CVEs published October 28, 2025
147 CVEs were published on October 28, 2025: 15 critical, 57 high.
- Published
- 147
- Critical
- 15
- High
- 57
- Medium
- 44
- Low
- 2
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 66
Most affected products
- Linux
- 58
- IPFire.org IPFire
- 18
- Azure Access Technology BLU-IC2 · Azure Access Technology B…
- 4
- Campcodes Retro Basketball Shoes Online Store
- 4
- Hitachi Energy TropOS 4th Gen
- 3
- GCC Productions Fade In
- 2
- HashiCorp Consul · github.com/hashicorp/consul
- 2
- IBM Concert Software
- 2
- jlowin fastmcp · fastmcp
- 2
- keycloak · Red Hat build of Keycloak +1
- 2
Critical 15
- CVE-2025-4665WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability thatWordPress Contact Form 7 Database Addon CFDB7 By Arshid CFD…
- CVE-2025-64095DNN Insufficient Access Control - Image Upload allows for Site Content Overwritednnsoftware Dnn.Platform · DNN.PLATFORM
- CVE-2025-62368Taiga Authenticated Remote Code Executiontaigaio taiga-back
- CVE-2025-12425Local Privilege EscalationAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12424Privilege Escalation through SUID-bit BinaryAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12423Denial of Service - Protocol ManipulationAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12422Vulnerable Upgrade Feature (Arbitrary File Write)Azure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-36386There is a vulnerability in the IBM Maximo Manage application in IBM Maximo Application Suite for Cognos AnalyticsIBM Maximo Application Suite
- CVE-2025-12380Use-after-free in WebGPU internals triggered from a compromised child processMozilla Firefox
- CVE-2025-9313Unauthorized database access in Asseco mMedicaAsseco Poland S.A. mMedica
- CVE-2025-40074ipv4: start using dst_dev_rcu()Linux
- CVE-2025-60355zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
- CVE-2025-61043An out-of-bounds read vulnerability has been discovered in Monkey's Audio 11.31, specifically in the CAPECharacterHelper::GetUTF16FromUTF8 f
- CVE-2025-61128Stack-based buffer overflow vulnerability in WAVLINK QUANTUM D3G/WL-WN530HG3 firmware M30HG3_V240730, and possibly other wavlink models allo
- CVE-2025-61235An issue was discovered in Dataphone A920 v2025.07.161103.
High 57
- CVE-2025-43017HP ThinPro 8.1 SP8 Security UpdatesHP ThinPro
- CVE-2025-62727Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponseKludex starlette · starlette
- CVE-2025-59837astro allows bypass of image proxy domain validation leading to SSRF and potential XSSwithastro astro · astro
- CVE-2025-34311IPFire < v2.29 Command Injection via Proxy Report CreationIPFire.org IPFire
- CVE-2025-34312IPFire < v2.29 Command Injection via URL Filter BlacklistIPFire.org IPFire
- CVE-2025-34304IPFire < v2.29 SQL Injection via OpenVPN Connection LogsIPFire.org IPFire
- CVE-2025-53855An out-of-bounds write vulnerability exists in the XML parser functionality of GCC Productions Inc.GCC Productions Fade In
- CVE-2025-53814A use-after-free vulnerability exists in the XML parser functionality of GCC Productions Inc.GCC Productions Fade In
- CVE-2025-1038The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticaHitachi Energy TropOS 4th Gen
- CVE-2025-1037By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands Hitachi Energy TropOS 4th Gen
- CVE-2025-1036Command injection vulnerability exists in the “Logging” page of the web-based configuration utility.Hitachi Energy TropOS 4th Gen
