# CVEs published 2025-10-30

202 CVEs were published on October 30, 2025: 24 critical, 78 high. Days are UTC.

- [CVE-2025-8849](https://cve.now/CVE-2025-8849.md): Denial of Service in danny-avila/librechat (CVSS 5.4, danny-avila/librechat)
- [CVE-2025-48983](https://cve.now/CVE-2025-48983.md): A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructur (CVSS 10.0, Veeam Backup and Replication)
- [CVE-2025-48982](https://cve.now/CVE-2025-48982.md): This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into rest (CVSS 7.3, Veeam Agent for Microsoft Windows)
- [CVE-2025-27208](https://cve.now/CVE-2025-27208.md): A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. (CVSS 6.3, Revive Adserver)
- [CVE-2025-48984](https://cve.now/CVE-2025-48984.md): A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. (CVSS 8.8, Veeam Backup and Replication)
- [CVE-2025-52665](https://cve.now/CVE-2025-52665.md): A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, t (CVSS 10.0, Ubiquiti UniFi Access Application)
- [CVE-2025-52663](https://cve.now/CVE-2025-52663.md): A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. (CVSS 7.3, Ubiquiti UniFi Talk Touch · Ubiquiti UniFi Talk G3 Phones)
- [CVE-2025-48980](https://cve.now/CVE-2025-48980.md): In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item (CVSS 6.5, Brave Desktop Browser)
- [CVE-2025-52664](https://cve.now/CVE-2025-52664.md): SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logg (CVSS 8.8, Revive Adserver)
- [CVE-2011-10037](https://cve.now/CVE-2011-10037.md): Nagios XI \< 2011R1.9 XSS via xiwindow Variables Affecting Permalinks (CVSS 5.1, Nagios XI)
- [CVE-2021-47697](https://cve.now/CVE-2021-47697.md): Nagios XI \< 5.8.0 XSS via Views URL Handling (CVSS 5.1, Nagios XI)
- [CVE-2018-25121](https://cve.now/CVE-2018-25121.md): Nagios XI \< 5.4.13 XSS via Views Page (CVSS 5.1, Nagios XI)
- [CVE-2013-10074](https://cve.now/CVE-2013-10074.md): Nagios XI \< 2012R2.6 XSS via Tools Menu (CVSS 5.1, Nagios XI)
- [CVE-2011-10040](https://cve.now/CVE-2011-10040.md): Nagios XI \< 2011R1.9 XSS via Status/Report Page Link Functions (CVSS 5.1, Nagios XI)
- [CVE-2016-15051](https://cve.now/CVE-2016-15051.md): Nagios XI \< 5.2.4 XSS via Report startdate/enddate Fields (CVSS 5.1, Nagios XI)
- [CVE-2011-10038](https://cve.now/CVE-2011-10038.md): Nagios XI \< 2011R1.9 XSS via Recurring Downtime Script (CVSS 5.1, Nagios XI)
- [CVE-2021-47695](https://cve.now/CVE-2021-47695.md): Nagios XI \< 5.8.0 XSS via My Tools Page (CVSS 5.1, Nagios XI)
- [CVE-2016-15053](https://cve.now/CVE-2016-15053.md): Nagios XI \< 5.2.4 XSS via “My Reports” Listing (CVSS 5.1, Nagios XI)
- [CVE-2016-15052](https://cve.now/CVE-2016-15052.md): Nagios XI \< 5.2.4 XSS via Menu System (CVSS 5.1, Nagios XI)
- [CVE-2020-36866](https://cve.now/CVE-2020-36866.md): Nagios XI \< 5.7.3 XSS via Manage Users in Admin Interface (CVSS 5.1, Nagios XI)
- [CVE-2023-7316](https://cve.now/CVE-2023-7316.md): Nagios XI \< 2024R1 XSS via Graph Explorer (CVSS 5.1, Nagios XI)
- [CVE-2023-7315](https://cve.now/CVE-2023-7315.md): Nagios XI \< 5.11.3 XSS via Graph Explorer (CVSS 5.1, Nagios XI)
- [CVE-2024-14001](https://cve.now/CVE-2024-14001.md): Nagios XI \< 2024R1.1.3 XSS via Executive Summary Report (CVSS 5.1, Nagios XI)
- [CVE-2020-36864](https://cve.now/CVE-2020-36864.md): Nagios XI \< 5.7.2 XSS via Dashboard Background Color Setting (CVSS 5.1, Nagios XI)
- [CVE-2023-7318](https://cve.now/CVE-2023-7318.md): Nagios XI \< 2024R1.0.2 XSS via Core Command Expansion (CVSS 5.1, Nagios XI)
- [CVE-2024-14000](https://cve.now/CVE-2024-14000.md): Nagios XI \< 2024R1.1.3 XSS via Capacity Planning Report (CVSS 5.1, Nagios XI)
- [CVE-2023-7313](https://cve.now/CVE-2023-7313.md): Nagios XI \< 5.11.3 XSS via Bulk Modifications (CVSS 5.1, Nagios XI)
