# CVEs published 2025-10-24 99 CVEs were published on October 24, 2025: 9 critical, 46 high. Days are UTC. - [CVE-2025-34503](https://cve.now/CVE-2025-34503.md): Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution (CVSS 7.0, Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle M…) - [CVE-2025-34502](https://cve.now/CVE-2025-34502.md): Shuffle Master Deck Mate 2 Missing Secure Boot (CVSS 7.0, Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle M…) - [CVE-2025-34500](https://cve.now/CVE-2025-34500.md): Shuffle Master Deck Mate 2 Insecure Update Chain (CVSS 7.0, Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle M…) - [CVE-2025-12194](https://cve.now/CVE-2025-12194.md): Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. (CVSS 5.9, Legion of the Bouncy Castle Bouncy Castle for Java FIPS… +2) - [CVE-2025-62711](https://cve.now/CVE-2025-62711.md): Wasmtime vulnerable to segfault when using component resources (CVSS 2.1, bytecodealliance wasmtime · wasmtime) - [CVE-2025-4106](https://cve.now/CVE-2025-4106.md): WatchGuard Firebox leftover debug code vulnerability (CVSS 8.9, WatchGuard Fireware OS) - [CVE-2025-34293](https://cve.now/CVE-2025-34293.md): GN4 Publishing System Insecure Direct Object Reference (IDOR) Information Disclosure (CVSS 8.6, Naviga Global / Miles 33 GN4 Publishing System) - [CVE-2025-62723](https://cve.now/CVE-2025-62723.md): FlashMQ does not release memory of queued QoS messages (CVSS 4.3, halfgaar FlashMQ) - [CVE-2025-62717](https://cve.now/CVE-2025-62717.md): Emlog Pro session verification code error due to clearing logic error (CVSS 2.7, emlog) - [CVE-2025-62716](https://cve.now/CVE-2025-62716.md): Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next\_path Parameter (CVSS 8.1, makeplane plane) - [CVE-2025-12176](https://cve.now/CVE-2025-12176.md): Undocumented Administrative Accounts (CVSS 10.0, Azure Access Technology BLU-IC2 · Azure Access Technology B…) - [CVE-2025-62714](https://cve.now/CVE-2025-62714.md): Karmada Dashboard API Unauthorized Access Vulnerability (CVSS 8.7, karmada-io dashboard · github.com/karmada-io/dashboard) - [CVE-2025-11145](https://cve.now/CVE-2025-11145.md): User Enumeration in CBK Soft's enVision (CVSS 7.5, CBK Soft Software Hardware Electronic Computer Systems Indu…) - [CVE-2025-8536](https://cve.now/CVE-2025-8536.md): SQL Injection in DobryCMS (CVSS 9.3, Studio Fabryka DobryCMS) - [CVE-2025-43994](https://cve.now/CVE-2025-43994.md): Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability. (CVSS 8.6, Dell Storage Manager) - [CVE-2025-43995](https://cve.now/CVE-2025-43995.md): Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. (CVSS 9.8, Dell Storage Manager) - [CVE-2025-46425](https://cve.now/CVE-2025-46425.md): Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerab (CVSS 6.5, Dell Storage Manager) - [CVE-2025-11576](https://cve.now/CVE-2025-11576.md): AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant \<= 1.6.5 - Unauthenticated CSV Injection (CVSS 4.3, newcodebyte AI Chatbot Free Models – Customer Support, Live…) - [CVE-2025-40024](https://cve.now/CVE-2025-40024.md): vhost: Take a reference on the task in struct vhost\_task. (CVSS 7.8, Linux) - [CVE-2025-40023](https://cve.now/CVE-2025-40023.md): drm/xe/vf: Don't expose sysfs attributes not applicable for VFs (no CVSS, Linux) - [CVE-2025-40022](https://cve.now/CVE-2025-40022.md): crypto: af\_alg - Fix incorrect boolean values in af\_alg\_ctx (no CVSS, Linux) - [CVE-2025-40021](https://cve.now/CVE-2025-40021.md): tracing: dynevent: Add a missing lockdown check on dynevent (no CVSS, Linux) - [CVE-2025-40020](https://cve.now/CVE-2025-40020.md): can: peak\_usb: fix shift-out-of-bounds issue (no CVSS, Linux) - [CVE-2025-40019](https://cve.now/CVE-2025-40019.md): crypto: essiv - Check ssize for decryption and in-place encryption (no CVSS, Linux) - [CVE-2025-40018](https://cve.now/CVE-2025-40018.md): ipvs: Defer ip\_vs\_ftp unregister during netns cleanup (CVSS 