Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-67291 | medium | 6.1 | No | A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts... | 2026-11-04 |
| CVE-2025-67290 | medium | 6.1 | No | A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary web... | 2026-11-04 |
| CVE-2025-65837 | medium | 5.4 | No | PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module. | 2026-11-04 |
| CVE-2025-65790 | medium | 6.1 | No | A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. F... | 2026-11-04 |
| CVE-2025-67288 | critical | 10.0 | No | An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NO... | 2026-11-04 |
| CVE-2025-63664 | high | 7.5 | No | Incorrect access control in the /api/v1/conversations/*/messages API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers... | 2026-11-04 |
| CVE-2025-63662 | high | 7.5 | No | Insecure permissions in the /api/v1/agents API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access sensitive i... | 2026-11-04 |
| CVE-2025-26787 | medium | 4.7 | No | An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to co... | 2026-11-04 |
| CVE-2025-67289 | critical | 9.6 | No | An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via... | 2026-11-04 |
| CVE-2025-65270 | medium | 6.1 | No | Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute... | 2026-11-04 |
| CVE-2025-67826 | high | 7.7 | No | An issue was discovered in K7 Ultimate Security 17.0.2045. A Local Privilege Escalation (LPE) vulnerability in the K7 Ultimate Security anti... | 2026-11-04 |
| CVE-2025-67174 | high | 7.5 | No | A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via a directory traversal... | 2026-11-04 |
| CVE-2025-67173 | medium | 6.8 | No | A Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via... | 2026-11-04 |
| CVE-2025-65832 | medium | 4.6 | No | The mobile application insecurely handles information stored within memory. By performing a memory dump on the application after a user has... | 2026-11-04 |
| CVE-2025-65831 | high | 7.5 | No | The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through e... | 2026-11-04 |
| CVE-2025-65830 | critical | 9.1 | No | Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upst... | 2026-11-04 |
| CVE-2025-65829 | medium | 6.8 | No | The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures... | 2026-11-04 |
| CVE-2025-65827 | critical | 9.1 | No | The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result,... | 2026-11-04 |
| CVE-2025-65825 | medium | 4.6 | No | The firmware on the basestation of the Meatmeet is not encrypted. An adversary with physical access to the Meatmeet device can disassemble t... | 2026-11-04 |
| CVE-2025-65822 | medium | 6.8 | No | The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on an ESP32 in a comme... | 2026-11-04 |