By publication date

Exploited and new serious CVEs: October 2025

195 records · 10 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
31Monitor	CVE-2025-39913Proof of concept	tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.linux · linux kernel	High7.8	—	0.1%	Oct 1, 2025
52Plan	CVE-2025-61622Proof of concept	Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyforyapache · fory · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	43.5%	Oct 1, 2025
21Monitor	CVE-2025-56514Proof of concept	Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rsuisuijiang · fiora · CWE-79 XSS	Medium5.4	—	0.2%	Oct 1, 2025
35Monitor	CVE-2025-56515Proof of concept	File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality.suisuijiang · fiora · CWE-79 pre-auth RCE XSS	High8.8	—	0.5%	Oct 1, 2025
21Monitor	CVE-2025-57389Proof of concept	A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to exeCWE-79 RCE XSS	Medium5.4	—	0.1%	Oct 1, 2025
36Monitor	CVE-2025-61734No exploit	Apache Kylin: improper restriction of file readapache · kylin · CWE-552 Pre-auth	High7.5	—	19.7%	Oct 2, 2025
21Monitor	CVE-2025-56379Proof of concept	A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scrfrappe · erpnext · CWE-79 RCE XSS	Medium5.4	—	0.4%	Oct 2, 2025
26Monitor	CVE-2025-56380Proof of concept	Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_valuefrappe · erpnext · CWE-89 Pre-auth SQL injection	Medium6.5	—	0.3%	Oct 2, 2025
26Monitor	CVE-2025-56381Proof of concept	ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint viafrappe · erpnext · CWE-89 Pre-auth SQL injection	Medium6.5	—	0.3%	Oct 2, 2025
26Monitor	CVE-2025-56019Proof of concept	An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to coagasta · easy touch plus firmware · CWE-277 Pre-auth Auth bypass Denial of service	Medium6.5	—	0.3%	Oct 2, 2025
34Monitor	CVE-2025-61666Proof of concept	Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config Filetraccar · traccar · CWE-22 Pre-auth Path traversal	High8.7	—	1.2%	Oct 2, 2025
42Plan	CVE-2025-59536Proof of concept	Claude Code's startup trust dialog could lead to Command Execution attackanthropic · claude code · CWE-94 pre-auth RCE	High8.7	—	27.2%	Oct 3, 2025
29Monitor	CVE-2025-27237Proof of concept	DLL injection in Zabbix Agent and Agent 2 via OpenSSL configurationzabbix · zabbix · CWE-427 Local privilege escalation	High7.3	—	0.3%	Oct 3, 2025
40Plan	CVE-2025-9209Proof of concept	RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWTmagnigenie · restropress – online food ordering system · CWE-200 Pre-auth Auth bypass Info leak	Critical9.8	—	2.3%	Oct 3, 2025
39Monitor	CVE-2025-9286Proof of concept	Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_passwordhancock11 · appy pie connect for woocommerce · CWE-620 Pre-auth	Critical9.8	—	0.4%	Oct 3, 2025
25Monitor	CVE-2025-9876Proof of concept	Ird Slider <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scriptinginforrada · ird slider · CWE-79 XSS	Medium6.4	—	0.2%	Oct 3, 2025
18Monitor	CVE-2025-55971Proof of concept	TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthentictcl · 65c655 firmware · CWE-918 Pre-auth SSRF Denial of service	Medium4.7	—	0.3%	Oct 3, 2025
30Monitor	CVE-2025-55972Proof of concept	A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS) tcl · 65c655 firmware · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Oct 3, 2025
40Plan	CVE-2025-60787Weaponized	MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name.motioneye project · motioneye · CWE-20 RCE Command injection	High7.2	—	18.4%	Oct 3, 2025
36Monitor	CVE-2025-46817Proof of concept	Lua library commands may lead to integer overflow and potential RCEredis · redis · CWE-190 RCE Memory safety	High8.8	—	3.8%	Oct 3, 2025
29Monitor	CVE-2025-59489Proof of concept	Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code funity · editor · CWE-88	High7.4	—	0.6%	Oct 3, 2025
29Monitor	CVE-2025-46818Proof of concept	Redis: Authenticated users can execute LUA scripts as a different userredis · redis · CWE-94 RCE	High7.3	—	0.7%	Oct 3, 2025
28Monitor	CVE-2025-46819Proof of concept	Redis is vulnerable to DoS via specially crafted LUA scriptsredis · redis · CWE-190 Memory safety	High7.1	—	1.0%	Oct 3, 2025
64This week	CVE-2025-49844Proof of concept	Redis Lua Use-After-Free may lead to remote code executionredis · redis · CWE-416 RCE Memory safety	Critical9.9	—	82.2%	Oct 3, 2025
28Monitor	CVE-2025-34226Proof of concept	OpenPLC Runtime v3 Persistent DoSautonomy logic · openplc runtime · CWE-20	High7.1	—	0.6%	Oct 3, 2025
39Monitor	CVE-2025-59944No exploit	Cursor IDE: Sensitive File Overwrite Bypass is Possibleanysphere · cursor · CWE-178 pre-auth RCE	Critical9.8	—	0.4%	Oct 3, 2025
39Monitor	CVE-2025-9485Proof of concept	OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()cyberlord92 · oauth single sign on – sso (oauth client) · CWE-347 Pre-auth Auth bypass Weak crypto	Critical9.8	—	0.5%	Oct 4, 2025
25Monitor	CVE-2025-39946Proof of concept	tls: make sure to abort the stream if headers are boguslinux · linux kernel Denial of service	Medium5.5	—	9.5%	Oct 4, 2025
17Monitor	CVE-2025-9886Proof of concept	Trinity Audio <= 5.20.2 - Cross-Site Request Forgerysergiotrinity · trinity audio – text to speech ai audio player to convert content into audio · CWE-352 Pre-auth CSRF	Medium4.3	—	0.1%	Oct 4, 2025
99Now	CVE-2025-61882Weaponized	Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).oracle · concurrent processing · CWE-287 Pre-auth Auth bypass	Critical9.8	KEV	99.7%	Oct 5, 2025
28Monitor	CVE-2025-50538No exploit	Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.flowiseai · flowise · CWE-79 Pre-auth XSS	Medium6.1	—	14.0%	Oct 6, 2025
13Monitor	CVE-2025-11331No exploit	IdeaCMS Website Name Config.php command injectionideacms · ideacms · CWE-74 RCE Command injection	Low2.0	—	17.4%	Oct 6, 2025
26Monitor	CVE-2025-61224Proof of concept	Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q paCWE-79 pre-auth RCE XSS	Medium6.5	—	1.4%	Oct 6, 2025
38Monitor	CVE-2025-52472Proof of concept	XWiki Platform vulnerable to HQL injection via wiki and space search REST APIxwiki · xwiki-platform · CWE-89 Pre-auth SQL injection	Critical9.3	—	2.3%	Oct 6, 2025
38Monitor	CVE-2025-61687No exploit	FlowiseAI/Flosise has File Upload vulnerabilityflowiseai · flowise · CWE-434 RCE File upload	High8.8	—	10.9%	Oct 6, 2025
25Monitor	CVE-2025-61765Proof of concept	python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deploymentsmiguelgrinberg · python-socketio · CWE-502 RCE Deserialization	Medium6.4	—	0.4%	Oct 6, 2025
36Monitor	CVE-2025-61777Proof of concept	FlagForge Allows Unauthenticated Badge Template API Accessflagforge · flagforge · CWE-200 Pre-auth Auth bypass Info leak	Critical9.1	—	0.4%	Oct 6, 2025
14Monitor	CVE-2025-61984Proof of concept	ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leadinopenbsd · openssh · CWE-159	Low3.6	—	0.4%	Oct 6, 2025
35Monitor	CVE-2025-10162Proof of concept	OrderConvo <= 15.1 - Unauthenticated Arbitrary File Readunknown · admin and customer messages after order for woocommerce: orderconvo · CWE-22 Pre-auth Path traversal	High8.6	—	4.4%	Oct 7, 2025
31Monitor	CVE-2025-50505Proof of concept	Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key functCWE-250 Local privilege escalation	High7.8	—	0.2%	Oct 7, 2025
39Monitor	CVE-2025-52021Proof of concept	A SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0.CWE-89 Pre-auth SQL injection	Critical9.8	—	0.3%	Oct 7, 2025
24Monitor	CVE-2025-56243Proof of concept	A Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the eventpuneethreddyhc · event management system · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.2%	Oct 7, 2025
40Plan	CVE-2025-44823Proof of concept	Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.phnagios · log server · CWE-497 Info leak	High8.8	—	16.1%	Oct 7, 2025
21Monitor	CVE-2025-11171Proof of concept	Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Functionays-pro · chartify – wordpress chart plugin · CWE-306 Pre-auth Auth bypass	Medium5.3	—	0.4%	Oct 8, 2025
24Monitor	CVE-2025-61183Proof of concept	Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of webreinvent · vaahcms · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.2%	Oct 8, 2025
37Monitor	CVE-2025-10351Proof of concept	SQL injection vulnerability in Melis Platformmelis technology · melis platform · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.4%	Oct 8, 2025
37Monitor	CVE-2025-10352Proof of concept	Missing Authorization vulnerability in Melis Platformmelis technology · melis platform · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.3%	Oct 8, 2025
