Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-65572 | medium | 6.1 | No | Cross Site Scripting (XSS) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to execute arbitrary code via the (1) c... | 2026-11-04 |
| CVE-2025-65300 | medium | 5.4 | No | A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-28) in the Account Set... | 2026-11-04 |
| CVE-2025-65594 | high | 8.1 | No | OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform... | 2026-11-04 |
| CVE-2025-64086 | high | 7.5 | No | A NULL pointer dereference vulnerability in the util.readFileIntoStream component of PDF-XChange Editor v10.7.3.401 allows attackers to caus... | 2026-11-04 |
| CVE-2025-64085 | high | 7.5 | No | A NULL pointer dereference vulnerability in the importDataObject() function of PDF-XChange Editor v10.7.3.401 allows attackers to cause a De... | 2026-11-04 |
| CVE-2025-61258 | high | 7.5 | No | Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via a crafted content-length value mismatching the bo... | 2026-11-04 |
| CVE-2025-61078 | medium | 6.1 | No | Cross-site scripting (XSS) vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML... | 2026-11-04 |
| CVE-2025-65730 | high | 8.8 | No | Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used... | 2026-11-04 |
| CVE-2025-64056 | medium | 4.3 | No | File upload vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store arbitrary files on the fi... | 2026-11-04 |
| CVE-2025-64054 | critical | 9.6 | No | A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potenti... | 2026-11-04 |
| CVE-2025-64052 | medium | 5.1 | No | An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system comman... | 2026-11-04 |
| CVE-2025-65900 | medium | 6.5 | No | Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient per... | 2026-11-04 |
| CVE-2025-65899 | medium | 5.3 | No | Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error... | 2026-11-04 |
| CVE-2025-63896 | high | 7.6 | No | An issue in the Bluetooth Human Interface Device (HID) of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject... | 2026-11-04 |
| CVE-2025-55948 | high | 7.3 | No | This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control (RBAC) through dual de... | 2026-11-04 |
| CVE-2025-65806 | medium | 4.3 | No | The E-POINT CMS eagle.gsam-1169.1 file upload feature improperly handles nested archive files. An attacker can upload a nested ZIP (a ZIP co... | 2026-11-04 |
| CVE-2025-29269 | critical | 9.8 | No | ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoin... | 2026-11-04 |
| CVE-2025-29268 | critical | 9.8 | No | ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library. | 2026-11-04 |
| CVE-2025-65637 | high | 7.5 | No | A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64... | 2026-11-04 |
| CVE-2025-66373 | medium | 4.8 | No | Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggl... | 2026-11-04 |