Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: September 2025

197 records · 16 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2025-6507
    44Plan

    Deserialization of Untrusted Data in h2oai/h2o-3

    CriticalCVSS 9.8No exploitEPSS 16%

    h2oai · h2oai/h2o-3Sep 1, 2025

  • CVE-2022-38691
    31Monitor

    In BootROM, there is a possible missing validation for Certificate Type 0.

    HighCVSS 7.8Proof of conceptEPSS 0%

    unisoc (shanghai) technologies co., ltd. · sc9863a//t310/t610/t618/Sep 1, 2025

  • CVE-2022-38694
    31Monitor

    In BootRom, there is a possible unchecked write address.

    HighCVSS 7.8Proof of conceptEPSS 0%

    unisoc (shanghai) technologies co., ltd. · sc9863a//t310/t610/t618/Sep 1, 2025

  • CVE-2025-9769
    12Monitor

    D-Link DI-7400G+ mng_platform.asp sub_478D28 command injection

    LowCVSS 0.9No exploitEPSS 29%

    dlink · di-7400g\+ firmwareSep 1, 2025

  • CVE-2024-28988
    51Plan

    SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 39%

    solarwinds · web help deskSep 1, 2025

  • CVE-2025-57808
    32Monitor

    ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

    HighCVSS 8.1Proof of conceptEPSS 1%

    esphome · esphome firmwareSep 2, 2025

  • CVE-2025-46047
    26Monitor

    A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to

    MediumCVSS 6.5Proof of conceptEPSS 0%

    silverpeas · silverpeasSep 2, 2025

  • CVE-2024-48705
    27Monitor

    Wavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection wh

    MediumCVSS 6.5Proof of conceptEPSS 3%

    wavlink · wl-wn531p3 firmwareSep 2, 2025

  • CVE-2025-50565
    26Monitor

    Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    doubo erp project · doubo erpSep 2, 2025

  • CVE-2025-9784
    31Monitor

    Undertow: undertow madeyoureset http/2 ddos vulnerability

    HighCVSS 7.5Proof of conceptEPSS 2%

    redhat · build of apache camel for spring bootSep 2, 2025

  • CVE-2025-22442
    28Monitor

    In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created

    HighCVSS 7.0Proof of conceptEPSS 0%

    google · androidSep 2, 2025

  • CVE-2024-32444
    39Monitor

    WordPress RealHomes theme <= 4.3.6 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    inspirythemes · realhomesSep 3, 2025

  • CVE-2025-56608
    16Monitor

    The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`

    MediumCVSS 4.2Proof of conceptEPSS 0%

    donbermoy · android corona virus tracker app for indiaSep 3, 2025

  • CVE-2025-57052
    39Monitor

    cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote at

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    davegamble · cjsonSep 3, 2025

  • CVE-2025-38678
    22Monitor

    netfilter: nf_tables: reject duplicate device on updates

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelSep 3, 2025

  • CVE-2025-53691
    35Monitor

    Sitecore Experience Remote Code Execution through Insecure Deserialization

    HighCVSS 8.8Proof of conceptEPSS 1%

    sitecore · experience commerceSep 3, 2025

  • CVE-2025-53693
    45Plan

    HTML Cache Poisoning through Unsafe Reflections

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    sitecore · experience commerceSep 3, 2025

  • CVE-2025-53694
    32Monitor

    Information Disclosure in ItemServices API

    HighCVSS 7.5Proof of conceptEPSS 6%

    sitecore · experience commerceSep 3, 2025

  • CVE-2025-45805
    30Monitor

    In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profile

    HighCVSS 7.6Proof of conceptEPSS 0%

    phpgurukul · doctor appointment management systemSep 3, 2025

  • CVE-2025-56803
    33Monitor

    Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader.

    HighCVSS 8.4Proof of conceptEPSS 1%

    figma · desktopSep 3, 2025

  • CVE-2025-55747
    38Monitor

    XWiki Platform's configuration files can be accessed through the webjars API

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    xwiki · xwikiSep 3, 2025

  • CVE-2025-57833
    40Plan

    An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6.