38Monitor	CVE-2025-10353Proof of concept	Missing Authorization vulnerability in Melis Platformmelis technology · melis platform · CWE-43 pre-auth RCE	Critical9.3	—	2.6%	Oct 8, 2025
35Monitor	CVE-2025-57457Proof of concept	An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS CommandCWE-78 RCE Command injection	High8.8	—	0.9%	Oct 8, 2025
43Plan	CVE-2025-61913No exploit	Flowise is vulnerable to arbitrary file read, arbitrary file writeflowiseai · flowise · CWE-22 RCE Path traversal	Critical9.9	—	12.9%	Oct 8, 2025
26Monitor	CVE-2025-10249No exploit	Slider Revolution <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Readrevolution slider · slider revolution · CWE-23 Path traversal	Medium6.5	—	0.3%	Oct 9, 2025
29Monitor	CVE-2025-60375Proof of concept	The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validatCWE-289 Pre-auth	High7.3	—	0.2%	Oct 9, 2025
88Now	CVE-2025-11371Weaponized	Gladinet CentreStack and TrioFox Local File Inclusion Flawgladinet · centrestack · CWE-552 Pre-auth	High7.5	KEV	92.1%	Oct 9, 2025
42Plan	CVE-2025-61928No exploit	Better Auth: Unauthenticated API key creation through api-key pluginbetter-auth · better-auth · CWE-285 Pre-auth Broken access control (IDOR)	Critical9.3	—	17.9%	Oct 9, 2025
22Monitor	CVE-2025-4615Proof of concept	PAN-OS: Improper Neutralization of Input in the Management Web Interfacepaloaltonetworks · pan-os · CWE-83 RCE	Medium5.5	—	0.7%	Oct 9, 2025
8Monitor	CVE-2025-11554Proof of concept	Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissionsportabilis · i-educar · CWE-266	Low2.1	—	0.3%	Oct 9, 2025
22Monitor	CVE-2025-11555Proof of concept	Campcodes Online Learning Management System calendar_of_events.php sql injectioncampcodes · online learning management system · CWE-74 Pre-auth SQL injection	Medium5.5	—	0.4%	Oct 9, 2025
21Monitor	CVE-2025-11449Proof of concept	Reflected Cross Site Scripting in ServiceNow AI Platformservicenow · servicenow ai platform · CWE-79 pre-auth RCE XSS	Medium5.3	—	0.3%	Oct 10, 2025
26Monitor	CVE-2025-21065Proof of concept	Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands on their own devices.samsung mobile · retail mode · CWE-20	Medium6.6	—	0.1%	Oct 10, 2025
20Monitor	CVE-2025-41088Proof of concept	Stored Cross-Site Scripting (XSS) in CMSxibo signage · xibo cms · CWE-79 XSS	Medium5.1	—	0.3%	Oct 10, 2025
19Monitor	CVE-2025-41089Proof of concept	Reflected Cross-Site Scripting (XSS) in CMSxibo signage · xibo cms · CWE-79 XSS	Medium4.8	—	0.2%	Oct 10, 2025
24Monitor	CVE-2025-61319Proof of concept	ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module.yogeshojha · rengine · CWE-79 Pre-auth XSS	Medium6.1	—	0.2%	Oct 10, 2025
32Monitor	CVE-2025-60378Proof of concept	Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages.fairsketch · rise ultimate project manager · CWE-79 XSS	High8.1	—	1.0%	Oct 10, 2025
26Monitor	CVE-2025-11579Proof of concept	DoS via Out Of Memory Crashnwaples · rardecode · CWE-789 Pre-auth Denial of service	Medium6.5	—	0.3%	Oct 10, 2025
22Monitor	CVE-2025-11580Proof of concept	PowerJob list authorizationpowerjob · powerjob · CWE-862 Pre-auth Broken access control (IDOR)	Medium5.5	—	1.0%	Oct 10, 2025
33Monitor	CVE-2025-60880Proof of concept	An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a webkul · bagisto · CWE-79 RCE XSS	High8.3	—	0.4%	Oct 10, 2025
26Monitor	CVE-2025-61505Proof of concept	e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script.e107 · e107 · CWE-502 pre-auth RCE Deserialization	Medium6.5	—	0.3%	Oct 10, 2025
33Monitor	CVE-2025-55903Proof of concept	A HTML injection vulnerability exists in Perfex CRM v3.3.1.CWE-116	High8.3	—	0.3%	Oct 10, 2025
23Monitor	CVE-2025-11380Proof of concept	Everest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposureeverestthemes · everest backup – wordpress cloud backup, migration, restore & cloning plugin · CWE-862 Pre-auth Broken access control (IDOR)	Medium5.9	—	0.4%	Oct 11, 2025
21Monitor	CVE-2025-9196Proof of concept	Trinity Audio <= 5.21.0 - Unauthenticated Information Exposuresergiotrinity · trinity audio – text to speech ai audio player to convert content into audio · CWE-200 Pre-auth Info leak	Medium5.3	—	1.0%	Oct 11, 2025
