CVE-2025-14564 | Medium | 6.4 | 2026-09-30 | The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0… |
CVE-2025-33207 | Medium | 6.8 | 2026-09-29 | NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register i… |
CVE-2025-71426 | High | 7.1 | 2026-09-27 | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.4.1, a recovering Coordinator does not verify the seed supplied by the recove… |
CVE-2025-71425 | High | 7.3 | 2026-09-27 | Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONT… |
CVE-2025-71424 | Low | 3.5 | 2026-09-27 | Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Doc… |
CVE-2025-71423 | High | 7.3 | 2026-09-27 | Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response —… |
CVE-2025-71422 | Medium | 5.7 | 2026-09-27 | Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host… |
CVE-2025-1218 | Low | 3.4 | 2026-09-25 | The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromis… |
CVE-2025-14181 | Medium | 6.5 | 2026-09-25 | The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed… |
CVE-2025-51457 | High | 8.8 | 2026-09-25 | D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker wi… |
CVE-2025-14814 | Medium | 6.4 | 2026-09-25 | The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and… |
CVE-2025-32000 | Medium | 4.3 | 2026-09-24 | HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or expl… |
CVE-2025-63564 | Critical | 9.8 | 2026-09-23 | SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests |
CVE-2025-15696 | Medium | 6.8 | 2026-09-23 | The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, all… |
CVE-2025-36084 | Medium | 5.9 | 2026-09-22 | IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
CVE-2025-12767 | Medium | 5.3 | 2026-09-22 | IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excess… |
CVE-2025-1281 | High | 8.8 | 2026-09-22 | The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax()… |
CVE-2025-1280 | Medium | 6.5 | 2026-09-22 | The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_lay… |
CVE-2025-14487 | Medium | 5.3 | 2026-09-22 | The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and inc… |
CVE-2025-14486 | Medium | 5.3 | 2026-09-22 | The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0… |
CVE-2025-14484 | Medium | 5.3 | 2026-09-22 | The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including… |
CVE-2025-71421 | High | 7.2 | 2026-09-21 | UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management p… |
CVE-2025-71420 | Medium | 4.3 | 2026-09-21 | UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replie… |
CVE-2025-71419 | Medium | 5.4 | 2026-09-21 | UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMail… |
CVE-2025-12999 | | | 2026-09-21 | UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forw… |
CVE-2025-15698 | Low | 3.5 | 2026-09-19 | The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2025-66455 | Critical | 9.8 | 2026-09-18 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch… |
CVE-2025-61682 | High | 8.6 | 2026-09-18 | Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and p… |
CVE-2025-53837 | Critical | 9.9 | 2026-09-18 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to… |
CVE-2025-36421 | Medium | 5.9 | 2026-09-18 | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive informati… |
CVE-2025-36178 | Medium | 5.4 | 2026-09-18 | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation… |
CVE-2025-36147 | Medium | 6.1 | 2026-09-18 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.16 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2025-36076 | Medium | 4.3 | 2026-09-18 | IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated use… |
CVE-2025-36045 | Medium | 4.3 | 2026-09-18 | IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction f… |
CVE-2025-33147 | Medium | 5.9 | 2026-09-18 | IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information cause… |
CVE-2025-33141 | Medium | 6.5 | 2026-09-18 | IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permis… |
CVE-2025-15399 | Critical | 10.0 | 2026-09-18 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could all… |
CVE-2025-14754 | High | 8.8 | 2026-09-18 | IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation… |
CVE-2025-14753 | High | 7.5 | 2026-09-18 | IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request contai… |
CVE-2025-1350 | Medium | 5.3 | 2026-09-18 | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical… |
CVE-2025-13882 | Medium | 5.3 | 2026-09-18 | IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Engagement Manager Sta… |
CVE-2025-13533 | Medium | 4.4 | 2026-09-18 | The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment… |
CVE-2025-55787 | Critical | 9.8 | 2026-09-17 | In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists. |
CVE-2025-15697 | High | 7.1 | 2026-09-17 | The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allow… |
CVE-2025-59607 | High | 7.8 | 2026-09-17 | Memory Corruption when copying large input data exceeds normal allocation limits. |
CVE-2025-56566 | Medium | 4.6 | 2026-09-16 | MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical acce… |
CVE-2025-56565 | High | 7.6 | 2026-09-16 | DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within non-volatile memory… |
CVE-2025-56563 | Critical | 9.8 | 2026-09-16 | A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL para… |
CVE-2025-59953 | Critical | 9.8 | 2026-09-16 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implem… |
