Archive
10 October 2025
Vulnerabilities first published on this day (UTC), newest first.
69 results · Clear filters · Feed
-
Medium 4.0
Out-of-bounds read in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-…
-
Medium 6.6CVE-2025-21065 Public exploit
Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands …
-
Medium 4.6
Improper access control in Samsung Voice Recorder prior to version 21.5.73.12 in Android 15 and 21.5.81.40 in Android 1…
-
Medium 5.5
Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access b…
-
Medium 6.2
Improper authorization in Samsung Health prior to version 6.30.5.105 allows local attackers to access data in Samsung H…
-
Medium 4.0
Use of implicit intent for sensitive communication in Samsung Notes prior to version 4.4.30.63 allows local attackers t…
-
Medium 4.3
Out-of-bounds read and write in libimagecodec.quram.so prior to SMR Oct-2025 Release 1 allows remote attackers to acces…
-
Medium 4.0
Out-of-bounds read in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local a…
-
Medium 4.0
Out-of-bounds write in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local …
-
Medium 4.0
Out-of-bounds write under specific condition in the pre-processing of JPEG decoding in libpadm.so prior to SMR Oct-2025…
-
Medium 4.0
Out-of-bounds write in the pre-processing of JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local a…
-
Medium 5.5
Improper access control in SecSettings prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive infor…
-
Medium 6.7
Relative path traversal in Knox Enterprise prior to SMR Oct-2025 Release 1 allows local attackers to execute arbitrary …
-
Medium 5.2
Improper access control in KnoxGuard prior to SMR Oct-2025 Release 1 allows physical attackers to use the privileged AP…
-
Medium 4.0
Insecure storage of sensitive information in Galaxy Watch prior to SMR Oct-2025 Release 1 allows local attackers to acc…
-
Medium 5.7
Out-of-bounds write in fingerprint trustlet prior to SMR Oct-2025 Release 1 allows local privileged attackers to write …
-
Medium 4.5
Booking Manager < 2.1.15 - Contributor+ Booking Deletion
The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted.
-
Medium 4.6
drupal-pattern-lab/unified-twig-extensions is vulnerable to XXS
Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficient filtering of data. **Note:** This is exploitable only if the code is executed outside of Drupal; the function is int…
-
Medium 6.7
NAS Navigator2 Windows version by BUFFALO INC. registers a Windows service with an unquoted file path. A user with the …
-
Medium 5.3CVE-2025-11449 Public exploit
Reflected Cross Site Scripting in ServiceNow AI Platform
ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafte…
-
Medium 5.3
Reflected Cross Site Scripting in ServiceNow AI Platform
ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafte…
-
Medium 4.3
In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2…
-
Medium 6.5
python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any cryptographic signature…
-
Medium 6.1CVE-2025-61319 Public exploit
ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module. Wh…
-
Medium 6.5CVE-2025-61505 Public exploit
e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-c…
-
Medium 4.1
code-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS) vulnerability in the Add Room…
-
Medium 6.5
An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the s…
-
Medium 6.5
Alt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw
The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may …
-
Medium 6.5
An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafte…