Exploited and new serious CVEs: September 2025

OS command injection in Chaos Mesh via the cleanTcs mutation

• pre-auth RCE
• Command injection

chaos-mesh · chaos meshSep 15, 2025

D-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb_paswd.asp sub_4621DC os command injection

• RCE
• Command injection

d-link · di-8100Sep 15, 2025

An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpC

• Pre-auth
• Weak crypto

avtech · eagleeyes\(lite\)Sep 15, 2025

An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse m

• Pre-auth
• Weak crypto

Sep 15, 2025

An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0.

• Pre-auth
• Weak crypto

avtech · eagleeyes\(lite\)Sep 15, 2025

D-Link DI-8100G/DI-8200G/DI-8003G jhttpd version_upgrade.asp sub_433F7C os command injection

• RCE
• Command injection

d-link · di-8100gSep 15, 2025

Phoenix: Rowhammer attack on Hynix DDR5 devices

sk hynix · ddr5Sep 15, 2025

An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previo

• pre-auth RCE
• Auth bypass
• Hard-coded credentials

Sep 15, 2025

On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP po

• Pre-auth
• File upload

ceragon networks / siklu communication · etherhaul and multihaul series microwave antennasSep 15, 2025

feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-dele

• pre-auth RCE
• Command injection

feisky · mcp-kubernetes-serverSep 15, 2025

The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure

• Pre-auth
• Info leak

stellarwp · the events calendarSep 16, 2025

XSS in Ubit Information Technologies' STOYS

• XSS

ubit information technologies · stoysSep 16, 2025

SQLi in BGS Interactive's SINAV.LINK Exam Result Module

• Pre-auth
• SQL injection

bgs interactive · sinav.link exam result moduleSep 16, 2025

CVE-2025-41249: Spring Framework Annotation Detection Vulnerability

• Pre-auth
• Broken access control (IDOR)

vmware · spring frameworkSep 16, 2025

InterSystems Caché UtilConfigHome.csp Stack Buffer Overflow

• pre-auth RCE
• Memory safety

intersystems corporation · intersystems cachéSep 16, 2025

osCommerce <= 2.2 Admin File Manager Arbitrary PHP Code Execution

• pre-auth RCE
• File upload

oscommerce · oscommerceSep 16, 2025

Talkative IRC v0.4.4.16 Response Buffer Overflow

• pre-auth RCE
• Memory safety

talkative · talkative ircSep 16, 2025

Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

• pre-auth RCE

spring · cloud gatewaySep 16, 2025

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Down

• Path traversal

kodezen · storeengine — complete ecommerce solution with memberships, licensing, affiliates & moreSep 17, 2025

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Uplo

• RCE
• File upload

kodezen · storeengine — complete ecommerce solution with memberships, licensing, affiliates & moreSep 17, 2025

WatchGuard Firebox iked Out of Bounds Write Vulnerability

• pre-auth RCE
• Memory safety

watchguard · firewareSep 17, 2025

In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload

• Path traversal

jetbrains · teamcitySep 17, 2025

Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection

• Pre-auth
• SQL injection

ays-pro · quiz makerSep 17, 2025

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible t

• Pre-auth
• Broken access control (IDOR)

jenkins · jenkinsSep 17, 2025

WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality.

• SSRF

wondercms · wondercmsSep 17, 2025

Local File Inclusion in esm.sh

• Pre-auth
• Path traversal

esm-dev · esm.shSep 17, 2025

esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header

• Pre-auth
• Path traversal

esm-dev · esm.shSep 17, 2025

D-Link DIR-852 Web Management hedwig.cgi command injection

• RCE
• Command injection

dlink · dir-852 firmwareSep 17, 2025

Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie

• Pre-auth
• Broken access control (IDOR)

prasunsen · chained quizSep 18, 2025

SQL injection vulnerability in Summar Software´s Portal del Empleado

• SQL injection

summar software · portal del empleadoSep 18, 2025

D-Link DIR-825 apply.cgi sub_4106d4 buffer overflow

• Memory safety

dlink · dir-825 firmwareSep 18, 2025

An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameter

• pre-auth RCE
• Command injection

oxygenz · clipbucketSep 18, 2025

An issue in user interface in Kyocera Command Center RX EXOSYS M5521cdn allows remote to obtain sensitive information via inspecting sent pa

