By publication date

Exploited and new serious CVEs: October 2025

195 records · 10 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
68This week	CVE-2025-53521Weaponized	BigIP APM Vulnerabilityf5 · big-ip access policy manager · CWE-121 pre-auth RCE Memory safety	Critical9.3	KEV	2.2%	Oct 15, 2025
18Monitor	CVE-2025-60013Proof of concept	F5OS-A FIPS HSM password vulnerabilityf5 · f5os-a · CWE-78 RCE Local privilege escalation Command injection	Medium4.6	—	0.1%	Oct 15, 2025
27Monitor	CVE-2025-9548Proof of concept	A potential null pointer dereference vulnerability was reported in the Lenovo Power Management Driver that could allow a local authenticatedlenovo · power management driver · CWE-476 Memory safety	Medium6.8	—	0.1%	Oct 15, 2025
34Monitor	CVE-2025-10576Proof of concept	Sound Research SECOMNService Escalation of Privilegehp, inc. · sound research · CWE-266 Local privilege escalation	High8.5	—	0.1%	Oct 15, 2025
40Plan	CVE-2025-11832Proof of concept	APIs Lack Rate Limitingazure-access · blu-ic2 firmware · CWE-770 Pre-auth Denial of service	Critical10.0	—	0.3%	Oct 15, 2025
32Monitor	CVE-2025-22381Proof of concept	Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password.CWE-620 Pre-auth	High8.2	—	0.6%	Oct 16, 2025
36Monitor	CVE-2025-61922Proof of concept	PrestaShop Checkout allows customer account takeover via emailprestashop · prestashop checkout · CWE-287 Pre-auth Auth bypass	Critical9.1	—	0.5%	Oct 16, 2025
23Monitor	CVE-2025-62411No exploit	Stored XSS in Alert Transport name field in LibreNMSlibrenms · librenms · CWE-79 XSS	Medium4.8	—	12.7%	Oct 16, 2025
30Monitor	CVE-2025-11492Proof of concept	HTTP Configuration and Encryption in Transitconnectwise · automate · CWE-319 Pre-auth Weak crypto	High7.5	—	0.2%	Oct 16, 2025
32Monitor	CVE-2025-62506Proof of concept	MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STSminio · minio · CWE-863 Broken access control (IDOR)	High8.1	—	0.5%	Oct 16, 2025
39Monitor	CVE-2025-56218Proof of concept	An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.ascertia · signinghub · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.6%	Oct 17, 2025
39Monitor	CVE-2025-56221Proof of concept	A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack.ascertia · signinghub · CWE-307 Pre-auth Auth bypass	Critical9.8	—	0.5%	Oct 17, 2025
49Plan	CVE-2025-62168Proof of concept	Squid vulnerable to information disclosure via authentication credential leakage in error handlingsquid-cache · squid · CWE-209 Pre-auth Info leak	High7.5	—	63.3%	Oct 17, 2025
28Monitor	CVE-2025-34282Proof of concept	ThingsBoard < v4.2.1 SVG Image SSRFthingsboard · thingsboard · CWE-918 Pre-auth SSRF	Medium6.9	—	1.8%	Oct 17, 2025
39Monitor	CVE-2025-11391Proof of concept	PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Uploadthemeisle · ppom – product addons & custom fields for woocommerce · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.9%	Oct 18, 2025
17Monitor	CVE-2025-11926Proof of concept	Related Posts Lite <= 1.12 - Authenticated (Admin+) Stored Cross-Site Scriptingwpdreams · related posts lite · CWE-79 XSS	Medium4.4	—	0.3%	Oct 18, 2025
68This week	CVE-2025-61932Weaponized	Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, motex · lanscope endpoint manager · CWE-940 pre-auth RCE	Critical9.3	KEV	2.7%	Oct 20, 2025
28Monitor	CVE-2025-56219Proof of concept	Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limiting.ascertia · signinghub · CWE-284 Broken access control (IDOR)	High7.1	—	0.3%	Oct 20, 2025
30Monitor	CVE-2025-56223Proof of concept	A lack of rate limiting in the component /Home/UploadStreamDocument of SigningHub v8.6.8 allows attackers to cause a Denial of Service (DoS)ascertia · signinghub · CWE-770 Pre-auth Denial of service	High7.5	—	0.4%	Oct 20, 2025
32Monitor	CVE-2025-56224Proof of concept	A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification viascertia · signinghub · CWE-307 Pre-auth	High8.1	—	0.3%	Oct 20, 2025
24Monitor	CVE-2025-61454Proof of concept	A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint.CWE-79 pre-auth RCE XSS	Medium6.1	—	0.2%	Oct 20, 2025
