По дате публикации
Эксплуатируемые и новые серьёзные CVE: октябрь 2025 г.
195 записей · 10 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
31Наблюдать | CVE-2025-39913Proof of concept | tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.linux · linux kernel | Высокая7,8 | — | 0,1 % | 1 окт. 2025 г. |
52В плане | CVE-2025-61622Proof of concept | Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyforyapache · fory · CWE-502 | Критическая9,8 | — | 43,5 % | 1 окт. 2025 г. |
21Наблюдать | CVE-2025-56514Proof of concept | Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rsuisuijiang · fiora · CWE-79 | Средняя5,4 | — | 0,2 % | 1 окт. 2025 г. |
35Наблюдать | CVE-2025-56515Proof of concept | File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality.suisuijiang · fiora · CWE-79 | Высокая8,8 | — | 0,5 % | 1 окт. 2025 г. |
21Наблюдать | CVE-2025-57389Proof of concept | A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to exeCWE-79 | Средняя5,4 | — | 0,1 % | 1 окт. 2025 г. |
36Наблюдать | CVE-2025-61734Эксплойта нет | Apache Kylin: improper restriction of file readapache · kylin · CWE-552 | Высокая7,5 | — | 19,7 % | 2 окт. 2025 г. |
21Наблюдать | CVE-2025-56379Proof of concept | A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scrfrappe · erpnext · CWE-79 | Средняя5,4 | — | 0,4 % | 2 окт. 2025 г. |
26Наблюдать | CVE-2025-56380Proof of concept | Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_valuefrappe · erpnext · CWE-89 | Средняя6,5 | — | 0,3 % | 2 окт. 2025 г. |
26Наблюдать | CVE-2025-56381Proof of concept | ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint viafrappe · erpnext · CWE-89 | Средняя6,5 | — | 0,3 % | 2 окт. 2025 г. |
26Наблюдать | CVE-2025-56019Proof of concept | An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to coagasta · easy touch plus firmware · CWE-277 | Средняя6,5 | — | 0,3 % | 2 окт. 2025 г. |
34Наблюдать | CVE-2025-61666Proof of concept | Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config Filetraccar · traccar · CWE-22 | Высокая8,7 | — | 1,2 % | 2 окт. 2025 г. |
42В плане | CVE-2025-59536Proof of concept | Claude Code's startup trust dialog could lead to Command Execution attackanthropic · claude code · CWE-94 | Высокая8,7 | — | 27,2 % | 3 окт. 2025 г. |
29Наблюдать | CVE-2025-27237Proof of concept | DLL injection in Zabbix Agent and Agent 2 via OpenSSL configurationzabbix · zabbix · CWE-427 | Высокая7,3 | — | 0,3 % | 3 окт. 2025 г. |
40В плане | CVE-2025-9209Proof of concept | RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWTmagnigenie · restropress – online food ordering system · CWE-200 | Критическая9,8 | — | 2,3 % | 3 окт. 2025 г. |
39Наблюдать | CVE-2025-9286Proof of concept | Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_passwordhancock11 · appy pie connect for woocommerce · CWE-620 | Критическая9,8 | — | 0,4 % | 3 окт. 2025 г. |
25Наблюдать | CVE-2025-9876Proof of concept | Ird Slider <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scriptinginforrada · ird slider · CWE-79 | Средняя6,4 | — | 0,2 % | 3 окт. 2025 г. |
18Наблюдать | CVE-2025-55971Proof of concept | TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthentictcl · 65c655 firmware · CWE-918 | Средняя4,7 | — | 0,3 % | 3 окт. 2025 г. |
30Наблюдать | CVE-2025-55972Proof of concept | A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS) tcl · 65c655 firmware · CWE-400 | Высокая7,5 | — | 0,5 % | 3 окт. 2025 г. |
34Наблюдать | CVE-2025-60787Готовый эксплойт | MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name.motioneye project · motioneye · CWE-20 | Высокая7,2 | — | 18,4 % | 3 окт. 2025 г. |
36Наблюдать | CVE-2025-46817Proof of concept | Lua library commands may lead to integer overflow and potential RCEredis · redis · CWE-190 | Высокая8,8 | — | 3,8 % | 3 окт. 2025 г. |
29Наблюдать | CVE-2025-59489Proof of concept | Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code funity · editor · CWE-88 | Высокая7,4 | — | 0,6 % | 3 окт. 2025 г. |
29Наблюдать | CVE-2025-46818Proof of concept | Redis: Authenticated users can execute LUA scripts as a different userredis · redis · CWE-94 | Высокая7,3 | — | 0,7 % | 3 окт. 2025 г. |
28Наблюдать | CVE-2025-46819Proof of concept | Redis is vulnerable to DoS via specially crafted LUA scriptsredis · redis · CWE-190 | Высокая7,1 | — | 1,0 % | 3 окт. 2025 г. |
