Archive
21 October 2025
Vulnerabilities first published on this day (UTC), newest first.
36 results · Clear filters · Feed
-
High 7.5
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Servi…
-
High 8.2CVE-2025-62641 Public exploit
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 8.2
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 8.2
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 8.2
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 8.2
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 7.2
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The support…
-
High 8.1
Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.7.3.0.0…
-
High 7.5
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 7.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
High 8.1
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Servi…
-
High 7.5
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
High 7.5
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). S…
-
High 8.4
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics …
-
High 8.1
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported version…
-
High 8.6
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Servi…
-
High 8.7
Improper Neutralization of Wildcards or Matching Symbols in CloudEdge Online Cameras and App
The CloudEdge Cloud does not sanitize the MQTT topic input, which could allow an attacker to leverage the MQTT wildcard to receive all the messages that should be delivered to other users by subscribing to the a MQTT topic. In these messages, the attacker can…
-
High 8.1CVE-2025-62518 Public exploit
astral-tokio-tar Vulnerable to PAX Header Desynchronization
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar hea…
-
High 8.3
This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This …
-
High 7.1
SQL Injection in SIMPLE.ERP
SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to …
-
High 8.2
Information Disclosure in Beyaz Computer's CityPLus
Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beyaz Bilgisayar Software Design Industry and Trade Ltd. Co. CityPLus allows Detect Unpublicized Web Pages.…
-
High 8.5
Command Injection
Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.
-
High 7.1
Unencrypted cleartext communication in EfficientLab WorkExaminer Professional
All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker with access to the network to read the transmitted sensitive data. An attacker can also freely modify the data on the wir…
-
High 8.3CVE-2025-9428 EPSS 29%
SQL Injection
Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.
-
High 8.8
Usage of Hardcoded FTP Credentials EfficientLab WorkExaminer Professional
The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read…
-
High 7.5
Digiwin｜EasyFlow .NET and EasyFlow AiNet - Missing Authentication
EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain database administrator credentials via a specific functionality.
-
High 8.1
A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series f…
-
High 7.2
A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, U…
-
High 8.7
Unauthorized root access via debug functionality
An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.
-
High 8.6
OS command injection using information obtained from the web management interface
An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.
-
High 7.5
The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as othe…
-
High 7.2CVE-2025-60500 Public exploit
QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypas…
-
High 8.6CVE-2025-60344 EPSS 11%
A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attacke…
-
High 7.5CVE-2025-60751 Public exploit
GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode.
-
High 8.9
Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher rol…
-
High 8.8
The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to U…