26Monitor	CVE-2025-10175Proof of concept	WP Links Page <= 4.9.6 - Authenticated (Subscriber+) SQL Injectionrico-macchi · wp links page · CWE-89 SQL injection	Medium6.5	—	0.3%	Oct 11, 2025
89Now	CVE-2025-61884Weaponized	Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).oracle · configurator · CWE-22 Pre-auth Path traversal	High7.5	KEV	95.8%	Oct 12, 2025
26Monitor	CVE-2025-10720Proof of concept	WP Private Content Plus <= 3.6.2 - Password Protection Bypassunknown · wp private content plus · CWE-639 Pre-auth Broken access control (IDOR)	Medium6.5	—	0.2%	Oct 13, 2025
52Plan	CVE-2025-39964Weaponized	crypto: af_alg - Disallow concurrent writes in af_alg_sendmsglinux · linux kernel · CWE-362 Race condition Denial of service	Medium5.5	KEV	1.3%	Oct 13, 2025
22Monitor	CVE-2025-39965Proof of concept	xfrm: xfrm_alloc_spi shouldn't use 0 as SPIlinux · linux kernel Denial of service	Medium5.5	—	0.1%	Oct 13, 2025
40Plan	CVE-2025-9713No exploit	Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution.ivanti · endpoint manager · CWE-22 pre-auth RCE Path traversal	High8.8	—	15.3%	Oct 13, 2025
37Monitor	CVE-2025-62360Proof of concept	WeGIA SQL Injection via 'id_dependente' param at endpoint `/html/funcionario/dependente_documento.php`wegia · wegia · CWE-89 RCE SQL injection	Critical9.4	—	0.8%	Oct 13, 2025
63This week	CVE-2025-24990Weaponized	Windows Agere Modem Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-822 Local privilege escalation	High7.8	KEV	6.3%	Oct 14, 2025
30Monitor	CVE-2025-58726Proof of concept	Windows SMB Server Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-284 Broken access control (IDOR)	High7.5	—	1.0%	Oct 14, 2025
29Monitor	CVE-2025-59194Proof of concept	Windows Kernel Elevation of Privilege Vulnerabilitymicrosoft · windows 11 22h2 · CWE-908 Local privilege escalation Memory safety	High7.0	—	2.6%	Oct 14, 2025
62This week	CVE-2025-59230Weaponized	Windows Remote Access Connection Manager Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-284 Local privilege escalation Broken access control (IDOR)	High7.8	KEV	2.6%	Oct 14, 2025
31Monitor	CVE-2025-59254Proof of concept	Microsoft DWM Core Library Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 Local privilege escalation Memory safety	High7.8	—	1.1%	Oct 14, 2025
99Now	CVE-2025-59287Weaponized	Windows Server Update Service (WSUS) Remote Code Execution Vulnerabilitymicrosoft · windows server 2012 · CWE-502 pre-auth RCE Deserialization	Critical9.8	KEV	99.9%	Oct 14, 2025
23Monitor	CVE-2025-22831No exploit	Buffer Overflow in NTFS when parsing the VOLUME_NAMEami · aptio v · CWE-787 Memory safety	Medium5.9	—	0.1%	Oct 14, 2025
34Monitor	CVE-2025-10242No exploit	OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attackeivanti · endpoint manager mobile · CWE-78 RCE Command injection	High7.2	—	20.3%	Oct 14, 2025
34Monitor	CVE-2025-10243No exploit	OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attackeivanti · endpoint manager mobile · CWE-78 RCE Command injection	High7.2	—	20.3%	Oct 14, 2025
34Monitor	CVE-2025-10985No exploit	OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attackeivanti · endpoint manager mobile · CWE-78 RCE Command injection	High7.2	—	20.3%	Oct 14, 2025
40Plan	CVE-2025-5946Weaponized	RCE via the poller reload feature available only to user with high privilegecentreon · centreon web · CWE-78 RCE Command injection	High7.2	—	13.5%	Oct 14, 2025
24Monitor	CVE-2025-60374Proof of concept	Stored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript.CWE-79 Pre-auth XSS	Medium6.1	—	0.3%	Oct 14, 2025
59Plan	CVE-2025-55315Proof of concept	ASP.NET Security Feature Bypass Vulnerabilitymicrosoft · asp.net core · CWE-444	Critical9.9	—	65.9%	Oct 14, 2025
27Monitor	CVE-2025-55320Proof of concept	Configuration Manager Elevation of Privilege Vulnerabilitymicrosoft · configuration manager 2403 · CWE-89 SQL injection	Medium6.8	—	0.6%	Oct 14, 2025
35Monitor	CVE-2025-59213Proof of concept	Configuration Manager Elevation of Privilege Vulnerabilitymicrosoft · configuration manager 2403 · CWE-89 Pre-auth SQL injection	High8.8	—	0.3%	Oct 14, 2025
22Monitor	CVE-2025-59284Proof of concept	Windows NTLM Spoofing Vulnerabilitymicrosoft · windows 11 22h2 · CWE-200 Info leak	Medium5.5	—	1.0%	Oct 14, 2025
