Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-56352 | high | 7.5 | No | In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), the broker mishandles protocol violations during CONNECT packet pa... | 2026-11-04 |
| CVE-2025-67031 | medium | 6.3 | No | ORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote Code Execution vulnerability in the partic... | 2026-11-04 |
| CVE-2025-69443 | medium | 6.3 | No | Remote Code Execution in coleam00 Archon 0.1.0. A crafted HTML page, when accessed by a victim, can execute commands, run prompts on behalf... | 2026-11-04 |
| CVE-2025-27853 | high | 7.3 | No | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU web site only performs... | 2026-11-04 |
| CVE-2025-27852 | medium | 5.0 | No | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack. This allows an att... | 2026-11-04 |
| CVE-2025-27851 | critical | 9.3 | No | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses,... | 2026-11-04 |
| CVE-2025-27850 | high | 7.5 | No | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing syml... | 2026-11-04 |
| CVE-2025-70842 | medium | 5.4 | No | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3. The flaw allows an authen... | 2026-11-04 |
| CVE-2025-61311 | high | 7.3 | No | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_alerts.php component of GmbH Mecury Managed Print Services (docuForm) v1... | 2026-11-04 |
| CVE-2025-61310 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the acc-menu_billings.php component of GmbH Mecury Managed Print Services (docuForm)... | 2026-11-04 |
| CVE-2025-61309 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_departments.php component of GmbH Mecury Managed Print Services (docuFor... | 2026-11-04 |
| CVE-2025-61308 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_maintenance.php component of GmbH Mecury Managed Print Services (docuFor... | 2026-11-04 |
| CVE-2025-61307 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the acc-menu_papers.php component of GmbH Mecury Managed Print Services (docuForm) v1... | 2026-11-04 |
| CVE-2025-61306 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_coveragealerts.php component of GmbH Mecury Managed Print Services (docu... | 2026-11-04 |
| CVE-2025-61305 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_firmware.php component of GmbH Mecury Managed Print Services (docuForm)... | 2026-11-04 |
| CVE-2025-69599 | critical | 9.8 | No | RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable.... | 2026-11-04 |
| CVE-2025-67888 | high | 7.3 | No | An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php (whe... | 2026-11-04 |
| CVE-2025-67887 | critical | 9.8 | No | 1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload... | 2026-11-04 |
| CVE-2025-67886 | medium | 6.3 | No | Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload... | 2026-11-04 |
| CVE-2025-65122 | high | 7.5 | No | Regex Denial of Service in youtube-regex npm package through version 1.0.5. | 2026-11-04 |