Archive
October 2025
Vulnerabilities first published in this month (UTC), newest first.
62 results · Clear filters · Feed
-
High 8.6
WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read
The WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.9.28. This makes it possible for unauthenticated attackers to read arbitrary files on the server, which can expose DB credentials whe…
-
High 7.8CVE-2025-60749 Public exploit
DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchup_webhelper.exe.
-
High 8.8CVE-2025-62726 Public exploit
n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook
n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing …
-
High 8.2CVE-2025-63298 Public exploit
A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin…
-
High 8.1
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit …
-
High 7.8CVE-2025-61156 Public exploit
Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privi…
-
High 8.2CVE-2025-60595 Public exploit
SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution.
-
High 7.5CVE-2025-62727 Public exploit
Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merg…
-
High 7.8CVE-2025-40040 Public exploit
mm/ksm: fix flag-dropping behavior in ksm_madvise
In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix flag-dropping behavior in ksm_madvise syzkaller discovered the following crash: (kernel BUG) [ 44.607039] ------------[ cut here ]------------ [ 44.607422] kernel BUG at mm/userfa…
-
High 7.6CVE-2025-41090 Public exploit
Improper Access Control in CCN-CERT microCLAUDIA
microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests. To do so, the attacker can use organization i…
-
High 7.5CVE-2025-60349 Public exploit
An issue was discovered in Prevx v3.0.5.220 allowing attackers to cause a denial of service via sending IOCTL code 0x22…
-
High 7.5CVE-2025-60800 Public exploit
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to acc…
-
High 8.8CVE-2025-56399 Public exploit
alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE)…
-
High 7.5
Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled
Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the UR…
-
High 8.7CVE-2025-41067 Public exploit
Reachable Assertion vulnerability in Open5GS
Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request that deletes the NRF's own registry causes a check that ends up crashing the NRF process and renders th…
-
High 8.8CVE-2023-49440 Public exploit
AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter."
-
High 7.6CVE-2025-60424 Public exploit
A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to by…
-
High 8.6CVE-2025-60425 Public exploit
Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authenticat…
-
High 8.8CVE-2025-12028 Public exploit
IndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens
The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?actio…
-
High 7.5CVE-2025-6980 Public exploit
Captive Portal can expose sensitive information
Captive Portal can expose sensitive information
-
High 8.6CVE-2025-40778 Public exploit
Cache poisoning attacks with unsolicited RRs
Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 …
-
High 8.2CVE-2025-62641 Public exploit
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 8.1CVE-2025-62518 Public exploit
astral-tokio-tar Vulnerable to PAX Header Desynchronization
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar hea…
-
High 7.2CVE-2025-60500 Public exploit
QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypas…
-
High 7.5CVE-2025-60751 Public exploit
GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode.
-
High 7.2CVE-2025-62429 Public exploit
ClipBucket v5 executes arbitrary PHP code
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 #147, ClipBucket v5 is vulnerable to arbitrary PHP code execution. In /upload/admin_area/actions/update_launch.php, the "type" parameter from a POST request is embedded into PHP ta…
-
High 7.5CVE-2025-61301 Public exploit
Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 (commit 52e4b43, on 2025-05-17) allows a…
-
High 8.1CVE-2025-56224 Public exploit
A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to b…
-
High 7.1CVE-2025-56219 Public exploit
Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limiti…
-
High 7.5CVE-2025-56223 Public exploit
A lack of rate limiting in the component /Home/UploadStreamDocument of SigningHub v8.6.8 allows attackers to cause a De…
-
High 8.1CVE-2025-62506 Public exploit
MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS
MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege escalation vulnerability allows service accounts and STS (Security Token Service) accounts with restricted session policies to bypass their i…
-
High 8.2CVE-2025-22381 Public exploit
Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to res…
-
High 8.5CVE-2025-10576 Public exploit
Sound Research SECOMNService Escalation of Privilege
Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. HP is releasing updated audio packages to mitigate the potential vulnerabilitie…
-
High 7.5CVE-2025-11177 Public exploit
External Login <= 1.11.2 - Unauthenticated SQL Injection via log
The External Login plugin for WordPress is vulnerable to SQL Injection via the 'log' parameter in all versions up to, and including, 1.11.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer…
-
High 8.6
FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vuln…
-
High 8.6
FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities…
-
High 8.8CVE-2025-59213 Public exploit
Configuration Manager Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elevate privileges over an adjacent network.
-
High 7.0CVE-2025-59194 Public exploit
Windows Kernel Elevation of Privilege Vulnerability
Use of uninitialized resource in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.5CVE-2025-58726 Public exploit
Windows SMB Server Elevation of Privilege Vulnerability
Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
-
High 7.8CVE-2025-59254 Public exploit
Microsoft DWM Core Library Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.