Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-32000 | medium | 4.3 | No | HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is... | 2026-10-14 |
| CVE-2025-63564 | critical | 9.8 | No | SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP re... | 2026-10-14 |
| CVE-2025-1281 | high | 8.8 | No | The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_r... | 2026-10-14 |
| CVE-2025-1280 | medium | 6.5 | No | The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page... | 2026-10-14 |
| CVE-2025-14487 | medium | 5.3 | No | The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all vers... | 2026-10-14 |
| CVE-2025-14486 | medium | 5.3 | No | The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to,... | 2026-10-14 |
| CVE-2025-14484 | medium | 5.3 | No | The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions u... | 2026-10-14 |
| CVE-2025-71421 | high | 7.2 | No | UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with... | 2026-10-14 |
| CVE-2025-71420 | medium | 4.3 | No | UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agen... | 2026-10-14 |
| CVE-2025-71419 | medium | 5.4 | No | UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier paramete... | 2026-10-14 |
| CVE-2025-12999 | not reported | — | No | UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forward... | 2026-10-14 |
| CVE-2025-15698 | low | 3.5 | No | The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege... | 2026-10-14 |
| CVE-2025-66455 | critical | 9.8 | No | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0,... | 2026-10-14 |
| CVE-2025-61682 | high | 8.6 | No | Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions star... | 2026-10-14 |
| CVE-2025-53837 | critical | 9.9 | No | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XH... | 2026-10-14 |
| CVE-2025-36421 | medium | 5.9 | No | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain... | 2026-10-14 |
| CVE-2025-56566 | medium | 4.6 | No | MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker... | 2026-10-14 |
| CVE-2026-70219 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 2026-10-14 |
| CVE-2026-88151 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 2026-10-14 |
| CVE-2026-88153 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 2026-10-14 |