39Monitor	CVE-2025-61455Proof of concept	SQL Injection vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the signup.inc.php endpoint.CWE-89 Pre-auth Auth bypass SQL injection	Critical9.8	—	0.5%	Oct 20, 2025
39Monitor	CVE-2025-54957Proof of concept	An issue was discovered in Dolby UDC 4.5 through 4.13.CWE-190 Pre-auth Memory safety	Critical9.8	—	1.5%	Oct 20, 2025
24Monitor	CVE-2025-61456Proof of concept	A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint.CWE-79 pre-auth RCE XSS	Medium6.1	—	0.2%	Oct 20, 2025
35Monitor	CVE-2025-57738No exploit	Apache Syncope: Remote Code Execution by delegated administratorsapache · syncope · CWE-653 RCE	High7.2	—	23.1%	Oct 20, 2025
30Monitor	CVE-2025-61301Proof of concept	Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 (commit 52e4b43, on 2025-05-17) allows attackers who can submCWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Oct 20, 2025
39Monitor	CVE-2025-61303Proof of concept	Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a vulnerability in its Windows behaCWE-400 Pre-auth Denial of service	Critical9.8	—	0.4%	Oct 20, 2025
28Monitor	CVE-2025-62429Proof of concept	ClipBucket v5 executes arbitrary PHP codeoxygenz · clipbucket · CWE-94 RCE	High7.2	—	0.8%	Oct 20, 2025
24Monitor	CVE-2025-62522Proof of concept	vite allows server.fs.deny bypass via backslash on Windowsvitejs · vite · CWE-22 Pre-auth Path traversal	Medium6.0	—	1.0%	Oct 20, 2025
43Plan	CVE-2025-9428No exploit	Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.zohocorp · manageengine analytics plus · CWE-89 SQL injection	High8.8	—	27.3%	Oct 21, 2025
31Monitor	CVE-2025-60751Proof of concept	GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode.CWE-121 Pre-auth Memory safety Denial of service	High7.5	—	2.2%	Oct 21, 2025
28Monitor	CVE-2025-60500Proof of concept	QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictiqdocs · smart school · CWE-434 File upload	High7.2	—	0.5%	Oct 21, 2025
37Monitor	CVE-2025-60344No exploit	A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate inpud-link · dsr-150 · CWE-24 Pre-auth Path traversal	High8.6	—	10.8%	Oct 21, 2025
26Monitor	CVE-2025-56799Proof of concept	Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted foldereolink · reolink · CWE-77 pre-auth RCE Command injection	Medium6.5	—	1.2%	Oct 21, 2025
20Monitor	CVE-2025-56800Proof of concept	Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism.reolink · reolink · CWE-290 Auth bypass	Medium5.1	—	0.2%	Oct 21, 2025
20Monitor	CVE-2025-56801Proof of concept	The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implementreolink · reolink · CWE-321 Hard-coded credentials	Medium5.1	—	0.1%	Oct 21, 2025
20Monitor	CVE-2025-56802Proof of concept	The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers reolink · reolink · CWE-321 Hard-coded credentials	Medium5.1	—	0.1%	Oct 21, 2025
32Monitor	CVE-2025-62518Proof of concept	astral-tokio-tar Vulnerable to PAX Header Desynchronizationastral-sh · tokio-tar · CWE-843 Pre-auth	High8.1	—	0.7%	Oct 21, 2025
10Monitor	CVE-2025-53051Proof of concept	Vulnerability in the RDBMS Functional Index component of Oracle Database Server.oracle · database server · CWE-125 Memory safety	Low2.7	—	0.3%	Oct 21, 2025
39Monitor	CVE-2025-53072Proof of concept	Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration).oracle · marketing · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.6%	Oct 21, 2025
96Now	CVE-2025-61757Weaponized	Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).oracle · identity manager · CWE-306 Pre-auth Auth bypass	Critical9.8	KEV	88.6%	Oct 21, 2025
32Monitor	CVE-2025-62641Proof of concept	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).oracle · vm virtualbox · CWE-267 Local privilege escalation	High8.2	—	0.2%	Oct 21, 2025
39Monitor	CVE-2024-58274No exploit	Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /hikvision · csmp isecure center · CWE-78 pre-auth RCE Command injection	High8.3	—	19.0%	Oct 22, 2025
21Monitor	CVE-2025-11750Proof of concept	User Enumeration via Distinct Error Messages in langgenius/dify-weblanggenius · dify · CWE-544 Pre-auth	Medium5.3	—	0.7%	Oct 22, 2025
