Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-65540 | medium | 6.1 | No | Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields su... | 2026-11-04 |
| CVE-2025-12183 | not reported | — | No | Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent me... | 2026-11-04 |
| CVE-2025-51736 | medium | 6.3 | No | File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0. | 2026-11-04 |
| CVE-2025-51733 | medium | 5.5 | No | Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0. | 2026-11-04 |
| CVE-2025-65202 | high | 8.0 | No | TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP... | 2026-11-04 |
| CVE-2025-65670 | medium | 4.3 | No | An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating... | 2026-11-04 |
| CVE-2025-65278 | high | 7.5 | No | An issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing unauthenticated attackers to gain sensitive i... | 2026-11-04 |
| CVE-2025-65276 | critical | 9.8 | No | An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0... | 2026-11-04 |
| CVE-2025-50433 | critical | 9.8 | No | An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to tak... | 2026-11-04 |
| CVE-2025-65681 | low | 3.3 | No | An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to se... | 2026-11-04 |
| CVE-2025-65676 | medium | 5.4 | No | Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via craft... | 2026-11-04 |
| CVE-2025-65672 | high | 7.5 | No | Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings. | 2026-11-04 |
| CVE-2025-65669 | critical | 9.1 | No | An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization o... | 2026-11-04 |
| CVE-2025-26155 | critical | 9.8 | No | NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability. | 2026-11-04 |
| CVE-2025-55469 | critical | 9.8 | No | Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend. | 2026-11-04 |
| CVE-2025-65239 | medium | 4.3 | No | Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers... | 2026-11-04 |
| CVE-2025-65238 | medium | 6.5 | No | Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attacke... | 2026-11-04 |
| CVE-2025-65237 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary Jav... | 2026-11-04 |
| CVE-2025-65236 | critical | 9.8 | No | OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occ... | 2026-11-04 |
| CVE-2025-65235 | critical | 9.8 | No | OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in... | 2026-11-04 |