CVEs published October 24, 2025
99 CVEs were published on October 24, 2025: 9 critical, 46 high.
- Published
- 99
- Critical
- 9
- High
- 46
- Medium
- 36
- Low
- 3
- Unrated
- 5
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- Linux
- 8
- Dell Storage Manager
- 3
- Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle M…
- 3
- Implem Pleasanter
- 2
- originalityai Originality.ai AI Checker
- 2
- WSO2 Identity Server · WSO2 Enterprise Integrator +7
- 2
- 10up Microsoft Azure Storage for WordPress
- 1
- Aksis Technology Netty ERP
- 1
- Azure Access Technology BLU-IC2 · Azure Access Technology B…
- 1
- bdthemes ZoloBlocks – Gutenberg Block Editor Plugin with Ad…
- 1
Critical 9
- CVE-2025-12176Undocumented Administrative AccountsAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-8536SQL Injection in DobryCMSStudio Fabryka DobryCMS
- CVE-2025-43995Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability.Dell Storage Manager
- CVE-2025-11253SQLi in Aksis Technologies' Netty ERPAksis Technology Netty ERP
- CVE-2025-6440WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File UploadJMA Plugins WooCommerce Designer Pro
- CVE-2025-60548D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLanSetupRouterSetting
- CVE-2025-60553D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard52.
- CVE-2025-60554D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEnableWizard.
- CVE-2025-60803Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the comp
High 46
- CVE-2025-34503Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware ExecutionLight & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle M…
- CVE-2025-34502Shuffle Master Deck Mate 2 Missing Secure BootLight & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle M…
- CVE-2025-34500Shuffle Master Deck Mate 2 Insecure Update ChainLight & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle M…
- CVE-2025-4106WatchGuard Firebox leftover debug code vulnerabilityWatchGuard Fireware OS
- CVE-2025-34293GN4 Publishing System Insecure Direct Object Reference (IDOR) Information DisclosureNaviga Global / Miles 33 GN4 Publishing System
- CVE-2025-62716Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parametermakeplane plane
- CVE-2025-62714Karmada Dashboard API Unauthorized Access Vulnerabilitykarmada-io dashboard · github.com/karmada-io/dashboard
- CVE-2025-11145User Enumeration in CBK Soft's enVisionCBK Soft Software Hardware Electronic Computer Systems Indu…
- CVE-2025-43994Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability.Dell Storage Manager
- CVE-2025-40024vhost: Take a reference on the task in struct vhost_task.Linux
- CVE-2025-40018ipvs: Defer ip_vs_ftp unregister during netns cleanupLinux
- CVE-2023-53733net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knodeLinux
- CVE-2025-10861Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgeryroxnor Popup builder with Gamification, Multi-Step Popups,…
- CVE-2025-10680OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variableOpenVPN
- CVE-2025-11889AIO Forms <= 1.3.18 - Authenticated (Admin+) Arbitrary File Upload via Zip Importedgarrojas AIO Forms – Craft Complex Forms Easily
- CVE-2025-11504Quickcreator – AI Blog Writer 0.0.9 - 0.1.17 - Unauthenticated API Key ExposureQuickcreator – AI Blog Writer
- CVE-2025-12028IndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokensindieweb IndieAuth
- CVE-2025-62868WordPress Edge CPT plugin <= 1.4 - Local File Inclusion vulnerabilityEdge-Themes Edge CPT
- CVE-2025-46183The Utils.deserialize function in pgCodeKeeper 10.12.0 processes serialized data from untrusted sources.
- CVE-2025-60547D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard7.
- CVE-2025-60549D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAutoDetecWAN_wizard4.
- CVE-2025-60550D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formEasySetTimezone.
- CVE-2025-60551D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the next_page parameter in the function formDeviceReboot.
- CVE-2025-60552D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formTcpipSetup.
- CVE-2025-60555D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizardSelectMode.
- CVE-2025-60556D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizard1.
- CVE-2025-60557D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEasy_Wizard.
- CVE-2025-60558D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formVirtualServ.
- CVE-2025-60559D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetDomainFilter.
- CVE-2025-60561D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEmail.
- CVE-2025-60562D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formWlSiteSurvey.
- CVE-2025-60563D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetPortTr.
- CVE-2025-60564D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetLog.
- CVE-2025-60565D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSchedule.
- CVE-2025-60566D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetMACFilter.
- CVE-2025-60568D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvFirewall.
- CVE-2025-60569D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetRoute.
- CVE-2025-60570D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLogDnsquery.
- CVE-2025-60571D-Link DIR600LAx FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetQoS.
- CVE-2025-60572D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvNetwork.
- CVE-2025-60730PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function
- CVE-2025-60731PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function
- CVE-2025-60735PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function
- CVE-2025-60801jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function
- CVE-2025-60938Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary
- CVE-2025-60954Microweber CMS 2.0 has Weak Password Requirements.
