Skip to content
OpenAdvisories

Archive

October 2025

Vulnerabilities first published in this month (UTC), newest first.

← September 2025 2025 / October November 2025 →
  1. 1246
  2. 2120
  3. 3158
  4. 4159
  5. 539
  6. 6114
  7. 7241
  8. 8103
  9. 9170
  10. 10126
  11. 1176
  12. 1236
  13. 1391
  14. 14370
  15. 15189
  16. 16132
  17. 1787
  18. 1873
  19. 1911
  20. 2081
  21. 21156
  22. 22393
  23. 2398
  24. 2499
  25. 2539
  26. 266
  27. 27315
  28. 28147
  29. 29161
  30. 30203
  31. 31103
All Critical High Medium Low Exploited only Public exploit

4,342 results · Feed

  • Medium 6.1
    CVE-2025-50574

    Cross-site scripting (XSS) vulnerability in blog-details.php in Hiruna Gallage's Glamour Salon Management System v1 all…

  • Medium 6.1
    CVE-2025-50736

    Byaidu PDFMathTranslate vulnerable to open redirect

    An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradio_api endpoint. This vulnerability coul…

    pdf2zh PyPI
  • Critical 9.8
    CVE-2025-50739

    iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization.

  • High 7.5
    CVE-2025-63423

    Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 was discovered to store the Administrator pass…

  • High 7.5
    CVE-2025-63422

    Incorrect access control in the Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRo…

  • Medium 5.4
    CVE-2025-63608

    A SQL injection vulnerability exists in CSZ-CMS <=1.3.0 in the Form Builder view functionality. The vulnerability is lo…

  • High 8.2
    CVE-2025-63298 Public exploit

    A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin…

  • Medium 6.1
    CVE-2025-63885

    A stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web s…

  • High 7.5
    CVE-2025-61120

    AG Life Logger Android App version v1.0.2.72 and before (package name com.donki.healthy), developed by IO FIT, K.K., co…

  • High 7.5
    CVE-2025-61141

    sqls-server/sqls is vulnerable to command injection in the config command

    sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands.

    github.com/sqls-server/sqls Go
  • High 7.5
    CVE-2025-61116

    AdForest - Classified Android App version 4.0.12 (package name scriptsbundle.adforest), developed by Muhammad Jawad Ars…

  • High 7.5
    CVE-2025-61118

    mCarFix Motorists App version 2.3 (package name com.skytop.mcarfix), developed by Paniel Mwaura, contains improper acce…

  • High 7.5
    CVE-2025-61113

    TalkTalk 3.3.6 Android App contains improper access control vulnerabilities in multiple API endpoints. By modifying req…

  • High 7.5
    CVE-2025-61117

    Senza: Keto & Fasting Android App version 2.10.15 (package name com.gl.senza), developed by Paul Itoi, contains an impr…

  • High 7.5
    CVE-2025-61119

    Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access con…

  • High 7.5
    CVE-2025-61498

    A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows attackers to cause a Denial of Service …

  • High 7.5
    CVE-2025-61121

    Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd.,…

  • High 7.5
    CVE-2025-61115

    ABC Fine Wine & Spirits Android App version v.11.27.5 and before (package name com.cta.abcfinewineandspirits), develope…

  • High 8.8
    CVE-2025-61196

    An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input p…

  • High 7.5
    CVE-2025-61114

    2nd Line Android App version v1.2.92 and before (package name com.mysecondline.app), developed by AutoBizLine, Inc., co…

  • Medium 6.1
    CVE-2025-60950

    An arbitrary file upload vulnerability in the Data Preparation function of AIxBlock commit f60975 allows attackers to e…

  • Medium 6.5
    CVE-2025-60319

    PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAtta…

  • Medium 6.5
    CVE-2025-57109

    Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When p…

    vtk9 vtk9 Debian Ubuntu
  • Medium 6.1
    CVE-2025-52179

    Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Revolution 4.1 and earlier allows remote unauthenticated a…

  • Medium 6.1
    CVE-2025-52180

    Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated att…

  • Medium 6.1
    CVE-2025-56313

    A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through …

  • Medium 6.3
    CVE-2025-62257

    Liferay Portal vulnerable to password enumeration

    Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsuppor…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • High 7.5
    CVE-2025-12466

    Simple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass - SA-CONTRIB-2025-114

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass.This issue affects Simple OAuth (OAuth2) & OpenID Connect: from 6.0.0 before 6.0.7.

    Drupal Simple OAuth (OAuth2) & OpenID Connect drupal/simple_oauth Packagist
  • Medium 6.1
    CVE-2025-12083

    CivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.

    Drupal CivicTheme Design System drupal/civictheme Packagist
  • High 7.5
    CVE-2025-12082

    CivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-112

    Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.

    Drupal CivicTheme Design System drupal/civictheme Packagist
  • Medium 5.3
    CVE-2025-10929

    Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111

    Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.

    Drupal Reverse Proxy Header drupal/reverse_proxy_header Packagist
  • Medium 6.5
    CVE-2025-10930

    Currency - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-110

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0.

    Drupal Currency drupal/currency Packagist
  • Low 3.8
    CVE-2025-10931

    Umami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS).This issue affects Umami Analytics: from 0.0.0 before 1.0.1.

    Drupal Umami Analytics drupal/umami_analytics Packagist
  • Medium 6.3
    CVE-2025-10928

    Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-108

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.

    Drupal Access code drupal/access_code Packagist
  • Medium 6.1
    CVE-2025-10927

    Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2.

    Drupal Plausible tracking drupal/plausible_tracking Packagist
  • Medium 6.1
    CVE-2025-10926

    JSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This issue affects JSON Field: from 0.0.0 before 1.5.

    Drupal JSON Field drupal/json_field Packagist
  • High 7.5
    CVE-2025-9954

    Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105

    Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5.

    Drupal Acquia DAM drupal/acquia_dam Packagist
  • Medium 5.9
    CVE-2025-54549

    Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO

    Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO

    Arista Networks DANZ Monitoring Fabric Network devices
  • Medium 4.3
    CVE-2025-54548

    On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)

    On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)

    Arista Networks DANZ Monitoring Fabric Network devices
  • Medium 5.3
    CVE-2025-54547

    On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired

    On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired

    Arista Networks DANZ Monitoring Fabric Network devices