7.8, Linux) - [CVE-2023-53733](https://cve.now/CVE-2023-53733.md): net: sched: cls\_u32: Undo tcf\_bind\_filter if u32\_replace\_hw\_knode (CVSS 7.8, Linux) - [CVE-2025-10861](https://cve.now/CVE-2025-10861.md): Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers \<= 2.1.4 - Unauthenticated Server-Side Request Forgery (CVSS 7.5, roxnor Popup builder with Gamification, Multi-Step Popups,…) - [CVE-2025-5605](https://cve.now/CVE-2025-5605.md): Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure (CVSS 4.3, WSO2 Identity Server · WSO2 Enterprise Integrator +7) - [CVE-2025-5350](https://cve.now/CVE-2025-5350.md): SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products (CVSS 5.9, WSO2 Identity Server · WSO2 Enterprise Integrator +7) - [CVE-2025-10680](https://cve.now/CVE-2025-10680.md): OpenVPN 2.7\_alpha1 through 2.7\_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variable (CVSS 8.8, OpenVPN) - [CVE-2025-36361](https://cve.now/CVE-2025-36361.md): IBM App Connect Enterprise runtime is vulnerable to a lack of authorization on windows environments using IWA (CVSS 6.3, IBM App Connect Enterprise) - [CVE-2025-12134](https://cve.now/CVE-2025-12134.md): ZoloBlocks \<= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/Disable (CVSS 5.3, bdthemes ZoloBlocks – Gutenberg Block Editor Plugin with Ad…) - [CVE-2025-12136](https://cve.now/CVE-2025-12136.md): Real Cookie Banner: GDPR & ePrivacy Cookie Consent \<= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint (CVSS 6.8, devowl Real Cookie Banner: GDPR & ePrivacy Cookie Consent) - [CVE-2025-11253](https://cve.now/CVE-2025-11253.md): SQLi in Aksis Technologies' Netty ERP (CVSS 9.8, Aksis Technology Netty ERP) - [CVE-2025-10749](https://cve.now/CVE-2025-10749.md): Microsoft Azure Storage for WordPress \<= 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion (CVSS 5.4, 10up Microsoft Azure Storage for WordPress) - [CVE-2025-12017](https://cve.now/CVE-2025-12017.md): VNPAY for Woocommerce \<= 1.0.0 - Reflected Cross-Site Scripting (CVSS 6.1, teyldoan VNPAY Payment gateway) - [CVE-2025-11172](https://cve.now/CVE-2025-11172.md): Check Plagiarism \<= 2.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, plagiarismchecker Check Plagiarism) - [CVE-2025-10901](https://cve.now/CVE-2025-10901.md): Originality.ai AI Checker \<= 1.0.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'ai\_get\_table' (CVSS 4.3, originalityai Originality.ai AI Checker) - [CVE-2025-10902](https://cve.now/CVE-2025-10902.md): Originality.ai AI Checker \<= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Scan Log Deletion via ' ai\_scan\_result\_remove' (CVSS 4.3, originalityai Originality.ai AI Checker) - [CVE-2025-12014](https://cve.now/CVE-2025-12014.md): NGINX Cache Optimizer \<= 1.1 - Missing Authorization to Authenticated (Subscriber+) Dynamic Caching Exclusion Update (CVSS 4.3, getclouder NGINX Cache Optimizer) - [CVE-2025-11889](https://cve.now/CVE-2025-11889.md): AIO Forms \<= 1.3.18 - Authenticated (Admin+) Arbitrary File Upload via Zip Import (CVSS 7.2, edgarrojas AIO Forms – Craft Complex Forms Easily) - [CVE-2025-11257](https://cve.now/CVE-2025-11257.md): LLM Hubspot Blog Import \<= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Hubspot Import (CVSS 4.3, limelightmarketing LLM Hubspot Blog Import) - [CVE-2025-12096](https://cve.now/CVE-2025-12096.md): Simple Excel Pricelist for WooCommerce \<= 1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, prawas Simple Excel Pricelist for WooCommerce) - [CVE-2025-11504](https://cve.now/CVE-2025-11504.md): Quickcreator – AI Blog Writer 0.0.9 - 0.1.17 - Unauthenticated API Key Exposure (CVSS 7.5, Quickcreator – AI Blog Writer) - [CVE-2025-10748](https://cve.now/CVE-2025-10748.md): RapidResult \<= 1.2 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, onlinediagnosticbd RapidResult) - [CVE-2025-12028](https://cve.now/CVE-2025-12028.md): IndieAuth \<= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens (CVSS 8.8, indieweb IndieAuth) - [CVE-2025-10701](https://cve.now/CVE-2025-10701.md): Time Clock – A WordPress Employee & Volunteer Time Clock Plugin \<= 1.3.1 - Authenticated (Custom+) Stored Cross-Site Scripting (CVSS 6.4, scottpaterson Time Clock – A WordPress Employee & Volunteer…) - [CVE-2025-11887](https://cve.now/CVE-2025-11887.md): Supervisor \<= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, tiagohillebrandt Supervisor) - [CVE-2025-10740](https://cve.now/CVE-2025-10740.md): URL Shortener Plugin For WordPress \<= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Link Manipulation (CVSS 6.3, rupok98 URL Shortener Plugin For WordPress) - [CVE-2025-12072](https://cve.now/CVE-2025-12072.md): Disable Content Editor For Specific Template \<= 2.0 - Cross-Site Request Forgery to Template Configuration Update (CVSS 4.3, mynamevenu24 Disable Content Editor For Specific Template) - [CVE-2025-11992](https://cve.now/CVE-2025-11992.md): Multi Item Responsive Slider \<= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, cnaveenkumar Multi Item Responsive Slider) - [CVE-2025-12016](https://cve.now/CVE-2025-12016.md): qnotsquiz \<= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, muniyandibg qnotsquiz) - [CVE-2025-62868](https://cve.now/CVE-2025-62868.md): WordPress Edge CPT plugin \<= 1.4 - Local File Inclusion vulnerability (CVSS 8.1, Edge-Themes Edge CPT) - [CVE-2025-6440](https://cve.now/CVE-2025-6440.md): WooCommerce Designer Pro \<= 1.9.26 - Unauthenticated Arbitrary File Upload (CVSS 9.8, JMA Plugins WooCommerce Designer Pro) - [CVE-2025-9158](https://cve.now/CVE-2025-9158.md): Stored XSS in Request Tracker (CVSS 5.3, Best Practical Request Tracker) - [CVE-2025-9978](https://cve.now/CVE-2025-9978.md): Jeg Elementor Kit \< 2.7.0 - Author+ Stored XSS (CVSS 6.8, Jeg Kit for Elementor) - [CVE-2025-10874](https://cve.now/CVE-2025-10874.md): Orbit Fox \< 3.0.2 - Author+ Server-Side Request Forgery (CVSS 5.5, Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie…) - [CVE-2025-10723](https://cve.now/CVE-2025-10723.md): PixelYourSite \< 11.1.2 - Admin+ LFI (CVSS 2.7, PixelYourSite) - [CVE-2025-61931](https://cve.now/CVE-2025-61931.md): Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an ar (CVSS 5.4, Implem Pleasanter) - [CVE-2025-58070](https://cve.now/CVE-2025-58070.md): Pleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitrary (CVSS 6.1, Implem Pleasanter) - [CVE-2021-43768](https://cve.now/CVE-2021-43768.md): In Malwarebytes For Teams v.1.0.990 and before and fixed in v.1.0.1003 and later a privilege escalation can occur via the COM interface runn (CVSS 5.3) - [CVE-2025-46183](https://cve.now/CVE-2025-46183.md): The Utils.deserialize function in pgCodeKeeper 10.12.0 processes serialized data from untrusted sources. (CVSS 8.2) - [CVE-2025-46185](https://cve.now/CVE-2025-46185.md): An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext stora (CVSS 6.2) - [CVE-2025-56438](https://cve.now/CVE-2025-56438.md): An issue in the firmware update mechanism of Nous W3 Smart WiFi Camera v1.33.50.82 allows unauthenticated and physically proximate attackers (CVSS 6.8) - [CVE-2025-60419](https://cve.now/CVE-2025-60419.md): An issue was discovered in the NDIS Usermode IO driver (RtkIOAC60.sys, version 6.0.5600.16348) allowing local authenticated attackers to sen (CVSS 6.2) - [CVE-2025-60547](https://cve.now/CVE-2025-60547.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN\_Wizard7. (CVSS 7.5) - [CVE-2025-60548](https://cve.now/CVE-2025-60548.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLanSetupRouterSetting (CVSS 9.8) - [CVE-2025-60549](https://cve.now/CVE-2025-60549.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAutoDetecWAN\_wizard4. (CVSS 7.5) - [CVE-2025-60550](https://cve.now/CVE-2025-60550.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formEasySetTimezone. (CVSS 7.5) - [CVE-2025-60551](https://cve.now/CVE-2025-60551.