Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-64052 | medium | 5.1 | No | An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system comman... | 2026-11-04 |
| CVE-2025-65900 | medium | 6.5 | No | Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient per... | 2026-11-04 |
| CVE-2025-65899 | medium | 5.3 | No | Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error... | 2026-11-04 |
| CVE-2025-63896 | high | 7.6 | No | An issue in the Bluetooth Human Interface Device (HID) of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject... | 2026-11-04 |
| CVE-2025-55948 | high | 7.3 | No | This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control (RBAC) through dual de... | 2026-11-04 |
| CVE-2025-65806 | medium | 4.3 | No | The E-POINT CMS eagle.gsam-1169.1 file upload feature improperly handles nested archive files. An attacker can upload a nested ZIP (a ZIP co... | 2026-11-04 |
| CVE-2025-29269 | critical | 9.8 | No | ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoin... | 2026-11-04 |
| CVE-2025-29268 | critical | 9.8 | No | ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library. | 2026-11-04 |
| CVE-2025-65637 | high | 7.5 | No | A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64... | 2026-11-04 |
| CVE-2025-66373 | medium | 4.8 | No | Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggl... | 2026-11-04 |
| CVE-2025-65516 | medium | 6.1 | No | A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is conf... | 2026-11-04 |
| CVE-2025-63681 | medium | 4.3 | No | open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying... | 2026-11-04 |
| CVE-2025-61148 | medium | 6.5 | No | An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access... | 2026-11-04 |
| CVE-2025-57213 | high | 7.5 | No | Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a... | 2026-11-04 |
| CVE-2025-57210 | high | 7.5 | No | Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unsp... | 2026-11-04 |
| CVE-2025-56427 | high | 7.5 | No | Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_... | 2026-11-04 |
| CVE-2025-65346 | critical | 9.1 | No | alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows ar... | 2026-11-04 |
| CVE-2025-54307 | high | 8.8 | No | An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. The /configure/plugins/plugin/upload/zip/ and /configu... | 2026-11-04 |
| CVE-2025-54306 | high | 7.2 | No | An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. A remote code execution vulnerability exists in the ne... | 2026-11-04 |
| CVE-2025-54305 | high | 7.8 | No | An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. One of the middlewares included in this application, L... | 2026-11-04 |