Medium, low and unrated 44
- CVE-2025-12194Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc.Legion of the Bouncy Castle Bouncy Castle for Java FIPS… +2
- CVE-2025-62711Wasmtime vulnerable to segfault when using component resourcesbytecodealliance wasmtime · wasmtime
- CVE-2025-62723FlashMQ does not release memory of queued QoS messageshalfgaar FlashMQ
- CVE-2025-62717Emlog Pro session verification code error due to clearing logic erroremlog
- CVE-2025-46425Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerabDell Storage Manager
- CVE-2025-11576AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant <= 1.6.5 - Unauthenticated CSV Injectionnewcodebyte AI Chatbot Free Models – Customer Support, Live…
- CVE-2025-40023drm/xe/vf: Don't expose sysfs attributes not applicable for VFsLinux
- CVE-2025-40022crypto: af_alg - Fix incorrect boolean values in af_alg_ctxLinux
- CVE-2025-40021tracing: dynevent: Add a missing lockdown check on dyneventLinux
- CVE-2025-40020can: peak_usb: fix shift-out-of-bounds issueLinux
- CVE-2025-40019crypto: essiv - Check ssize for decryption and in-place encryptionLinux
- CVE-2025-5605Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information DisclosureWSO2 Identity Server · WSO2 Enterprise Integrator +7
- CVE-2025-5350SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 ProductsWSO2 Identity Server · WSO2 Enterprise Integrator +7
- CVE-2025-36361IBM App Connect Enterprise runtime is vulnerable to a lack of authorization on windows environments using IWAIBM App Connect Enterprise
- CVE-2025-12134ZoloBlocks <= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/Disablebdthemes ZoloBlocks – Gutenberg Block Editor Plugin with Ad…
- CVE-2025-12136Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpointdevowl Real Cookie Banner: GDPR & ePrivacy Cookie Consent
- CVE-2025-10749Microsoft Azure Storage for WordPress <= 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion10up Microsoft Azure Storage for WordPress
- CVE-2025-12017VNPAY for Woocommerce <= 1.0.0 - Reflected Cross-Site Scriptingteyldoan VNPAY Payment gateway
- CVE-2025-11172Check Plagiarism <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Settings Updateplagiarismchecker Check Plagiarism
- CVE-2025-10901Originality.ai AI Checker <= 1.0.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'ai_get_table'originalityai Originality.ai AI Checker
- CVE-2025-10902Originality.ai AI Checker <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Scan Log Deletion via ' ai_scan_result_remove'originalityai Originality.ai AI Checker
- CVE-2025-12014NGINX Cache Optimizer <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Dynamic Caching Exclusion Updategetclouder NGINX Cache Optimizer
- CVE-2025-11257LLM Hubspot Blog Import <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Hubspot Importlimelightmarketing LLM Hubspot Blog Import
- CVE-2025-12096Simple Excel Pricelist for WooCommerce <= 1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeprawas Simple Excel Pricelist for WooCommerce
- CVE-2025-10748RapidResult <= 1.2 - Authenticated (Contributor+) SQL Injectiononlinediagnosticbd RapidResult
- CVE-2025-10701Time Clock – A WordPress Employee & Volunteer Time Clock Plugin <= 1.3.1 - Authenticated (Custom+) Stored Cross-Site Scriptingscottpaterson Time Clock – A WordPress Employee & Volunteer…
- CVE-2025-11887Supervisor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Settings Updatetiagohillebrandt Supervisor
- CVE-2025-10740URL Shortener Plugin For WordPress <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Link Manipulationrupok98 URL Shortener Plugin For WordPress
- CVE-2025-12072Disable Content Editor For Specific Template <= 2.0 - Cross-Site Request Forgery to Template Configuration Updatemynamevenu24 Disable Content Editor For Specific Template
- CVE-2025-11992Multi Item Responsive Slider <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scriptingcnaveenkumar Multi Item Responsive Slider
- CVE-2025-12016qnotsquiz <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scriptingmuniyandibg qnotsquiz
- CVE-2025-9158Stored XSS in Request TrackerBest Practical Request Tracker
- CVE-2025-9978Jeg Elementor Kit < 2.7.0 - Author+ Stored XSSJeg Kit for Elementor
- CVE-2025-10874Orbit Fox < 3.0.2 - Author+ Server-Side Request ForgeryOrbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie…
- CVE-2025-10723PixelYourSite < 11.1.2 - Admin+ LFIPixelYourSite
- CVE-2025-61931Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an arImplem Pleasanter
- CVE-2025-58070Pleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitraryImplem Pleasanter
- CVE-2021-43768In Malwarebytes For Teams v.1.0.990 and before and fixed in v.1.0.1003 and later a privilege escalation can occur via the COM interface runn
- CVE-2025-46185An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext stora
- CVE-2025-56438An issue in the firmware update mechanism of Nous W3 Smart WiFi Camera v1.33.50.82 allows unauthenticated and physically proximate attackers
- CVE-2025-60419An issue was discovered in the NDIS Usermode IO driver (RtkIOAC60.sys, version 6.0.5600.16348) allowing local authenticated attackers to sen
- CVE-2025-60729PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function
- CVE-2025-60936Emoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism.
- CVE-2025-61430Improper handling of DNS over TCP in Simple DNS Plus v9 allows a remote attacker with querying access to the DNS server to cause the server