Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-59607 | high | 7.8 | No | Memory Corruption when copying large input data exceeds normal allocation limits. | 2026-10-14 |
| CVE-2025-59953 | critical | 9.8 | No | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2,... | 2026-10-14 |
| CVE-2025-43936 | critical | 9.1 | No | Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication vulnerability. An unauthenticated attacker with... | 2026-10-14 |
| CVE-2025-36591 | medium | 4.4 | No | Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Use of a Broken or Risky Cryptographi... | 2026-10-14 |
| CVE-2025-14871 | high | 7.5 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2... | 2026-10-14 |
| CVE-2025-13166 | low | 3.7 | No | The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on... | 2026-10-14 |
| CVE-2025-24890 | medium | 6.8 | No | gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controll... | 2026-10-14 |
| CVE-2025-26790 | low | 3.7 | No | Withsecure Atlant with Capricorn engine before 2025-01-20_02 allows a Remote Denial of Service via an out-of-bounds memory read during proce... | 2026-10-14 |
| CVE-2025-68624 | medium | 4.3 | No | N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound ema... | 2026-10-14 |
| CVE-2025-64031 | low | 2.5 | No | libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compress... | 2026-10-14 |
| CVE-2025-63842 | medium | 5.4 | No | A Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user t... | 2026-10-14 |
| CVE-2025-70820 | low | 3.5 | No | Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder. | 2026-10-14 |
| CVE-2025-64059 | low | 1.8 | No | Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because adm... | 2026-10-14 |
| CVE-2025-45480 | low | 3.0 | No | Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary. | 2026-10-14 |
| CVE-2025-15679 | not reported | — | No | Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequan... | 2026-10-14 |
| CVE-2025-15695 | low | 3.5 | No | The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end sc... | 2026-10-14 |
| CVE-2025-71418 | medium | 5.3 | No | PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server reso... | 2026-10-14 |
| CVE-2026-87675 | medium | 6.8 | No | An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.... | 2026-10-14 |
| CVE-2026-5769 | medium | 4.1 | No | A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory sw... | 2026-10-14 |
| CVE-2026-17507 | high | 7.5 | No | In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so... | 2026-10-14 |