Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-63548 | high | 7.5 | No | An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a packet specially crafted to be... | 2026-11-04 |
| CVE-2025-63547 | high | 7.5 | No | An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a crafted packet to the MTU leng... | 2026-11-04 |
| CVE-2025-56568 | high | 7.5 | No | Assertion failure vulnerability in the PCO (Protocol Configuration Options) parser in the SMF (Session Management Function) component of Ope... | 2026-11-04 |
| CVE-2025-46115 | high | 7.5 | No | An issue in open5gs v.2.7.3 allows a remote attacker to cause a denial of service via a crafted PDU Session Modification Request | 2026-11-04 |
| CVE-2025-50328 | high | 7.3 | No | A vulnerability in B1 Free Archiver v1.5.86 allows files extracted from downloaded archives to bypass Windows Mark of the Web (MotW) protect... | 2026-11-04 |
| CVE-2025-60887 | medium | 5.3 | No | An issue was discovered in Cista v0.15 and below. Insecure deserialization of untrusted input under certain conditions may lead to leaking o... | 2026-11-04 |
| CVE-2025-69428 | high | 7.5 | No | An issue in Pro-Bit before v1.77.4 allows unauthenticated attackers to directly access sensitive directory and its subdirectories. | 2026-11-04 |
| CVE-2025-69689 | high | 8.8 | No | The Fan Control application V251 contains an improper privilege handling vulnerability in its Open File Dialog. The dialog processes user-su... | 2026-11-04 |
| CVE-2025-67259 | medium | 6.5 | No | A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthor... | 2026-11-04 |
| CVE-2025-59308 | medium | 4.7 | No | In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site... | 2026-11-04 |
| CVE-2025-61872 | medium | 6.1 | No | Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. This occur... | 2026-11-04 |
| CVE-2025-70994 | high | 7.3 | No | Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless entry system. The syste... | 2026-11-04 |
| CVE-2025-66954 | medium | 6.5 | No | A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to enumerate valid use... | 2026-11-04 |
| CVE-2025-67841 | high | 7.5 | No | Nordic Semiconductor IronSide SE for nRF54H20 before 23.0.2+17 has an Algorithmic complexity issue. | 2026-11-04 |
| CVE-2025-70023 | critical | 9.8 | No | An issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in transloadit uppy v0.25.6. | 2026-11-04 |
| CVE-2025-65135 | critical | 9.8 | No | In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprts... | 2026-11-04 |
| CVE-2025-65134 | medium | 6.1 | No | In manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.ph... | 2026-11-04 |
| CVE-2025-65133 | critical | 9.8 | No | A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated or authenticated rem... | 2026-11-04 |
| CVE-2025-63939 | critical | 9.8 | No | Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection v... | 2026-11-04 |
| CVE-2025-68128 | not reported | — | No | Rejected reason: reserved but not needed | 2026-11-04 |