Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-112905 | critical | 9.0 | No | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authentica... | 2026-11-04 |
| CVE-2026-112348 | medium | 6.5 | No | Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend f... | 2026-11-04 |
| CVE-2015-20130 | medium | 6.1 | No | Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log... | 2026-11-04 |
| CVE-2025-63361 | medium | 5.7 | No | Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discov... | 2026-11-04 |
| CVE-2025-57212 | high | 7.5 | No | Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a cra... | 2026-11-04 |
| CVE-2025-60736 | critical | 9.8 | No | code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter. | 2026-11-04 |
| CVE-2025-65881 | medium | 6.1 | No | Sourcecodester Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /classes/Login.php. | 2026-11-04 |
| CVE-2025-65844 | high | 7.5 | No | EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The e... | 2026-11-04 |
| CVE-2025-65215 | medium | 6.1 | No | Sourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplier... | 2026-11-04 |
| CVE-2025-60854 | critical | 9.8 | No | A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change r... | 2026-11-04 |
| CVE-2025-58386 | critical | 9.8 | No | In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorizatio... | 2026-11-04 |
| CVE-2025-65186 | medium | 6.1 | No | Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown... | 2026-11-04 |
| CVE-2025-64070 | medium | 5.4 | No | Sourcecodester Student Grades Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the Add New Subject Description field. | 2026-11-04 |
| CVE-2025-65187 | medium | 6.1 | No | A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject... | 2026-11-04 |
| CVE-2025-63872 | medium | 6.1 | No | DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript execution through model-generated SVG content. | 2026-11-04 |
| CVE-2025-59704 | medium | 4.6 | No | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow an atta... | 2026-11-04 |
| CVE-2025-59703 | critical | 9.1 | No | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physi... | 2026-11-04 |
| CVE-2025-59705 | medium | 6.8 | No | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physi... | 2026-11-04 |
| CVE-2025-59702 | high | 7.2 | No | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physi... | 2026-11-04 |
| CVE-2025-59701 | medium | 4.1 | No | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physi... | 2026-11-04 |