46Plan	CVE-2025-61675Weaponized	FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parametersfreepbx · endpoint · CWE-89 RCE SQL injection	High8.6	—	38.4%	Oct 14, 2025
47Plan	CVE-2025-61678Weaponized	FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameterfreepbx · endpointman · CWE-434 RCE File upload	High8.6	—	43.6%	Oct 14, 2025
39Monitor	CVE-2025-9967Proof of concept	Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeovergsayed786 · orion sms otp verification. · CWE-288 Pre-auth Auth bypass	Critical9.8	—	0.4%	Oct 15, 2025
27Monitor	CVE-2025-31702Proof of concept	A vulnerability exists in certain Dahua embedded products.dahua · ipc · CWE-732	Medium6.8	—	0.4%	Oct 15, 2025
39Monitor	CVE-2025-10041Proof of concept	Flex QR Code Generator <= 1.2.5 - Unauthenticated Arbitrary File Uploadajitdas · flex qr code generator · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.9%	Oct 15, 2025
39Monitor	CVE-2025-10294Proof of concept	OwnID Passwordless Login <= 1.3.4 - Authentication Bypassvictornavarro · ownid passwordless login · CWE-288 Pre-auth Auth bypass	Critical9.8	—	0.7%	Oct 15, 2025
30Monitor	CVE-2025-11177Proof of concept	External Login <= 1.11.2 - Unauthenticated SQL Injection via logtbenyon · external login · CWE-89 Pre-auth SQL injection	High7.5	—	0.3%	Oct 15, 2025

CVE-2025-39913
31Monitor
tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
HighCVSS 7.8Proof of conceptEPSS 0%
linux · linux kernelOct 1, 2025
CVE-2025-61622
52Plan
Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory
CriticalCVSS 9.8Proof of conceptEPSS 43%
- pre-auth RCE
- Deserialization
apache · foryOct 1, 2025
CVE-2025-56514
21Monitor
Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are r
MediumCVSS 5.4Proof of conceptEPSS 0%
- XSS
suisuijiang · fioraOct 1, 2025
CVE-2025-56515
35Monitor
File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality.
HighCVSS 8.8Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
suisuijiang · fioraOct 1, 2025
CVE-2025-57389
21Monitor
A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to exe
MediumCVSS 5.4Proof of conceptEPSS 0%
- RCE
- XSS
Oct 1, 2025
CVE-2025-61734
36Monitor
Apache Kylin: improper restriction of file read
HighCVSS 7.5No exploitEPSS 19%
- Pre-auth
apache · kylinOct 2, 2025
CVE-2025-56379
21Monitor
A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scr
MediumCVSS 5.4Proof of conceptEPSS 0%
- RCE
- XSS
frappe · erpnextOct 2, 2025
CVE-2025-56380
26Monitor
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
frappe · erpnextOct 2, 2025
CVE-2025-56381
26Monitor
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
frappe · erpnextOct 2, 2025
CVE-2025-56019
26Monitor
An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to co
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
- Denial of service
agasta · easy touch plus firmwareOct 2, 2025
CVE-2025-61666
34Monitor
Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File
HighCVSS 8.7Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
traccar · traccarOct 2, 2025
CVE-2025-59536
42Plan
Claude Code's startup trust dialog could lead to Command Execution attack
HighCVSS 8.7Proof of conceptEPSS 27%
- pre-auth RCE
anthropic · claude codeOct 3, 2025
CVE-2025-27237
29Monitor
DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration
HighCVSS 7.3Proof of conceptEPSS 0%
- Local privilege escalation
zabbix · zabbixOct 3, 2025
CVE-2025-9209
40Plan
RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT
CriticalCVSS 9.8Proof of conceptEPSS 2%
- Pre-auth
- Auth bypass
- Info leak
magnigenie · restropress – online food ordering systemOct 3, 2025
CVE-2025-9286
39Monitor
Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
hancock11 · appy pie connect for woocommerceOct 3, 2025
CVE-2025-9876
25Monitor
Ird Slider <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
MediumCVSS 6.4Proof of conceptEPSS 0%
- XSS
inforrada · ird sliderOct 3, 2025
CVE-2025-55971
18Monitor
TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthentic
MediumCVSS 4.7Proof of conceptEPSS 0%
- Pre-auth
- SSRF
- Denial of service
tcl · 65c655 firmwareOct 3, 2025
CVE-2025-55972
30Monitor
A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS)
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
tcl · 65c655 firmwareOct 3, 2025
CVE-2025-60787
40Plan
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name.