21Monitor	CVE-2025-11844Proof of concept	XPath Injection in Hugging Face Smolagents search_item_ctrl_f Functionhuggingface · smolagents · CWE-643 Pre-auth	Medium5.4	—	0.2%	Oct 22, 2025
21Monitor	CVE-2025-8848Proof of concept	HTML Injection in Accept-Language Header in danny-avila/librechatlibrechat · librechat · CWE-94 RCE XSS	Medium5.4	—	0.4%	Oct 22, 2025
39Monitor	CVE-2025-49901Proof of concept	WordPress Simple Link Directory plugin < 14.8.1 - Broken Authentication vulnerabilityquantumcloud · simple link directory · CWE-288 Pre-auth Auth bypass	Critical9.8	—	0.7%	Oct 22, 2025
36Monitor	CVE-2025-62023Proof of concept	WordPress s2Member plugin <= 250905 - Remote Code Execution (RCE) vulnerabilitycristián lávaque · s2member · CWE-94 pre-auth RCE	Critical9.0	—	0.4%	Oct 22, 2025
34Monitor	CVE-2025-40778Proof of concept	Cache poisoning attacks with unsolicited RRsisc · bind 9 · CWE-349 Pre-auth	High8.6	—	0.6%	Oct 22, 2025
33Monitor	CVE-2025-8677No exploit	Resource exhaustion via malformed DNSKEY handlingisc · bind 9 · CWE-405 Pre-auth Denial of service	High7.5	—	10.7%	Oct 22, 2025
27Monitor	CVE-2025-62613Proof of concept	VDO.Ninja Reflected XSS Vulnerability in control.htmlsteveseguin · vdo.ninja · CWE-79 Pre-auth XSS	Medium6.9	—	1.1%	Oct 22, 2025
26Monitor	CVE-2025-60852Proof of concept	A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600.CWE-1236 Pre-auth	Medium6.5	—	0.4%	Oct 23, 2025
32Monitor	CVE-2025-6978No exploit	Diagnostics command injection vulnerabilityarista networks · arista edge threat management - arista next generation firewall · CWE-78 RCE Command injection	High7.2	—	13.4%	Oct 23, 2025
30Monitor	CVE-2025-6980Proof of concept	Captive Portal can expose sensitive informationarista networks · arista edge threat management - arista next generation firewall · CWE-200 Pre-auth Info leak	High7.5	—	0.4%	Oct 23, 2025
22Monitor	CVE-2025-10874Proof of concept	Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgeryunknown · orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more · CWE-918 SSRF	Medium5.5	—	0.1%	Oct 24, 2025
19Monitor	CVE-2025-5350Proof of concept	SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Productswso2 · api control plane · CWE-79 SSRF XSS	Medium4.8	—	0.6%	Oct 24, 2025
21Monitor	CVE-2025-5605Proof of concept	Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosurewso2 · api control plane · CWE-290 Pre-auth Auth bypass	Medium5.3	—	0.8%	Oct 24, 2025
49Plan	CVE-2025-6440Proof of concept	WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Uploadjma plugins · woocommerce designer pro · CWE-434 pre-auth RCE File upload	Critical9.8	—	33.3%	Oct 24, 2025
35Monitor	CVE-2025-12028Proof of concept	IndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokensindieweb · indieauth · CWE-352 Pre-auth CSRF	High8.8	—	0.2%	Oct 24, 2025
0Monitor	CVE-2025-40019Proof of concept	crypto: essiv - Check ssize for decryption and in-place encryptionlinux · linux	—	—	0.2%	Oct 24, 2025
31Monitor	CVE-2025-12055Proof of concept	Unauthenticated Local File Disclosure in MPDV Mikrolab MIP 2 / FEDRA 2 / HYDRA X Manufacturing Execution Systemmpdv mikrolab gmbh · mip 2 · CWE-22 Pre-auth Path traversal	High7.5	—	3.8%	Oct 27, 2025
35Monitor	CVE-2023-49440Proof of concept	AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter."CWE-89 SQL injection	High8.8	—	0.3%	Oct 27, 2025
30Monitor	CVE-2025-60424Proof of concept	A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication vnagios · fusion · CWE-287 Auth bypass	High7.6	—	0.7%	Oct 27, 2025
34Monitor	CVE-2025-60425Proof of concept	Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabnagios · fusion · CWE-491 Pre-auth	High8.6	—	0.9%	Oct 27, 2025
24Monitor	CVE-2025-60791Proof of concept	Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory.CWE-316	Medium6.2	—	0.1%	Oct 27, 2025
35Monitor	CVE-2025-27222Proof of concept	TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files.rocketsoftware · trufusion enterprise · CWE-22 Pre-auth Path traversal	High8.6	—	2.0%	Oct 27, 2025
31Monitor	CVE-2025-27223Proof of concept	TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPorrocketsoftware · trufusion enterprise · CWE-1004 Pre-auth	High7.5	—	2.2%	Oct 27, 2025
