# CVEs published 2025-10-31

103 CVEs were published on October 31, 2025: 9 critical, 46 high. Days are UTC.

- [CVE-2025-62276](https://cve.now/CVE-2025-62276.md): The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay D (CVSS 4.6, Liferay Portal · Liferay DXP +2)
- [CVE-2025-12464](https://cve.now/CVE-2025-12464.md): Qemu-kvm: stack buffer overflow in e1000 device via short frames in loopback mode (CVSS 6.2, qemu · Red Hat Enterprise Linux +1)
- [CVE-2025-60711](https://cve.now/CVE-2025-60711.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 6.3, Microsoft Edge)
- [CVE-2025-10693](https://cve.now/CVE-2025-10693.md): Silicon Labs Z-Wave PIR Sensor Joins Network as Non-Secure (CVSS 7.6, silabs.com Silicon Labs Z-Wave SDK)
- [CVE-2025-12547](https://cve.now/CVE-2025-12547.md): LogicalDOC Community Edition Admin Login login.jsp excessive authentication (CVSS 6.3, LogicalDOC Community Edition)
- [CVE-2025-12546](https://cve.now/CVE-2025-12546.md): LogicalDOC Community Edition API Key creation UI cross site scripting (CVSS 5.1, LogicalDOC Community Edition)
- [CVE-2025-64349](https://cve.now/CVE-2025-64349.md): ELOG user profile missing authorization (CVSS 8.7, ELOG)
- [CVE-2025-64348](https://cve.now/CVE-2025-64348.md): ELOG configuration file authorization bypass (CVSS 9.3, ELOG)
- [CVE-2025-62618](https://cve.now/CVE-2025-62618.md): ELOG file upload stored XSS (CVSS 8.6, ELOG)
- [CVE-2025-62267](https://cve.now/CVE-2025-62267.md): Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3 (CVSS 4.6, Liferay Portal · Liferay DXP +1)
- [CVE-2025-62264](https://cve.now/CVE-2025-62264.md): Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q (CVSS 5.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-59501](https://cve.now/CVE-2025-59501.md): Microsoft Configuration Manager Spoofing Vulnerability (CVSS 4.8, Microsoft Configuration Manager)
- [CVE-2025-6075](https://cve.now/CVE-2025-6075.md): Quadratic complexity in os.path.expandvars() with user-controlled template (CVSS 1.8, Python Software Foundation CPython)
- [CVE-2025-12554](https://cve.now/CVE-2025-12554.md): Missing Security Headers (CVSS 6.9, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12509](https://cve.now/CVE-2025-12509.md): Scripts for the module Global\_Shipping executable on BRAIN2 Server (CVSS 8.4, Bizerba BRAIN2)
- [CVE-2025-12508](https://cve.now/CVE-2025-12508.md): Unencrypted communication to Active Directory services (CVSS 8.4, Bizerba BRAIN2)
- [CVE-2025-12507](https://cve.now/CVE-2025-12507.md): Insecure service configuration – unquoted path (CVSS 8.8, Bizerba \_connect.BRAIN)
- [CVE-2025-12553](https://cve.now/CVE-2025-12553.md): Server Certificate Verification Disabled (CVSS 10.0, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12552](https://cve.now/CVE-2025-12552.md): Insufficient Password Policy (CVSS 6.9, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12357](https://cve.now/CVE-2025-12357.md): International Standards Organization ISO 15118-2 Improper Restriction of Communication Channel to Intended Endpoints (CVSS 6.3, ISO 15118-2 Network and Application Protocol Requirements E…)
- [CVE-2025-64168](https://cve.now/CVE-2025-64168.md): Agno session state overwrites between different sessions/users (CVSS 7.1, agno-agi agno · agno)
- [CVE-2025-64385](https://cve.now/CVE-2025-64385.md): INCORRECT SECURITY VALIDATION IN SENDING UDP FRAMES (CVSS 9.2, Circutor TCPRS1plus)