    HighCVSS 8.1Proof of conceptEPSS 26%

    djangoproject · djangoSep 3, 2025

  • CVE-2025-53690
    84Now

    Sitecore Products ViewState Deserialization Vulnerability

    CriticalCVSS 9.0KEVWeaponizedEPSS 60%

    sitecore · experience commerceSep 3, 2025

  • CVE-2025-55748
    38Monitor

    XWiki Platform's configuration files can be accessed through jsx and sx endpoints

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    xwiki · xwikiSep 3, 2025

  • CVE-2025-6085
    28Monitor

    Make Connector <= 1.5.10 - Authenticated (Administrator+) Arbitrary File Upload

    HighCVSS 7.2Proof of conceptEPSS 1%

    celonis · make connectorSep 4, 2025

  • CVE-2025-9519
    28Monitor

    Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode

    HighCVSS 7.2Proof of conceptEPSS 0%

    kleor · easy timerSep 4, 2025

  • CVE-2025-9933
    22Monitor

    PHPGurukul Beauty Parlour Management System view-appointment.php sql injection

    MediumCVSS 5.5Proof of conceptEPSS 0%

    phpgurukul · beauty parlour management systemSep 4, 2025

  • CVE-2025-6984
    30Monitor

    Sensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchain

    HighCVSS 7.5Proof of conceptEPSS 1%

    langchain-ai · langchain-ai/langchainSep 4, 2025

  • CVE-2025-8311
    38Monitor

    dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint.

    CriticalCVSS 9.4Proof of conceptEPSS 1%

    dotcms · dotcms cloud services (dcs)Sep 4, 2025

  • CVE-2025-57576
    21Monitor

    PHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) in /admin/updateorder.php.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    phpgurukul · online shopping portalSep 4, 2025

  • CVE-2025-0087
    20Monitor

    In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check.

    MediumCVSS 5.1Proof of conceptEPSS 0%

    google · androidSep 4, 2025

  • CVE-2025-26443
    29Monitor

    In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from unknown sources due to

    HighCVSS 7.3Proof of conceptEPSS 0%

    google · androidSep 4, 2025

  • CVE-2025-22441
    29Monitor

    In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privile

    HighCVSS 7.3Proof of conceptEPSS 0%

    google · androidSep 4, 2025

  • CVE-2025-32324
    31Monitor

    In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy.

    HighCVSS 7.8Proof of conceptEPSS 0%

    google · androidSep 4, 2025

  • CVE-2025-48543
    65This week

    In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free.

    HighCVSS 8.8KEVWeaponizedEPSS 0%

    google · androidSep 4, 2025

  • CVE-2025-48561
    22Monitor

    In multiple locations, there is a possible way to access data displayed on the screen due to side channel information disclosure.

    MediumCVSS 5.5Proof of conceptEPSS 0%

    google · androidSep 4, 2025

  • CVE-2025-58179
    26Monitor

    Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint

    MediumCVSS 6.5Proof of conceptEPSS 0%

    astro · \@astrojs\/cloudflareSep 4, 2025

  • CVE-2025-54914
    40Plan

    Azure Networking Elevation of Privilege Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    microsoft · azure networkingSep 4, 2025

  • CVE-2025-55190
    41Plan

    Argo CD: Project API Token Exposes Repository Credentials

    CriticalCVSS 9.9Proof of conceptEPSS 5%

    argoproj · argo cdSep 4, 2025

  • CVE-2025-58789
    30Monitor

    WordPress WP Full Stripe Free Plugin <= 8.2.5 - SQL Injection Vulnerability

    HighCVSS 7.6Proof of conceptEPSS 0%

    themeisle · wp full stripe freeSep 5, 2025

  • CVE-2025-58780
    28Monitor

    index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request.