36Monitor	CVE-2025-27225Proof of concept	TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users.rocketsoftware · trufusion enterprise · CWE-200 Pre-auth Info leak	High7.5	—	18.3%	Oct 27, 2025
34Monitor	CVE-2025-41067Proof of concept	Reachable Assertion vulnerability in Open5GSopen5gs · open5gs · CWE-617 Pre-auth	High8.7	—	0.4%	Oct 27, 2025
49Plan	CVE-2025-55752Proof of concept	Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabledapache · tomcat · CWE-23 RCE Path traversal	High7.5	—	64.4%	Oct 27, 2025
41Plan	CVE-2025-55754No exploit	Apache Tomcat: console manipulation via escape sequences in log messagesapache · tomcat · CWE-150 Pre-auth	Critical9.6	—	10.1%	Oct 27, 2025
20Monitor	CVE-2025-53533Proof of concept	Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error pagepi-hole · web interface · CWE-79 pre-auth RCE XSS	Medium5.1	—	0.5%	Oct 27, 2025
39Monitor	CVE-2025-62725No exploit	Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotationsdocker · compose · CWE-22 Pre-auth Path traversal	High8.9	—	13.7%	Oct 27, 2025
30Monitor	CVE-2025-41090Proof of concept	Improper Access Control in CCN-CERT microCLAUDIAccn-cert · microclaudia · CWE-306 Auth bypass	High7.6	—	0.3%	Oct 28, 2025
38Monitor	CVE-2025-34311No exploit	IPFire < v2.29 Command Injection via Proxy Report Creationipfire · ipfire · CWE-78 RCE Command injection	High8.7	—	13.4%	Oct 28, 2025
22Monitor	CVE-2025-40040Proof of concept	mm/ksm: fix flag-dropping behavior in ksm_madviselinux · linux kernel Denial of service	Medium5.5	—	0.3%	Oct 28, 2025
35Monitor	CVE-2025-56399Proof of concept	alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted fiCWE-94 RCE	High8.8	—	0.5%	Oct 28, 2025
30Monitor	CVE-2025-60349Proof of concept	An issue was discovered in Prevx v3.0.5.220 allowing attackers to cause a denial of service via sending IOCTL code 0x22E044 to the pxscan.syCWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Oct 28, 2025
22Monitor	CVE-2025-61155Proof of concept	The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an access control vulnerability in one of its IOCTL hanCWE-400 Local privilege escalation Denial of service	Medium5.5	—	0.2%	Oct 28, 2025
30Monitor	CVE-2025-60800Proof of concept	Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive informajishenghua · jsherp · CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Oct 28, 2025
40Plan	CVE-2025-62368Weaponized	Taiga Authenticated Remote Code Executiontaigaio · taiga-back · CWE-502 RCE Deserialization	Critical9.0	—	1.5%	Oct 28, 2025
30Monitor	CVE-2025-62727Proof of concept	Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponsekludex · starlette · CWE-407 Pre-auth Denial of service	High7.5	—	0.8%	Oct 28, 2025
53Plan	CVE-2025-64095Proof of concept	DNN Insufficient Access Control - Image Upload allows for Site Content Overwritednnsoftware · dotnetnuke · CWE-434 Pre-auth File upload XSS	Critical9.8	—	46.9%	Oct 28, 2025
32Monitor	CVE-2025-60595Proof of concept	SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution.CWE-77 pre-auth RCE Command injection	High8.2	—	0.3%	Oct 29, 2025
31Monitor	CVE-2025-61156Proof of concept	Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privileges and execute arbCWE-284 RCE Local privilege escalation Broken access control (IDOR)	High7.8	—	0.1%	Oct 29, 2025
47Plan	CVE-2025-11201Proof of concept	MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerabilitylfprojects · mlflow · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	26.2%	Oct 29, 2025
14Monitor	CVE-2025-11203Proof of concept	LiteLLM Information health API_KEY Information Disclosure Vulnerabilitylitellm · litellm · CWE-200 Info leak	Low3.5	—	0.3%	Oct 29, 2025
26Monitor	CVE-2025-11627Proof of concept	Site Checkup AI Troubleshooting with Wizard and Tips for Each Issue <= 1.47 - Unauthenticated Log File Poisoningsminozzi · site checkup debug ai troubleshooting with wizard and tips for each issue · CWE-117 Pre-auth	Medium6.5	—	0.3%	Oct 30, 2025
32Monitor	CVE-2025-63298Proof of concept	A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/manage_website.php cmayurik · pet grooming management software · CWE-24 Pre-auth Path traversal	High8.2	—	0.5%	Oct 30, 2025
