Total
310690 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-30755 | 1 Oracle | 1 Opengrok | 2025-09-19 | 6.1 Medium |
| OpenGrok 1.14.1 has a reflected Cross-Site Scripting (XSS) issue when producing the cross reference page. This happens through improper handling of the revision parameter. The application reflects unsanitized user input into the HTML output. | ||||
| CVE-2025-59712 | 1 Snipeitapp | 1 Snipe-it | 2025-09-19 | 6.4 Medium |
| Snipe-IT before 8.1.18 allows XSS. | ||||
| CVE-2025-10690 | 2 Bearsthemes, Wordpress | 2 Goza Nonprofit Charity Wordpress Theme, Wordpress | 2025-09-19 | 9.8 Critical |
| The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution. | ||||
| CVE-2025-59715 | 1 Smseagle | 1 Smseagle | 2025-09-19 | 4.8 Medium |
| SMSEagle before 6.11 allows reflected XSS via a username or contact phone number. | ||||
| CVE-2025-59714 | 1 Internet2 | 1 Grouper | 2025-09-19 | 6.5 Medium |
| In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs. | ||||
| CVE-2025-6198 | 1 Supermicro | 1 Mbd-x13sem-f | 2025-09-19 | 6.4 Medium |
| There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image. | ||||
| CVE-2025-7937 | 1 Supermicro | 1 Mbd-x12stw | 2025-09-19 | 6.6 Medium |
| There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW . An attacker can update the system firmware with a specially crafted image. | ||||
| CVE-2025-47698 | 1 Cognex | 1 In-sight Explorer | 2025-09-19 | N/A |
| An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credentials. These credentials are present during the firmware upgrade procedure. | ||||
| CVE-2025-59713 | 1 Snipeitapp | 1 Snipe-it | 2025-09-19 | 6.8 Medium |
| Snipe-IT before 8.1.18 allows unsafe deserialization. | ||||
| CVE-2025-5955 | 2 Aonetheme, Wordpress | 2 Service Finder Sms System, Wordpress | 2025-09-19 | 8.1 High |
| The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugin not verifying a user's phone number before logging them in. This makes it possible for unauthenticated attackers to login as arbitrary users. | ||||
| CVE-2025-8487 | 2 Extendthemes, Wordpress | 2 Kubio Ai Page Builder, Wordpress | 2025-09-19 | 5.4 Medium |
| The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-install-plugin AJAX action in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the Image Hub plugin. | ||||
| CVE-2025-2404 | 1 Ubit | 1 Stoys | 2025-09-19 | 4.3 Medium |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ubit Information Technologies STOYS allows Cross-Site Scripting (XSS).This issue affects STOYS: from 2 before 20250916. | ||||
| CVE-2024-9137 | 1 Moxa | 7 Edf-g1002-bp, Edr-8010, Edr-g9004 and 4 more | 2025-09-19 | 9.4 Critical |
| The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise. | ||||
| CVE-2025-7403 | 2025-09-19 | 7.6 High | ||
| Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption. | ||||
| CVE-2025-10458 | 2025-09-19 | 7.6 High | ||
| Parameters are not validated or sanitized, and are later used in various internal operations. | ||||
| CVE-2025-10457 | 2025-09-19 | 4.3 Medium | ||
| The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching. | ||||
| CVE-2025-0624 | 1 Redhat | 7 Enterprise Linux, Openshift, Rhel Aus and 4 more | 2025-09-19 | 7.6 High |
| A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write. If correctly exploited, this issue may result in remote code execution through the same network segment grub is searching for the boot information, which can be used to by-pass secure boot protections. | ||||
| CVE-2025-23016 | 1 Fastcgi | 1 Fcgi | 2025-09-19 | 9.3 Critical |
| FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c. | ||||
| CVE-2023-27349 | 2 Bluez, Redhat | 2 Bluez, Enterprise Linux | 2025-09-19 | 8.0 High |
| BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908. | ||||
| CVE-2025-23337 | 1 Nvidia | 6 Dgx, Dgx Gb200, Hgc and 3 more | 2025-09-19 | 6.7 Medium |
| NVIDIA HGX & DGX GB200, GB300, B300 contain a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administrative access on the BMC to access the HMC as an administrator. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. | ||||