Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-60542 | medium | 6.5 | No | SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call u... | 2026-10-27 |
| CVE-2025-60355 | critical | 9.8 | No | zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. | 2026-10-27 |
| CVE-2025-60424 | high | 7.6 | No | A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication v... | 2026-10-27 |
| CVE-2025-60553 | critical | 9.8 | No | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard52. | 2026-10-27 |
| CVE-2025-60552 | high | 7.5 | No | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formTcpipSetup. | 2026-10-27 |
| CVE-2025-60550 | high | 7.5 | No | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formEasySetTimezone. | 2026-10-27 |
| CVE-2025-60549 | high | 7.5 | No | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAutoDetecWAN_wizard4. | 2026-10-27 |
| CVE-2025-60570 | high | 7.5 | No | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLogDnsquery. | 2026-10-27 |
| CVE-2025-46185 | medium | 6.2 | No | An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext stora... | 2026-10-27 |
| CVE-2025-50950 | high | 7.5 | No | Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function. | 2026-10-27 |
| CVE-2025-50949 | medium | 6.5 | No | FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8. | 2026-10-27 |
| CVE-2025-62396 | medium | 5.3 | No | An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP h... | 2026-10-27 |
| CVE-2025-60335 | high | 7.5 | No | A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS... | 2026-10-27 |
| CVE-2025-61035 | high | 7.7 | No | The seffaflik thru 0.0.9 is vulnerable to symlink attacks due to incorrect default permissions given to the .kimlik file and .seffaflik file... | 2026-10-27 |
| CVE-2025-52079 | high | 8.8 | No | The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Ch... | 2026-10-27 |
| CVE-2025-61457 | medium | 6.1 | No | code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php. | 2026-10-27 |
| CVE-2025-60790 | medium | 6.5 | No | ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted witho... | 2026-10-27 |
| CVE-2025-60751 | high | 7.5 | No | GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode. | 2026-10-27 |
| CVE-2025-60934 | medium | 6.1 | No | Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Performance Pro v3.19.17 a... | 2026-10-27 |
| CVE-2026-91474 | medium | 6.1 | No | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported v... | 2026-10-27 |