CVE-2025-43936 | High | 8.1 | 2026-09-16 | Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access coul… |
CVE-2025-36591 | Medium | 4.4 | 2026-09-16 | Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Use of a Broken or Risky Cryptographic Algorithm vulnera… |
CVE-2025-14871 | High | 7.5 | 2026-09-16 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain… |
CVE-2025-11395 | Medium | 5.5 | 2026-09-15 | A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the priv… |
CVE-2025-66974 | High | 7.5 | 2026-09-15 | An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service (DoS) o… |
CVE-2025-5802 | Medium | 5.3 | 2026-09-15 | The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts t… |
CVE-2025-13166 | Low | 3.7 | 2026-09-15 | The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses rece… |
CVE-2025-24890 | Medium | 6.8 | 2026-09-14 | gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user… |
CVE-2025-26790 | Low | 3.7 | 2026-09-14 | Withsecure Atlant with Capricorn engine before 2025-01-20_02 allows a Remote Denial of Service via an out-of-bounds memory read during processing of a document… |
CVE-2025-68624 | Medium | 4.3 | 2026-09-14 | N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM… |
CVE-2025-64031 | Low | 2.5 | 2026-09-14 | libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in arc… |
CVE-2025-63842 | Medium | 5.4 | 2026-09-14 | A Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary… |
CVE-2025-70820 | Low | 3.5 | 2026-09-13 | Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder. |
CVE-2025-70819 | Medium | 6.3 | 2026-09-13 | Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as volumes: - ../../../../../../../etc:/h_… |
CVE-2025-64059 | Low | 1.8 | 2026-09-13 | Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to… |
CVE-2025-45480 | Low | 3.0 | 2026-09-13 | Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary. |
CVE-2025-69904 | Medium | 4.9 | 2026-09-11 | Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path inp… |
CVE-2025-15679 | | | 2026-09-11 | Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515. |
CVE-2025-15695 | Low | 3.5 | 2026-09-11 | The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup… |
CVE-2025-57231 | High | 7.5 | 2026-09-10 | Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url. |
CVE-2025-51619 | Medium | 5.5 | 2026-09-09 | A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local unprivileged users to cause a denial-of-service (BSOD) condition o… |
CVE-2025-71418 | Medium | 5.3 | 2026-09-09 | PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resources. Attackers ca… |
CVE-2025-71417 | Medium | 6.5 | 2026-09-09 | PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated c… |
CVE-2025-3271 | | | 2026-09-09 | Documentum Webtop versions prior to 16.7.1 software is vulnerable to an XSS |
CVE-2025-46808 | Medium | 6.8 | 2026-09-09 | An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager container’s log
… |
CVE-2025-7062 | | | 2026-09-09 | A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and includi… |
CVE-2025-15690 | Medium | 6.8 | 2026-09-09 | The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it gener… |
CVE-2025-64868 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2025-64866 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2025-64854 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2025-64838 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2025-64830 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2025-64618 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2025-64610 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2025-64589 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2025-64588 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2025-64584 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious… |
CVE-2025-64542 | Medium | 5.4 | 2026-09-08 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM envi… |
CVE-2025-52657 | Low | 3.5 | 2026-09-07 | HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact… |
CVE-2025-52652 | Low | 3.5 | 2026-09-07 | HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originat… |
CVE-2025-52651 | Low | 3.5 | 2026-09-07 | HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security… |
CVE-2025-9049 | High | 8.8 | 2026-09-05 | The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_ac… |
CVE-2025-15647 | Medium | 5.5 | 2026-09-05 | CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are computed in floating po… |
CVE-2025-15614 | Low | 3.3 | 2026-09-05 | ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malfor… |
CVE-2025-15694 | Low | 3.5 | 2026-09-05 | The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could… |
CVE-2025-15693 | Low | 2.7 | 2026-09-05 | The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to wit… |
CVE-2025-14945 | Medium | 5.4 | 2026-09-05 | The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all… |
CVE-2025-67066 | Critical | 9.8 | 2026-09-04 | SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging pa… |
CVE-2025-15691 | Medium | 5.3 | 2026-09-04 | The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submiss… |
CVE-2025-12737 | High | 8.4 | 2026-09-03 | The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with a… |
CVE-2025-9314 | Critical | 9.8 | 2026-09-02 | The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component |