64На этой неделе | CVE-2025-49844Proof of concept | Redis Lua Use-After-Free may lead to remote code executionredis · redis · CWE-416 | Критическая9,9 | — | 82,2 % | 3 окт. 2025 г. |
28Наблюдать | CVE-2025-34226Proof of concept | OpenPLC Runtime v3 Persistent DoSautonomy logic · openplc runtime · CWE-20 | Высокая7,1 | — | 0,6 % | 3 окт. 2025 г. |
39Наблюдать | CVE-2025-59944Эксплойта нет | Cursor IDE: Sensitive File Overwrite Bypass is Possibleanysphere · cursor · CWE-178 | Критическая9,8 | — | 0,4 % | 3 окт. 2025 г. |
39Наблюдать | CVE-2025-9485Proof of concept | OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()cyberlord92 · oauth single sign on – sso (oauth client) · CWE-347 | Критическая9,8 | — | 0,5 % | 4 окт. 2025 г. |
25Наблюдать | CVE-2025-39946Proof of concept | tls: make sure to abort the stream if headers are boguslinux · linux kernel | Средняя5,5 | — | 9,5 % | 4 окт. 2025 г. |
17Наблюдать | CVE-2025-9886Proof of concept | Trinity Audio <= 5.20.2 - Cross-Site Request Forgerysergiotrinity · trinity audio – text to speech ai audio player to convert content into audio · CWE-352 | Средняя4,3 | — | 0,1 % | 4 окт. 2025 г. |
99Срочно | CVE-2025-61882Готовый эксплойт | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).oracle · concurrent processing · CWE-287 | Критическая9,8 | KEV | 99,7 % | 5 окт. 2025 г. |
28Наблюдать | CVE-2025-50538Эксплойта нет | Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.flowiseai · flowise · CWE-79 | Средняя6,1 | — | 14,0 % | 6 окт. 2025 г. |
13Наблюдать | CVE-2025-11331Эксплойта нет | IdeaCMS Website Name Config.php command injectionideacms · ideacms · CWE-74 | Низкая2,0 | — | 17,4 % | 6 окт. 2025 г. |
26Наблюдать | CVE-2025-61224Proof of concept | Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q paCWE-79 | Средняя6,5 | — | 1,4 % | 6 окт. 2025 г. |
38Наблюдать | CVE-2025-52472Proof of concept | XWiki Platform vulnerable to HQL injection via wiki and space search REST APIxwiki · xwiki-platform · CWE-89 | Критическая9,3 | — | 2,3 % | 6 окт. 2025 г. |
38Наблюдать | CVE-2025-61687Эксплойта нет | FlowiseAI/Flosise has File Upload vulnerabilityflowiseai · flowise · CWE-434 | Высокая8,8 | — | 10,9 % | 6 окт. 2025 г. |
25Наблюдать | CVE-2025-61765Proof of concept | python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deploymentsmiguelgrinberg · python-socketio · CWE-502 | Средняя6,4 | — | 0,4 % | 6 окт. 2025 г. |
36Наблюдать | CVE-2025-61777Proof of concept | FlagForge Allows Unauthenticated Badge Template API Accessflagforge · flagforge · CWE-200 | Критическая9,1 | — | 0,4 % | 6 окт. 2025 г. |
14Наблюдать | CVE-2025-61984Proof of concept | ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leadinopenbsd · openssh · CWE-159 | Низкая3,6 | — | 0,4 % | 6 окт. 2025 г. |
35Наблюдать | CVE-2025-10162Proof of concept | OrderConvo <= 15.1 - Unauthenticated Arbitrary File Readunknown · admin and customer messages after order for woocommerce: orderconvo · CWE-22 | Высокая8,6 | — | 4,4 % | 7 окт. 2025 г. |
31Наблюдать | CVE-2025-50505Proof of concept | Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key functCWE-250 | Высокая7,8 | — | 0,2 % | 7 окт. 2025 г. |
39Наблюдать | CVE-2025-52021Proof of concept | A SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0.CWE-89 | Критическая9,8 | — | 0,3 % | 7 окт. 2025 г. |
24Наблюдать | CVE-2025-56243Proof of concept | A Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the eventpuneethreddyhc · event management system · CWE-79 | Средняя6,1 | — | 0,2 % | 7 окт. 2025 г. |
40В плане | CVE-2025-44823Proof of concept | Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.phnagios · log server · CWE-497 | Высокая8,8 | — | 16,1 % | 7 окт. 2025 г. |
21Наблюдать | CVE-2025-11171Proof of concept | Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Functionays-pro · chartify – wordpress chart plugin · CWE-306 | Средняя5,3 | — | 0,4 % | 8 окт. 2025 г. |
24Наблюдать | CVE-2025-61183Proof of concept | Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of webreinvent · vaahcms · CWE-79 | Средняя6,1 | — | 0,2 % | 8 окт. 2025 г. |
37Наблюдать | CVE-2025-10351Proof of concept | SQL injection vulnerability in Melis Platformmelis technology · melis platform · CWE-89 | Критическая9,3 | — | 0,4 % | 8 окт. 2025 г. |
37Наблюдать | CVE-2025-10352Proof of concept | Missing Authorization vulnerability in Melis Platformmelis technology · melis platform · CWE-862 | Критическая9,3 | — | 0,3 % | 8 окт. 2025 г. |