    HighCVSS 7.2Proof of conceptEPSS 0%

    sciencelogic · sl1Sep 5, 2025

  • CVE-2025-9998
    24Monitor

    Improper validation of packets sequencing

    MediumCVSS 6.0Proof of conceptEPSS 0%

    arcinfo · pcvueSep 5, 2025

  • CVE-2025-58788
    30Monitor

    WordPress License Manager for WooCommerce Plugin <= 3.0.12 - SQL Injection Vulnerability

    HighCVSS 7.6Proof of conceptEPSS 0%

    saad iqbal · license manager for woocommerceSep 5, 2025

  • CVE-2025-39682
    70This week

    tls: fix handling of zero-length records on the rx_list

    CriticalCVSS 9.8KEVWeaponizedEPSS 2%

    linux · linux kernelSep 5, 2025

  • CVE-2025-58371
    39Monitor

    Roo Code is vulnerable to command injection via GitHub actions workflow

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    roocode · roo codeSep 5, 2025

  • CVE-2025-10046
    19Monitor

    ELEX WooCommerce Google Shopping (Google Product Feed) <= 1.4.3 - Authenticated (Admin+) SQL Inejction

    MediumCVSS 4.9Proof of conceptEPSS 0%

    elextensions · elex woocommerce google shopping (google product feed)Sep 6, 2025

  • CVE-2025-9961
    37Monitor

    Authenticated RCE by CWMP binary

    HighCVSS 8.6Proof of conceptEPSS 10%

    tp-link systems inc. · ax10 v1/v1.2/v2/v2.6/v3/v3.6Sep 6, 2025

  • CVE-2025-8359
    39Monitor

    AdForest <= 6.0.9 - Authentication Bypass to Admin

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    scriptsbundle · adforestSep 6, 2025

  • CVE-2025-58443
    45Plan

    FOG's authentication bypass leads to full SQL DB dump

    CriticalCVSS 9.9Proof of conceptEPSS 20%

    fogproject · fogprojectSep 6, 2025

  • CVE-2025-8085
    40Plan

    Ditty < 3.1.58 - Unauthenticated SSRF

    HighCVSS 8.6Proof of conceptEPSS 19%

    metaphorcreations · dittySep 8, 2025

  • CVE-2025-10090
    23Monitor

    Jinher OA GetTreeDate.aspx sql injection

    MediumCVSS 5.5Proof of conceptEPSS 1%

    jinher · jinher oaSep 8, 2025

  • CVE-2025-55998
    32Monitor

    A cross-site scripting (XSS) vulnerability in Smart Search & Filter Shopify and BigCommerce apps allows a remote attacker to execute arbitra

    HighCVSS 8.1Proof of conceptEPSS 0%

    mezereon · smart search and filterSep 8, 2025

  • CVE-2025-51586
    14Monitor

    An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive in

    LowCVSS 3.7Proof of conceptEPSS 0%

    prestashop · prestashopSep 8, 2025

  • CVE-2025-56266
    40Plan

    A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL.

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    avigilon · access control managerSep 8, 2025

  • CVE-2025-58751
    9Monitor

    Vite middleware may serve files starting with the same name with the public directory

    LowCVSS 2.3Proof of conceptEPSS 1%

    vitejs · viteSep 8, 2025

  • CVE-2025-8889
    15Monitor

    Compress Then Upload < 1.0.5 - Admin+ Arbitrary File Upload

    LowCVSS 3.8Proof of conceptEPSS 0%

    eliehanna · compress \& uploadSep 9, 2025

  • CVE-2025-42944
    41Plan

    Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)

    CriticalCVSS 10.0Proof of conceptEPSS 2%

    sap_se · sap netweaver (rmi-p4)Sep 9, 2025

  • CVE-2025-53609
    22Monitor

    A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7

    MediumCVSS 4.9No exploitEPSS 10%

    fortinet · fortiwebSep 9, 2025

  • CVE-2025-54236
    94Now

    Adobe Commerce | Improper Input Validation (CWE-20)

