Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-34509 | high | 7.5 | No | Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3... | 2026-10-29 |
| CVE-2025-34458 | not reported | — | No | wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 3658a87, contain a reachable assertion vulnerability in the... | 2026-10-29 |
| CVE-2025-34457 | not reported | — | No | wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 694c954, contain a stack-based buffer overflow vulnerability... | 2026-10-29 |
| CVE-2025-34253 | medium | 5.4 | No | D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization o... | 2026-10-29 |
| CVE-2025-34108 | not reported | — | No | A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send... | 2026-10-29 |
| CVE-2025-34023 | not reported | — | No | A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to prop... | 2026-10-29 |
| CVE-2025-30006 | medium | 6.1 | No | Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administrative control panel. This issue affects Complete... | 2026-10-29 |
| CVE-2025-15620 | high | 8.6 | No | HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web inter... | 2026-10-29 |
| CVE-2024-58300 | not reported | — | No | Siklu MultiHaul TG series devices through version 2.0.0 contain an unauthenticated vulnerability that allows remote attackers to retrieve ra... | 2026-10-29 |
| CVE-2024-58296 | not reported | — | No | CE Phoenix v1.0.8.20 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to in... | 2026-10-29 |
| CVE-2025-25034 | not reported | — | No | A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper vali... | 2026-10-29 |
| CVE-2024-8517 | critical | 9.8 | No | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitr... | 2026-10-29 |
| CVE-2024-58366 | high | 8.8 | No | SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Atta... | 2026-10-29 |
| CVE-2024-58363 | medium | 6.3 | No | SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases... | 2026-10-29 |
| CVE-2023-53982 | high | 7.5 | No | PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the storage module (categ=storage) of the opac_css/ajax.php endpoint... | 2026-10-29 |
| CVE-2023-53937 | high | 7.8 | No | Hubstaff 1.6.13 and 1.6.14 contain a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.d... | 2026-10-29 |
| CVE-2023-53907 | medium | 6.5 | No | Bludit versions before 3.13.0 contain an authenticated file download vulnerability in the Backup Plugin that allows logged-in users to acces... | 2026-10-29 |
| CVE-2024-22047 | low | 3.1 | No | A race condition exists in Audited 4.0.0 before 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed t... | 2026-10-29 |
| CVE-2016-20084 | high | 7.2 | No | WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to... | 2026-10-29 |
| CVE-2017-20243 | high | 8.2 | No | WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attack... | 2026-10-29 |