38Наблюдать | CVE-2025-10353Proof of concept | Missing Authorization vulnerability in Melis Platformmelis technology · melis platform · CWE-43 | Критическая9,3 | — | 2,6 % | 8 окт. 2025 г. |
35Наблюдать | CVE-2025-57457Proof of concept | An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS CommandCWE-78 | Высокая8,8 | — | 0,9 % | 8 окт. 2025 г. |
43В плане | CVE-2025-61913Эксплойта нет | Flowise is vulnerable to arbitrary file read, arbitrary file writeflowiseai · flowise · CWE-22 | Критическая9,9 | — | 12,9 % | 8 окт. 2025 г. |
26Наблюдать | CVE-2025-10249Эксплойта нет | Slider Revolution <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Readrevolution slider · slider revolution · CWE-23 | Средняя6,5 | — | 0,3 % | 9 окт. 2025 г. |
22Наблюдать | CVE-2025-4615Proof of concept | PAN-OS: Improper Neutralization of Input in the Management Web Interfacepaloaltonetworks · pan-os · CWE-83 | Средняя5,5 | — | 0,7 % | 9 окт. 2025 г. |
29Наблюдать | CVE-2025-60375Proof of concept | The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validatCWE-289 | Высокая7,3 | — | 0,2 % | 9 окт. 2025 г. |
88Срочно | CVE-2025-11371Готовый эксплойт | Gladinet CentreStack and TrioFox Local File Inclusion Flawgladinet · centrestack · CWE-552 | Высокая7,5 | KEV | 92,1 % | 9 окт. 2025 г. |
42В плане | CVE-2025-61928Эксплойта нет | Better Auth: Unauthenticated API key creation through api-key pluginbetter-auth · better-auth · CWE-285 | Критическая9,3 | — | 17,9 % | 9 окт. 2025 г. |
8Наблюдать | CVE-2025-11554Proof of concept | Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissionsportabilis · i-educar · CWE-266 | Низкая2,1 | — | 0,3 % | 9 окт. 2025 г. |
22Наблюдать | CVE-2025-11555Proof of concept | Campcodes Online Learning Management System calendar_of_events.php sql injectioncampcodes · online learning management system · CWE-74 | Средняя5,5 | — | 0,4 % | 9 окт. 2025 г. |
21Наблюдать | CVE-2025-11449Proof of concept | Reflected Cross Site Scripting in ServiceNow AI Platformservicenow · servicenow ai platform · CWE-79 | Средняя5,3 | — | 0,3 % | 10 окт. 2025 г. |
26Наблюдать | CVE-2025-21065Proof of concept | Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands on their own devices.samsung mobile · retail mode · CWE-20 | Средняя6,6 | — | 0,1 % | 10 окт. 2025 г. |
20Наблюдать | CVE-2025-41088Proof of concept | Stored Cross-Site Scripting (XSS) in CMSxibo signage · xibo cms · CWE-79 | Средняя5,1 | — | 0,3 % | 10 окт. 2025 г. |
19Наблюдать | CVE-2025-41089Proof of concept | Reflected Cross-Site Scripting (XSS) in CMSxibo signage · xibo cms · CWE-79 | Средняя4,8 | — | 0,2 % | 10 окт. 2025 г. |
24Наблюдать | CVE-2025-61319Proof of concept | ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module.yogeshojha · rengine · CWE-79 | Средняя6,1 | — | 0,2 % | 10 окт. 2025 г. |
32Наблюдать | CVE-2025-60378Proof of concept | Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages.fairsketch · rise ultimate project manager · CWE-79 | Высокая8,1 | — | 1,0 % | 10 окт. 2025 г. |
26Наблюдать | CVE-2025-11579Proof of concept | DoS via Out Of Memory Crashnwaples · rardecode · CWE-789 | Средняя6,5 | — | 0,3 % | 10 окт. 2025 г. |
22Наблюдать | CVE-2025-11580Proof of concept | PowerJob list authorizationpowerjob · powerjob · CWE-862 | Средняя5,5 | — | 1,0 % | 10 окт. 2025 г. |
33Наблюдать | CVE-2025-60880Proof of concept | An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a webkul · bagisto · CWE-79 | Высокая8,3 | — | 0,4 % | 10 окт. 2025 г. |
26Наблюдать | CVE-2025-61505Proof of concept | e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script.e107 · e107 · CWE-502 | Средняя6,5 | — | 0,3 % | 10 окт. 2025 г. |
33Наблюдать | CVE-2025-55903Proof of concept | A HTML injection vulnerability exists in Perfex CRM v3.3.1.CWE-116 | Высокая8,3 | — | 0,3 % | 10 окт. 2025 г. |
23Наблюдать | CVE-2025-11380Proof of concept | Everest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposureeverestthemes · everest backup – wordpress cloud backup, migration, restore & cloning plugin · CWE-862 | Средняя5,9 | — | 0,4 % | 11 окт. 2025 г. |
21Наблюдать | CVE-2025-9196Proof of concept | Trinity Audio <= 5.21.0 - Unauthenticated Information Exposuresergiotrinity · trinity audio – text to speech ai audio player to convert content into audio · CWE-200 | Средняя5,3 | — | 1,0 % | 11 окт. 2025 г. |
26Наблюдать | CVE-2025-10175Proof of concept | WP Links Page <= 4.9.6 - Authenticated (Subscriber+) SQL Injectionrico-macchi · wp links page · CWE-89 | Средняя6,5 | — | 0,3 % | 11 окт. 2025 г. |
