Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-67826 | high | 7.7 | No | An issue was discovered in K7 Ultimate Security 17.0.2045. A Local Privilege Escalation (LPE) vulnerability in the K7 Ultimate Security anti... | 2026-11-04 |
| CVE-2025-67174 | high | 7.5 | No | A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via a directory traversal... | 2026-11-04 |
| CVE-2025-67173 | medium | 6.8 | No | A Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via... | 2026-11-04 |
| CVE-2025-65832 | medium | 4.6 | No | The mobile application insecurely handles information stored within memory. By performing a memory dump on the application after a user has... | 2026-11-04 |
| CVE-2025-65831 | high | 7.5 | No | The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through e... | 2026-11-04 |
| CVE-2025-65830 | critical | 9.1 | No | Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upst... | 2026-11-04 |
| CVE-2025-65829 | medium | 6.8 | No | The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures... | 2026-11-04 |
| CVE-2025-65827 | critical | 9.1 | No | The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result,... | 2026-11-04 |
| CVE-2025-65825 | medium | 4.6 | No | The firmware on the basestation of the Meatmeet is not encrypted. An adversary with physical access to the Meatmeet device can disassemble t... | 2026-11-04 |
| CVE-2025-65822 | medium | 6.8 | No | The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on an ESP32 in a comme... | 2026-11-04 |
| CVE-2025-65821 | high | 7.5 | No | As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and ret... | 2026-11-04 |
| CVE-2025-65820 | critical | 9.8 | No | An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application whic... | 2026-11-04 |
| CVE-2025-65512 | high | 7.5 | No | A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 an... | 2026-11-04 |
| CVE-2025-24857 | high | 7.6 | No | Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019... | 2026-11-04 |
| CVE-2025-65602 | critical | 9.8 | No | A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a cra... | 2026-11-04 |
| CVE-2025-56431 | high | 7.5 | No | Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via th... | 2026-11-04 |
| CVE-2025-56430 | high | 7.5 | No | Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via th... | 2026-11-04 |
| CVE-2025-56429 | medium | 6.1 | No | Cross Site Scripting vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to obtain sensitive information vi... | 2026-11-04 |
| CVE-2025-65754 | medium | 6.1 | No | Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a fil... | 2026-11-04 |
| CVE-2025-63094 | high | 7.5 | No | XiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and indirect branch prediction, allowing attackers... | 2026-11-04 |