35Monitor	CVE-2025-62726Proof of concept	n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hookn8n · n8n · CWE-829 RCE	High8.8	—	0.8%	Oct 30, 2025
52Plan	CVE-2025-52665Proof of concept	A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, tui · unifi access · CWE-306 Pre-auth Auth bypass	Critical10.0	—	41.0%	Oct 31, 2025
60This week	CVE-2025-8489Weaponized	King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalationkingaddons · king addons for elementor – 4,000+ ready elementor sections, 650+ templates, 70+ free widgets for elementor · CWE-269 Pre-auth	Critical9.8	—	9.6%	Oct 31, 2025
35Monitor	CVE-2025-10897Proof of concept	WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Readjma plugins · woocommerce designer pro · CWE-22 Pre-auth Path traversal	High8.6	—	1.9%	Oct 31, 2025
31Monitor	CVE-2025-60749Proof of concept	DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchup_webhelper.exe.CWE-427	High7.8	—	0.1%	Oct 31, 2025
20Monitor	CVE-2025-59501Proof of concept	Microsoft Configuration Manager Spoofing Vulnerabilitymicrosoft · configuration manager 2403 · CWE-290 Auth bypass	Medium4.8	—	3.2%	Oct 31, 2025

CVE-2025-53521
68This week
BigIP APM Vulnerability
CriticalCVSS 9.3KEVWeaponizedEPSS 2%
- pre-auth RCE
- Memory safety
f5 · big-ip access policy managerOct 15, 2025
CVE-2025-60013
18Monitor
F5OS-A FIPS HSM password vulnerability
MediumCVSS 4.6Proof of conceptEPSS 0%
- RCE
- Local privilege escalation
- Command injection
f5 · f5os-aOct 15, 2025
CVE-2025-9548
27Monitor
A potential null pointer dereference vulnerability was reported in the Lenovo Power Management Driver that could allow a local authenticated
MediumCVSS 6.8Proof of conceptEPSS 0%
- Memory safety
lenovo · power management driverOct 15, 2025
CVE-2025-10576
34Monitor
Sound Research SECOMNService Escalation of Privilege
HighCVSS 8.5Proof of conceptEPSS 0%
- Local privilege escalation
hp, inc. · sound researchOct 15, 2025
CVE-2025-11832
40Plan
APIs Lack Rate Limiting
CriticalCVSS 10.0Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
azure-access · blu-ic2 firmwareOct 15, 2025
CVE-2025-22381
32Monitor
Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password.
HighCVSS 8.2Proof of conceptEPSS 0%
- Pre-auth
Oct 16, 2025
CVE-2025-61922
36Monitor
PrestaShop Checkout allows customer account takeover via email
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
prestashop · prestashop checkoutOct 16, 2025
CVE-2025-62411
23Monitor
Stored XSS in Alert Transport name field in LibreNMS
MediumCVSS 4.8No exploitEPSS 12%
- XSS
librenms · librenmsOct 16, 2025
CVE-2025-11492
30Monitor
HTTP Configuration and Encryption in Transit
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
connectwise · automateOct 16, 2025
CVE-2025-62506
32Monitor
MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS
HighCVSS 8.1Proof of conceptEPSS 0%
- Broken access control (IDOR)
minio · minioOct 16, 2025
CVE-2025-56218
39Monitor
An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- File upload
ascertia · signinghubOct 17, 2025
CVE-2025-56221
39Monitor
A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
ascertia · signinghubOct 17, 2025
CVE-2025-62168
49Plan
Squid vulnerable to information disclosure via authentication credential leakage in error handling
HighCVSS 7.5Proof of conceptEPSS 63%
- Pre-auth
- Info leak
squid-cache · squidOct 17, 2025
CVE-2025-34282
28Monitor
ThingsBoard < v4.2.1 SVG Image SSRF
MediumCVSS 6.9Proof of conceptEPSS 1%
- Pre-auth
- SSRF
thingsboard · thingsboardOct 17, 2025
CVE-2025-11391
39Monitor
PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- File upload
themeisle · ppom – product addons & custom fields for woocommerceOct 18, 2025
CVE-2025-11926
17Monitor
Related Posts Lite <= 1.12 - Authenticated (Admin+) Stored Cross-Site Scripting
MediumCVSS 4.4Proof of conceptEPSS 0%
- XSS
wpdreams · related posts liteOct 18, 2025
CVE-2025-61932
68This week
Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests,
CriticalCVSS 9.3KEVWeaponizedEPSS 2%
- pre-auth RCE
motex · lanscope endpoint managerOct 20, 2025
CVE-2025-56219
28Monitor
Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limiting.
