CVEs published October 31, 2025
103 CVEs were published on October 31, 2025: 9 critical, 46 high.
- Published
- 103
- Critical
- 9
- High
- 46
- Medium
- 42
- Low
- 5
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- Circutor TCPRS1plus
- 5
- Azure Access Technology BLU-IC2 · Azure Access Technology B…
- 3
- ELOG
- 3
- vtk
- 3
- Xen
- 3
- Bizerba BRAIN2
- 2
- Century Systems Co. FutureNet MA-X series · Century Syst… +3
- 2
- Liferay Portal · Liferay DXP +1
- 2
- LogicalDOC Community Edition
- 2
- Open-Xchange OX App Suite
- 2
Critical 9
- CVE-2025-64348ELOG configuration file authorization bypassELOG
- CVE-2025-12553Server Certificate Verification DisabledAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-64385INCORRECT SECURITY VALIDATION IN SENDING UDP FRAMESCircutor TCPRS1plus
- CVE-2025-64388Denial of service through specific packetsCircutor TCPRS1plus
- CVE-2025-6520SQLi in Abis Technology's BAPSISAbis Technology BAPSIS
- CVE-2025-8489King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalationkingaddons King Addons for Elementor – 4,000+ ready Element…
- CVE-2025-5397Jobmonster - Job Board WordPress Theme <= 4.8.1 - Authentication BypassNoo JobMonster
- CVE-2025-29270Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain acce
- CVE-2025-57108Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader.vtk
High 46
- CVE-2025-10693Silicon Labs Z-Wave PIR Sensor Joins Network as Non-Securesilabs.com Silicon Labs Z-Wave SDK
- CVE-2025-64349ELOG user profile missing authorizationELOG
- CVE-2025-62618ELOG file upload stored XSSELOG
- CVE-2025-12509Scripts for the module Global_Shipping executable on BRAIN2 ServerBizerba BRAIN2
- CVE-2025-12508Unencrypted communication to Active Directory servicesBizerba BRAIN2
- CVE-2025-12507Insecure service configuration – unquoted pathBizerba _connect.BRAIN
- CVE-2025-64168Agno session state overwrites between different sessions/usersagno-agi agno · agno
- CVE-2025-64389EXCHANGE OF SENSITIVE INFORMATION IN CLEAR TEXTCircutor TCPRS1plus
- CVE-2025-12501Integer overflow in GameMaker IDE below 2024.14.0 version can lead to can lead to application crashes through denial-of-service attacks (DoSOpera Norway AS GameMaker IDE
- CVE-2025-64386HIJACKING OF THE TOKEN AND GAINING ACCESSCircutor TCPRS1plus
- CVE-2025-33003IBM InfoSphere Information Server is vulnerable to privilege escalationIBM InfoSphere Information Server
- CVE-2025-58149Incorrect removal of permissions on PCI device unplugXen
- CVE-2025-58148x86: Incorrect input sanitisation in Viridian hypercallsXen
- CVE-2025-58147x86: Incorrect input sanitisation in Viridian hypercallsXen
- CVE-2025-64366WordPress MasterStudy LMS plugin <= 3.6.27 - SQL Injection vulnerabilityStylemix MasterStudy LMS
- CVE-2025-64364WordPress Masterstudy theme < 4.8.126 - Local File Inclusion vulnerabilityStylemixThemes Masterstudy
- CVE-2025-64363WordPress Kleo theme < 5.5.0 - Local File Inclusion vulnerabilitySeventhQueen Kleo
- CVE-2025-64360WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Local File Inclusion vulnerabilityStylemixThemes Consulting Elementor Widgets
- CVE-2025-64359WordPress Consulting theme < 6.7.5 - Local File Inclusion vulnerabilityStylemixThemes Consulting
- CVE-2025-64353WordPress Polylang plugin <= 3.7.3 - Deserialization of untrusted data vulnerabilityChouby Polylang
- CVE-2025-11843Therefore™ Online and Therefore™ On-Premises contains an account impersonation issue, which could potentially allow the attacker to access all the stored dataTherefore Corporation Therefore Online and Therefore On-Pre…
- CVE-2025-12115WPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price Alterationwpclever WPC Name Your Price for WooCommerce
- CVE-2025-30189When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be usOpen-Xchange OX Dovecot Pro
- CVE-2025-30188Malicious or unintentional API requests can be used to add significant amount of data to caches.Open-Xchange OX App Suite