- [CVE-2020-36865](https://cve.now/CVE-2020-36865.md): Nagios XI \< 5.7.2 XSS via BPI Config Management (CVSS 5.1, Nagios XI)
- [CVE-2021-47696](https://cve.now/CVE-2021-47696.md): Nagios XI \< 5.8.0 XSS via BPI Config ID Handling (CVSS 5.1, Nagios XI)
- [CVE-2023-7314](https://cve.now/CVE-2023-7314.md): Nagios XI \< 5.11.3 XSS via Bandwidth Report (CVSS 5.1, Nagios XI)
- [CVE-2011-10036](https://cve.now/CVE-2011-10036.md): Nagios XI \< 2011R1.9 XSS via backend\_url JavaScript Link Handler (CVSS 5.1, Nagios XI)
- [CVE-2011-10039](https://cve.now/CVE-2011-10039.md): Nagios XI \< 2011R1.9 XSS via Alert Heatmap Report & “My Reports” Listing (CVSS 5.1, Nagios XI)
- [CVE-2021-47699](https://cve.now/CVE-2021-47699.md): Nagios XI \< 5.8.7 XSS in Audit Log via Send to NLS Form (CVSS 5.1, Nagios XI)
- [CVE-2023-53688](https://cve.now/CVE-2023-53688.md): Nagios XI \< 5.11.3 XSS & CSRF via Hypermap Replay (CVSS 5.1, Nagios XI)
- [CVE-2023-7317](https://cve.now/CVE-2023-7317.md): Nagios XI \< 2024R1 Web SSH Terminal Missing Access Control (CVSS 9.4, Nagios XI)
- [CVE-2020-36863](https://cve.now/CVE-2020-36863.md): Nagios XI \< 5.7.2 Unrestricted File Upload via Audio Import Directory (CVSS 8.7, Nagios XI)
- [CVE-2020-36862](https://cve.now/CVE-2020-36862.md): Nagios XI \< 5.6.11 Unauthenticated XSS and SSRF via Highcharts (CVSS 6.9, Nagios XI)
- [CVE-2022-50587](https://cve.now/CVE-2022-50587.md): Nagios XI \< 5.8.9 Stored XSS via Command Names in Apply Config Error Text (CVSS 5.1, Nagios XI)
- [CVE-2022-50586](https://cve.now/CVE-2022-50586.md): Nagios XI \< 5.8.9 Stored XSS via BPI Info URL (CVSS 5.1, Nagios XI)
- [CVE-2022-50588](https://cve.now/CVE-2022-50588.md): Nagios XI \< 5.8.9 Stored XSS in Update Checking (CVSS 5.1, Nagios XI)
- [CVE-2020-36869](https://cve.now/CVE-2020-36869.md): Nagios XI \< 5.7.5 SQL injection via SNMP Trap Interface Edit Page (CVSS 8.7, Nagios XI)
- [CVE-2016-15050](https://cve.now/CVE-2016-15050.md): Nagios XI \< 5.2.4 SQL Injection in Notification Search (CVSS 8.7, Nagios XI)
- [CVE-2024-13996](https://cve.now/CVE-2024-13996.md): Nagios XI \< 2024R1.1.3 Session Not Invalidated After Password Change (CVSS 9.2, Nagios XI)
- [CVE-2024-13993](https://cve.now/CVE-2024-13993.md): Nagios XI \< 2024R1.1.2 Reflected XSS via Login Page on Older Browsers (CVSS 5.1, Nagios XI)
- [CVE-2013-10071](https://cve.now/CVE-2013-10071.md): Nagios XI \< 2012R1.6 Reflected XSS via Dashlet AJAX Load Functionality (CVSS 5.1, Nagios XI)
- [CVE-2024-14008](https://cve.now/CVE-2024-14008.md): Nagios XI \< 2024R1.3.2 RCE via WinRM Configuration Wizard (CVSS 9.4, Nagios XI)
- [CVE-2025-34286](https://cve.now/CVE-2025-34286.md): Nagios XI \< 2026R1 RCE via Run Check Command in CCM (CVSS 9.4, Nagios XI)
- [CVE-2024-14003](https://cve.now/CVE-2024-14003.md): Nagios XI \< 2024R1.2 RCE via NRDP Server Plugins (CVSS 9.4, Nagios XI)
- [CVE-2025-34134](https://cve.now/CVE-2025-34134.md): Nagios XI \< 2024R1.4.2 RCE via Business Process Intelligence (BPI) (CVSS 9.4, Nagios XI)
- [CVE-2011-10035](https://cve.now/CVE-2011-10035.md): Nagios XI \< 2011R1.9 Race Conditions in Crontab Install Scripts LPE (CVSS 7.3, Nagios XI)
- [CVE-2024-14009](https://cve.now/CVE-2024-14009.md): Nagios XI \< 2024R1.0.1 Privilege Escalation via System Profile (CVSS 9.4, Nagios XI)
- [CVE-2024-14004](https://cve.now/CVE-2024-14004.md): Nagios XI \< 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf) (CVSS 8.7, Nagios XI)
- [CVE-2018-25123](https://cve.now/CVE-2018-25123.md): Nagios XI \< 5.5.7 Privilege Escalation via MRTG Graphing Component (CVSS 8.5, Nagios XI)
- [CVE-2020-36868](https://cve.now/CVE-2020-36868.md): Nagios XI \< 5.7.3 Privilege escalation via Insecure getprofile.sh Script (CVSS 8.5, Nagios XI)
