Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-67303 | high | 7.5 | No | An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. Th... | 2026-11-04 |
| CVE-2025-65328 | medium | 6.5 | No | Mega-Fence (webgate-lib.*) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF) header as the client IP without validating... | 2026-11-04 |
| CVE-2025-67160 | high | 7.5 | No | An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal. | 2026-11-04 |
| CVE-2025-67159 | high | 7.5 | No | Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext. | 2026-11-04 |
| CVE-2025-67158 | high | 7.5 | No | An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitiv... | 2026-11-04 |
| CVE-2025-67269 | high | 7.5 | No | An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b0... | 2026-11-04 |
| CVE-2025-67268 | critical | 9.8 | No | gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 fun... | 2026-11-04 |
| CVE-2025-45286 | medium | 6.1 | No | A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a craf... | 2026-11-04 |
| CVE-2025-65354 | critical | 9.8 | No | Improper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management 1.0 permits SQL injection via the sitem_nam... | 2026-11-04 |
| CVE-2025-65410 | medium | 6.2 | No | A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a craft... | 2026-11-04 |
| CVE-2025-29228 | critical | 9.8 | No | Linksys E5600 V1.1.0.26 is vulnerable to command injection in the runtime.macClone function via the mc.ip parameter. | 2026-11-04 |
| CVE-2025-67111 | high | 7.5 | No | An integer overflow in the RTPS protocol implementation of OpenDDS DDS before v3.33.0 allows attackers to cause a Denial of Service (DoS) vi... | 2026-11-04 |
| CVE-2025-67109 | critical | 10.0 | No | Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execut... | 2026-11-04 |
| CVE-2025-65865 | high | 7.5 | No | An integer overflow in eProsima Fast-DDS v3.3 allows attackers to cause a Denial of Service (DoS) via a crafted input. | 2026-11-04 |
| CVE-2025-66845 | medium | 6.1 | No | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in TechStore version 1.0. The user_name endpoint reflects the id qu... | 2026-11-04 |
| CVE-2025-67436 | medium | 6.5 | No | Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP... | 2026-11-04 |
| CVE-2025-65857 | high | 7.5 | No | An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTS... | 2026-11-04 |
| CVE-2025-65856 | critical | 9.8 | No | Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenti... | 2026-11-04 |
| CVE-2025-66736 | high | 7.1 | No | youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The importUsers function in SysUserController.java does not perform a permiss... | 2026-11-04 |
| CVE-2025-65817 | high | 8.8 | No | LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh. | 2026-11-04 |