Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2024-4027 | high | 7.5 | No | A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError wh... | 2026-11-04 |
| CVE-2024-52336 | high | 7.8 | No | A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged... | 2026-11-04 |
| CVE-2024-4467 | high | 7.8 | No | A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value descr... | 2026-11-04 |
| CVE-2024-5154 | high | 8.1 | No | A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“).... | 2026-11-04 |
| CVE-2024-3183 | high | 8.1 | No | A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for... | 2026-11-04 |
| CVE-2024-3049 | medium | 5.9 | No | A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an inval... | 2026-11-04 |
| CVE-2024-3094 | critical | 10.0 | No | Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the li... | 2026-11-04 |
| CVE-2024-31083 | high | 7.8 | No | A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is ca... | 2026-11-04 |
| CVE-2024-31082 | high | 7.3 | No | A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte... | 2026-11-04 |
| CVE-2024-31081 | high | 7.3 | No | A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-... | 2026-11-04 |
| CVE-2024-31080 | high | 7.3 | No | A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-... | 2026-11-04 |
| CVE-2025-65132 | medium | 6.1 | No | alandsilva26 hotel-management-php 1.0 is vulnerable to Cross Site Scripting (XSS) in /public/admin/edit_room.php which allows an attacker to... | 2026-11-04 |
| CVE-2025-69893 | medium | 4.6 | No | A side-channel vulnerability exists in the implementation of BIP-39 mnemonic processing, as observed in Trezor One v1.13.0 to v1.14.0, Trezo... | 2026-11-04 |
| CVE-2025-61260 | critical | 9.8 | No | A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Proto... | 2026-11-04 |
| CVE-2025-70936 | medium | 5.4 | No | Vtiger CRM 8.4.0 contains a reflected cross-site scripting (XSS) vulnerability in the MailManager module. Improper handling of user-controll... | 2026-11-04 |
| CVE-2025-51414 | high | 8.8 | No | In Phpgurukul Online Course Registration v3.1, an arbitrary file upload vulnerability was discovered within the profile picture upload funct... | 2026-11-04 |
| CVE-2025-63743 | medium | 5.4 | No | Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated... | 2026-11-04 |
| CVE-2025-44560 | critical | 9.8 | No | owntone-server 2ca10d9 is vulnerable to Buffer Overflow due to lack of recursive checking. | 2026-11-04 |
| CVE-2025-70365 | medium | 5.4 | No | A stored cross-site scripting (XSS) vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in admin... | 2026-11-04 |
| CVE-2025-70364 | high | 8.8 | No | An issue was discovered in Kiamo before 8.4 allowing authenticated administrative attackers to execute arbitrary PHP code on the server. NOT... | 2026-11-04 |