Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-67259 | medium | 6.5 | No | A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthor... | 2026-11-04 |
| CVE-2025-59308 | medium | 4.7 | No | In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site... | 2026-11-04 |
| CVE-2025-61872 | medium | 6.1 | No | Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. This occur... | 2026-11-04 |
| CVE-2025-70994 | high | 7.3 | No | Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless entry system. The syste... | 2026-11-04 |
| CVE-2025-66954 | medium | 6.5 | No | A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to enumerate valid use... | 2026-11-04 |
| CVE-2025-67841 | high | 7.5 | No | Nordic Semiconductor IronSide SE for nRF54H20 before 23.0.2+17 has an Algorithmic complexity issue. | 2026-11-04 |
| CVE-2025-70023 | critical | 9.8 | No | An issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in transloadit uppy v0.25.6. | 2026-11-04 |
| CVE-2025-65135 | critical | 9.8 | No | In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprts... | 2026-11-04 |
| CVE-2025-65134 | medium | 6.1 | No | In manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.ph... | 2026-11-04 |
| CVE-2025-65133 | critical | 9.8 | No | A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated or authenticated rem... | 2026-11-04 |
| CVE-2025-63939 | critical | 9.8 | No | Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection v... | 2026-11-04 |
| CVE-2025-68128 | not reported | — | No | Rejected reason: reserved but not needed | 2026-11-04 |
| CVE-2025-26433 | high | 8.4 | No | In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could le... | 2026-11-04 |
| CVE-2025-22436 | high | 8.4 | No | In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack. This co... | 2026-11-04 |
| CVE-2025-71450 | low | 3.3 | No | inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an em... | 2026-11-04 |
| CVE-2025-62819 | not reported | — | No | Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA (Registration Au... | 2026-11-04 |
| CVE-2025-13647 | medium | 5.8 | No | The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This... | 2026-11-04 |
| CVE-2025-9462 | medium | 6.5 | No | The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including,... | 2026-11-04 |
| CVE-2025-11455 | medium | 4.3 | No | The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json... | 2026-11-04 |
| CVE-2025-8574 | high | 8.7 | No | The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due... | 2026-11-04 |