Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-65516 | medium | 6.1 | No | A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is conf... | 2026-11-04 |
| CVE-2025-63681 | medium | 4.3 | No | open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying... | 2026-11-04 |
| CVE-2025-61148 | medium | 6.5 | No | An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access... | 2026-11-04 |
| CVE-2025-57213 | high | 7.5 | No | Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a... | 2026-11-04 |
| CVE-2025-57210 | high | 7.5 | No | Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unsp... | 2026-11-04 |
| CVE-2025-56427 | high | 7.5 | No | Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_... | 2026-11-04 |
| CVE-2025-65346 | critical | 9.1 | No | alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows ar... | 2026-11-04 |
| CVE-2025-54307 | high | 8.8 | No | An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. The /configure/plugins/plugin/upload/zip/ and /configu... | 2026-11-04 |
| CVE-2025-54306 | high | 7.2 | No | An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. A remote code execution vulnerability exists in the ne... | 2026-11-04 |
| CVE-2025-54305 | high | 7.8 | No | An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. One of the middlewares included in this application, L... | 2026-11-04 |
| CVE-2025-54304 | critical | 9.8 | No | An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. When they are powered on, an X11 display server is start... | 2026-11-04 |
| CVE-2025-54303 | critical | 9.8 | No | The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API.... | 2026-11-04 |
| CVE-2025-53963 | critical | 9.8 | No | An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. They run an SSH server accessible over the default port... | 2026-11-04 |
| CVE-2025-65868 | high | 7.5 | No | XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST reques... | 2026-11-04 |
| CVE-2025-65345 | medium | 6.5 | No | alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to c... | 2026-11-04 |
| CVE-2025-50361 | medium | 5.1 | No | Buffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v12_28, and commit sha:298a1d495355959db36451e90a0ac74bcc5593fe... | 2026-11-04 |
| CVE-2025-63401 | medium | 5.5 | No | Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary c... | 2026-11-04 |
| CVE-2025-50360 | high | 8.4 | No | A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7. Malicious execu... | 2026-11-04 |
| CVE-2025-65843 | high | 7.7 | No | Aquarius Desktop 3.0.069 for macOS contains an insecure file handling vulnerability in its support data archive generation feature. The appl... | 2026-11-04 |
| CVE-2025-65842 | medium | 5.1 | No | The Aquarius HelperTool (1.0.003) privileged XPC service on macOS contains multiple flaws that allow local privilege escalation. The service... | 2026-11-04 |