Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-49602 | critical | 9.8 | No | An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session,... | 2026-11-04 |
| CVE-2025-68395 | not reported | — | No | ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject... | 2026-11-04 |
| CVE-2025-68394 | not reported | — | No | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by... | 2026-11-04 |
| CVE-2025-68393 | not reported | — | No | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by... | 2026-11-04 |
| CVE-2025-68391 | not reported | — | No | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and overr... | 2026-11-04 |
| CVE-2025-31704 | critical | 9.8 | No | A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the a... | 2026-11-04 |
| CVE-2025-62841 | not reported | — | No | An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploit... | 2026-11-04 |
| CVE-2025-62839 | not reported | — | No | An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploit... | 2026-11-04 |
| CVE-2025-14260 | high | 8.3 | No | Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on af... | 2026-11-04 |
| CVE-2025-30414 | high | 7.1 | No | Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows)... | 2026-11-04 |
| CVE-2025-30053 | not reported | — | No | The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability w... | 2026-11-04 |
| CVE-2025-7203 | medium | 4.9 | No | The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore... | 2026-11-04 |
| CVE-2025-7043 | medium | 5.4 | No | The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling... | 2026-11-04 |
| CVE-2025-6623 | medium | 4.3 | No | The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection... | 2026-11-04 |
| CVE-2025-13591 | medium | 5.3 | No | The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the syst... | 2026-11-04 |
| CVE-2025-13173 | medium | 6.5 | No | Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initia... | 2026-11-04 |
| CVE-2025-10149 | high | 8.2 | No | The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store.... | 2026-11-04 |
| CVE-2025-70521 | critical | 9.8 | No | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lac... | 2026-11-04 |
| CVE-2025-70518 | critical | 10.0 | No | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lac... | 2026-11-04 |
| CVE-2025-56565 | high | 7.6 | No | DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within no... | 2026-11-04 |