Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-65670 | medium | 4.3 | No | An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating... | 2026-11-04 |
| CVE-2025-65278 | high | 7.5 | No | An issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing unauthenticated attackers to gain sensitive i... | 2026-11-04 |
| CVE-2025-65276 | critical | 9.8 | No | An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0... | 2026-11-04 |
| CVE-2025-50433 | critical | 9.8 | No | An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to tak... | 2026-11-04 |
| CVE-2025-65681 | low | 3.3 | No | An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to se... | 2026-11-04 |
| CVE-2025-65676 | medium | 5.4 | No | Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via craft... | 2026-11-04 |
| CVE-2025-65672 | high | 7.5 | No | Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings. | 2026-11-04 |
| CVE-2025-65669 | critical | 9.1 | No | An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization o... | 2026-11-04 |
| CVE-2025-26155 | critical | 9.8 | No | NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability. | 2026-11-04 |
| CVE-2025-55469 | critical | 9.8 | No | Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend. | 2026-11-04 |
| CVE-2025-65239 | medium | 4.3 | No | Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers... | 2026-11-04 |
| CVE-2025-65238 | medium | 6.5 | No | Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attacke... | 2026-11-04 |
| CVE-2025-65237 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary Jav... | 2026-11-04 |
| CVE-2025-65236 | critical | 9.8 | No | OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occ... | 2026-11-04 |
| CVE-2025-65235 | critical | 9.8 | No | OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in... | 2026-11-04 |
| CVE-2025-63938 | medium | 6.5 | No | Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c. | 2026-11-04 |
| CVE-2025-56396 | high | 8.8 | No | An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights tha... | 2026-11-04 |
| CVE-2025-50402 | critical | 9.8 | No | FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via the parameter string fac_password. | 2026-11-04 |
| CVE-2025-50399 | critical | 9.8 | No | FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via the parameter password. | 2026-11-04 |
| CVE-2025-46174 | high | 7.5 | No | Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUse... | 2026-11-04 |