Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-65955 | medium | 6.1 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vu... | 2026-11-04 |
| CVE-2025-65657 | medium | 6.5 | No | FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticate... | 2026-11-04 |
| CVE-2025-65380 | medium | 6.5 | No | PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint. Specifically, the username parameter accepts u... | 2026-11-04 |
| CVE-2025-65379 | medium | 6.5 | No | PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the /admin/password-recovery.php endpoint. Specifically, the username and mo... | 2026-11-04 |
| CVE-2025-65896 | critical | 9.8 | No | SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys. | 2026-11-04 |
| CVE-2025-12544 | medium | 4.8 | No | The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious sc... | 2026-11-04 |
| CVE-2025-11969 | critical | 9.4 | No | The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative... | 2026-11-04 |
| CVE-2025-68392 | not reported | — | No | ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by fo... | 2026-11-04 |
| CVE-2025-12523 | medium | 6.5 | No | Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user | 2026-11-04 |
| CVE-2025-13050 | medium | 5.4 | No | Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user | 2026-11-04 |
| CVE-2025-68645 | high | 8.8 | Listed | A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper... | 2026-11-04 |
| CVE-2026-83128 | high | 7.5 | No | Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are a... | 2026-11-04 |
| CVE-2026-83424 | high | 7.5 | No | Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affec... | 2026-11-04 |
| CVE-2026-91552 | high | 7.5 | No | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are af... | 2026-11-04 |
| CVE-2026-91542 | high | 7.5 | No | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are af... | 2026-11-04 |
| CVE-2026-97373 | medium | 5.8 | No | draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete se... | 2026-11-04 |
| CVE-2026-97701 | medium | 6.5 | No | Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint ren... | 2026-11-04 |
| CVE-2026-93900 | medium | 6.4 | No | The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the... | 2026-11-04 |
| CVE-2026-93866 | not reported | — | No | An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unaut... | 2026-11-04 |
| CVE-2026-93434 | not reported | — | No | An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with acces... | 2026-11-04 |