- CVE-2025-62232Apache APISIX: basic-auth logs plaintext credentials at info levelApache Software Foundation Apache APISIX
- CVE-2025-10897WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File ReadJMA Plugins WooCommerce Designer Pro
- CVE-2025-7846WordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Functionvanquish WordPress User Extra Fields
- CVE-2025-54763FutureNet MA and IP-K series provided by Century Systems Co., Ltd.Century Systems Co. FutureNet MA-X series · Century Syst… +3
- CVE-2025-6176Brotli decompression bomb DoS in scrapy/scrapyscrapy/scrapy · scrapy +1
- CVE-2025-57106Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader.vtk
- CVE-2025-57107Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader.vtk
- CVE-2025-60749DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchup_webhelper.exe.
- CVE-2025-63454Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the deviceId parameter in the get_parentControl_list_Info function
- CVE-2025-63458Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the form_fast_setting_wifi_set function.
- CVE-2025-63459Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_421CF0 function.
- CVE-2025-63460Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_4222E0 function.
- CVE-2025-63461Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the urldecode function.
- CVE-2025-63462Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the wifiOff parameter in the sub_421A04 function.
- CVE-2025-63463Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the wifiOff parameter in the sub_4232EC function.
- CVE-2025-63464Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_42396C function.
- CVE-2025-63465Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_422880 function.
- CVE-2025-63466Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password parameter in the sub_426EF8 function.
- CVE-2025-63467Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_425400 function.
- CVE-2025-63468Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the sub_426EF8 function.
- CVE-2025-63469Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_421BAC function.
- CVE-2025-63561Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition
Medium, low and unrated 48
- CVE-2025-62276The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DLiferay Portal · Liferay DXP +2
- CVE-2025-12464Qemu-kvm: stack buffer overflow in e1000 device via short frames in loopback modeqemu · Red Hat Enterprise Linux +1
- CVE-2025-60711Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2025-12547LogicalDOC Community Edition Admin Login login.jsp excessive authenticationLogicalDOC Community Edition
- CVE-2025-12546LogicalDOC Community Edition API Key creation UI cross site scriptingLogicalDOC Community Edition
- CVE-2025-62267Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3Liferay Portal · Liferay DXP +1
- CVE-2025-62264Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.QLiferay Portal · Liferay DXP +1
- CVE-2025-59501Microsoft Configuration Manager Spoofing VulnerabilityMicrosoft Configuration Manager
- CVE-2025-6075Quadratic complexity in os.path.expandvars() with user-controlled templatePython Software Foundation CPython
- CVE-2025-12554Missing Security HeadersAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12552Insufficient Password PolicyAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-12357International Standards Organization ISO 15118-2 Improper Restriction of Communication Channel to Intended EndpointsISO 15118-2 Network and Application Protocol Requirements E…
- CVE-2025-64387CLICKJACKINGCircutor TCPRS1plus
- CVE-2025-12460Stored XSS vulnerability in Afterlogic Aurora webmailAfterlogic Aurora
- CVE-2025-12521Analytify Pro <= 7.0.3 - Unauthenticated Information ExposureAnalytify Pro
