60511.md): Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient (CVSS 4.3)
- [CVE-2025-60751](https://cve.now/CVE-2025-60751.md): GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode. (CVSS 7.5)
- [CVE-2025-60772](https://cve.now/CVE-2025-60772.md): Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthenticated attacker to (CVSS 9.8)
- [CVE-2025-60790](https://cve.now/CVE-2025-60790.md): ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted witho (CVSS 6.5, processwire/processwire)
- [CVE-2025-60932](https://cve.now/CVE-2025-60932.md): Multiple stored cross-site scripting (XSS) vulnerabilities in the Current Goals function of HR Performance Solutions Performance Pro v3.19.1 (CVSS 6.1)
- [CVE-2025-60933](https://cve.now/CVE-2025-60933.md): Multiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Performance Pro v3.19.17 (CVSS 6.1)
- [CVE-2025-60934](https://cve.now/CVE-2025-60934.md): Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Performance Pro v3.19.17 a (CVSS 6.1)
- [CVE-2025-61181](https://cve.now/CVE-2025-61181.md): daicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature. (CVSS 6.5)
- [CVE-2025-61194](https://cve.now/CVE-2025-61194.md): daicuocms V1.3.13 contains a SQL injection vulnerability in the file library\\think\\db\\Builder.php. (CVSS 6.5)
- [CVE-2025-61220](https://cve.now/CVE-2025-61220.md): The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unau (CVSS 7.5)
- [CVE-2025-61255](https://cve.now/CVE-2025-61255.md): Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting (XSS) vulnerability via the /search parameter, where unsan (CVSS 6.1)
- [CVE-2025-61457](https://cve.now/CVE-2025-61457.md): code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php. (CVSS 6.1, code16/sharp)
- [CVE-2025-62763](https://cve.now/CVE-2025-62763.md): Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy. (CVSS 5.0, Zimbra Collaboration)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.