- CVE-2025-40082hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()Linux
- CVE-2025-40081perf: arm_spe: Prevent overflow in PERF_IDX2OFF()Linux
- CVE-2025-40079riscv, bpf: Sign extend struct ops return values properlyLinux
- CVE-2025-40075tcp_metrics: use dst_dev_net_rcu()Linux
- CVE-2025-40069drm/msm: Fix obj leak in VM_BIND error pathLinux
- CVE-2025-40068fs: ntfs3: Fix integer overflow in run_unpack()Linux
- CVE-2025-40067fs/ntfs3: reject index allocation if $BITMAP is empty but blocks existLinux
- CVE-2025-40064smc: Fix use-after-free in __pnet_find_base_ndev().Linux
- CVE-2025-40063crypto: comp - Use same definition of context alloc and free opsLinux
- CVE-2025-40061RDMA/rxe: Fix race in do_task() when drainingLinux
- CVE-2025-40058iommu/vt-d: Disallow dirty tracking if incoherent page walkLinux
- CVE-2025-40054f2fs: fix UAF issue in f2fs_merge_page_bio()Linux
- CVE-2025-40053net: dlink: handle copy_thresh allocation failureLinux
- CVE-2025-40051vhost: vringh: Modify the return value checkLinux
- CVE-2025-40048uio_hv_generic: Let userspace take care of interrupt maskLinux
- CVE-2025-40047io_uring/waitid: always prune wait queue entry in io_waitid_wait()Linux
- CVE-2025-40046io_uring/zcrx: fix overshooting recv limitLinux
- CVE-2025-40045ASoC: codecs: wcd937x: set the comp soundwire port correctlyLinux
- CVE-2025-40044fs: udf: fix OOB read in lengthAllocDescs handlingLinux
- CVE-2025-40043net: nfc: nci: Add parameter validation for packet dataLinux
- CVE-2025-40041LoongArch: BPF: Sign-extend struct ops return values properlyLinux
- CVE-2025-40040mm/ksm: fix flag-dropping behavior in ksm_madviseLinux
- CVE-2025-40039ksmbd: Fix race condition in RPC handle list accessLinux
- CVE-2025-40038KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't validLinux
- CVE-2025-40028binder: fix double-free in dbitmapLinux
- CVE-2025-40027net/9p: fix double req put in p9_fd_cancelledLinux
- CVE-2025-40026KVM: x86: Don't (re)check L1 intercepts when completing userspace I/OLinux
- CVE-2025-40025f2fs: fix to do sanity check on node footer for non inode dnodeLinux
- CVE-2025-41090Improper Access Control in CCN-CERT microCLAUDIACCN-CERT microCLAUDIA
- CVE-2025-10151Malicious TCP/IP thread locking leads into diverse malfunctionsSofting Industrial Automation smartLink HW-PN · Softing Ind…
- CVE-2025-10150Webserver crash caused by scanning on TCP port 80Softing Industrial Automation smartLink HW-PN · Softing Ind…
- CVE-2025-11735HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.1 - Unauthenticated SQL Injection via `phrase` Parameterrealmag777 HUSKY – Products Filter Professional for WooComm…
- CVE-2025-62777Use of Hard-Coded Credentials issue exists in MZK-DP300N version 1.07 and earlier, which may allow an attacker within the local network to lPLANEX COMMUNICATIONS MZK-DP300N
- CVE-2025-12341ermig1979 AntiDupl Delete Duplicate Image AntiDupl.NET.WinForms.exe link followingermig1979 AntiDupl
- CVE-2025-54604Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2).
- CVE-2025-54605Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 2 of 2).
- CVE-2025-56399alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted fi
- CVE-2025-60349An issue was discovered in Prevx v3.0.5.220 allowing attackers to cause a denial of service via sending IOCTL code 0x22E044 to the pxscan.sy
- CVE-2025-60354Unauthorized modification of arbitrary articles vulnerability exists in blog-vue-springboot.