- CVE-2025-36249IBM Jazz for Service Management is vulnerable to "filter" cookie not sent over SSLIBM Jazz for Service Management
- CVE-2024-13992Nagios XI < 2024R1.1 XSS via Missing Page / 404Nagios XI
- CVE-2025-4952Denial-of-service vulnerability in ESET security products for WindowsESET NOD32 Antivirus · ESET Internet Security +11
- CVE-2025-64368WordPress Bard theme <= 1.6 - Cross Site Request Forgery (CSRF) vulnerabilityMikado-Themes Bard
- CVE-2025-64367WordPress Groundhogg plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerabilityAdrian Tobey Groundhogg
- CVE-2025-64365WordPress Ohio Extra plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerabilitycolabrio Ohio Extra
- CVE-2025-64362WordPress K Elements plugin < 5.5.0 - Cross Site Scripting (XSS) vulnerabilitySeventhQueen K Elements
- CVE-2025-64361WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityStylemixThemes Consulting Elementor Widgets
- CVE-2025-64358WordPress Smart Coupons for WooCommerce plugin <= 2.2.3 - Broken Access Control vulnerabilityWebToffee Smart Coupons for WooCommerce
- CVE-2025-64357WordPress Advanced Database Cleaner plugin <= 3.1.6 - Cross Site Request Forgery (CSRF) vulnerabilityYounes JFR. Advanced Database Cleaner
- CVE-2025-64356WordPress Insert PHP Code Snippet plugin <= 1.4.3 - Broken Access Control vulnerabilityf1logic Insert PHP Code Snippet
- CVE-2025-64354WordPress Gutenberg plugin <= 21.8.2 - Cross Site Scripting (XSS) vulnerabilityMatias Ventura Gutenberg
- CVE-2025-64352WordPress Essential Addons for Elementor plugin <= 6.2.4 - Broken Access Control vulnerabilityWPDeveloper Essential Addons for Elementor
- CVE-2025-64351WordPress Rank Math SEO plugin <= 1.0.252.1 - Sensitive Data Exposure vulnerabilityRank Math SEO
- CVE-2025-64350WordPress Rank Math SEO plugin <= 1.0.252.1 - Broken Access Control vulnerabilityRank Math SEO
- CVE-2025-40603A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administrSonicWall SMA100
- CVE-2025-11602Untargeted information leak in Bolt protocol handshakeneo4j Enterprise Edition · neo4j Community Edition
- CVE-2025-40106comedi: fix divide-by-zero in comedi_buf_munge()Linux
- CVE-2025-12041ERI File Library <= 1.1.0 - Missing Authorization to Unauthenticated Protected File Downloadapos37 ERI File Library
- CVE-2025-30191Malicious content from E-Mail can be used to perform a redressing attack.Open-Xchange OX App Suite
- CVE-2025-8383Depicter <= 4.0.4 - Cross-Site Request Forgeryaverta Depicter — Popup & Slider Builder
- CVE-2025-12094OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header SpoofingOOPSpam Anti-Spam: Spam Protection for WordPress Forms & Co…
- CVE-2025-12175The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposurestellarwp The Events Calendar
- CVE-2025-8385Zombify <= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File ReadPX-lab Zombify
- CVE-2025-11191RealPress < 1.1.0 - Unauthenticated Content Creation/Email Sending via RESTRealPress
- CVE-2025-58152FutureNet MA and IP-K series provided by Century Systems Co., Ltd.Century Systems Co. FutureNet MA-X series · Century Syst… +3
- CVE-2025-11806Qzzr Shortcode Plugin <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeQzzr Shortcode Plugin
- CVE-2025-11975FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Missing Authorization to Authenticated (Subscriber+) Sync Rule CreationFuseWP – WordPress User Sync to Email List & Marketing Auto…
- CVE-2025-23050QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero).Qt
- CVE-2025-61427A reflected cross-site scripting (XSS) vulnerability in BEO GmbH BEO Atlas Einfuhr Ausfuhr 3.0 allows attackers to execute arbitrary code in
- CVE-2025-63562Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization.
- CVE-2025-63563Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password ch
- CVE-2025-63675cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used.cryptidy