Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-65841 | medium | 6.2 | No | Aquarius Desktop 3.0.069 for macOS stores user authentication credentials in the local file ~/Library/Application Support/Aquarius/aquarius.... | 2026-11-04 |
| CVE-2025-54326 | high | 7.5 | No | An issue was discovered in Camera in Samsung Mobile Processor Exynos 1280 and 2200. Unnecessary registration of a hardware IP address in the... | 2026-11-04 |
| CVE-2025-53965 | medium | 5.3 | No | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480,... | 2026-11-04 |
| CVE-2025-65320 | high | 7.5 | No | Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The applicat... | 2026-11-04 |
| CVE-2025-57202 | medium | 6.1 | No | A stored cross-site scripting (XSS) vulnerability in the PwdGrp.cgi endpoint of AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1... | 2026-11-04 |
| CVE-2025-57201 | high | 8.8 | No | AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i... | 2026-11-04 |
| CVE-2025-57199 | high | 8.8 | No | AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i... | 2026-11-04 |
| CVE-2025-57198 | high | 8.8 | No | AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i... | 2026-11-04 |
| CVE-2025-65267 | critical | 9.0 | No | In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious Jav... | 2026-11-04 |
| CVE-2025-57200 | medium | 6.5 | No | AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i... | 2026-11-04 |
| CVE-2025-65955 | medium | 6.1 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vu... | 2026-11-04 |
| CVE-2025-65657 | medium | 6.5 | No | FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticate... | 2026-11-04 |
| CVE-2025-65380 | medium | 6.5 | No | PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint. Specifically, the username parameter accepts u... | 2026-11-04 |
| CVE-2025-65379 | medium | 6.5 | No | PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the /admin/password-recovery.php endpoint. Specifically, the username and mo... | 2026-11-04 |
| CVE-2025-65896 | critical | 9.8 | No | SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys. | 2026-11-04 |
| CVE-2025-12544 | medium | 4.8 | No | The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious sc... | 2026-11-04 |
| CVE-2025-11969 | critical | 9.4 | No | The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative... | 2026-11-04 |
| CVE-2025-68392 | not reported | — | No | ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by fo... | 2026-11-04 |
| CVE-2025-12523 | medium | 6.5 | No | Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user | 2026-11-04 |
| CVE-2025-13050 | medium | 5.4 | No | Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user | 2026-11-04 |