Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-70811 | medium | 4.3 | No | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Pan... | 2026-11-04 |
| CVE-2025-70810 | high | 8.8 | No | Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function an... | 2026-11-04 |
| CVE-2025-45806 | medium | 6.1 | No | A cross-site scripting (XSS) vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTM... | 2026-11-04 |
| CVE-2025-70844 | medium | 6.1 | No | yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the "Add Account Group" function... | 2026-11-04 |
| CVE-2025-52908 | critical | 9.8 | No | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580... | 2026-11-04 |
| CVE-2025-52909 | critical | 9.8 | No | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580... | 2026-11-04 |
| CVE-2025-66442 | medium | 5.1 | No | In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's sele... | 2026-11-04 |
| CVE-2025-67807 | medium | 4.7 | No | The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing ac... | 2026-11-04 |
| CVE-2025-67806 | medium | 5.3 | No | The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing ac... | 2026-11-04 |
| CVE-2025-67805 | high | 7.5 | No | A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor featur... | 2026-11-04 |
| CVE-2025-69988 | medium | 6.5 | No | BS Producten Petcam 33.1.0.0818 is vulnerable to Incorrect Access Control. An unauthenticated attacker in physical proximity can associate w... | 2026-11-04 |
| CVE-2025-69986 | high | 7.2 | No | A buffer overflow vulnerability exists in the ONVIF GetStreamUri function of LSC Indoor Camera V7.6.32. The application fails to validate th... | 2026-11-04 |
| CVE-2025-61190 | medium | 6.1 | No | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in DSpace JSPUI 6.5 within the search/discover filtering functional... | 2026-11-04 |
| CVE-2025-68718 | medium | 5.4 | No | KAYSUS KS-WR1200 routers with firmware 107 expose SSH and TELNET services on the LAN interface with hardcoded root credentials (root:1234567... | 2026-11-04 |
| CVE-2025-68717 | critical | 9.4 | No | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints... | 2026-11-04 |
| CVE-2025-68716 | high | 8.4 | No | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The root account is configu... | 2026-11-04 |
| CVE-2025-68715 | critical | 9.1 | No | An issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple HTTP endpoints (/goform/setWan, /goform/se... | 2026-11-04 |
| CVE-2025-66916 | critical | 9.4 | No | The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpre... | 2026-11-04 |
| CVE-2025-66913 | critical | 9.8 | No | JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes th... | 2026-11-04 |
| CVE-2025-67325 | critical | 9.8 | No | Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achiev... | 2026-11-04 |