HighCVSS 7.2WeaponizedEPSS 18%
- RCE
- Command injection
motioneye project · motioneyeOct 3, 2025
CVE-2025-46817
36Monitor
Lua library commands may lead to integer overflow and potential RCE
HighCVSS 8.8Proof of conceptEPSS 3%
- RCE
- Memory safety
redis · redisOct 3, 2025
CVE-2025-59489
29Monitor
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code f
HighCVSS 7.4Proof of conceptEPSS 0%
unity · editorOct 3, 2025
CVE-2025-46818
29Monitor
Redis: Authenticated users can execute LUA scripts as a different user
HighCVSS 7.3Proof of conceptEPSS 0%
- RCE
redis · redisOct 3, 2025
CVE-2025-46819
28Monitor
Redis is vulnerable to DoS via specially crafted LUA scripts
HighCVSS 7.1Proof of conceptEPSS 1%
- Memory safety
redis · redisOct 3, 2025
CVE-2025-49844
64This week
Redis Lua Use-After-Free may lead to remote code execution
CriticalCVSS 9.9Proof of conceptEPSS 82%
- RCE
- Memory safety
redis · redisOct 3, 2025
CVE-2025-34226
28Monitor
OpenPLC Runtime v3 Persistent DoS
HighCVSS 7.1Proof of conceptEPSS 0%
autonomy logic · openplc runtimeOct 3, 2025
CVE-2025-59944
39Monitor
Cursor IDE: Sensitive File Overwrite Bypass is Possible
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
anysphere · cursorOct 3, 2025
CVE-2025-9485
39Monitor
OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
cyberlord92 · oauth single sign on – sso (oauth client)Oct 4, 2025
CVE-2025-39946
25Monitor
tls: make sure to abort the stream if headers are bogus
MediumCVSS 5.5Proof of conceptEPSS 9%
- Denial of service
linux · linux kernelOct 4, 2025
CVE-2025-9886
17Monitor
Trinity Audio <= 5.20.2 - Cross-Site Request Forgery
MediumCVSS 4.3Proof of conceptEPSS 0%
- Pre-auth
- CSRF
sergiotrinity · trinity audio – text to speech ai audio player to convert content into audioOct 4, 2025
CVE-2025-61882
99Now
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).
CriticalCVSS 9.8KEVWeaponizedEPSS 99%
- Pre-auth
- Auth bypass
oracle · concurrent processingOct 5, 2025
CVE-2025-50538
28Monitor
Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.
MediumCVSS 6.1No exploitEPSS 14%
- Pre-auth
- XSS
flowiseai · flowiseOct 6, 2025
CVE-2025-11331
13Monitor
IdeaCMS Website Name Config.php command injection
LowCVSS 2.0No exploitEPSS 17%
- RCE
- Command injection
ideacms · ideacmsOct 6, 2025
CVE-2025-61224
26Monitor
Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q pa
MediumCVSS 6.5Proof of conceptEPSS 1%
- pre-auth RCE
- XSS
Oct 6, 2025
CVE-2025-52472
38Monitor
XWiki Platform vulnerable to HQL injection via wiki and space search REST API
CriticalCVSS 9.3Proof of conceptEPSS 2%
- Pre-auth
- SQL injection
xwiki · xwiki-platformOct 6, 2025
CVE-2025-61687
38Monitor
FlowiseAI/Flosise has File Upload vulnerability
HighCVSS 8.8No exploitEPSS 10%
- RCE
- File upload
flowiseai · flowiseOct 6, 2025
CVE-2025-61765
25Monitor
python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments
MediumCVSS 6.4Proof of conceptEPSS 0%
- RCE
- Deserialization
miguelgrinberg · python-socketioOct 6, 2025
CVE-2025-61777
36Monitor
FlagForge Allows Unauthenticated Badge Template API Access
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
- Info leak
flagforge · flagforgeOct 6, 2025
CVE-2025-61984
14Monitor
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leadin
LowCVSS 3.6Proof of conceptEPSS 0%
openbsd · opensshOct 6, 2025
CVE-2025-10162
35Monitor
OrderConvo <= 15.1 - Unauthenticated Arbitrary File Read
HighCVSS 8.6Proof of conceptEPSS 4%
- Pre-auth
- Path traversal
unknown · admin and customer messages after order for woocommerce: orderconvoOct 7, 2025
CVE-2025-50505
31Monitor
Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key funct
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
Oct 7, 2025
CVE-2025-52021
39Monitor
A SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
Oct 7, 2025
CVE-2025-56243
24Monitor
A Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the event
MediumCVSS 6.1Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
puneethreddyhc · event management systemOct 7, 2025
CVE-2025-44823
40Plan
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.ph
HighCVSS 8.8Proof of conceptEPSS 16%
- Info leak
nagios · log serverOct 7, 2025
CVE-2025-11171
21Monitor
Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
ays-pro · chartify – wordpress chart pluginOct 8, 2025
CVE-2025-61183
24Monitor
Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of
MediumCVSS 6.1Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
webreinvent · vaahcmsOct 8, 2025
CVE-2025-10351
37Monitor
SQL injection vulnerability in Melis Platform
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
melis technology · melis platformOct 8, 2025
CVE-2025-10352
37Monitor
Missing Authorization vulnerability in Melis Platform
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
melis technology · melis platformOct 8, 2025
CVE-2025-10353
38Monitor
Missing Authorization vulnerability in Melis Platform
CriticalCVSS 9.3Proof of conceptEPSS 2%