HighCVSS 7.1Proof of conceptEPSS 0%
- Broken access control (IDOR)
ascertia · signinghubOct 20, 2025
CVE-2025-56223
30Monitor
A lack of rate limiting in the component /Home/UploadStreamDocument of SigningHub v8.6.8 allows attackers to cause a Denial of Service (DoS)
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
ascertia · signinghubOct 20, 2025
CVE-2025-56224
32Monitor
A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification vi
HighCVSS 8.1Proof of conceptEPSS 0%
- Pre-auth
ascertia · signinghubOct 20, 2025
CVE-2025-61454
24Monitor
A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint.
MediumCVSS 6.1Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
Oct 20, 2025
CVE-2025-61455
39Monitor
SQL Injection vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the signup.inc.php endpoint.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
- SQL injection
Oct 20, 2025
CVE-2025-54957
39Monitor
An issue was discovered in Dolby UDC 4.5 through 4.13.
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
- Memory safety
Oct 20, 2025
CVE-2025-61456
24Monitor
A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint.
MediumCVSS 6.1Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
Oct 20, 2025
CVE-2025-57738
35Monitor
Apache Syncope: Remote Code Execution by delegated administrators
HighCVSS 7.2No exploitEPSS 23%
- RCE
apache · syncopeOct 20, 2025
CVE-2025-61301
30Monitor
Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 (commit 52e4b43, on 2025-05-17) allows attackers who can subm
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
Oct 20, 2025
CVE-2025-61303
39Monitor
Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a vulnerability in its Windows beha
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
Oct 20, 2025
CVE-2025-62429
28Monitor
ClipBucket v5 executes arbitrary PHP code
HighCVSS 7.2Proof of conceptEPSS 0%
- RCE
oxygenz · clipbucketOct 20, 2025
CVE-2025-62522
24Monitor
vite allows server.fs.deny bypass via backslash on Windows
MediumCVSS 6.0Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
vitejs · viteOct 20, 2025
CVE-2025-9428
43Plan
Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.
HighCVSS 8.8No exploitEPSS 27%
- SQL injection
zohocorp · manageengine analytics plusOct 21, 2025
CVE-2025-60751
31Monitor
GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode.
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
- Memory safety
- Denial of service
Oct 21, 2025
CVE-2025-60500
28Monitor
QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restricti
HighCVSS 7.2Proof of conceptEPSS 0%
- File upload
qdocs · smart schoolOct 21, 2025
CVE-2025-60344
37Monitor
A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate inpu
HighCVSS 8.6No exploitEPSS 10%
- Pre-auth
- Path traversal
d-link · dsr-150Oct 21, 2025
CVE-2025-56799
26Monitor
Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folde
MediumCVSS 6.5Proof of conceptEPSS 1%
- pre-auth RCE
- Command injection
reolink · reolinkOct 21, 2025
CVE-2025-56800
20Monitor
Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism.
MediumCVSS 5.1Proof of conceptEPSS 0%
- Auth bypass
reolink · reolinkOct 21, 2025
CVE-2025-56801
20Monitor
The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implement
MediumCVSS 5.1Proof of conceptEPSS 0%
- Hard-coded credentials
reolink · reolinkOct 21, 2025
CVE-2025-56802
20Monitor
The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers
MediumCVSS 5.1Proof of conceptEPSS 0%
- Hard-coded credentials
reolink · reolinkOct 21, 2025
CVE-2025-62518
32Monitor
astral-tokio-tar Vulnerable to PAX Header Desynchronization
HighCVSS 8.1Proof of conceptEPSS 0%
- Pre-auth
astral-sh · tokio-tarOct 21, 2025
CVE-2025-53051
10Monitor
Vulnerability in the RDBMS Functional Index component of Oracle Database Server.
LowCVSS 2.7Proof of conceptEPSS 0%
- Memory safety
oracle · database serverOct 21, 2025
CVE-2025-53072
39Monitor
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration).
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
oracle · marketingOct 21, 2025
CVE-2025-61757
96Now
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).
