Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-63938 | medium | 6.5 | No | Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c. | 2026-11-04 |
| CVE-2025-56396 | high | 8.8 | No | An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights tha... | 2026-11-04 |
| CVE-2025-50402 | critical | 9.8 | No | FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via the parameter string fac_password. | 2026-11-04 |
| CVE-2025-50399 | critical | 9.8 | No | FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via the parameter password. | 2026-11-04 |
| CVE-2025-46174 | high | 7.5 | No | Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUse... | 2026-11-04 |
| CVE-2025-45311 | high | 8.8 | No | Insecure permissions in fail2ban-client v0.11.2 allows attackers with limited sudo privileges to perform arbitrary operations as root. NOTE:... | 2026-11-04 |
| CVE-2025-65647 | medium | 4.3 | No | Insecure Direct Object Reference (IDOR) in the Track order function in PHPGURUKUL Online Shopping Portal 2.1 allows information disclosure v... | 2026-11-04 |
| CVE-2025-51742 | critical | 9.8 | No | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parame... | 2026-11-04 |
| CVE-2025-64067 | medium | 5.3 | No | Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data (e.g., user profiles, project records) f... | 2026-11-04 |
| CVE-2025-64065 | high | 8.8 | No | The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation. The administrative Logi... | 2026-11-04 |
| CVE-2025-64064 | high | 8.8 | No | Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user permissions before processing a PATCH request to modify t... | 2026-11-04 |
| CVE-2025-64063 | critical | 9.8 | No | Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard u... | 2026-11-04 |
| CVE-2026-118265 | medium | 5.3 | No | Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP valu... | 2026-11-04 |
| CVE-2026-118264 | not reported | — | No | Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade... | 2026-11-04 |
| CVE-2026-118263 | not reported | — | No | Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-leng... | 2026-11-04 |
| CVE-2026-118262 | not reported | — | No | Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network c... | 2026-11-04 |
| CVE-2026-118261 | not reported | — | No | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without li... | 2026-11-04 |
| CVE-2026-118260 | not reported | — | No | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before h... | 2026-11-04 |
| CVE-2026-116794 | not reported | — | No | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agen... | 2026-11-04 |
| CVE-2026-67187 | high | 7.1 | No | Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attac... | 2026-11-04 |