- [CVE-2025-34287](https://cve.now/CVE-2025-34287.md): Nagios XI \< 2024R2 Privilege Escalation via process\_perfdata.pl (CVSS 8.4, Nagios XI)
- [CVE-2025-34135](https://cve.now/CVE-2025-34135.md): Nagios XI \< 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files (CVSS 5.1, Nagios XI)
- [CVE-2021-47700](https://cve.now/CVE-2021-47700.md): Nagios XI \< 5.8.7 Insecure Permissions on Highcharts Temporary Directory (CVSS 8.5, Nagios XI)
- [CVE-2024-14006](https://cve.now/CVE-2024-14006.md): Nagios XI \< 2024R1.2.2 Host Header Injection (CVSS 8.8, Nagios XI)
- [CVE-2018-25122](https://cve.now/CVE-2018-25122.md): Nagios XI \< 5.4.13 Component Download Page RCE (CVSS 8.7, Nagios XI)
- [CVE-2024-14005](https://cve.now/CVE-2024-14005.md): Nagios XI \< 2024R1.2 Command Injection via Docker Wizard (CVSS 9.4, Nagios XI)
- [CVE-2020-36867](https://cve.now/CVE-2020-36867.md): Nagios XI \< 5.7.3 Command Injection in Report PDF Download (CVSS 8.7, Nagios XI)
- [CVE-2021-47689](https://cve.now/CVE-2021-47689.md): Nagios XI \< 5.8.0 Core Config Manager (CCM) XSS via Templates Pages (CVSS 5.1, Nagios XI)
- [CVE-2021-47691](https://cve.now/CVE-2021-47691.md): Nagios XI \< 5.8.2 Core Config Manager (CCM) XSS via Services Page (CVSS 5.1, Nagios XI)
- [CVE-2022-50584](https://cve.now/CVE-2022-50584.md): Nagios XI \< 5.8.8 Core Config Manager (CCM) XSS via Search & Deletion Flows (CVSS 5.1, Nagios XI)
- [CVE-2020-36861](https://cve.now/CVE-2020-36861.md): Nagios XI \< 5.7.5 Core Config Manager (CCM) XSS via Overlay Rendering and Notification/Check Period Pages (CVSS 5.1, Nagios XI)
- [CVE-2021-47690](https://cve.now/CVE-2021-47690.md): Nagios XI \< 5.8.2 Core Config Manager (CCM) XSS via Overlay Modals (CVSS 5.1, Nagios XI)
- [CVE-2020-36860](https://cve.now/CVE-2020-36860.md): Nagios XI \< 5.7.4 Core Config Manager (CCM) XSS via Object Edit Pages (CVSS 5.1, Nagios XI)
- [CVE-2022-50585](https://cve.now/CVE-2022-50585.md): Nagios XI \< 5.8.9 Core Config Manager (CCM) XSS via Audit Log Page Search Input (CVSS 5.1, Nagios XI)
- [CVE-2020-36859](https://cve.now/CVE-2020-36859.md): Nagios XI \< 5.7.4 Core Config Manager (CCM) SQL Injection via Object Edit Pages (CVSS 8.7, Nagios XI)
- [CVE-2021-47693](https://cve.now/CVE-2021-47693.md): Nagios XI \< 5.8.5 Core Config Manager (CCM) SQL Injection via Improper Escaping in Search Text (CVSS 8.7, Nagios XI)
- [CVE-2021-47694](https://cve.now/CVE-2021-47694.md): Nagios XI \< 5.8.6 Core Config Manager (CCM) Reflected XSS via Test Command (CVSS 5.1, Nagios XI)
- [CVE-2013-10073](https://cve.now/CVE-2013-10073.md): Nagios XI \< 2012R1.6 Auto-Discovery Shell Command Injection (CVSS 8.7, Nagios XI)
- [CVE-2013-10072](https://cve.now/CVE-2013-10072.md): Nagios XI \< 2012R1.6 Auto-Discovery Missing Authorization (CVSS 7.2, Nagios XI)
- [CVE-2020-36857](https://cve.now/CVE-2020-36857.md): Nagios XI \< 5.6.14 Authenticated SQL Injection via SNMP Trap Interface Page (CVSS 8.6, Nagios XI)
- [CVE-2012-10063](https://cve.now/CVE-2012-10063.md): Nagios XI \< 2012R1.3 Authenticated SQL Injection in Legacy CCM (CVSS 8.7, Nagios XI)
- [CVE-2020-36856](https://cve.now/CVE-2020-36856.md): Nagios XI \< 5.6.14 Authenticated RCE command\_test.php via address (CVSS 9.4, Nagios XI)
- [CVE-2024-14002](https://cve.now/CVE-2024-14002.md): Nagios XI \< 2024R1.1.4 Authenticated Local File Inclusion via NagVis (CVSS 7.1, Nagios XI)
- [CVE-2025-34284](https://cve.now/CVE-2025-34284.md): Nagios XI \< 2024R2 Authenticated Command Injection via WinRM Plugin (CVSS 9.4, Nagios XI)
- [CVE-2024-13995](https://cve.now/CVE-2024-13995.md): Nagios XI \< 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure (CVSS 7.1, Nagios XI)
- [CVE-2025-34283](https://cve.now/CVE-2025-34283.md): Nagios XI \< 2024R1.4.2 API Key Disclosure via Neptune Themes (CVSS 7.1, Nagios XI)