- [CVE-2025-64389](https://cve.now/CVE-2025-64389.md): EXCHANGE OF SENSITIVE INFORMATION IN CLEAR TEXT (CVSS 8.3, Circutor TCPRS1plus)
- [CVE-2025-64388](https://cve.now/CVE-2025-64388.md): Denial of service through specific packets (CVSS 9.2, Circutor TCPRS1plus)
- [CVE-2025-64387](https://cve.now/CVE-2025-64387.md): CLICKJACKING (CVSS 5.1, Circutor TCPRS1plus)
- [CVE-2025-12501](https://cve.now/CVE-2025-12501.md): Integer overflow in GameMaker IDE below 2024.14.0 version can lead to can lead to application crashes through denial-of-service attacks (DoS (CVSS 7.5, Opera Norway AS GameMaker IDE)
- [CVE-2025-12460](https://cve.now/CVE-2025-12460.md): Stored XSS vulnerability in Afterlogic Aurora webmail (CVSS 5.3, Afterlogic Aurora)
- [CVE-2025-12521](https://cve.now/CVE-2025-12521.md): Analytify Pro \<= 7.0.3 - Unauthenticated Information Exposure (CVSS 5.3, Analytify Pro)
- [CVE-2025-64386](https://cve.now/CVE-2025-64386.md): HIJACKING OF THE TOKEN AND GAINING ACCESS (CVSS 7.7, Circutor TCPRS1plus)
- [CVE-2025-36249](https://cve.now/CVE-2025-36249.md): IBM Jazz for Service Management is vulnerable to "filter" cookie not sent over SSL (CVSS 3.7, IBM Jazz for Service Management)
- [CVE-2025-33003](https://cve.now/CVE-2025-33003.md): IBM InfoSphere Information Server is vulnerable to privilege escalation (CVSS 7.8, IBM InfoSphere Information Server)
- [CVE-2024-13992](https://cve.now/CVE-2024-13992.md): Nagios XI \< 2024R1.1 XSS via Missing Page / 404 (CVSS 5.1, Nagios XI)
- [CVE-2025-4952](https://cve.now/CVE-2025-4952.md): Denial-of-service vulnerability in ESET security products for Windows (CVSS 6.8, ESET NOD32 Antivirus · ESET Internet Security +11)
- [CVE-2025-58149](https://cve.now/CVE-2025-58149.md): Incorrect removal of permissions on PCI device unplug (CVSS 7.5, Xen)
- [CVE-2025-58148](https://cve.now/CVE-2025-58148.md): x86: Incorrect input sanitisation in Viridian hypercalls (CVSS 7.5, Xen)
- [CVE-2025-58147](https://cve.now/CVE-2025-58147.md): x86: Incorrect input sanitisation in Viridian hypercalls (CVSS 7.5, Xen)
- [CVE-2025-64368](https://cve.now/CVE-2025-64368.md): WordPress Bard theme \<= 1.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Mikado-Themes Bard)
- [CVE-2025-64367](https://cve.now/CVE-2025-64367.md): WordPress Groundhogg plugin \<= 4.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Adrian Tobey Groundhogg)
- [CVE-2025-64366](https://cve.now/CVE-2025-64366.md): WordPress MasterStudy LMS plugin \<= 3.6.27 - SQL Injection vulnerability (CVSS 7.6, Stylemix MasterStudy LMS)
- [CVE-2025-64365](https://cve.now/CVE-2025-64365.md): WordPress Ohio Extra plugin \<= 3.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, colabrio Ohio Extra)
- [CVE-2025-64364](https://cve.now/CVE-2025-64364.md): WordPress Masterstudy theme \< 4.8.126 - Local File Inclusion vulnerability (CVSS 7.5, StylemixThemes Masterstudy)
- [CVE-2025-64363](https://cve.now/CVE-2025-64363.md): WordPress Kleo theme \< 5.5.0 - Local File Inclusion vulnerability (CVSS 7.5, SeventhQueen Kleo)
- [CVE-2025-64362](https://cve.now/CVE-2025-64362.md): WordPress K Elements plugin \< 5.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SeventhQueen K Elements)
- [CVE-2025-64361](https://cve.now/CVE-2025-64361.md): WordPress Consulting Elementor Widgets plugin \<= 1.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, StylemixThemes Consulting Elementor Widgets)