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the next\_page parameter in the function formDeviceReboot. (CVSS 7.5) - [CVE-2025-60552](https://cve.now/CVE-2025-60552.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formTcpipSetup. (CVSS 7.5) - [CVE-2025-60553](https://cve.now/CVE-2025-60553.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN\_Wizard52. (CVSS 9.8) - [CVE-2025-60554](https://cve.now/CVE-2025-60554.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEnableWizard. (CVSS 9.8) - [CVE-2025-60555](https://cve.now/CVE-2025-60555.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizardSelectMode. (CVSS 7.5) - [CVE-2025-60556](https://cve.now/CVE-2025-60556.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizard1. (CVSS 7.5) - [CVE-2025-60557](https://cve.now/CVE-2025-60557.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEasy\_Wizard. (CVSS 7.5) - [CVE-2025-60558](https://cve.now/CVE-2025-60558.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formVirtualServ. (CVSS 7.5) - [CVE-2025-60559](https://cve.now/CVE-2025-60559.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetDomainFilter. (CVSS 7.5) - [CVE-2025-60561](https://cve.now/CVE-2025-60561.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEmail. (CVSS 7.5) - [CVE-2025-60562](https://cve.now/CVE-2025-60562.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formWlSiteSurvey. (CVSS 7.5) - [CVE-2025-60563](https://cve.now/CVE-2025-60563.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetPortTr. (CVSS 7.5) - [CVE-2025-60564](https://cve.now/CVE-2025-60564.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetLog. (CVSS 7.5) - [CVE-2025-60565](https://cve.now/CVE-2025-60565.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSchedule. (CVSS 7.5) - [CVE-2025-60566](https://cve.now/CVE-2025-60566.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetMACFilter. (CVSS 7.5) - [CVE-2025-60568](https://cve.now/CVE-2025-60568.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvFirewall. (CVSS 7.5) - [CVE-2025-60569](https://cve.now/CVE-2025-60569.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetRoute. (CVSS 7.5) - [CVE-2025-60570](https://cve.now/CVE-2025-60570.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLogDnsquery. (CVSS 7.5) - [CVE-2025-60571](https://cve.now/CVE-2025-60571.md): D-Link DIR600LAx FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetQoS. (CVSS 7.5) - [CVE-2025-60572](https://cve.now/CVE-2025-60572.md): D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvNetwork. (CVSS 7.5) - [CVE-2025-60729](https://cve.now/CVE-2025-60729.md): PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function (CVSS 5.3) - [CVE-2025-60730](https://cve.now/CVE-2025-60730.md): PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function (CVSS 7.6) - [CVE-2025-60731](https://cve.now/CVE-2025-60731.md): PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function (CVSS 7.6) - [CVE-2025-60735](https://cve.now/CVE-2025-60735.md): PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function (CVSS 7.6) - [CVE-2025-60801](https://cve.now/CVE-2025-60801.md): jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh\_erp function (CVSS 8.2) - [CVE-2025-60803](https://cve.now/CVE-2025-60803.md): Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the comp (CVSS 9.8) - [CVE-2025-60936](https://cve.now/CVE-2025-60936.md): Emoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism. (CVSS 6.1) - [CVE-2025-60938](https://cve.now/CVE-2025-60938.md): Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary (CVSS 7.5) - [CVE-2025-60954](https://cve.now/CVE-2025-60954.md): Microweber CMS 2.0 has Weak Password Requirements. (CVSS 8.3) - [CVE-2025-61430](https://cve.now/CVE-2025-61430.md): Improper handling of DNS over TCP in Simple DNS Plus v9 allows a remote attacker with querying access to the DNS server to cause the server (CVSS 6.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-10-24 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.