- CVE-2025-60800Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive informa
- CVE-2025-60805An issue was discovered in BESSystem BES Application Server thru 9.5.x allowing unauthorized attackers to gain sensitive information via the
- CVE-2025-60858Reolink Video Doorbell Wi-Fi DB_566128M5MP_W stores and transmits DDNS credentials in plaintext within its configuration and update scripts,
- CVE-2025-61103FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_lan_adj_sid function
- CVE-2025-61104FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_unknown_tlv function at ospf_e
- CVE-2025-61106FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at
- CVE-2025-61107FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at
Medium, low and unrated 75
- CVE-2025-64094DNN vulnerable to stored cross-site-scripting (XSS) via SVG uploaddnnsoftware Dnn.Platform · DotNetNuke.Core
- CVE-2025-62802DNN CKEditor Provider allows unauthenticated upload out-of-the-boxdnnsoftware Dnn.Platform · Dnn.Platform
- CVE-2025-62801FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_namejlowin fastmcp · fastmcp
- CVE-2025-62800FastMCP vulnerable to reflected XSS in client's callback pagejlowin fastmcp · fastmcp
- CVE-2025-62798Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntaxcode16 sharp · code16/sharp
- CVE-2025-62794GitHub Workflow Updater stored the optional Github token in plaintextRichardoC github-workflow-updater-extension
- CVE-2025-62796PrivateBin persistent HTML injection in attachment filename enables redirect and defacementPrivateBin · privatebin/privatebin
- CVE-2025-61598Discourse is missing Cache-Control response header on error responsesdiscourse
- CVE-2025-11374Consul's KV endpoint is vulnerable to denial of serviceHashiCorp Consul · github.com/hashicorp/consul
- CVE-2025-11375Consul's event endpoint is vulnerable to denial of serviceHashiCorp Consul · github.com/hashicorp/consul
- CVE-2025-62367Taiga Blind SQL Injection Time Basedtaigaio taiga-back
- CVE-2025-27093Sliver does not restricted traffic between Wireguard clients.BishopFox sliver · github.com/BishopFox/sliver
- CVE-2025-40843Buffer overflow in CodeChecker log commandEricsson CodeChecker · codechecker
- CVE-2025-36085Multiple Vulnerabilities in IBM Concert Software.IBM Concert
- CVE-2025-36083Multiple Vulnerabilities in IBM Concert Software.IBM Concert Software
- CVE-2025-36081Multiple Vulnerabilities in IBM Concert Software.IBM Concert Software
- CVE-2025-34307IPFire < v2.29 Stored XSS via Default Country SearchIPFire.org IPFire
- CVE-2025-34306IPFire < v2.29 Stored XSS via Default IP Search ValueIPFire.org IPFire
- CVE-2025-34308IPFire < v2.29 Stored XSS via Default Time SyncIPFire.org IPFire
- CVE-2025-34318IPFire < v2.29 Stored XSS via DNS Creation (proxy.cgi)IPFire.org IPFire
- CVE-2025-34317IPFire < v2.29 Stored XSS via DNS Creation (dns.cgi)IPFire.org IPFire
- CVE-2025-34309IPFire < v2.29 Stored XSS via Dynamic DNS HostIPFire.org IPFire
- CVE-2025-34301IPFire < v2.29 Stored XSS via Location Group CreationIPFire.org IPFire
- CVE-2025-34316IPFire < v2.29 Stored XSS via Mail Server SettingsIPFire.org IPFire
- CVE-2025-34305IPFire < v2.29 Stored XSS via Multiple Methods in cleanhtml()IPFire.org IPFire
- CVE-2025-34310IPFire < v2.29 Stored XSS via Quality of Service (QoS) SettingsIPFire.org IPFire
- CVE-2025-34315IPFire < v2.29 Stored XSS via Remote Syslog Server AddressIPFire.org IPFire
- CVE-2025-34302IPFire < v2.29 Stored XSS via Service CreationIPFire.org IPFire
- CVE-2025-34314IPFire < v2.29 Stored XSS via Time Constraint Rule URL FilterIPFire.org IPFire
- CVE-2025-34313IPFire < v2.29 Stored XSS via User Quota Rule URL FilterIPFire.org IPFire
- CVE-2025-34303IPFire < v2.29 Stored XSS via Whitelisted Host CreationIPFire.org IPFire
- CVE-2025-12103Openshift-ai: trusty ai grants all authenticated users to list pods in any namespaceRed Hat OpenShift AI
