Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-62841 | not reported | — | No | An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploit... | 2026-11-04 |
| CVE-2025-62839 | not reported | — | No | An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploit... | 2026-11-04 |
| CVE-2025-14260 | high | 8.3 | No | Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on af... | 2026-11-04 |
| CVE-2025-30414 | high | 7.1 | No | Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows)... | 2026-11-04 |
| CVE-2025-30053 | not reported | — | No | The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability w... | 2026-11-04 |
| CVE-2025-7203 | medium | 4.9 | No | The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore... | 2026-11-04 |
| CVE-2025-7043 | medium | 5.4 | No | The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling... | 2026-11-04 |
| CVE-2025-6623 | medium | 4.3 | No | The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection... | 2026-11-04 |
| CVE-2025-13591 | medium | 5.3 | No | The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the syst... | 2026-11-04 |
| CVE-2025-13173 | medium | 6.5 | No | Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initia... | 2026-11-04 |
| CVE-2025-10149 | high | 8.2 | No | The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store.... | 2026-11-04 |
| CVE-2025-70521 | critical | 9.8 | No | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lac... | 2026-11-04 |
| CVE-2025-70518 | critical | 10.0 | No | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lac... | 2026-11-04 |
| CVE-2025-56565 | high | 7.6 | No | DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within no... | 2026-11-04 |
| CVE-2026-59044 | high | 8.4 | No | In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege... | 2026-11-04 |
| CVE-2026-59043 | high | 7.4 | No | In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to lo... | 2026-11-04 |
| CVE-2026-59042 | high | 7.4 | No | In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of... | 2026-11-04 |
| CVE-2026-59031 | medium | 6.2 | No | In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code. This could l... | 2026-11-04 |
| CVE-2026-59028 | high | 8.4 | No | In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to l... | 2026-11-04 |
| CVE-2026-59021 | medium | 6.2 | No | In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service wi... | 2026-11-04 |