    CriticalCVSS 9.1KEVWeaponizedEPSS 94%

    adobe · commerceSep 9, 2025

  • CVE-2025-9712
    42Plan

    Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to

    HighCVSS 8.8No exploitEPSS 23%

    ivanti · endpoint managerSep 9, 2025

  • CVE-2025-9872
    40Plan

    Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to

    HighCVSS 8.8No exploitEPSS 15%

    ivanti · endpoint managerSep 9, 2025

  • CVE-2025-47437
    25Monitor

    WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability

    MediumCVSS 6.4No exploitEPSS 0%

    litespeed technologies · litespeed cacheSep 9, 2025

  • CVE-2025-54110
    36Monitor

    Windows Kernel Elevation of Privilege Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 4%

    microsoft · windows 10 1507Sep 9, 2025

  • CVE-2025-54251
    18Monitor

    Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)

    MediumCVSS 4.3Proof of conceptEPSS 1%

    adobe · experience managerSep 9, 2025

  • CVE-2025-54918
    43Plan

    Windows NTLM Elevation of Privilege Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 25%

    microsoft · windows 10 1507Sep 9, 2025

  • CVE-2025-55234
    45Plan

    Windows SMB Elevation of Privilege Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    microsoft · windows 10 1507Sep 9, 2025

  • CVE-2025-9951
    28Monitor

    Remote code execution via Heap Buffer Overflow in FFmpeg JPEG2000

    HighCVSS 7.2Proof of conceptEPSS 0%

    ffmpeg · ffmpegSep 9, 2025

  • CVE-2025-52915
    28Monitor

    K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to termin

    HighCVSS 7.2Proof of conceptEPSS 0%

    Sep 9, 2025

  • CVE-2025-34174
    24Monitor

    Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting

    MediumCVSS 5.1No exploitEPSS 12%

    pfsense · pfsenseSep 9, 2025

  • CVE-2025-34175
    26Monitor

    Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting

    MediumCVSS 5.1No exploitEPSS 19%

    pfsense · pfsenseSep 9, 2025

  • CVE-2025-34176
    26Monitor

    Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure

    MediumCVSS 5.3No exploitEPSS 17%

    pfsense · pfsenseSep 9, 2025

  • CVE-2025-54249
    27Monitor

    Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)

    MediumCVSS 6.5Proof of conceptEPSS 1%

    adobe · experience managerSep 9, 2025

  • CVE-2025-54261
    47Plan

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    CriticalCVSS 10.0No exploitEPSS 23%

    adobe · coldfusionSep 9, 2025

  • CVE-2025-54897
    42Plan

    Microsoft SharePoint Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 21%

    microsoft · sharepoint serverSep 9, 2025

  • CVE-2025-58180
    36Monitor

    OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload

    HighCVSS 7.5Proof of conceptEPSS 21%

    octoprint · octoprintSep 9, 2025

  • CVE-2025-10142
    19Monitor

    PagBank / PagSeguro Connect para WooCommerce <= 4.44.3 - Authenticated (Shop Manager+) SQL Injection

    MediumCVSS 4.9Proof of conceptEPSS 0%

    martins56 · pagbank / pagseguro connect para woocommerceSep 10, 2025

  • CVE-2025-57520
    24Monitor

    A Cross Site Scripting (XSS) vulnerability exists in Decap CMS thru 3.8.3.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    techhub.p-m · decap cmsSep 10, 2025

  • CVE-2025-57642
    28Monitor

    A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the se

    HighCVSS 7.2Proof of conceptEPSS 1%

    sohamjuhin · tourism management systemSep 10, 2025

  • CVE-2025-57392
    31Monitor

    BenimPOS Masaustu 3.0.x is affected by insecure file permissions.