- pre-auth RCE
melis technology · melis platformOct 8, 2025
CVE-2025-57457
35Monitor
An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Command
HighCVSS 8.8Proof of conceptEPSS 0%
- RCE
- Command injection
Oct 8, 2025
CVE-2025-61913
43Plan
Flowise is vulnerable to arbitrary file read, arbitrary file write
CriticalCVSS 9.9No exploitEPSS 12%
- RCE
- Path traversal
flowiseai · flowiseOct 8, 2025
CVE-2025-10249
26Monitor
Slider Revolution <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read
MediumCVSS 6.5No exploitEPSS 0%
- Path traversal
revolution slider · slider revolutionOct 9, 2025
CVE-2025-60375
29Monitor
The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validat
HighCVSS 7.3Proof of conceptEPSS 0%
- Pre-auth
Oct 9, 2025
CVE-2025-11371
88Now
Gladinet CentreStack and TrioFox Local File Inclusion Flaw
HighCVSS 7.5KEVWeaponizedEPSS 92%
- Pre-auth
gladinet · centrestackOct 9, 2025
CVE-2025-61928
42Plan
Better Auth: Unauthenticated API key creation through api-key plugin
CriticalCVSS 9.3No exploitEPSS 17%
- Pre-auth
- Broken access control (IDOR)
better-auth · better-authOct 9, 2025
CVE-2025-4615
22Monitor
PAN-OS: Improper Neutralization of Input in the Management Web Interface
MediumCVSS 5.5Proof of conceptEPSS 0%
- RCE
paloaltonetworks · pan-osOct 9, 2025
CVE-2025-11554
8Monitor
Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissions
LowCVSS 2.1Proof of conceptEPSS 0%
portabilis · i-educarOct 9, 2025
CVE-2025-11555
22Monitor
Campcodes Online Learning Management System calendar_of_events.php sql injection
MediumCVSS 5.5Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
campcodes · online learning management systemOct 9, 2025
CVE-2025-11449
21Monitor
Reflected Cross Site Scripting in ServiceNow AI Platform
MediumCVSS 5.3Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
servicenow · servicenow ai platformOct 10, 2025
CVE-2025-21065
26Monitor
Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands on their own devices.
MediumCVSS 6.6Proof of conceptEPSS 0%
samsung mobile · retail modeOct 10, 2025
CVE-2025-41088
20Monitor
Stored Cross-Site Scripting (XSS) in CMS
MediumCVSS 5.1Proof of conceptEPSS 0%
- XSS
xibo signage · xibo cmsOct 10, 2025
CVE-2025-41089
19Monitor
Reflected Cross-Site Scripting (XSS) in CMS
MediumCVSS 4.8Proof of conceptEPSS 0%
- XSS
xibo signage · xibo cmsOct 10, 2025
CVE-2025-61319
24Monitor
ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module.
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
yogeshojha · rengineOct 10, 2025
CVE-2025-60378
32Monitor
Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages.
HighCVSS 8.1Proof of conceptEPSS 1%
- XSS
fairsketch · rise ultimate project managerOct 10, 2025
CVE-2025-11579
26Monitor
DoS via Out Of Memory Crash
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
nwaples · rardecodeOct 10, 2025
CVE-2025-11580
22Monitor
PowerJob list authorization
MediumCVSS 5.5Proof of conceptEPSS 1%
- Pre-auth
- Broken access control (IDOR)
powerjob · powerjobOct 10, 2025
CVE-2025-60880
33Monitor
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a
HighCVSS 8.3Proof of conceptEPSS 0%
- RCE
- XSS
webkul · bagistoOct 10, 2025
CVE-2025-61505
26Monitor
e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script.
MediumCVSS 6.5Proof of conceptEPSS 0%
- pre-auth RCE
- Deserialization
e107 · e107Oct 10, 2025
CVE-2025-55903
33Monitor
A HTML injection vulnerability exists in Perfex CRM v3.3.1.
HighCVSS 8.3Proof of conceptEPSS 0%
Oct 10, 2025
CVE-2025-11380
23Monitor
Everest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure
MediumCVSS 5.9Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
everestthemes · everest backup – wordpress cloud backup, migration, restore & cloning pluginOct 11, 2025
CVE-2025-9196
21Monitor
Trinity Audio <= 5.21.0 - Unauthenticated Information Exposure
MediumCVSS 5.3Proof of conceptEPSS 1%
- Pre-auth
- Info leak
sergiotrinity · trinity audio – text to speech ai audio player to convert content into audioOct 11, 2025
CVE-2025-10175
26Monitor
WP Links Page <= 4.9.6 - Authenticated (Subscriber+) SQL Injection
MediumCVSS 6.5Proof of conceptEPSS 0%
- SQL injection
rico-macchi · wp links pageOct 11, 2025
CVE-2025-61884
89Now
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).
HighCVSS 7.5KEVWeaponizedEPSS 95%
- Pre-auth
- Path traversal
oracle · configuratorOct 12, 2025
CVE-2025-10720
26Monitor
WP Private Content Plus <= 3.6.2 - Password Protection Bypass
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · wp private content plusOct 13, 2025
CVE-2025-39964
52Plan
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
MediumCVSS 5.5KEVWeaponizedEPSS 1%
- Race condition
- Denial of service
linux · linux kernelOct 13, 2025
CVE-2025-39965
22Monitor
xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
MediumCVSS 5.5Proof of conceptEPSS 0%
- Denial of service
linux · linux kernelOct 13, 2025
CVE-2025-9713
40Plan
Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution.