- [CVE-2025-64360](https://cve.now/CVE-2025-64360.md): WordPress Consulting Elementor Widgets plugin \<= 1.4.2 - Local File Inclusion vulnerability (CVSS 7.5, StylemixThemes Consulting Elementor Widgets)
- [CVE-2025-64359](https://cve.now/CVE-2025-64359.md): WordPress Consulting theme \< 6.7.5 - Local File Inclusion vulnerability (CVSS 7.5, StylemixThemes Consulting)
- [CVE-2025-64358](https://cve.now/CVE-2025-64358.md): WordPress Smart Coupons for WooCommerce plugin \<= 2.2.3 - Broken Access Control vulnerability (CVSS 4.3, WebToffee Smart Coupons for WooCommerce)
- [CVE-2025-64357](https://cve.now/CVE-2025-64357.md): WordPress Advanced Database Cleaner plugin \<= 3.1.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Younes JFR. Advanced Database Cleaner)
- [CVE-2025-64356](https://cve.now/CVE-2025-64356.md): WordPress Insert PHP Code Snippet plugin \<= 1.4.3 - Broken Access Control vulnerability (CVSS 4.3, f1logic Insert PHP Code Snippet)
- [CVE-2025-64354](https://cve.now/CVE-2025-64354.md): WordPress Gutenberg plugin \<= 21.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Matias Ventura Gutenberg)
- [CVE-2025-64353](https://cve.now/CVE-2025-64353.md): WordPress Polylang plugin \<= 3.7.3 - Deserialization of untrusted data vulnerability (CVSS 8.8, Chouby Polylang)
- [CVE-2025-64352](https://cve.now/CVE-2025-64352.md): WordPress Essential Addons for Elementor plugin \<= 6.2.4 - Broken Access Control vulnerability (CVSS 2.7, WPDeveloper Essential Addons for Elementor)
- [CVE-2025-64351](https://cve.now/CVE-2025-64351.md): WordPress Rank Math SEO plugin \<= 1.0.252.1 - Sensitive Data Exposure vulnerability (CVSS 4.3, Rank Math SEO)
- [CVE-2025-64350](https://cve.now/CVE-2025-64350.md): WordPress Rank Math SEO plugin \<= 1.0.252.1 - Broken Access Control vulnerability (CVSS 3.8, Rank Math SEO)
- [CVE-2025-40603](https://cve.now/CVE-2025-40603.md): A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administr (CVSS 4.5, SonicWall SMA100)
- [CVE-2025-11602](https://cve.now/CVE-2025-11602.md): Untargeted information leak in Bolt protocol handshake (CVSS 6.3, neo4j Enterprise Edition · neo4j Community Edition)
- [CVE-2025-11843](https://cve.now/CVE-2025-11843.md): Therefore™ Online and Therefore™ On-Premises contains an account impersonation issue, which could potentially allow the attacker to access all the stored data (CVSS 8.8, Therefore Corporation Therefore Online and Therefore On-Pre…)
- [CVE-2025-40106](https://cve.now/CVE-2025-40106.md): comedi: fix divide-by-zero in comedi\_buf\_munge() (no CVSS, Linux)
- [CVE-2025-12115](https://cve.now/CVE-2025-12115.md): WPC Name Your Price for WooCommerce \<= 2.1.9 - Unauthenticated Price Alteration (CVSS 7.5, wpclever WPC Name Your Price for WooCommerce)
- [CVE-2025-12041](https://cve.now/CVE-2025-12041.md): ERI File Library \<= 1.1.0 - Missing Authorization to Unauthenticated Protected File Download (CVSS 5.3, apos37 ERI File Library)
- [CVE-2025-30189](https://cve.now/CVE-2025-30189.md): When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be us (CVSS 7.4, Open-Xchange OX Dovecot Pro)
- [CVE-2025-30191](https://cve.now/CVE-2025-30191.md): Malicious content from E-Mail can be used to perform a redressing attack. (CVSS 5.4, Open-Xchange OX App Suite)
- [CVE-2025-30188](https://cve.now/CVE-2025-30188.md): Malicious or unintentional API requests can be used to add significant amount of data to caches. (CVSS 7.5, Open-Xchange OX App Suite)
