Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-65821 | high | 7.5 | No | As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and ret... | 2026-11-04 |
| CVE-2025-65820 | critical | 9.8 | No | An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application whic... | 2026-11-04 |
| CVE-2025-65512 | high | 7.5 | No | A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 an... | 2026-11-04 |
| CVE-2025-24857 | high | 7.6 | No | Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019... | 2026-11-04 |
| CVE-2025-65602 | critical | 9.8 | No | A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a cra... | 2026-11-04 |
| CVE-2025-56431 | high | 7.5 | No | Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via th... | 2026-11-04 |
| CVE-2025-56430 | high | 7.5 | No | Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via th... | 2026-11-04 |
| CVE-2025-56429 | medium | 6.1 | No | Cross Site Scripting vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to obtain sensitive information vi... | 2026-11-04 |
| CVE-2025-65754 | medium | 6.1 | No | Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a fil... | 2026-11-04 |
| CVE-2025-63094 | high | 7.5 | No | XiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and indirect branch prediction, allowing attackers... | 2026-11-04 |
| CVE-2025-65815 | medium | 6.5 | No | A lack of security checks in the file import process of AB TECHNOLOGY Document Reader: PDF, DOC, PPT v65.0 allows attackers to execute a dir... | 2026-11-04 |
| CVE-2025-65814 | medium | 6.5 | No | A lack of security checks in the file import process of RHOPHI Analytics LLP Office App-Edit Word v6.4.1 allows attackers to execute a direc... | 2026-11-04 |
| CVE-2025-65792 | critical | 9.1 | No | DataGear v5.5.0 is vulnerable to Arbitrary File Deletion. | 2026-11-04 |
| CVE-2025-52493 | medium | 6.5 | No | PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. Although these secrets ap... | 2026-11-04 |
| CVE-2025-65807 | high | 8.4 | No | An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command. | 2026-11-04 |
| CVE-2025-65803 | medium | 6.5 | No | An integer overflow in the psdParser::ReadImageData function of FreeImage v3.18.0 and before allows attackers to cause a Denial of Service (... | 2026-11-04 |
| CVE-2025-65513 | high | 7.5 | No | fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP v... | 2026-11-04 |
| CVE-2025-65741 | critical | 9.8 | No | Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could compile a .dylib file and force the executi... | 2026-11-04 |
| CVE-2025-65882 | critical | 9.8 | No | An issue was discovered in openmptcprouter thru 0.64 in file common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c in function crea... | 2026-11-04 |
| CVE-2025-65573 | high | 8.8 | No | Cross Site Request Forgery (CSRF) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to cause a denial of service via... | 2026-11-04 |