| CVE-2025-10345 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'name' and 'address' at the endpoint 'admin/leads/lead'. | medium | 2026-10-19 |
| CVE-2025-10344 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'name' and 'clientid' at the endpoint '/projects/project/x'. | medium | 2026-10-19 |
| CVE-2025-10343 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'expense_name' at the endpoint '/expenses/expense'. | medium | 2026-10-19 |
| CVE-2025-10342 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'name' at the endpoint '/subscriptions/create'. | medium | 2026-10-19 |
| CVE-2025-10341 | HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'company' at the endpoint '/clients/client/x. | medium | 2026-10-19 |
| CVE-2025-10319 | A security flaw has been discovered in JeecgBoot up to 3.8.2. Affected by this issue is some unknown functionality of the file /sys/tenant/exportLog of the component Tenant Log Export. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. | medium | 2026-10-19 |
| CVE-2025-10318 | A vulnerability was identified in JeecgBoot up to 3.8.2. Affected by this vulnerability is an unknown functionality of the file /api/system/sendWebSocketMsg of the component WebSocket Message Handler. The manipulation of the argument userIds leads to improper authorization. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | medium | 2026-10-19 |
| CVE-2025-10253 | A vulnerability has been found in openDCIM 23.04. This vulnerability affects unknown code of the file /scripts/uploadifive.php of the component SVG File Handler. Such manipulation of the argument Filedata leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | medium | 2026-10-19 |
| CVE-2025-10251 | A vulnerability was detected in FoxCMS up to 1.24. Affected by this issue is the function batchCope of the file /app/admin/controller/Images.php. The manipulation of the argument ids results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | medium | 2026-10-19 |
| CVE-2025-10249 | The Slider Revolution plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions in all versions up to, and including, 6.7.37. This makes it possible for authenticated attackers, with Contributor-level access and above, to install and activate plugin add-ons, create sliders, and download arbitrary files. | medium | 2026-10-19 |
| CVE-2025-10247 | A security vulnerability has been detected in JEPaaS 7.2.8. This vulnerability affects the function doFilterInternal of the component Filter Handler. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | medium | 2026-10-19 |
| CVE-2025-10235 | A flaw has been found in Scada-LTS up to 2.7.8.1. This issue affects some unknown processing of the file /reports.shtm of the component Reports Module. This manipulation of the argument Colour causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | medium | 2026-10-19 |
| CVE-2025-10234 | A vulnerability was detected in Scada-LTS up to 2.7.8.1. This vulnerability affects unknown code of the file /data_point_edit.shtm of the component Data Point Edit Module. The manipulation of the argument Text Renderer properties results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | medium | 2026-10-19 |
| CVE-2025-10213 | DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a dxtn.dll file of their choice in the 'C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\' directory, which could lead to arbitrary code execution and persistence. | high | 2026-10-19 |
| CVE-2025-10195 | A vulnerability has been found in Seismic App 2.4.2 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component com.seismic.doccenter. Such manipulation leads to improper export of android application components. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | medium | 2026-10-19 |
| CVE-2025-10158 | A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue. | medium | 2026-10-19 |
| CVE-2025-10149 | The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations. A malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity. | high | 2026-10-19 |
| CVE-2025-10148 | curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy. | medium | 2026-10-19 |
| CVE-2025-10141 | The Digiseller plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ds' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | medium | 2026-10-19 |
| CVE-2025-10122 | A vulnerability was found in Maccms10 2025.1000.4050. Affected is the function rep of the file application/admin/controller/Database.php. Performing manipulation of the argument where results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. | medium | 2026-10-19 |
| CVE-2025-10121 | A flaw has been found in uverif up to 3.2. This affects the function addbatch of the file /admin/kami_list. This manipulation of the argument note causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. | medium | 2026-10-19 |
| CVE-2025-10117 | A weakness has been identified in SourceCodester Simple To-Do List System 1.0. Impacted is an unknown function of the file /fetch_tasks.php of the component Add New Task. Executing manipulation with the input <script>alert('XSS')</script> can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. | medium | 2026-10-19 |
| CVE-2025-10116 | A vulnerability was identified in SiempreCMS up to 1.3.6. This vulnerability affects unknown code of the file /docs/admin/file_upload.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. | medium | 2026-10-19 |
| CVE-2025-10115 | A vulnerability was determined in SiempreCMS up to 1.3.6. This affects an unknown part of the file user_search_ajax.php. This manipulation of the argument name/userName causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. | medium | 2026-10-19 |
| CVE-2025-10110 | A vulnerability was identified in ChanCMS up to 3.3.1. Impacted is an unknown function of the file /search/. The manipulation with the input '%20or%201=1%20%23/words.html leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. | medium | 2026-10-19 |
| CVE-2025-10094 | An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to disrupt access to token listings and related administrative operations by creating tokens with excessively large names. | medium | 2026-10-19 |
| CVE-2025-10021 | A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static object `COdaMfcAppApp theApp` may access `OdString::kEmpty` before its initialization. Due to undefined initialization order of static objects across translation units (Static Initialization Order Fiasco), the application accesses uninitialized memory. This results in application crash on startup, causing denial of service. Due to undefined behavior, memory corruption and potential arbitrary code execution cannot be ruled out in specific exploitation scenarios. | high | 2026-10-19 |
| CVE-2025-10016 | The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege escalation to root privileges. It is worth noting that it is possible to spawn Autopudate manually via Installer XPC service. However this requires the victim to enter credentials upon system authorization dialog creation that can be modified by the attacker. This issue was fixed in version 2.7.2 | high | 2026-10-19 |
| CVE-2025-10015 | The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. Lack of validation of connecting client allows the attacker to copy TCC-protected files to an arbitrary location. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in version 2.7.2 | medium | 2026-10-19 |
| CVE-2025-10004 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs. | high | 2026-10-19 |
| CVE-2025-0421 | Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay. This issue affects Shopside: through 05022025. | medium | 2026-10-19 |
| CVE-2024-58398 | Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing. | medium | 2026-10-19 |
| CVE-2024-54657 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54656 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54655 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54654 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54653 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54652 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54651 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54650 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54649 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54648 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54647 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54646 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54645 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54644 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54643 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54642 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54641 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
| CVE-2024-54640 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | No Score | 2026-10-19 |
