Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-114354 | not reported | — | No | Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 t... | 2026-10-28 |
| CVE-2026-114353 | not reported | — | No | Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0... | 2026-10-28 |
| CVE-2026-112407 | high | 8.8 | No | Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authen... | 2026-10-28 |
| CVE-2026-112188 | not reported | — | No | MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration... | 2026-10-28 |
| CVE-2026-10632 | high | 8.7 | No | A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject Ja... | 2026-10-28 |
| CVE-2026-109682 | medium | 4.7 | No | Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host withou... | 2026-10-28 |
| CVE-2026-109681 | medium | 4.7 | No | The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can sp... | 2026-10-28 |
| CVE-2025-58403 | not reported | — | No | CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenti... | 2026-10-28 |
| CVE-2025-30054 | not reported | — | No | CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but du... | 2026-10-28 |
| CVE-2025-30053 | not reported | — | No | The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability w... | 2026-10-28 |
| CVE-2025-30052 | not reported | — | No | The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client'... | 2026-10-28 |
| CVE-2025-30051 | not reported | — | No | The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl conf... | 2026-10-28 |
| CVE-2025-30050 | not reported | — | No | CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter... | 2026-10-28 |
| CVE-2025-30049 | not reported | — | No | The CGM CLININET application stores user passwords as unsalted MD5 hashes. This issue was fixed in versions 2026.MS1 and 2026.MS3 | 2026-10-28 |
| CVE-2025-7043 | medium | 5.4 | No | The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling... | 2026-10-28 |
| CVE-2025-30047 | not reported | — | No | CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used... | 2026-10-28 |
| CVE-2025-30046 | not reported | — | No | In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges... | 2026-10-28 |
| CVE-2025-30045 | not reported | — | No | CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to im... | 2026-10-28 |
| CVE-2025-30043 | not reported | — | No | CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without aut... | 2026-10-28 |
| CVE-2026-87707 | high | 7.8 | No | Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally. | 2026-10-28 |