- [CVE-2024-13994](https://cve.now/CVE-2024-13994.md): Nagios XI \< 2024R1.1.2 Allow Insecure Logins Missing Authorization (CVSS 8.7, Nagios XI)
- [CVE-2024-13999](https://cve.now/CVE-2024-13999.md): Nagios XI \< 2024R1.1.3 AD/LDAP Token Authenticated Information Disclosure (CVSS 7.3, Nagios XI)
- [CVE-2023-7319](https://cve.now/CVE-2023-7319.md): Nagios Network Analyzer \< 2024R1 XSS via Percentile Calculator Menu (CVSS 5.1, Nagios Network Analyzer)
- [CVE-2025-34278](https://cve.now/CVE-2025-34278.md): Nagios Network Analyzer \< 2024R1 Source Groups / Percentile Calculator Menu Stored XSS (CVSS 5.1, Nagios Network Analyzer)
- [CVE-2025-34280](https://cve.now/CVE-2025-34280.md): Nagios Network Analyzer \< 2024R2.0.1 RCE in LDAP Certificate Removal Function (CVSS 8.6, Nagios Network Analyzer)
- [CVE-2023-7321](https://cve.now/CVE-2023-7321.md): Nagios Log Server \< 2.1.14 XSS via Snapshots Page (CVSS 5.1, Nagios Log Server)
- [CVE-2023-7323](https://cve.now/CVE-2023-7323.md): Nagios Log Server \< 2024R1 XSS via Create User Function (CVSS 5.1, Nagios Log Server)
- [CVE-2020-36858](https://cve.now/CVE-2020-36858.md): Nagios Log Server \< 2.1.6 XSS via Create User, Edit User, & Manage Host Lists Pages (CVSS 5.1, Nagios Log Server)
- [CVE-2025-34298](https://cve.now/CVE-2025-34298.md): Nagios Log Server \< 2024R1.3.2 Set Email Privilege Escalation (CVSS 8.7, Nagios Log Server)
- [CVE-2025-34277](https://cve.now/CVE-2025-34277.md): Nagios Log Server \< 2024R1.3.1 RCE via Malformed Dashboard ID (CVSS 9.4, Nagios Log Server)
- [CVE-2025-34272](https://cve.now/CVE-2025-34272.md): Nagios Log Server \< 2024R2.0.3 Non-Empty Default Dashboard Fallback (CVSS 5.3, Nagios Log Server)
- [CVE-2025-34273](https://cve.now/CVE-2025-34273.md): Nagios Log Server \< 2024R2.0.3 Non-Admin Dashboard Deletion (CVSS 7.1, Nagios Log Server)
- [CVE-2024-58273](https://cve.now/CVE-2024-58273.md): Nagios Log Server \< 2024R1.0.2 LPE from Apache/Backend Shell User to Root (CVSS 8.5, Nagios Log Server)
- [CVE-2025-34274](https://cve.now/CVE-2025-34274.md): Nagios Log Server \< 2024R2.0.3 Logstash Process Root Privileges (CVSS 9.3, Nagios Log Server)
- [CVE-2023-7322](https://cve.now/CVE-2023-7322.md): Nagios Log Server \< 2024R1 Incorrect Authorization Granting Full API Access (CVSS 8.7, Nagios Log Server)
- [CVE-2016-15049](https://cve.now/CVE-2016-15049.md): Nagios Log Server \< 1.4.2 Dashboards Logs Table XSS (CVSS 5.1, Nagios Log Server)
- [CVE-2025-34271](https://cve.now/CVE-2025-34271.md): Nagios Log Server \< 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext (CVSS 8.7, Nagios Log Server)
- [CVE-2025-34270](https://cve.now/CVE-2025-34270.md): Nagios Log Server \< 2024R2.0.2 AD/LDAP Import Password Not Obfuscated (CVSS 6.9, Nagios Log Server)
- [CVE-2017-20209](https://cve.now/CVE-2017-20209.md): Nagios Fusion \< 4.0.1 XSS via Users/Servers Page (CVSS 5.1, Nagios Fusion)
- [CVE-2018-25119](https://cve.now/CVE-2018-25119.md): Nagios Fusion \< 4.1.5 XSS via fusionwindow Parameter (CVSS 5.1, Nagios Fusion)
- [CVE-2023-53689](https://cve.now/CVE-2023-53689.md): Nagios Fusion \< 4.2.0 License Information Reflected XSS (CVSS 6.0, Nagios Fusion)
- [CVE-2023-53690](https://cve.now/CVE-2023-53690.md): Nagios Fusion \< 4.2.0 LDAP/AD Integration Stored XSS (CVSS 6.2, Nagios Fusion)
- [CVE-2023-7312](https://cve.now/CVE-2023-7312.md): Nagios Fusion \< 4.2.0 Email Settings Stored XSS via SMTP/sendmail (CVSS 6.2, Nagios Fusion)
- [CVE-2023-7325](https://cve.now/CVE-2023-7325.md): Mingyu Operations and Maintenance Audit and Risk Control System xmlrpc.sock SSRF (CVSS 9.3, Anheng Information (Hangzhou DBAPP Security Information Tec…)
- [CVE-2021-4461](https://cve.now/CVE-2021-4461.md): Seeyon Zhiyuan OA Web Application System \< 7.0 SP1 Authentication Bypass (CVSS 9.3, Seeyon Zhiyuan OA Web Application System)