89Срочно | CVE-2025-61884Готовый эксплойт | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).oracle · configurator · CWE-22 | Высокая7,5 | KEV | 95,8 % | 12 окт. 2025 г. |
26Наблюдать | CVE-2025-10720Proof of concept | WP Private Content Plus <= 3.6.2 - Password Protection Bypassunknown · wp private content plus · CWE-639 | Средняя6,5 | — | 0,2 % | 13 окт. 2025 г. |
52В плане | CVE-2025-39964Готовый эксплойт | crypto: af_alg - Disallow concurrent writes in af_alg_sendmsglinux · linux kernel · CWE-362 | Средняя5,5 | KEV | 1,3 % | 13 окт. 2025 г. |
22Наблюдать | CVE-2025-39965Proof of concept | xfrm: xfrm_alloc_spi shouldn't use 0 as SPIlinux · linux kernel | Средняя5,5 | — | 0,1 % | 13 окт. 2025 г. |
40В плане | CVE-2025-9713Эксплойта нет | Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution.ivanti · endpoint manager · CWE-22 | Высокая8,8 | — | 15,3 % | 13 окт. 2025 г. |
37Наблюдать | CVE-2025-62360Proof of concept | WeGIA SQL Injection via 'id_dependente' param at endpoint `/html/funcionario/dependente_documento.php`wegia · wegia · CWE-89 | Критическая9,4 | — | 0,8 % | 13 окт. 2025 г. |
63На этой неделе | CVE-2025-24990Готовый эксплойт | Windows Agere Modem Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-822 | Высокая7,8 | KEV | 6,3 % | 14 окт. 2025 г. |
59В плане | CVE-2025-55315Proof of concept | ASP.NET Security Feature Bypass Vulnerabilitymicrosoft · asp.net core · CWE-444 | Критическая9,9 | — | 65,9 % | 14 окт. 2025 г. |
27Наблюдать | CVE-2025-55320Proof of concept | Configuration Manager Elevation of Privilege Vulnerabilitymicrosoft · configuration manager 2403 · CWE-89 | Средняя6,8 | — | 0,6 % | 14 окт. 2025 г. |
30Наблюдать | CVE-2025-58726Proof of concept | Windows SMB Server Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-284 | Высокая7,5 | — | 1,0 % | 14 окт. 2025 г. |
29Наблюдать | CVE-2025-59194Proof of concept | Windows Kernel Elevation of Privilege Vulnerabilitymicrosoft · windows 11 22h2 · CWE-908 | Высокая7,0 | — | 2,6 % | 14 окт. 2025 г. |
35Наблюдать | CVE-2025-59213Proof of concept | Configuration Manager Elevation of Privilege Vulnerabilitymicrosoft · configuration manager 2403 · CWE-89 | Высокая8,8 | — | 0,3 % | 14 окт. 2025 г. |
62На этой неделе | CVE-2025-59230Готовый эксплойт | Windows Remote Access Connection Manager Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-284 | Высокая7,8 | KEV | 2,6 % | 14 окт. 2025 г. |
31Наблюдать | CVE-2025-59254Proof of concept | Microsoft DWM Core Library Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 | Высокая7,8 | — | 1,1 % | 14 окт. 2025 г. |
22Наблюдать | CVE-2025-59284Proof of concept | Windows NTLM Spoofing Vulnerabilitymicrosoft · windows 11 22h2 · CWE-200 | Средняя5,5 | — | 1,0 % | 14 окт. 2025 г. |
99Срочно | CVE-2025-59287Готовый эксплойт | Windows Server Update Service (WSUS) Remote Code Execution Vulnerabilitymicrosoft · windows server 2012 · CWE-502 | Критическая9,8 | KEV | 99,9 % | 14 окт. 2025 г. |
23Наблюдать | CVE-2025-22831Эксплойта нет | Buffer Overflow in NTFS when parsing the VOLUME_NAMEami · aptio v · CWE-787 | Средняя5,9 | — | 0,1 % | 14 окт. 2025 г. |
34Наблюдать | CVE-2025-10242Эксплойта нет | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attackeivanti · endpoint manager mobile · CWE-78 | Высокая7,2 | — | 20,3 % | 14 окт. 2025 г. |
34Наблюдать | CVE-2025-10243Эксплойта нет | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attackeivanti · endpoint manager mobile · CWE-78 | Высокая7,2 | — | 20,3 % | 14 окт. 2025 г. |
34Наблюдать | CVE-2025-10985Эксплойта нет | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attackeivanti · endpoint manager mobile · CWE-78 | Высокая7,2 | — | 20,3 % | 14 окт. 2025 г. |
32Наблюдать | CVE-2025-5946Готовый эксплойт | RCE via the poller reload feature available only to user with high privilegecentreon · centreon web · CWE-78 | Высокая7,2 | — | 13,5 % | 14 окт. 2025 г. |
24Наблюдать | CVE-2025-60374Proof of concept | Stored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript.CWE-79 | Средняя6,1 | — | 0,3 % | 14 окт. 2025 г. |
46В плане | CVE-2025-61675Готовый эксплойт | FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parametersfreepbx · endpoint · CWE-89 | Высокая8,6 | — | 38,4 % | 14 окт. 2025 г. |
47В плане | CVE-2025-61678Готовый эксплойт | FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameterfreepbx · endpointman · CWE-434 | Высокая8,6 | — | 43,6 % | 14 окт. 2025 г. |
