Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-15247 | critical | 9.8 | No | A vulnerability was identified in gmg137 snap7-rs up to 153d3e8c16decd7271e2a5b2e3da4d6f68589424. Affected by this issue is the function sna... | 2026-10-07 |
| CVE-2025-43529 | high | 8.8 | Listed | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS... | 2026-10-07 |
| CVE-2025-43520 | medium | 5.5 | Listed | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPa... | 2026-10-07 |
| CVE-2025-43510 | high | 7.8 | Listed | A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and... | 2026-10-07 |
| CVE-2025-68456 | critical | 9.1 | No | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users... | 2026-10-07 |
| CVE-2025-55204 | critical | 9.6 | No | muffon is a cross-platform music streaming client for desktop. Versions prior to 2.3.0 have a one-click Remote Code Execution (RCE) vulnerab... | 2026-10-07 |
| CVE-2025-59467 | critical | 9.6 | No | A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation... | 2026-10-07 |
| CVE-2025-66376 | medium | 6.1 | Listed | Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import d... | 2026-10-07 |
| CVE-2025-59852 | critical | 9.1 | No | HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability where data is transmitted over the network without... | 2026-10-07 |
| CVE-2025-59851 | critical | 9.8 | No | HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub... | 2026-10-07 |
| CVE-2025-14543 | critical | 9.1 | No | Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data Exte... | 2026-10-07 |
| CVE-2025-15625 | critical | 9.8 | No | Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases. | 2026-10-07 |
| CVE-2025-31991 | critical | 9.8 | No | Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past... | 2026-10-07 |
| CVE-2025-15480 | critical | 9.1 | No | In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure,... | 2026-10-07 |
| CVE-2025-59468 | critical | 9.1 | No | This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password... | 2026-10-07 |
| CVE-2025-55125 | critical | 9.8 | No | This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configurat... | 2026-10-07 |
| CVE-2025-14942 | critical | 9.8 | No | wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signatu... | 2026-10-07 |
| CVE-2026-42638 | high | 7.5 | No | Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured... | 2026-10-07 |
| CVE-2026-42418 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rock... | 2026-10-07 |
| CVE-2026-81792 | medium | 6.5 | No | Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enq... | 2026-10-07 |