- [CVE-2025-8850](https://cve.now/CVE-2025-8850.md): Insecure API Design in danny-avila/librechat (CVSS 3.1, danny-avila/librechat)
- [CVE-2025-3356](https://cve.now/CVE-2025-3356.md): IBM Tivoli Monitoring is vulnerable to unauthenticated file read and write operations (CVSS 8.6, IBM Tivoli Monitoring)
- [CVE-2025-3355](https://cve.now/CVE-2025-3355.md): IBM Tivoli Monitoring is vulnerable to unauthenticated file read and write operations (CVSS 7.5, IBM Tivoli Monitoring)
- [CVE-2025-36137](https://cve.now/CVE-2025-36137.md): IBM Sterling Connect:Direct for UNIX command execution (CVSS 7.2, IBM Sterling Connect:Direct for Unix)
- [CVE-2025-62265](https://cve.now/CVE-2025-62265.md): Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-64118](https://cve.now/CVE-2025-64118.md): node-tar vulnerable to race condition leading to uninitialized memory exposure (CVSS 6.1, isaacs node-tar · tar)
- [CVE-2025-64112](https://cve.now/CVE-2025-64112.md): Statmatic vulnerable to Stored Cross-Site Scripting (CVSS 8.0, statamic cms · statamic/cms)
- [CVE-2025-64115](https://cve.now/CVE-2025-64115.md): Movary unvalidated Referer header allows open redirect and phishing (CVSS 5.1, leepeuker movary)
- [CVE-2025-62266](https://cve.now/CVE-2025-62266.md): By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 t (CVSS 5.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-64116](https://cve.now/CVE-2025-64116.md): Movary vulnerable to an open redirect (CVSS 5.1, leepeuker movary)
- [CVE-2025-12060](https://cve.now/CVE-2025-12060.md): Keras keras.utils.get\_file Utility Path Traversal Vulnerability (CVSS 8.9, Keras)
- [CVE-2025-64096](https://cve.now/CVE-2025-64096.md): CryptoLib vulnerable to Stack Buffer Overflow in Crypto\_Key\_Update due to missing TLV length check (CVSS 8.8, nasa CryptoLib)
- [CVE-2025-62795](https://cve.now/CVE-2025-62795.md): JumpServer Unauthorized LDAP Configuration Access via WebSocket (CVSS 7.1, jumpserver)
- [CVE-2025-62726](https://cve.now/CVE-2025-62726.md): n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook (CVSS 8.8, n8n-io n8n · n8n)
- [CVE-2025-62712](https://cve.now/CVE-2025-62712.md): JumpServer Connection Token Leak Vulnerability (CVSS 9.6, jumpserver)
- [CVE-2025-11998](https://cve.now/CVE-2025-11998.md): HP Card Readers (B Models) – Potential Information Disclosure (CVSS 6.8, HP Card Readers B Model)
- [CVE-2025-12517](https://cve.now/CVE-2025-12517.md): Credits Page not Matching Versions in Use in the Firmware (CVSS 2.1, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12516](https://cve.now/CVE-2025-12516.md): Lack of Graceful Error Handling - HTTP 5xx Error (CVSS 10.0, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12515](https://cve.now/CVE-2025-12515.md): Systemic Internal Server Errors - HTTP 500 Response (CVSS 10.0, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-36592](https://cve.now/CVE-2025-36592.md): Dell Secure Connect Gateway (SCG) Policy Manager, version(s) 5.20. (CVSS 5.4, Dell Secure Connect Gateway SCG Policy Manager)
- [CVE-2025-46363](https://cve.now/CVE-2025-46363.md): Dell Secure Connect Gateway (SCG) 5.0 Application and Appliance version(s) 5.26.00.00 - 5.30.00.00, contain a Relative Path Traversal vulner (CVSS 4.3, Dell Secure Connect Gateway SCG 5.0 Application and Applian…)
- [CVE-2025-5347](https://cve.now/CVE-2025-5347.md): Stored XSS (CVSS 6.3, Zohocorp ManageEngine Exchange Reporter Plus)
- [CVE-2025-5343](https://cve.now/CVE-2025-5343.md): Stored XSS (CVSS 6.3, Zohocorp ManageEngine Exchange Reporter Plus)
- [CVE-2025-43942](https://cve.now/CVE-2025-43942.md): Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2025-5342](https://cve.now/CVE-2025-5342.md): Denial of Service (DoS) (CVSS 4.3, Zohocorp ManageEngine Exchange Reporter Plus)