HighCVSS 8.8No exploitEPSS 15%
- pre-auth RCE
- Path traversal
ivanti · endpoint managerOct 13, 2025
CVE-2025-62360
37Monitor
WeGIA SQL Injection via 'id_dependente' param at endpoint `/html/funcionario/dependente_documento.php`
CriticalCVSS 9.4Proof of conceptEPSS 0%
- RCE
- SQL injection
wegia · wegiaOct 13, 2025
CVE-2025-24990
63This week
Windows Agere Modem Driver Elevation of Privilege Vulnerability
HighCVSS 7.8KEVWeaponizedEPSS 6%
- Local privilege escalation
microsoft · windows 10 1507Oct 14, 2025
CVE-2025-58726
30Monitor
Windows SMB Server Elevation of Privilege Vulnerability
HighCVSS 7.5Proof of conceptEPSS 1%
- Broken access control (IDOR)
microsoft · windows 10 1507Oct 14, 2025
CVE-2025-59194
29Monitor
Windows Kernel Elevation of Privilege Vulnerability
HighCVSS 7.0Proof of conceptEPSS 2%
- Local privilege escalation
- Memory safety
microsoft · windows 11 22h2Oct 14, 2025
CVE-2025-59230
62This week
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
HighCVSS 7.8KEVWeaponizedEPSS 2%
- Local privilege escalation
- Broken access control (IDOR)
microsoft · windows 10 1507Oct 14, 2025
CVE-2025-59254
31Monitor
Microsoft DWM Core Library Elevation of Privilege Vulnerability
HighCVSS 7.8Proof of conceptEPSS 1%
- Local privilege escalation
- Memory safety
microsoft · windows 10 1507Oct 14, 2025
CVE-2025-59287
99Now
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
CriticalCVSS 9.8KEVWeaponizedEPSS 99%
- pre-auth RCE
- Deserialization
microsoft · windows server 2012Oct 14, 2025
CVE-2025-22831
23Monitor
Buffer Overflow in NTFS when parsing the VOLUME_NAME
MediumCVSS 5.9No exploitEPSS 0%
- Memory safety
ami · aptio vOct 14, 2025
CVE-2025-10242
34Monitor
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke
HighCVSS 7.2No exploitEPSS 20%
- RCE
- Command injection
ivanti · endpoint manager mobileOct 14, 2025
CVE-2025-10243
34Monitor
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke
HighCVSS 7.2No exploitEPSS 20%
- RCE
- Command injection
ivanti · endpoint manager mobileOct 14, 2025
CVE-2025-10985
34Monitor
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke
HighCVSS 7.2No exploitEPSS 20%
- RCE
- Command injection
ivanti · endpoint manager mobileOct 14, 2025
CVE-2025-5946
40Plan
RCE via the poller reload feature available only to user with high privilege
HighCVSS 7.2WeaponizedEPSS 13%
- RCE
- Command injection
centreon · centreon webOct 14, 2025
CVE-2025-60374
24Monitor
Stored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript.
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
Oct 14, 2025
CVE-2025-55315
59Plan
ASP.NET Security Feature Bypass Vulnerability
CriticalCVSS 9.9Proof of conceptEPSS 65%
microsoft · asp.net coreOct 14, 2025
CVE-2025-55320
27Monitor
Configuration Manager Elevation of Privilege Vulnerability
MediumCVSS 6.8Proof of conceptEPSS 0%
- SQL injection
microsoft · configuration manager 2403Oct 14, 2025
CVE-2025-59213
35Monitor
Configuration Manager Elevation of Privilege Vulnerability
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
microsoft · configuration manager 2403Oct 14, 2025
CVE-2025-59284
22Monitor
Windows NTLM Spoofing Vulnerability
MediumCVSS 5.5Proof of conceptEPSS 1%
- Info leak
microsoft · windows 11 22h2Oct 14, 2025
CVE-2025-61675
46Plan
FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters
HighCVSS 8.6WeaponizedEPSS 38%
- RCE
- SQL injection
freepbx · endpointOct 14, 2025
CVE-2025-61678
47Plan
FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter
HighCVSS 8.6WeaponizedEPSS 43%
- RCE
- File upload
freepbx · endpointmanOct 14, 2025
CVE-2025-9967
39Monitor
Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeover
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
gsayed786 · orion sms otp verification.Oct 15, 2025
CVE-2025-31702
27Monitor
A vulnerability exists in certain Dahua embedded products.
MediumCVSS 6.8Proof of conceptEPSS 0%
dahua · ipcOct 15, 2025
CVE-2025-10041
39Monitor
Flex QR Code Generator <= 1.2.5 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- File upload
ajitdas · flex qr code generatorOct 15, 2025
CVE-2025-10294
39Monitor
OwnID Passwordless Login <= 1.3.4 - Authentication Bypass
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
victornavarro · ownid passwordless loginOct 15, 2025
CVE-2025-11177
30Monitor
External Login <= 1.11.2 - Unauthenticated SQL Injection via log
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
tbenyon · external loginOct 15, 2025