• Pre-auth
• Info leak

Sep 18, 2025

An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php t

• Pre-auth
• File upload

oxygenz · clipbucketSep 18, 2025

LinkAce Vulnerable to Stored XSS on the Audit Page

• XSS

linkace · linkaceSep 18, 2025

Deserialization Vulnerability in GoAnywhere MFT's License Servlet

• pre-auth RCE
• Deserialization
• Command injection

fortra · goanywhere managed file transferSep 18, 2025

Snipe-IT before 8.1.18 allows XSS.

• XSS

snipeitapp · snipe-itSep 18, 2025

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in t

• pre-auth RCE
• Command injection

control-webpanel · webpanelSep 19, 2025

Paracrawl KeOPs v2 is vulnerable to Cross Site Scripting (XSS) in error.php.

• Pre-auth
• XSS

paracrawl · keopsSep 19, 2025

Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment.

• pre-auth RCE
• Command injection

libraesva · email security gatewaySep 19, 2025

fs: writeback: fix use-after-free in __mark_inode_dirty()

• Memory safety

linux · linux kernelSep 19, 2025

SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover

• Pre-auth
• Auth bypass

psmplugins · supportcandy – helpdesk & customer support ticket systemSep 20, 2025

jeecgboot JimuReport DB2 JDBC testConnection deserialization

• Deserialization

jeecg · jimureportSep 21, 2025

Wavlink WL-NU516U1 login.cgi sub_4012A0 os command injection

• RCE
• Command injection

wavlink · wl-nu516u1 firmwareSep 21, 2025

Lack of Authentication for RTSP stream

• Pre-auth
• Auth bypass

galayou · g2Sep 22, 2025

SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04-23 allows a remote attacker to escalate pri

• SQL injection

ard · gec en ligneSep 22, 2025

An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD.

• Broken access control (IDOR)

Sep 22, 2025

Cross-Site Scripting (XSS) vulnerability was discovered in the Ajax transaction manager endpoint of ARD.

• Pre-auth
• XSS

ard · gec en ligneSep 22, 2025

Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field.

• RCE
• XSS

pivotx · pivotxSep 22, 2025

Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD.

• Pre-auth
• XSS

ard · gec en ligneSep 22, 2025

WordPress Passster Plugin <= 4.2.18 - Cross Site Scripting (XSS) Vulnerability

• XSS

wp chill · passsterSep 22, 2025

WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin <= 1.16.16 - Sensitive Data Exposure Vulnerability

• Pre-auth

iberezansky · 3d flipbook – pdf flipbook viewer, flipbook image gallerySep 22, 2025

WordPress Ajax Load More Plugin <= 7.6.0.2 - Sensitive Data Exposure Vulnerability

• Pre-auth
• Info leak

darren cooney · ajax load moreSep 22, 2025

Flowise has Remote Code Execution vulnerability

• pre-auth RCE

flowiseai · flowiseSep 22, 2025

Codex has sandbox bypass due to bug in path configuration logic

• RCE

openai · codexSep 22, 2025

SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability

• pre-auth RCE
• Deserialization

solarwinds · web help deskSep 23, 2025

Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Upload

• pre-auth RCE
• File upload

eteubert · podlove podcast publisherSep 23, 2025

OnePlus OxygenOS Telephony provider permission bypass

• SQL injection

oneplus · oxygenosSep 23, 2025

A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document.

• Pre-auth
• Memory safety
• Denial of service

artifex · mupdfSep 23, 2025

In Shenzhen C-Data Technology Co.

• Pre-auth
• CSRF

Sep 23, 2025

NVIDIA CUDA Toolkit for all platforms contains a vulnerability in cuobjdump where an attacker may cause a stack-based buffer overflow by get

• RCE
• Local privilege escalation
• Memory safety

nvidia · cuda toolkitSep 24, 2025

Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive

• RCE

horilla · horillaSep 24, 2025

An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.

