Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-65731 | medium | 6.8 | No | An issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6.02CN02) allowing an attacker with physical acce... | 2026-11-04 |
| CVE-2025-65518 | high | 7.5 | No | Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_pas... | 2026-11-04 |
| CVE-2025-67825 | medium | 5.5 | No | An issue was discovered in Nitro PDF Pro for Windows before 14.42.0.34. In certain cases, it displays signer information from a non-verified... | 2026-11-04 |
| CVE-2025-61550 | medium | 5.4 | No | Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx end... | 2026-11-04 |
| CVE-2025-61549 | medium | 6.1 | No | Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Pr... | 2026-11-04 |
| CVE-2025-61548 | critical | 9.8 | No | SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business... | 2026-11-04 |
| CVE-2025-61547 | medium | 6.8 | No | Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76... | 2026-11-04 |
| CVE-2025-61546 | critical | 9.1 | No | There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34... | 2026-11-04 |
| CVE-2025-61246 | critical | 9.8 | No | indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action.php via the proId parameter. | 2026-11-04 |
| CVE-2025-56425 | critical | 9.1 | No | An issue was discovered in the AppConnector component version 10.10.0.183 and earlier of enaio 10.10, in the AppConnector component version... | 2026-11-04 |
| CVE-2025-56424 | high | 7.5 | No | An issue in Insiders Technologies GmbH e-invoice pro before release 1 Service Pack 2 allows a remote attacker to cause a denial of service v... | 2026-11-04 |
| CVE-2025-50334 | high | 7.5 | No | An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting component | 2026-11-04 |
| CVE-2025-67091 | medium | 6.5 | No | An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4.6.4 & 4.6.8 in the GL.iNet custom opkg wra... | 2026-11-04 |
| CVE-2025-67090 | medium | 5.1 | No | The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version... | 2026-11-04 |
| CVE-2025-67089 | high | 8.1 | No | A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the `plugins.inst... | 2026-11-04 |
| CVE-2025-63611 | high | 8.7 | No | Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /regis... | 2026-11-04 |
| CVE-2025-61492 | critical | 10.0 | No | A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary com... | 2026-11-04 |
| CVE-2025-67366 | high | 7.5 | No | @sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains... | 2026-11-04 |
| CVE-2025-67364 | high | 7.5 | No | fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file. Thi... | 2026-11-04 |
| CVE-2025-66837 | medium | 6.8 | No | A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafted PDF file/Malware | 2026-11-04 |