Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-45311 | high | 8.8 | No | Insecure permissions in fail2ban-client v0.11.2 allows attackers with limited sudo privileges to perform arbitrary operations as root. NOTE:... | 2026-11-04 |
| CVE-2025-65647 | medium | 4.3 | No | Insecure Direct Object Reference (IDOR) in the Track order function in PHPGURUKUL Online Shopping Portal 2.1 allows information disclosure v... | 2026-11-04 |
| CVE-2025-51742 | critical | 9.8 | No | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parame... | 2026-11-04 |
| CVE-2025-64067 | medium | 5.3 | No | Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data (e.g., user profiles, project records) f... | 2026-11-04 |
| CVE-2025-64065 | high | 8.8 | No | The Primakon Pi Portal 1.0.18 API /api/V2/pp_udfv_admin endpoint, fails to perform necessary server-side validation. The administrative Logi... | 2026-11-04 |
| CVE-2025-64064 | high | 8.8 | No | Primakon Pi Portal 1.0.18 /api/v2/pp_users endpoint fails to adequately check user permissions before processing a PATCH request to modify t... | 2026-11-04 |
| CVE-2025-64063 | critical | 9.8 | No | Primakon Pi Portal 1.0.18 API endpoints fail to enforce sufficient authorization checks when processing requests. Specifically, a standard u... | 2026-11-04 |
| CVE-2026-118265 | medium | 5.3 | No | Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP valu... | 2026-11-04 |
| CVE-2026-118264 | not reported | — | No | Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade... | 2026-11-04 |
| CVE-2026-118263 | not reported | — | No | Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-leng... | 2026-11-04 |
| CVE-2026-118262 | not reported | — | No | Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network c... | 2026-11-04 |
| CVE-2026-118261 | not reported | — | No | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without li... | 2026-11-04 |
| CVE-2026-118260 | not reported | — | No | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before h... | 2026-11-04 |
| CVE-2026-116794 | not reported | — | No | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agen... | 2026-11-04 |
| CVE-2026-67187 | high | 7.1 | No | Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attac... | 2026-11-04 |
| CVE-2026-56828 | high | 8.8 | No | Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps afte... | 2026-11-04 |
| CVE-2026-50543 | medium | 4.3 | No | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, mi... | 2026-11-04 |
| CVE-2026-50542 | medium | 5.4 | No | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, mi... | 2026-11-04 |
| CVE-2026-50539 | medium | 6.5 | No | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, mi... | 2026-11-04 |
| CVE-2026-47235 | not reported | — | No | SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7,... | 2026-11-04 |