- [CVE-2025-62232](https://cve.now/CVE-2025-62232.md): Apache APISIX: basic-auth logs plaintext credentials at info level (CVSS 7.5, Apache Software Foundation Apache APISIX)
- [CVE-2025-8383](https://cve.now/CVE-2025-8383.md): Depicter \<= 4.0.4 - Cross-Site Request Forgery (CVSS 4.3, averta Depicter — Popup & Slider Builder)
- [CVE-2025-12094](https://cve.now/CVE-2025-12094.md): OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) \<= 1.2.53 - Unauthenticated IP Header Spoofing (CVSS 5.3, OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Co…)
- [CVE-2025-12175](https://cve.now/CVE-2025-12175.md): The Events Calendar \<= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure (CVSS 4.3, stellarwp The Events Calendar)
- [CVE-2025-6520](https://cve.now/CVE-2025-6520.md): SQLi in Abis Technology's BAPSIS (CVSS 9.8, Abis Technology BAPSIS)
- [CVE-2025-8385](https://cve.now/CVE-2025-8385.md): Zombify \<= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read (CVSS 6.8, PX-lab Zombify)
- [CVE-2025-10897](https://cve.now/CVE-2025-10897.md): WooCommerce Designer Pro \<= 1.9.28 - Unauthenticated Arbitrary File Read (CVSS 8.6, JMA Plugins WooCommerce Designer Pro)
- [CVE-2025-7846](https://cve.now/CVE-2025-7846.md): WordPress User Extra Fields \<= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save\_fields Function (CVSS 8.8, vanquish WordPress User Extra Fields)
- [CVE-2025-8489](https://cve.now/CVE-2025-8489.md): King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalation (CVSS 9.8, kingaddons King Addons for Elementor – 4,000+ ready Element…)
- [CVE-2025-5397](https://cve.now/CVE-2025-5397.md): Jobmonster - Job Board WordPress Theme \<= 4.8.1 - Authentication Bypass (CVSS 9.8, Noo JobMonster)
- [CVE-2025-11191](https://cve.now/CVE-2025-11191.md): RealPress \< 1.1.0 - Unauthenticated Content Creation/Email Sending via REST (CVSS 5.3, RealPress)
- [CVE-2025-54763](https://cve.now/CVE-2025-54763.md): FutureNet MA and IP-K series provided by Century Systems Co., Ltd. (CVSS 7.2, Century Systems Co. FutureNet MA-X series · Century Syst… +3)
- [CVE-2025-58152](https://cve.now/CVE-2025-58152.md): FutureNet MA and IP-K series provided by Century Systems Co., Ltd. (CVSS 5.3, Century Systems Co. FutureNet MA-X series · Century Syst… +3)
- [CVE-2025-11806](https://cve.now/CVE-2025-11806.md): Qzzr Shortcode Plugin \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Qzzr Shortcode Plugin)
- [CVE-2025-11975](https://cve.now/CVE-2025-11975.md): FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) \<= 1.1.23.0 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation (CVSS 4.3, FuseWP – WordPress User Sync to Email List & Marketing Auto…)
- [CVE-2025-6176](https://cve.now/CVE-2025-6176.md): Brotli decompression bomb DoS in scrapy/scrapy (CVSS 7.5, scrapy/scrapy · scrapy +1)
- [CVE-2025-23050](https://cve.now/CVE-2025-23050.md): QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). (CVSS 3.1, Qt)
- [CVE-2025-29270](https://cve.now/CVE-2025-29270.md): Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain acce (CVSS 10.0)
- [CVE-2025-57106](https://cve.now/CVE-2025-57106.md): Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. (CVSS 7.5, vtk)
- [CVE-2025-57107](https://cve.now/CVE-2025-57107.md): Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. (CVSS 7.1, vtk)
