Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-10796 | critical | 9.8 | No | A vulnerability was found in code-projects Hostel Management System 1.0. This vulnerability affects unknown code of the file /justines/admin... | 2026-09-30 |
| CVE-2025-10768 | critical | 9.8 | No | A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the compon... | 2026-09-30 |
| CVE-2025-10564 | critical | 9.8 | No | A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=... | 2026-09-30 |
| CVE-2025-10479 | critical | 9.8 | No | A security flaw has been discovered in SourceCodester Online Student File Management System 1.0. The impacted element is an unknown function... | 2026-09-30 |
| CVE-2025-10405 | critical | 9.8 | No | A vulnerability was determined in itsourcecode Baptism Information Management System 1.0. Affected is an unknown function of the file /listb... | 2026-09-30 |
| CVE-2025-40690 | critical | 9.8 | No | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and dele... | 2026-09-30 |
| CVE-2025-10097 | critical | 9.8 | No | A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execut... | 2026-09-30 |
| CVE-2025-10091 | critical | 9.8 | No | A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectMana... | 2026-09-30 |
| CVE-2025-10068 | critical | 9.8 | No | A flaw has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin/admin_forum/add_views... | 2026-09-30 |
| CVE-2025-58371 | critical | 9.8 | No | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanit... | 2026-09-30 |
| CVE-2026-47097 | high | 7.5 | No | AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensit... | 2026-09-30 |
| CVE-2026-97316 | medium | 5.8 | No | The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing una... | 2026-09-30 |
| CVE-2026-97059 | high | 8.2 | No | DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the Pixe... | 2026-09-30 |
| CVE-2026-94953 | high | 8.8 | No | A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It... | 2026-09-30 |
| CVE-2026-94954 | high | 8.8 | No | A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It... | 2026-09-30 |
| CVE-2026-93332 | medium | 5.4 | No | Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged us... | 2026-09-30 |
| CVE-2026-93353 | low | 3.1 | No | copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, a... | 2026-09-30 |
| CVE-2026-79536 | critical | 9.1 | No | bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allo... | 2026-09-30 |
| CVE-2026-79535 | medium | 6.3 | No | mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool (and the "voicemode config set" CLI) writes a... | 2026-09-30 |
| CVE-2026-86330 | high | 7.2 | No | An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible... | 2026-09-30 |