CriticalCVSS 9.8KEVWeaponizedEPSS 88%
- Pre-auth
- Auth bypass
oracle · identity managerOct 21, 2025
CVE-2025-62641
32Monitor
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
HighCVSS 8.2Proof of conceptEPSS 0%
- Local privilege escalation
oracle · vm virtualboxOct 21, 2025
CVE-2024-58274
39Monitor
Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /
HighCVSS 8.3No exploitEPSS 19%
- pre-auth RCE
- Command injection
hikvision · csmp isecure centerOct 22, 2025
CVE-2025-11750
21Monitor
User Enumeration via Distinct Error Messages in langgenius/dify-web
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
langgenius · difyOct 22, 2025
CVE-2025-11844
21Monitor
XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function
MediumCVSS 5.4Proof of conceptEPSS 0%
- Pre-auth
huggingface · smolagentsOct 22, 2025
CVE-2025-8848
21Monitor
HTML Injection in Accept-Language Header in danny-avila/librechat
MediumCVSS 5.4Proof of conceptEPSS 0%
- RCE
- XSS
librechat · librechatOct 22, 2025
CVE-2025-49901
39Monitor
WordPress Simple Link Directory plugin < 14.8.1 - Broken Authentication vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
quantumcloud · simple link directoryOct 22, 2025
CVE-2025-62023
36Monitor
WordPress s2Member plugin <= 250905 - Remote Code Execution (RCE) vulnerability
CriticalCVSS 9.0Proof of conceptEPSS 0%
- pre-auth RCE
cristián lávaque · s2memberOct 22, 2025
CVE-2025-40778
34Monitor
Cache poisoning attacks with unsolicited RRs
HighCVSS 8.6Proof of conceptEPSS 0%
- Pre-auth
isc · bind 9Oct 22, 2025
CVE-2025-8677
33Monitor
Resource exhaustion via malformed DNSKEY handling
HighCVSS 7.5No exploitEPSS 10%
- Pre-auth
- Denial of service
isc · bind 9Oct 22, 2025
CVE-2025-62613
27Monitor
VDO.Ninja Reflected XSS Vulnerability in control.html
MediumCVSS 6.9Proof of conceptEPSS 1%
- Pre-auth
- XSS
steveseguin · vdo.ninjaOct 22, 2025
CVE-2025-60852
26Monitor
A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600.
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
Oct 23, 2025
CVE-2025-6978
32Monitor
Diagnostics command injection vulnerability
HighCVSS 7.2No exploitEPSS 13%
- RCE
- Command injection
arista networks · arista edge threat management - arista next generation firewallOct 23, 2025
CVE-2025-6980
30Monitor
Captive Portal can expose sensitive information
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Info leak
arista networks · arista edge threat management - arista next generation firewallOct 23, 2025
CVE-2025-10874
22Monitor
Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery
MediumCVSS 5.5Proof of conceptEPSS 0%
- SSRF
unknown · orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & moreOct 24, 2025
CVE-2025-5350
19Monitor
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
MediumCVSS 4.8Proof of conceptEPSS 0%
- SSRF
- XSS
wso2 · api control planeOct 24, 2025
CVE-2025-5605
21Monitor
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
wso2 · api control planeOct 24, 2025
CVE-2025-6440
49Plan
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8Proof of conceptEPSS 33%
- pre-auth RCE
- File upload
jma plugins · woocommerce designer proOct 24, 2025
CVE-2025-12028
35Monitor
IndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- CSRF
indieweb · indieauthOct 24, 2025
CVE-2025-40019
0Monitor
crypto: essiv - Check ssize for decryption and in-place encryption
Proof of conceptEPSS 0%
linux · linuxOct 24, 2025
CVE-2025-12055
31Monitor
Unauthenticated Local File Disclosure in MPDV Mikrolab MIP 2 / FEDRA 2 / HYDRA X Manufacturing Execution System
HighCVSS 7.5Proof of conceptEPSS 3%
- Pre-auth
- Path traversal
mpdv mikrolab gmbh · mip 2Oct 27, 2025
CVE-2023-49440
35Monitor
AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter."
HighCVSS 8.8Proof of conceptEPSS 0%
- SQL injection
Oct 27, 2025
CVE-2025-60424
30Monitor
A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication v
HighCVSS 7.6Proof of conceptEPSS 0%
- Auth bypass
nagios · fusionOct 27, 2025
CVE-2025-60425
34Monitor
Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enab
HighCVSS 8.6Proof of conceptEPSS 0%
- Pre-auth
nagios · fusionOct 27, 2025
CVE-2025-60791
24Monitor
Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory.
MediumCVSS 6.2Proof of conceptEPSS 0%
Oct 27, 2025
CVE-2025-27222
35Monitor
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files.
HighCVSS 8.6Proof of conceptEPSS 2%
- Pre-auth
- Path traversal
rocketsoftware · trufusion enterpriseOct 27, 2025
CVE-2025-27223
31Monitor
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPor
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
rocketsoftware · trufusion enterpriseOct 27, 2025
CVE-2025-27225
36Monitor
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users.