- [CVE-2025-57108](https://cve.now/CVE-2025-57108.md): Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. (CVSS 9.8, vtk)
- [CVE-2025-60749](https://cve.now/CVE-2025-60749.md): DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchup\_webhelper.exe. (CVSS 7.8)
- [CVE-2025-61427](https://cve.now/CVE-2025-61427.md): A reflected cross-site scripting (XSS) vulnerability in BEO GmbH BEO Atlas Einfuhr Ausfuhr 3.0 allows attackers to execute arbitrary code in (CVSS 6.1)
- [CVE-2025-63454](https://cve.now/CVE-2025-63454.md): Tenda AX-3 v16.03.12.10\_CN was discovered to contain a stack overflow via the deviceId parameter in the get\_parentControl\_list\_Info function (CVSS 7.5)
- [CVE-2025-63458](https://cve.now/CVE-2025-63458.md): Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the form\_fast\_setting\_wifi\_set function. (CVSS 7.5)
- [CVE-2025-63459](https://cve.now/CVE-2025-63459.md): Totolink A7000R v9.1.0u.6115\_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub\_421CF0 function. (CVSS 7.5)
- [CVE-2025-63460](https://cve.now/CVE-2025-63460.md): Totolink A7000R v9.1.0u.6115\_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub\_4222E0 function. (CVSS 7.5)
- [CVE-2025-63461](https://cve.now/CVE-2025-63461.md): Totolink A7000R v9.1.0u.6115\_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the urldecode function. (CVSS 7.5)
- [CVE-2025-63462](https://cve.now/CVE-2025-63462.md): Totolink A7000R v9.1.0u.6115\_B20201022 was discovered to contain a stack overflow via the wifiOff parameter in the sub\_421A04 function. (CVSS 7.5)
- [CVE-2025-63463](https://cve.now/CVE-2025-63463.md): Totolink LR350 v9.3.5u.6369\_B20220309 was discovered to contain a stack overflow via the wifiOff parameter in the sub\_4232EC function. (CVSS 7.5)
- [CVE-2025-63464](https://cve.now/CVE-2025-63464.md): Totolink LR350 v9.3.5u.6369\_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub\_42396C function. (CVSS 7.5)
- [CVE-2025-63465](https://cve.now/CVE-2025-63465.md): Totolink LR350 v9.3.5u.6369\_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub\_422880 function. (CVSS 7.5)
- [CVE-2025-63466](https://cve.now/CVE-2025-63466.md): Totolink LR350 v9.3.5u.6369\_B20220309 was discovered to contain a stack overflow via the password parameter in the sub\_426EF8 function. (CVSS 7.5)
- [CVE-2025-63467](https://cve.now/CVE-2025-63467.md): Totolink LR350 v9.3.5u.6369\_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub\_425400 function. (CVSS 7.5)
- [CVE-2025-63468](https://cve.now/CVE-2025-63468.md): Totolink LR350 v9.3.5u.6369\_B20220309 was discovered to contain a stack overflow via the http\_host parameter in the sub\_426EF8 function. (CVSS 7.5)
- [CVE-2025-63469](https://cve.now/CVE-2025-63469.md): Totolink LR350 v9.3.5u.6369\_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub\_421BAC function. (CVSS 7.5)
- [CVE-2025-63561](https://cve.now/CVE-2025-63561.md): Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition (CVSS 7.5)
- [CVE-2025-63562](https://cve.now/CVE-2025-63562.md): Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization. (CVSS 6.3)
- [CVE-2025-63563](https://cve.now/CVE-2025-63563.md): Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password ch (CVSS 6.5)
- [CVE-2025-63675](https://cve.now/CVE-2025-63675.md): cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. (CVSS 6.9, cryptidy)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.