Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2021-46848 | critical | 9.1 | No | GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der. | 2026-10-14 |
| CVE-2025-9661 | critical | 9.8 | No | OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and... | 2026-10-14 |
| CVE-2025-13030 | critical | 9.8 | No | All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An... | 2026-10-14 |
| CVE-2025-59947 | critical | 9.0 | No | NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger... | 2026-10-14 |
| CVE-2025-67906 | critical | 9.0 | No | In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. | 2026-10-14 |
| CVE-2025-67896 | critical | 9.8 | No | Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records... | 2026-10-14 |
| CVE-2025-45871 | high | 8.1 | No | LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated... | 2026-10-14 |
| CVE-2025-71384 | medium | 6.7 | No | Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer... | 2026-10-14 |
| CVE-2025-71383 | critical | 9.8 | No | Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/lo... | 2026-10-14 |
| CVE-2025-8352 | not reported | — | No | Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), lea... | 2026-10-14 |
| CVE-2025-15591 | not reported | — | No | Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious c... | 2026-10-14 |
| CVE-2025-15643 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b... | 2026-10-14 |
| CVE-2025-12828 | medium | 6.4 | No | The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all version... | 2026-10-14 |
| CVE-2025-71427 | medium | 6.8 | No | Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside t... | 2026-10-14 |
| CVE-2025-31980 | medium | 4.3 | No | HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated... | 2026-10-14 |
| CVE-2025-41753 | critical | 9.8 | No | The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative pa... | 2026-10-14 |
| CVE-2025-14564 | medium | 6.4 | No | The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to,... | 2026-10-14 |
| CVE-2025-33207 | medium | 6.8 | No | NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control... | 2026-10-14 |
| CVE-2025-71426 | high | 7.1 | No | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.4.1, a recovering Coordinator does not verify the seed sup... | 2026-10-14 |
| CVE-2025-71425 | high | 7.3 | No | Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is c... | 2026-10-14 |