27Наблюдать | CVE-2025-31702Proof of concept | A vulnerability exists in certain Dahua embedded products.dahua · ipc · CWE-732 | Средняя6,8 | — | 0,4 % | 15 окт. 2025 г. |
39Наблюдать | CVE-2025-9967Proof of concept | Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeovergsayed786 · orion sms otp verification. · CWE-288 | Критическая9,8 | — | 0,4 % | 15 окт. 2025 г. |
39Наблюдать | CVE-2025-10041Proof of concept | Flex QR Code Generator <= 1.2.5 - Unauthenticated Arbitrary File Uploadajitdas · flex qr code generator · CWE-434 | Критическая9,8 | — | 0,9 % | 15 окт. 2025 г. |
39Наблюдать | CVE-2025-10294Proof of concept | OwnID Passwordless Login <= 1.3.4 - Authentication Bypassvictornavarro · ownid passwordless login · CWE-288 | Критическая9,8 | — | 0,7 % | 15 окт. 2025 г. |
30Наблюдать | CVE-2025-11177Proof of concept | External Login <= 1.11.2 - Unauthenticated SQL Injection via logtbenyon · external login · CWE-89 | Высокая7,5 | — | 0,3 % | 15 окт. 2025 г. |
- CVE-2025-3991331Наблюдать
tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %linux · linux kernel1 окт. 2025 г.
- CVE-2025-6162252В плане
Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory
КритическаяCVSS 9,8Proof of conceptEPSS 43 %apache · fory1 окт. 2025 г.
- CVE-2025-5651421Наблюдать
Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are r
СредняяCVSS 5,4Proof of conceptEPSS 0 %suisuijiang · fiora1 окт. 2025 г.
- CVE-2025-5651535Наблюдать
File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality.
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %suisuijiang · fiora1 окт. 2025 г.
- CVE-2025-5738921Наблюдать
A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to exe
СредняяCVSS 5,4Proof of conceptEPSS 0 %1 окт. 2025 г.
- CVE-2025-6173436Наблюдать
Apache Kylin: improper restriction of file read
ВысокаяCVSS 7,5Эксплойта нетEPSS 19 %apache · kylin2 окт. 2025 г.
- CVE-2025-5637921Наблюдать
A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scr
СредняяCVSS 5,4Proof of conceptEPSS 0 %frappe · erpnext2 окт. 2025 г.
- CVE-2025-5638026Наблюдать
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value
СредняяCVSS 6,5Proof of conceptEPSS 0 %frappe · erpnext2 окт. 2025 г.
- CVE-2025-5638126Наблюдать
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via
СредняяCVSS 6,5Proof of conceptEPSS 0 %frappe · erpnext2 окт. 2025 г.
- CVE-2025-5601926Наблюдать
An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to co
СредняяCVSS 6,5Proof of conceptEPSS 0 %agasta · easy touch plus firmware2 окт. 2025 г.
- CVE-2025-6166634Наблюдать
Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File
ВысокаяCVSS 8,7Proof of conceptEPSS 1 %traccar · traccar2 окт. 2025 г.
- CVE-2025-5953642В плане
Claude Code's startup trust dialog could lead to Command Execution attack
ВысокаяCVSS 8,7Proof of conceptEPSS 27 %anthropic · claude code3 окт. 2025 г.
- CVE-2025-2723729Наблюдать
DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %zabbix · zabbix3 окт. 2025 г.
- CVE-2025-920940В плане
RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT
КритическаяCVSS 9,8Proof of conceptEPSS 2 %magnigenie · restropress – online food ordering system3 окт. 2025 г.
- CVE-2025-928639Наблюдать
Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password
КритическаяCVSS 9,8Proof of conceptEPSS 0 %hancock11 · appy pie connect for woocommerce3 окт. 2025 г.
- CVE-2025-987625Наблюдать
Ird Slider <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
СредняяCVSS 6,4Proof of conceptEPSS 0 %inforrada · ird slider3 окт. 2025 г.
- CVE-2025-5597118Наблюдать
TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthentic
СредняяCVSS 4,7Proof of conceptEPSS 0 %tcl · 65c655 firmware3 окт. 2025 г.
- CVE-2025-5597230Наблюдать
A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS)
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %tcl · 65c655 firmware3 окт. 2025 г.
- CVE-2025-6078734Наблюдать
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name.
ВысокаяCVSS 7,2Готовый эксплойтEPSS 18 %motioneye project · motioneye3 окт. 2025 г.
- CVE-2025-4681736Наблюдать
Lua library commands may lead to integer overflow and potential RCE
ВысокаяCVSS 8,8Proof of conceptEPSS 3 %redis · redis3 окт. 2025 г.
- CVE-2025-5948929Наблюдать
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code f
ВысокаяCVSS 7,4Proof of conceptEPSS 0 %unity · editor3 окт. 2025 г.