- CVE-2025-12390Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session idkeycloak · Red Hat build of Keycloak +1
- CVE-2025-40080nbd: restrict sockets to TCP and UDPLinux
- CVE-2025-40078bpf: Explicitly check accesses to bpf_sock_addrLinux
- CVE-2025-40077f2fs: fix to avoid overflow while left shift operationLinux
- CVE-2025-40076PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq()Linux
- CVE-2025-40073drm/msm: Do not validate SSPP when it is not readyLinux
- CVE-2025-40072fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencingLinux
- CVE-2025-40071tty: n_gsm: Don't block input queue by waiting MSCLinux
- CVE-2025-40070pps: fix warning in pps_register_cdev when register device failLinux
- CVE-2025-40066wifi: mt76: mt7996: Check phy before init msta_link in mt7996_mac_sta_add_links()Linux
- CVE-2025-40065RISC-V: KVM: Write hgatp register with valid mode bitsLinux
- CVE-2025-40062crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regsLinux
- CVE-2025-40060coresight: trbe: Return NULL pointer for allocation failuresLinux
- CVE-2025-40059coresight: Fix incorrect handling for return value of devm_kzallocLinux
- CVE-2025-40057ptp: Add a upper bound on max_vclocksLinux
- CVE-2025-40056vhost: vringh: Fix copy_to_iter return value checkLinux
- CVE-2025-40055ocfs2: fix double free in user_cluster_connect()Linux
- CVE-2025-40052smb: client: fix crypto buffers in non-linear memoryLinux
- CVE-2025-40050bpf: Skip scalar adjustment for BPF_NEG if dst is a pointerLinux
- CVE-2025-40049Squashfs: fix uninit-value in squashfs_get_parentLinux
- CVE-2025-40042tracing: Fix race condition in kprobe initialization causing NULL pointer dereferenceLinux
- CVE-2025-40037fbdev: simplefb: Fix use after free in simplefb_detach_genpds()Linux
- CVE-2025-40036misc: fastrpc: fix possible map leak in fastrpc_put_argsLinux
- CVE-2025-40035Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leakLinux
- CVE-2025-40034PCI/AER: Avoid NULL pointer dereference in aer_ratelimit()Linux
- CVE-2025-40033remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()Linux
- CVE-2025-40032PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before releaseLinux
- CVE-2025-40031tee: fix register_shm_helper()Linux
- CVE-2025-40030pinctrl: check the return value of pinmux_ops::get_function_name()Linux
- CVE-2025-40029bus: fsl-mc: Check return value of platform_get_resource()Linux
- CVE-2025-55758Extension - jdownloads.com - CSRF vectors in jDownloads component 1.0.0 - 4.0.47 for Joomlajdownloads.com JDownloads component for Joomla
- CVE-2025-12378code-projects Simple Food Ordering System addproduct.php unrestricted uploadcode-projects Simple Food Ordering System
- CVE-2025-10939Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin consolekeycloak · Red Hat build of Keycloak +1
- CVE-2025-12347MaxSite CMS save-file-ajax.php unrestricted uploadMaxSite CMS
- CVE-2025-12346MaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted uploadMaxSite CMS
- CVE-2025-12344Yonyou U8 Cloud Request Header NCloudGatewayServlet unrestricted uploadYonyou U8 Cloud
- CVE-2025-12342Serdar Bayram Ghost Hot Spot Login Auth.php sql injectionSerdar Bayram Ghost Hot Spot
- CVE-2025-12339Campcodes Retro Basketball Shoes Online Store admin_football.php sql injectionCampcodes Retro Basketball Shoes Online Store
- CVE-2025-12338Campcodes Retro Basketball Shoes Online Store admin_product.ph sql injectionCampcodes Retro Basketball Shoes Online Store
- CVE-2025-12337Campcodes Retro Basketball Shoes Online Store admin_feature.php sql injectionCampcodes Retro Basketball Shoes Online Store
- CVE-2025-12336Campcodes Retro Basketball Shoes Online Store admin_index.php sql injectionCampcodes Retro Basketball Shoes Online Store
- CVE-2025-61080A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Clear2Pay Bank Visibility Application - Payment Execution 1.10.0
- CVE-2025-61155The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an access control vulnerability in one of its IOCTL han