Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-29897 | not reported | — | No | A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user acco... | 2026-10-19 |
| CVE-2025-29896 | not reported | — | No | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then... | 2026-10-19 |
| CVE-2025-29895 | not reported | — | No | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then... | 2026-10-19 |
| CVE-2025-58771 | not reported | — | No | AMI APTIOV contains vulnerabilities in BIOS where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation... | 2026-10-19 |
| CVE-2025-71432 | high | 8.1 | No | Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validatio... | 2026-10-19 |
| CVE-2025-71431 | medium | 5.3 | No | Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-suppli... | 2026-10-19 |
| CVE-2025-71430 | medium | 5.4 | No | Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user nam... | 2026-10-19 |
| CVE-2025-71429 | critical | 9.8 | No | GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to... | 2026-10-19 |
| CVE-2025-15703 | low | 3.5 | No | The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back in... | 2026-10-19 |
| CVE-2025-14123 | medium | 6.8 | No | The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to... | 2026-10-19 |
| CVE-2025-15700 | high | 8.8 | No | The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its list... | 2026-10-19 |
| CVE-2025-71428 | medium | 4.9 | No | Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators... | 2026-10-19 |
| CVE-2025-64392 | not reported | — | No | This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a craft... | 2026-10-19 |
| CVE-2025-64391 | not reported | — | No | This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locati... | 2026-10-19 |
| CVE-2025-71417 | medium | 6.5 | No | PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allow... | 2026-10-19 |
| CVE-2025-3271 | not reported | — | No | Documentum Webtop versions prior to 16.7.1 software is vulnerable to an XSS | 2026-10-19 |
| CVE-2025-46808 | medium | 6.8 | No | An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager c... | 2026-10-19 |
| CVE-2025-7062 | not reported | — | No | A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in version... | 2026-10-19 |
| CVE-2025-15690 | medium | 6.8 | No | The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in... | 2026-10-19 |
| CVE-2025-64868 | medium | 5.4 | No | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker... | 2026-10-19 |