Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-61311 | high | 7.3 | No | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_alerts.php component of GmbH Mecury Managed Print Services (docuForm) v1... | 2026-11-04 |
| CVE-2025-61310 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the acc-menu_billings.php component of GmbH Mecury Managed Print Services (docuForm)... | 2026-11-04 |
| CVE-2025-61309 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_departments.php component of GmbH Mecury Managed Print Services (docuFor... | 2026-11-04 |
| CVE-2025-61308 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_maintenance.php component of GmbH Mecury Managed Print Services (docuFor... | 2026-11-04 |
| CVE-2025-61307 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the acc-menu_papers.php component of GmbH Mecury Managed Print Services (docuForm) v1... | 2026-11-04 |
| CVE-2025-61306 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_coveragealerts.php component of GmbH Mecury Managed Print Services (docu... | 2026-11-04 |
| CVE-2025-61305 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_firmware.php component of GmbH Mecury Managed Print Services (docuForm)... | 2026-11-04 |
| CVE-2025-69599 | critical | 9.8 | No | RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable.... | 2026-11-04 |
| CVE-2025-67888 | high | 7.3 | No | An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php (whe... | 2026-11-04 |
| CVE-2025-67887 | critical | 9.8 | No | 1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload... | 2026-11-04 |
| CVE-2025-67886 | medium | 6.3 | No | Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload... | 2026-11-04 |
| CVE-2025-65122 | high | 7.5 | No | Regex Denial of Service in youtube-regex npm package through version 1.0.5. | 2026-11-04 |
| CVE-2025-63704 | critical | 9.8 | No | NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query param... | 2026-11-04 |
| CVE-2025-63703 | critical | 9.8 | No | npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js(). | 2026-11-04 |
| CVE-2025-67202 | medium | 6.1 | No | Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via craft... | 2026-11-04 |
| CVE-2025-63705 | high | 8.8 | No | NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js. | 2026-11-04 |
| CVE-2025-66369 | high | 7.5 | No | An issue was discovered in MM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380,... | 2026-11-04 |
| CVE-2025-67796 | high | 8.1 | No | IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other... | 2026-11-04 |
| CVE-2025-70071 | medium | 5.9 | No | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray() | 2026-11-04 |
| CVE-2025-70072 | medium | 6.5 | No | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter::ConvertMeshMultiMat... | 2026-11-04 |