Skip to content
OpenAdvisories

Archive

30 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /30 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

103 results · Feed

  • Critical 9.3
    CVE-2025-61584 Public exploit

    serverless-dns is vulnerable to Command Injection through pr.yml GitHub Action Workflow

    serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action interpolates in an unsafe manner untrusted input, specifical…

    serverless-dns serverless-dns
  • High 7.0
    CVE-2025-10991

    Root Access via UART

    The attacker may obtain root access by connecting to the UART port and this vulnerability requires the attacker to have the physical access to the device. This issue affects Tapo D230S1 V1.20: before 1.2.2 Build 20250907.

    TP-Link Systems Tapo D230S1 V1.20 Network devices
  • High 7.5
    CVE-2024-55017

    Account Takeover in Corezoid 6.6.0 in the OAuth2 implementation via an open redirect in the redirect_uri parameter allo…

  • Medium 6.5
    CVE-2025-55797

    FormCMS has an improper access control vulnerability in the /api/schemas/history/[schemaId] endpoint

    An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed.

    FormCMS NuGet
  • Medium 4.8
    CVE-2025-28016

    A Reflected Cross-Site Scripting (XSS) vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User R…

  • Medium 6.4
    CVE-2025-61792

    Quadient DS-700 iQ devices through 2025-09-30 might have a race condition during the quick clicking of (in order) the Q…

    Quadient DS-700 iQ
  • Medium 6.5
    CVE-2025-57254

    An SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital Management System (HMS) 1.0 all…

  • Medium 6.5
    CVE-2025-52047

    In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL In…

  • Medium 6.5
    CVE-2025-52049

    In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py…

  • Medium 6.5
    CVE-2025-52050

    In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_p…

  • Medium 6.5
    CVE-2025-52043

    In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_a…

  • High 7.5
    CVE-2025-56572

    Finance.js vulnerable to DoS via the seekZero() parameter

    An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter.

    financejs npm
  • High 8.1
    CVE-2025-56392

    An Insecure Direct Object Reference (IDOR) in the /dashboard/notes endpoint of Syaqui Collegetivity v1.0.0 allows attac…

  • Critical 9.8
    CVE-2025-56513 Public exploit

    NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. An …

  • High 7.3
    CVE-2025-56132 Public exploit Scanner template

    LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The appl…

  • Medium 6.1
    CVE-2025-56200

    validator.js has a URL validation bypass vulnerability in its isURL function

    A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and …

    sqlpad saf validator validator.js Ubuntu Wolfi npm
  • Medium 5.4
    CVE-2025-56676

    TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary …

  • High 7.5
    CVE-2025-56571

    Finance.js vulnerable to DoS via the IRR function’s depth parameter

    Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper handling of the recursion/iteration limit can lead to excessive CPU usage, causing application stalls or crashes.

    financejs npm
  • Low 3.5
    CVE-2025-56675

    The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers w…

    EKEN video doorbell T6
  • Medium 6.5
    CVE-2025-56207

    A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an E…

  • Medium 6.1
    CVE-2025-56018

    SourceCodester Web-based Pharmacy Product Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in Categor…

  • Medium 5.3
    CVE-2025-56520 Scanner template

    Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote…

  • High 7.5
    CVE-2025-56301

    An issue was discovered in Chipsalliance Rocket-Chip commit f517abbf41abb65cea37421d3559f9739efd00a9 (2025-01-29) allow…