- CVE-2025-4681829Наблюдать
Redis: Authenticated users can execute LUA scripts as a different user
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %redis · redis3 окт. 2025 г.
- CVE-2025-4681928Наблюдать
Redis is vulnerable to DoS via specially crafted LUA scripts
ВысокаяCVSS 7,1Proof of conceptEPSS 1 %redis · redis3 окт. 2025 г.
- CVE-2025-4984464На этой неделе
Redis Lua Use-After-Free may lead to remote code execution
КритическаяCVSS 9,9Proof of conceptEPSS 82 %redis · redis3 окт. 2025 г.
- CVE-2025-3422628Наблюдать
OpenPLC Runtime v3 Persistent DoS
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %autonomy logic · openplc runtime3 окт. 2025 г.
- CVE-2025-5994439Наблюдать
Cursor IDE: Sensitive File Overwrite Bypass is Possible
КритическаяCVSS 9,8Эксплойта нетEPSS 0 %anysphere · cursor3 окт. 2025 г.
- CVE-2025-948539Наблюдать
OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()
КритическаяCVSS 9,8Proof of conceptEPSS 0 %cyberlord92 · oauth single sign on – sso (oauth client)4 окт. 2025 г.
- CVE-2025-3994625Наблюдать
tls: make sure to abort the stream if headers are bogus
СредняяCVSS 5,5Proof of conceptEPSS 9 %linux · linux kernel4 окт. 2025 г.
- CVE-2025-988617Наблюдать
Trinity Audio <= 5.20.2 - Cross-Site Request Forgery
СредняяCVSS 4,3Proof of conceptEPSS 0 %sergiotrinity · trinity audio – text to speech ai audio player to convert content into audio4 окт. 2025 г.
- CVE-2025-6188299Срочно
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %oracle · concurrent processing5 окт. 2025 г.
- CVE-2025-5053828Наблюдать
Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.
СредняяCVSS 6,1Эксплойта нетEPSS 14 %flowiseai · flowise6 окт. 2025 г.
- CVE-2025-1133113Наблюдать
IdeaCMS Website Name Config.php command injection
НизкаяCVSS 2,0Эксплойта нетEPSS 17 %ideacms · ideacms6 окт. 2025 г.
- CVE-2025-6122426Наблюдать
Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q pa
СредняяCVSS 6,5Proof of conceptEPSS 1 %6 окт. 2025 г.
- CVE-2025-5247238Наблюдать
XWiki Platform vulnerable to HQL injection via wiki and space search REST API
КритическаяCVSS 9,3Proof of conceptEPSS 2 %xwiki · xwiki-platform6 окт. 2025 г.
- CVE-2025-6168738Наблюдать
FlowiseAI/Flosise has File Upload vulnerability
ВысокаяCVSS 8,8Эксплойта нетEPSS 10 %flowiseai · flowise6 окт. 2025 г.
- CVE-2025-6176525Наблюдать
python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments
СредняяCVSS 6,4Proof of conceptEPSS 0 %miguelgrinberg · python-socketio6 окт. 2025 г.
- CVE-2025-6177736Наблюдать
FlagForge Allows Unauthenticated Badge Template API Access
КритическаяCVSS 9,1Proof of conceptEPSS 0 %flagforge · flagforge6 окт. 2025 г.
- CVE-2025-6198414Наблюдать
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leadin
НизкаяCVSS 3,6Proof of conceptEPSS 0 %openbsd · openssh6 окт. 2025 г.
- CVE-2025-1016235Наблюдать
OrderConvo <= 15.1 - Unauthenticated Arbitrary File Read
ВысокаяCVSS 8,6Proof of conceptEPSS 4 %unknown · admin and customer messages after order for woocommerce: orderconvo7 окт. 2025 г.
- CVE-2025-5050531Наблюдать
Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key funct
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %7 окт. 2025 г.
- CVE-2025-5202139Наблюдать
A SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0.
КритическаяCVSS 9,8Proof of conceptEPSS 0 %7 окт. 2025 г.
- CVE-2025-5624324Наблюдать
A Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the event
СредняяCVSS 6,1Proof of conceptEPSS 0 %puneethreddyhc · event management system7 окт. 2025 г.
- CVE-2025-4482340В плане
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.ph
ВысокаяCVSS 8,8Proof of conceptEPSS 16 %nagios · log server7 окт. 2025 г.
- CVE-2025-1117121Наблюдать
Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function
СредняяCVSS 5,3Proof of conceptEPSS 0 %ays-pro · chartify – wordpress chart plugin8 окт. 2025 г.
- CVE-2025-6118324Наблюдать
Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of
СредняяCVSS 6,1Proof of conceptEPSS 0 %webreinvent · vaahcms8 окт. 2025 г.
- CVE-2025-1035137Наблюдать
SQL injection vulnerability in Melis Platform
КритическаяCVSS 9,3Proof of conceptEPSS 0 %melis technology · melis platform8 окт. 2025 г.
- CVE-2025-1035237Наблюдать
Missing Authorization vulnerability in Melis Platform
КритическаяCVSS 9,3Proof of conceptEPSS 0 %melis technology · melis platform8 окт. 2025 г.