HighCVSS 7.5Proof of conceptEPSS 18%
- Pre-auth
- Info leak
rocketsoftware · trufusion enterpriseOct 27, 2025
CVE-2025-41067
34Monitor
Reachable Assertion vulnerability in Open5GS
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
open5gs · open5gsOct 27, 2025
CVE-2025-55752
49Plan
Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled
HighCVSS 7.5Proof of conceptEPSS 64%
- RCE
- Path traversal
apache · tomcatOct 27, 2025
CVE-2025-55754
41Plan
Apache Tomcat: console manipulation via escape sequences in log messages
CriticalCVSS 9.6No exploitEPSS 10%
- Pre-auth
apache · tomcatOct 27, 2025
CVE-2025-53533
20Monitor
Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page
MediumCVSS 5.1Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
pi-hole · web interfaceOct 27, 2025
CVE-2025-62725
39Monitor
Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations
HighCVSS 8.9No exploitEPSS 13%
- Pre-auth
- Path traversal
docker · composeOct 27, 2025
CVE-2025-41090
30Monitor
Improper Access Control in CCN-CERT microCLAUDIA
HighCVSS 7.6Proof of conceptEPSS 0%
- Auth bypass
ccn-cert · microclaudiaOct 28, 2025
CVE-2025-34311
38Monitor
IPFire < v2.29 Command Injection via Proxy Report Creation
HighCVSS 8.7No exploitEPSS 13%
- RCE
- Command injection
ipfire · ipfireOct 28, 2025
CVE-2025-40040
22Monitor
mm/ksm: fix flag-dropping behavior in ksm_madvise
MediumCVSS 5.5Proof of conceptEPSS 0%
- Denial of service
linux · linux kernelOct 28, 2025
CVE-2025-56399
35Monitor
alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted fi
HighCVSS 8.8Proof of conceptEPSS 0%
- RCE
Oct 28, 2025
CVE-2025-60349
30Monitor
An issue was discovered in Prevx v3.0.5.220 allowing attackers to cause a denial of service via sending IOCTL code 0x22E044 to the pxscan.sy
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
Oct 28, 2025
CVE-2025-61155
22Monitor
The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an access control vulnerability in one of its IOCTL han
MediumCVSS 5.5Proof of conceptEPSS 0%
- Local privilege escalation
- Denial of service
Oct 28, 2025
CVE-2025-60800
30Monitor
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive informa
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
jishenghua · jsherpOct 28, 2025
CVE-2025-62368
40Plan
Taiga Authenticated Remote Code Execution
CriticalCVSS 9.0WeaponizedEPSS 1%
- RCE
- Deserialization
taigaio · taiga-backOct 28, 2025
CVE-2025-62727
30Monitor
Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
kludex · starletteOct 28, 2025
CVE-2025-64095
53Plan
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
CriticalCVSS 9.8Proof of conceptEPSS 46%
- Pre-auth
- File upload
- XSS
dnnsoftware · dotnetnukeOct 28, 2025
CVE-2025-60595
32Monitor
SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution.
HighCVSS 8.2Proof of conceptEPSS 0%
- pre-auth RCE
- Command injection
Oct 29, 2025
CVE-2025-61156
31Monitor
Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privileges and execute arb
HighCVSS 7.8Proof of conceptEPSS 0%
- RCE
- Local privilege escalation
- Broken access control (IDOR)
Oct 29, 2025
CVE-2025-11201
47Plan
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 26%
- pre-auth RCE
- Path traversal
lfprojects · mlflowOct 29, 2025
CVE-2025-11203
14Monitor
LiteLLM Information health API_KEY Information Disclosure Vulnerability
LowCVSS 3.5Proof of conceptEPSS 0%
- Info leak
litellm · litellmOct 29, 2025
CVE-2025-11627
26Monitor
Site Checkup AI Troubleshooting with Wizard and Tips for Each Issue <= 1.47 - Unauthenticated Log File Poisoning
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
sminozzi · site checkup debug ai troubleshooting with wizard and tips for each issueOct 30, 2025
CVE-2025-63298
32Monitor
A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/manage_website.php c
HighCVSS 8.2Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
mayurik · pet grooming management softwareOct 30, 2025
CVE-2025-62726
35Monitor
n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook
HighCVSS 8.8Proof of conceptEPSS 0%
- RCE
n8n · n8nOct 30, 2025
CVE-2025-52665
52Plan
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, t
CriticalCVSS 10.0Proof of conceptEPSS 41%
- Pre-auth
- Auth bypass
ui · unifi accessOct 31, 2025
CVE-2025-8489
60This week
King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalation
CriticalCVSS 9.8WeaponizedEPSS 9%
- Pre-auth
kingaddons · king addons for elementor – 4,000+ ready elementor sections, 650+ templates, 70+ free widgets for elementorOct 31, 2025
CVE-2025-10897
35Monitor
WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read
HighCVSS 8.6Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
jma plugins · woocommerce designer proOct 31, 2025
CVE-2025-60749
31Monitor
DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchup_webhelper.exe.
HighCVSS 7.8Proof of conceptEPSS 0%
Oct 31, 2025
CVE-2025-59501
20Monitor
Microsoft Configuration Manager Spoofing Vulnerability
MediumCVSS 4.8Proof of conceptEPSS 3%
- Auth bypass
microsoft · configuration manager 2403Oct 31, 2025