- [CVE-2025-46422](https://cve.now/CVE-2025-46422.md): Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2025-46423](https://cve.now/CVE-2025-46423.md): Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2025-43027](https://cve.now/CVE-2025-43027.md): A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain adminis (CVSS 9.8, Genetec Security Center)
- [CVE-2025-43939](https://cve.now/CVE-2025-43939.md): Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2025-43940](https://cve.now/CVE-2025-43940.md): Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.8, Dell Unity)
- [CVE-2025-43941](https://cve.now/CVE-2025-43941.md): Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection (CVSS 7.2, Dell Unity)
- [CVE-2025-10348](https://cve.now/CVE-2025-10348.md): Stored Cross-Site Scripting in URVE Smart Office (CVSS 5.1, Eveo URVE Smart Office)
- [CVE-2025-10317](https://cve.now/CVE-2025-10317.md): Multiple Cross-Site Request Forgery in Quick.Cart (CVSS 5.1, OpenSolution Quick.Cart)
- [CVE-2025-53883](https://cve.now/CVE-2025-53883.md): spacewalk-java has various XSS issues on search page (CVSS 9.3, Container suse manager · SUSE Manager Server LTS)
- [CVE-2025-39663](https://cve.now/CVE-2025-39663.md): Cross Site Scripting through compromised remote site (CVSS 8.5, Checkmk)
- [CVE-2025-53880](https://cve.now/CVE-2025-53880.md): susemanager-tftpsync-recv allows arbitrary file creation and deletion due to path traversal (CVSS 8.7, Container suse/manager/4.3/proxy-httpd:latest · Containe… +2)
- [CVE-2025-40105](https://cve.now/CVE-2025-40105.md): vfs: Don't leak disconnected dentries on umount (CVSS 7.8, Linux)
- [CVE-2025-40104](https://cve.now/CVE-2025-40104.md): ixgbevf: fix mailbox API compatibility by negotiating supported features (CVSS 7.8, Linux)
- [CVE-2025-40103](https://cve.now/CVE-2025-40103.md): smb: client: Fix refcount leak for cifs\_sb\_tlink (no CVSS, Linux)
- [CVE-2025-40102](https://cve.now/CVE-2025-40102.md): KVM: arm64: Prevent access to vCPU events before init (no CVSS, Linux)
- [CVE-2025-40101](https://cve.now/CVE-2025-40101.md): btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (no CVSS, Linux)
- [CVE-2025-40100](https://cve.now/CVE-2025-40100.md): btrfs: do not assert we found block group item when creating free space tree (no CVSS, Linux)
- [CVE-2025-40099](https://cve.now/CVE-2025-40099.md): cifs: parse\_dfs\_referrals: prevent oob on malformed input (CVSS 9.4, Linux)
- [CVE-2025-40098](https://cve.now/CVE-2025-40098.md): ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41\_get\_acpi\_mute\_state() (no CVSS, Linux)
- [CVE-2025-40097](https://cve.now/CVE-2025-40097.md): ALSA: hda: Fix missing pointer check in hda\_component\_manager\_init function (no CVSS, Linux)
- [CVE-2025-40096](https://cve.now/CVE-2025-40096.md): drm/sched: Fix potential double free in drm\_sched\_job\_add\_resv\_dependencies (CVSS 7.8, Linux)
- [CVE-2025-40095](https://cve.now/CVE-2025-40095.md): usb: gadget: f\_rndis: Refactor bind path to use \_\_free() (CVSS 7.8, Linux)
- [CVE-2025-40094](https://cve.now/CVE-2025-40094.md): usb: gadget: f\_acm: Refactor bind path to use \_\_free() (CVSS 7.8, Linux)
- [CVE-2025-40093](https://cve.now/CVE-2025-40093.md): usb: gadget: f\_ecm: Refactor bind path to use \_\_free() (CVSS 7.8, Linux)
- [CVE-2025-40092](https://cve.now/CVE-2025-40092.md): usb: gadget: f\_ncm: Refactor bind path to use \_\_free() (CVSS 7.8, Linux)
- [CVE-2025-40091](https://cve.now/CVE-2025-40091.md): ixgbe: fix too early devlink\_free() in ixgbe\_remove() (no CVSS, Linux)
- [CVE-2025-40090](https://cve.now/CVE-2025-40090.md): ksmbd: fix recursive locking in RPC handle list access (CVSS 7.5, Linux)