• pre-auth RCE
• Command injection

running-elephant · datartSep 24, 2025

Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted

• Pre-auth

google · chromeSep 24, 2025

Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transf

• Pre-auth
• Path traversal

running-elephant · datartSep 24, 2025

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the f

• Memory safety
• Denial of service

cisco · ios xe sd-wanSep 24, 2025

TOTOLINK X6000R Command Injection Vulnerability

• pre-auth RCE
• Command injection

totolink · x6000r firmwareSep 24, 2025

toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other obj

• Pre-auth
• Prototype pollution
• Denial of service

jonschlinkert · toggle-arraySep 24, 2025

Nx: nx/devkit: malicious versions of nx and plugins published to npm

• Pre-auth

red hat · multicluster global hubSep 24, 2025

geyang ml-logger server.py log_handler path traversal

• Pre-auth
• Path traversal

geyang · ml-loggerSep 25, 2025

geyang ml-logger File server.py stream_handler information disclosure

• Pre-auth
• Info leak

geyang · ml-loggerSep 25, 2025

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat D

• RCE
• Memory safety

cisco · adaptive security appliance softwareSep 25, 2025

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FT

• Pre-auth
• Broken access control (IDOR)

cisco · adaptive security appliance softwareSep 25, 2025

Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection

• RCE
• Command injection

nagios · nagios xiSep 25, 2025

System Dashboard <= 2.8.20 - Cross-Site Request Forgery

• Pre-auth
• CSRF

qriouslad · system dashboardSep 26, 2025

Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File

• Pre-auth
• Info leak

marceljm · featured image from url (fifu)Sep 26, 2025

Backuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion

• RCE
• Path traversal

softaculous · backuply – backup, restore, migrate and cloneSep 26, 2025

An issue was discovered in DIR-823 firmware 20250416.

• pre-auth RCE
• Command injection

dlink · dir-823x firmwareSep 26, 2025

In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from

• RCE
• Local privilege escalation

seagate · toolkitSep 26, 2025

Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code.

• Local privilege escalation

Sep 26, 2025

FlagForgeCTF Exposes User Emails via Public /api/user/[username] API

• Pre-auth
• Info leak

flagforge · flagforgeSep 26, 2025

Formbricks missing JWT signature verification

• Pre-auth
• Auth bypass

formbricks · formbricksSep 26, 2025

WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

• Pre-auth
• XSS

veronalabs · wp statistics – simple, privacy-friendly google analytics alternativeSep 27, 2025

Campcodes Online Learning Management System add_content.php sql injection

• Pre-auth
• SQL injection

campcodes · online learning management systemSep 27, 2025

Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gain access to the debug

• Pre-auth
• Hard-coded credentials
• Broken access control (IDOR)

Sep 29, 2025

Chef Automate compliance service SQL Injection Vulnerability

• SQL injection

chef · automateSep 29, 2025

An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17.

• Pre-auth
• Memory safety
• Denial of service

cesanta · mongooseSep 29, 2025

Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality.

• XSS

mealie · mealieSep 29, 2025

A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaSc

• Pre-auth
• XSS

fairsketch · rise ultimate project managerSep 29, 2025

A reflected cross-site scripting (XSS) vulnerability in tawk.to chatbox widget v4 allows attackers to execute arbitrary Javascript in the co

• pre-auth RCE
• XSS

Sep 29, 2025

Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning different error mess

• Pre-auth

trivisionsecurity · trivision nc-227wf firmwareSep 29, 2025

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

• Local privilege escalation

vmware · aria operationsSep 29, 2025

An out-of-bounds write issue was addressed with improved bounds checking.

• Pre-auth
• Memory safety

apple · ipadosSep 29, 2025

serverless-dns is vulnerable to Command Injection through pr.yml GitHub Action Workflow

• pre-auth RCE
• Command injection

serverless-dns · serverless-dnsSep 30, 2025

Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution

• pre-auth RCE
• Hard-coded credentials

copypressdev · copypress rest apiSep 30, 2025

Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUplo

• Pre-auth
• SSRF

dify · difySep 30, 2025

Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster admin

opendatahub-io · opendatahub-operatorSep 30, 2025

NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks.

• pre-auth RCE

nicehash · quickminerSep 30, 2025

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality.

• Pre-auth
• Auth bypass

liquidfiles · liquidfilesSep 30, 2025