    HighCVSS 7.8Proof of conceptEPSS 0%

    benimpos · benimposSep 10, 2025

  • CVE-2025-10200
    35Monitor

    Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap co

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · chromeSep 10, 2025

  • CVE-2025-10210
    8Monitor

    yanyutao0402 ChanCMS Api.js search sql injection

    LowCVSS 2.1Proof of conceptEPSS 1%

    chancms · chancmsSep 10, 2025

  • CVE-2025-54123
    42Plan

    Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    hoverfly · hoverflySep 10, 2025

  • CVE-2025-59049
    31Monitor

    Mockoon has a Path Traversal and LFI in the static file serving endpoint

    HighCVSS 7.5Proof of conceptEPSS 1%

    mockoon · mockoonSep 10, 2025

  • CVE-2025-10211
    8Monitor

    yanyutao0402 ChanCMS getArticle CollectController server-side request forgery

    LowCVSS 2.1Proof of conceptEPSS 0%

    chancms · chancmsSep 10, 2025

  • CVE-2025-8422
    30Monitor

    Propovoice <= 1.7.6.7 - Unauthenticated Arbitrary File Read

    HighCVSS 7.5Proof of conceptEPSS 0%

    fassionstorage · propovoice: all-in-one client management systemSep 11, 2025

  • CVE-2025-9776
    26Monitor

    CatFolders – Tame Your WordPress Media Library by Category <= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Import

    MediumCVSS 6.5Proof of conceptEPSS 0%

    catfolders · catfolders – wordpress media library folders & categoriesSep 11, 2025

  • CVE-2025-58320
    33Monitor

    DIALink - Directory Traversal Authentication Bypass Vulnerability

    HighCVSS 7.3No exploitEPSS 14%

    deltaww · dialinkSep 11, 2025

  • CVE-2025-8570
    39Monitor

    BeyondCart Connector <= 3.0.1 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation via determine_current_user Filter

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    beyondcart · beyondcart connectorSep 11, 2025

  • CVE-2025-58060
    32Monitor

    cups has Authentication bypass with AuthType Negotiate

    HighCVSS 8.0Proof of conceptEPSS 0%

    openprinting · cupsSep 11, 2025

  • CVE-2025-8061
    29Monitor

    A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Leno

    HighCVSS 7.3Proof of conceptEPSS 0%

    lenovo · dispatcher 3.0 driverSep 11, 2025

  • CVE-2025-55319
    39Monitor

    Agentic AI and Visual Studio Code Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    microsoft · visual studio codeSep 11, 2025

  • CVE-2025-21042
    79This week

    Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.

    CriticalCVSS 9.8KEVWeaponizedEPSS 33%

    samsung · androidSep 12, 2025

  • CVE-2025-21043
    70This week

    Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.

    CriticalCVSS 9.8KEVWeaponizedEPSS 2%

    samsung · androidSep 12, 2025

  • CVE-2025-59139
    21Monitor

    Hono has Body Limit Middleware Bypass

    MediumCVSS 5.3Proof of conceptEPSS 0%

    hono · honoSep 12, 2025

  • CVE-2025-55996
    25Monitor

    Viber Desktop 25.6.0 is vulnerable to HTML Injection via the text parameter of the message compose/forward interface

    MediumCVSS 6.3Proof of conceptEPSS 0%

    rakuten · viberSep 12, 2025

  • CVE-2025-10327
    11Monitor

    MiczFlor RPi-Jukebox-RFID shuffle.php os command injection

    LowCVSS 2.1Proof of conceptEPSS 10%

    sourcefabric · rpi-jukebox-rfidSep 12, 2025

  • CVE-2025-58434
    54Plan

    Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

    CriticalCVSS 9.8Proof of conceptEPSS 49%

    flowiseai · flowiseSep 12, 2025

  • CVE-2025-10370
    8Monitor

    MiczFlor RPi-Jukebox-RFID userScripts.php cross site scripting

    LowCVSS 2.0Proof of conceptEPSS 0%

    sourcefabric · rpi-jukebox-rfidSep 13, 2025

  • CVE-2025-10204
    28Monitor

    Unauth Admin Reset Password on AC Smart II

    HighCVSS 7.1Proof of conceptEPSS 0%

    lg electronics · ac smart iiSep 14, 2025

  • CVE-2025-59359
    40Plan

    OS command injection in Chaos Mesh via the cleanTcs mutation

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    chaos-mesh · chaos meshSep 15, 2025