Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110625 | medium | 6.1 | No | ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded ty... | 2026-10-14 |
| CVE-2023-0687 | critical | 9.8 | No | A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of t... | 2026-10-14 |
| CVE-2025-65474 | critical | 9.8 | No | An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute ar... | 2026-10-14 |
| CVE-2025-14518 | critical | 9.8 | No | A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/... | 2026-10-14 |
| CVE-2025-34394 | critical | 9.8 | No | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service that is insuffi... | 2026-10-14 |
| CVE-2025-34393 | critical | 9.8 | No | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify the name of an attack... | 2026-10-14 |
| CVE-2025-34392 | critical | 9.8 | No | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-... | 2026-10-14 |
| CVE-2025-14087 | critical | 9.8 | No | A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service o... | 2026-10-14 |
| CVE-2025-66456 | critical | 9.8 | No | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4... | 2026-10-14 |
| CVE-2025-64113 | critical | 9.8 | No | Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby... | 2026-10-14 |
| CVE-2025-14337 | critical | 9.8 | No | A vulnerability was determined in itsourcecode Student Management System 1.0. This affects an unknown part of the file /new_grade.php. This... | 2026-10-14 |
| CVE-2025-14336 | critical | 9.8 | No | A vulnerability was found in itsourcecode Student Management System 1.0. Affected by this issue is some unknown functionality of the file /p... | 2026-10-14 |
| CVE-2025-14335 | critical | 9.8 | No | A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of... | 2026-10-14 |
| CVE-2025-14334 | critical | 9.8 | No | A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /new_adviser.php. Executing... | 2026-10-14 |
| CVE-2025-64672 | critical | 9.0 | No | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att... | 2026-10-14 |
| CVE-2025-66568 | critical | 9.1 | No | The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentica... | 2026-10-14 |
| CVE-2025-66567 | critical | 9.1 | No | The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an... | 2026-10-14 |
| CVE-2025-8110 | high | 8.8 | Listed | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. | 2026-10-14 |
| CVE-2026-84247 | medium | 6.5 | No | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerabi... | 2026-10-14 |
| CVE-2026-84246 | critical | 9.8 | No | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. | 2026-10-14 |