- CVE-2025-1035338Наблюдать
Missing Authorization vulnerability in Melis Platform
КритическаяCVSS 9,3Proof of conceptEPSS 2 %melis technology · melis platform8 окт. 2025 г.
- CVE-2025-5745735Наблюдать
An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Command
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %8 окт. 2025 г.
- CVE-2025-6191343В плане
Flowise is vulnerable to arbitrary file read, arbitrary file write
КритическаяCVSS 9,9Эксплойта нетEPSS 12 %flowiseai · flowise8 окт. 2025 г.
- CVE-2025-1024926Наблюдать
Slider Revolution <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read
СредняяCVSS 6,5Эксплойта нетEPSS 0 %revolution slider · slider revolution9 окт. 2025 г.
- CVE-2025-461522Наблюдать
PAN-OS: Improper Neutralization of Input in the Management Web Interface
СредняяCVSS 5,5Proof of conceptEPSS 0 %paloaltonetworks · pan-os9 окт. 2025 г.
- CVE-2025-6037529Наблюдать
The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validat
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %9 окт. 2025 г.
- CVE-2025-1137188Срочно
Gladinet CentreStack and TrioFox Local File Inclusion Flaw
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 92 %gladinet · centrestack9 окт. 2025 г.
- CVE-2025-6192842В плане
Better Auth: Unauthenticated API key creation through api-key plugin
КритическаяCVSS 9,3Эксплойта нетEPSS 17 %better-auth · better-auth9 окт. 2025 г.
- CVE-2025-115548Наблюдать
Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissions
НизкаяCVSS 2,1Proof of conceptEPSS 0 %portabilis · i-educar9 окт. 2025 г.
- CVE-2025-1155522Наблюдать
Campcodes Online Learning Management System calendar_of_events.php sql injection
СредняяCVSS 5,5Proof of conceptEPSS 0 %campcodes · online learning management system9 окт. 2025 г.
- CVE-2025-1144921Наблюдать
Reflected Cross Site Scripting in ServiceNow AI Platform
СредняяCVSS 5,3Proof of conceptEPSS 0 %servicenow · servicenow ai platform10 окт. 2025 г.
- CVE-2025-2106526Наблюдать
Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands on their own devices.
СредняяCVSS 6,6Proof of conceptEPSS 0 %samsung mobile · retail mode10 окт. 2025 г.
- CVE-2025-4108820Наблюдать
Stored Cross-Site Scripting (XSS) in CMS
СредняяCVSS 5,1Proof of conceptEPSS 0 %xibo signage · xibo cms10 окт. 2025 г.
- CVE-2025-4108919Наблюдать
Reflected Cross-Site Scripting (XSS) in CMS
СредняяCVSS 4,8Proof of conceptEPSS 0 %xibo signage · xibo cms10 окт. 2025 г.
- CVE-2025-6131924Наблюдать
ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module.
СредняяCVSS 6,1Proof of conceptEPSS 0 %yogeshojha · rengine10 окт. 2025 г.
- CVE-2025-6037832Наблюдать
Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages.
ВысокаяCVSS 8,1Proof of conceptEPSS 1 %fairsketch · rise ultimate project manager10 окт. 2025 г.
- CVE-2025-1157926Наблюдать
DoS via Out Of Memory Crash
СредняяCVSS 6,5Proof of conceptEPSS 0 %nwaples · rardecode10 окт. 2025 г.
- CVE-2025-1158022Наблюдать
PowerJob list authorization
СредняяCVSS 5,5Proof of conceptEPSS 1 %powerjob · powerjob10 окт. 2025 г.
- CVE-2025-6088033Наблюдать
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a
ВысокаяCVSS 8,3Proof of conceptEPSS 0 %webkul · bagisto10 окт. 2025 г.
- CVE-2025-6150526Наблюдать
e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script.
СредняяCVSS 6,5Proof of conceptEPSS 0 %e107 · e10710 окт. 2025 г.
- CVE-2025-5590333Наблюдать
A HTML injection vulnerability exists in Perfex CRM v3.3.1.
ВысокаяCVSS 8,3Proof of conceptEPSS 0 %10 окт. 2025 г.
- CVE-2025-1138023Наблюдать
Everest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure
СредняяCVSS 5,9Proof of conceptEPSS 0 %everestthemes · everest backup – wordpress cloud backup, migration, restore & cloning plugin11 окт. 2025 г.
- CVE-2025-919621Наблюдать
Trinity Audio <= 5.21.0 - Unauthenticated Information Exposure
СредняяCVSS 5,3Proof of conceptEPSS 1 %sergiotrinity · trinity audio – text to speech ai audio player to convert content into audio11 окт. 2025 г.
- CVE-2025-1017526Наблюдать
WP Links Page <= 4.9.6 - Authenticated (Subscriber+) SQL Injection
СредняяCVSS 6,5Proof of conceptEPSS 0 %rico-macchi · wp links page11 окт. 2025 г.
- CVE-2025-6188489Срочно
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 95 %oracle · configurator12 окт. 2025 г.
- CVE-2025-1072026Наблюдать
WP Private Content Plus <= 3.6.2 - Password Protection Bypass
СредняяCVSS 6,5Proof of conceptEPSS 0 %unknown · wp private content plus13 окт. 2025 г.