- [CVE-2025-40089](https://cve.now/CVE-2025-40089.md): cxl/features: Add check for no entries in cxl\_feature\_info (no CVSS, Linux)
- [CVE-2025-40088](https://cve.now/CVE-2025-40088.md): hfsplus: fix slab-out-of-bounds read in hfsplus\_strcasecmp() (CVSS 7.1, Linux)
- [CVE-2025-40087](https://cve.now/CVE-2025-40087.md): NFSD: Define a proc\_layoutcommit for the FlexFiles layout type (CVSS 7.5, Linux)
- [CVE-2025-40086](https://cve.now/CVE-2025-40086.md): drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (no CVSS, Linux)
- [CVE-2025-54471](https://cve.now/CVE-2025-54471.md): NeuVector is shipping cryptographic material into its binary (CVSS 6.5, SUSE neuvector · github.com/neuvector/neuvector)
- [CVE-2025-54941](https://cve.now/CVE-2025-54941.md): Apache Airflow: Command injection in "example\_dag\_decorator" (CVSS 4.6, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2025-54469](https://cve.now/CVE-2025-54469.md): NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow (CVSS 9.9, SUSE neuvector · github.com/neuvector/neuvector)
- [CVE-2025-54470](https://cve.now/CVE-2025-54470.md): NeuVector telemetry sender is vulnerable to MITM and DoS (CVSS 8.6, SUSE neuvector · github.com/neuvector/neuvector)
- [CVE-2025-62402](https://cve.now/CVE-2025-62402.md): Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API (CVSS 5.4, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2025-62503](https://cve.now/CVE-2025-62503.md): Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables) (CVSS 4.6, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2025-11906](https://cve.now/CVE-2025-11906.md): Privilege escalation via writable configuration files in Progress Flowmon (CVSS 6.7, Progress Software Flowmon)
- [CVE-2025-11881](https://cve.now/CVE-2025-11881.md): AppPresser – Mobile App Framework \<= 4.5.0 - Missing Authorization to Unauthenticated Limited Sensitive Information Exposure (CVSS 5.3, scottopolis AppPresser – Mobile App Framework)
- [CVE-2025-10636](https://cve.now/CVE-2025-10636.md): NS Maintenance Mode for WP \<= 1.3.1 - Admin+ Stored XSS (CVSS 3.5, NS Maintenance Mode for WP)
- [CVE-2025-62229](https://cve.now/CVE-2025-62229.md): Xorg: xmayland: use-after-free in xpresentnotify structure creation (CVSS 7.3, X.Org Xwayland · Red Hat Enterprise Linux)
- [CVE-2025-10008](https://cve.now/CVE-2025-10008.md): Translate WordPress and go Multilingual – Weglot \<= 5.1 - Missing Authorization to Unauthenticated Limited Transient Deletion (CVSS 5.3, remyb92 Translate WordPress with Weglot – Multilingual AI T…)
- [CVE-2025-11627](https://cve.now/CVE-2025-11627.md): Site Checkup AI Troubleshooting with Wizard and Tips for Each Issue \<= 1.47 - Unauthenticated Log File Poisoning (CVSS 6.5, sminozzi Site Checkup Debug AI Troubleshooting with Wizard…)
- [CVE-2025-62230](https://cve.now/CVE-2025-62230.md): Xorg: xwayland: use-after-free in xkb client resource removal (CVSS 7.3, X.Org Xwayland · Red Hat Enterprise Linux)
- [CVE-2025-62231](https://cve.now/CVE-2025-62231.md): Xorg: xmayland: value overflow in xkbsetcompatmap() (CVSS 7.3, X.Org Xwayland · Red Hat Enterprise Linux)
- [CVE-2025-12475](https://cve.now/CVE-2025-12475.md): Blocksy Companion \<= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, creativethemeshq Blocksy Companion)
- [CVE-2025-50574](https://cve.now/CVE-2025-50574.md): Cross-site scripting (XSS) vulnerability in blog-details.php in Hiruna Gallage's Glamour Salon Management System v1 allows remote attackers (CVSS 6.1)
- [CVE-2025-50736](https://cve.now/CVE-2025-50736.md): An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to re (CVSS 6.1, pdf2zh)
- [CVE-2025-50739](https://cve.now/CVE-2025-50739.md): iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization. (CVSS 9.8)