- CVE-2025-3996452В плане
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
СредняяCVSS 5,5KEVГотовый эксплойтEPSS 1 %linux · linux kernel13 окт. 2025 г.
- CVE-2025-3996522Наблюдать
xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
СредняяCVSS 5,5Proof of conceptEPSS 0 %linux · linux kernel13 окт. 2025 г.
- CVE-2025-971340В плане
Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution.
ВысокаяCVSS 8,8Эксплойта нетEPSS 15 %ivanti · endpoint manager13 окт. 2025 г.
- CVE-2025-6236037Наблюдать
WeGIA SQL Injection via 'id_dependente' param at endpoint `/html/funcionario/dependente_documento.php`
КритическаяCVSS 9,4Proof of conceptEPSS 0 %wegia · wegia13 окт. 2025 г.
- CVE-2025-2499063На этой неделе
Windows Agere Modem Driver Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 6 %microsoft · windows 10 150714 окт. 2025 г.
- CVE-2025-5531559В плане
ASP.NET Security Feature Bypass Vulnerability
КритическаяCVSS 9,9Proof of conceptEPSS 65 %microsoft · asp.net core14 окт. 2025 г.
- CVE-2025-5532027Наблюдать
Configuration Manager Elevation of Privilege Vulnerability
СредняяCVSS 6,8Proof of conceptEPSS 0 %microsoft · configuration manager 240314 окт. 2025 г.
- CVE-2025-5872630Наблюдать
Windows SMB Server Elevation of Privilege Vulnerability
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %microsoft · windows 10 150714 окт. 2025 г.
- CVE-2025-5919429Наблюдать
Windows Kernel Elevation of Privilege Vulnerability
ВысокаяCVSS 7,0Proof of conceptEPSS 2 %microsoft · windows 11 22h214 окт. 2025 г.
- CVE-2025-5921335Наблюдать
Configuration Manager Elevation of Privilege Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %microsoft · configuration manager 240314 окт. 2025 г.
- CVE-2025-5923062На этой неделе
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 2 %microsoft · windows 10 150714 окт. 2025 г.
- CVE-2025-5925431Наблюдать
Microsoft DWM Core Library Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 1 %microsoft · windows 10 150714 окт. 2025 г.
- CVE-2025-5928422Наблюдать
Windows NTLM Spoofing Vulnerability
СредняяCVSS 5,5Proof of conceptEPSS 1 %microsoft · windows 11 22h214 окт. 2025 г.
- CVE-2025-5928799Срочно
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %microsoft · windows server 201214 окт. 2025 г.
- CVE-2025-2283123Наблюдать
Buffer Overflow in NTFS when parsing the VOLUME_NAME
СредняяCVSS 5,9Эксплойта нетEPSS 0 %ami · aptio v14 окт. 2025 г.
- CVE-2025-1024234Наблюдать
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke
ВысокаяCVSS 7,2Эксплойта нетEPSS 20 %ivanti · endpoint manager mobile14 окт. 2025 г.
- CVE-2025-1024334Наблюдать
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke
ВысокаяCVSS 7,2Эксплойта нетEPSS 20 %ivanti · endpoint manager mobile14 окт. 2025 г.
- CVE-2025-1098534Наблюдать
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke
ВысокаяCVSS 7,2Эксплойта нетEPSS 20 %ivanti · endpoint manager mobile14 окт. 2025 г.
- CVE-2025-594632Наблюдать
RCE via the poller reload feature available only to user with high privilege
ВысокаяCVSS 7,2Готовый эксплойтEPSS 13 %centreon · centreon web14 окт. 2025 г.
- CVE-2025-6037424Наблюдать
Stored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript.
СредняяCVSS 6,1Proof of conceptEPSS 0 %14 окт. 2025 г.
- CVE-2025-6167546В плане
FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters
ВысокаяCVSS 8,6Готовый эксплойтEPSS 38 %freepbx · endpoint14 окт. 2025 г.
- CVE-2025-6167847В плане
FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter
ВысокаяCVSS 8,6Готовый эксплойтEPSS 43 %freepbx · endpointman14 окт. 2025 г.
- CVE-2025-3170227Наблюдать
A vulnerability exists in certain Dahua embedded products.
СредняяCVSS 6,8Proof of conceptEPSS 0 %dahua · ipc15 окт. 2025 г.
- CVE-2025-996739Наблюдать
Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeover
КритическаяCVSS 9,8Proof of conceptEPSS 0 %gsayed786 · orion sms otp verification.15 окт. 2025 г.
- CVE-2025-1004139Наблюдать
Flex QR Code Generator <= 1.2.5 - Unauthenticated Arbitrary File Upload
КритическаяCVSS 9,8Proof of conceptEPSS 0 %ajitdas · flex qr code generator15 окт. 2025 г.
- CVE-2025-1029439Наблюдать
OwnID Passwordless Login <= 1.3.4 - Authentication Bypass
КритическаяCVSS 9,8Proof of conceptEPSS 0 %victornavarro · ownid passwordless login15 окт. 2025 г.
- CVE-2025-1117730Наблюдать
External Login <= 1.11.2 - Unauthenticated SQL Injection via log
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %tbenyon · external login15 окт. 2025 г.