- [CVE-2025-52179](https://cve.now/CVE-2025-52179.md): Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Revolution 4.1 and earlier allows remote unauthenticated attackers to inject ar (CVSS 6.1)
- [CVE-2025-52180](https://cve.now/CVE-2025-52180.md): Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbi (CVSS 6.1)
- [CVE-2025-56313](https://cve.now/CVE-2025-56313.md): A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive). (CVSS 6.1)
- [CVE-2025-57109](https://cve.now/CVE-2025-57109.md): Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. (CVSS 6.5)
- [CVE-2025-60319](https://cve.now/CVE-2025-60319.md): PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (CVSS 6.5)
- [CVE-2025-60950](https://cve.now/CVE-2025-60950.md): An arbitrary file upload vulnerability in the Data Preparation function of AIxBlock commit f60975 allows attackers to execute arbitrary code (CVSS 6.1)
- [CVE-2025-61113](https://cve.now/CVE-2025-61113.md): TalkTalk 3.3.6 Android App contains improper access control vulnerabilities in multiple API endpoints. (CVSS 7.5)
- [CVE-2025-61114](https://cve.now/CVE-2025-61114.md): 2nd Line Android App version v1.2.92 and before (package name com.mysecondline.app), developed by AutoBizLine, Inc., contains an improper ac (CVSS 7.5)
- [CVE-2025-61115](https://cve.now/CVE-2025-61115.md): ABC Fine Wine & Spirits Android App version v.11.27.5 and before (package name com.cta.abcfinewineandspirits), developed by ABC Liquors, Inc (CVSS 7.5)
- [CVE-2025-61116](https://cve.now/CVE-2025-61116.md): AdForest - Classified Android App version 4.0.12 (package name scriptsbundle.adforest), developed by Muhammad Jawad Arshad, contains an impr (CVSS 7.5)
- [CVE-2025-61117](https://cve.now/CVE-2025-61117.md): Senza: Keto & Fasting Android App version 2.10.15 (package name com.gl.senza), developed by Paul Itoi, contains an improper access control v (CVSS 7.5)
- [CVE-2025-61118](https://cve.now/CVE-2025-61118.md): mCarFix Motorists App version 2.3 (package name com.skytop.mcarfix), developed by Paniel Mwaura, contains improper access control vulnerabil (CVSS 7.5)
- [CVE-2025-61119](https://cve.now/CVE-2025-61119.md): Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities. (CVSS 7.5)
- [CVE-2025-61120](https://cve.now/CVE-2025-61120.md): AG Life Logger Android App version v1.0.2.72 and before (package name com.donki.healthy), developed by IO FIT, K.K., contains improper acces (CVSS 7.5)
- [CVE-2025-61121](https://cve.now/CVE-2025-61121.md): Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a credentia (CVSS 7.5)
- [CVE-2025-61141](https://cve.now/CVE-2025-61141.md): sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environme (CVSS 7.5, github.com/sqls-server/sqls)
- [CVE-2025-61196](https://cve.now/CVE-2025-61196.md): An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter. (CVSS 8.8)
- [CVE-2025-61498](https://cve.now/CVE-2025-61498.md): A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows attackers to cause a Denial of Service (DoS) via supplying a (CVSS 7.5)
- [CVE-2025-63298](https://cve.now/CVE-2025-63298.md): A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/manage\_website.php c (CVSS 8.2)
- [CVE-2025-63422](https://cve.now/CVE-2025-63422.md): Incorrect access control in the Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows (CVSS 7.5)
- [CVE-2025-63423](https://cve.now/CVE-2025-63423.md): Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 was discovered to store the Administrator password. (CVSS 7.5)
- [CVE-2025-63608](https://cve.now/CVE-2025-63608.md): A SQL injection vulnerability exists in CSZ-CMS \<=1.3.0 in the Form Builder view functionality. (CVSS 5.4)
- [CVE-2025-63885](https://cve.now/CVE-2025-63885.md): A stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via in (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.