Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-10796 | critical | 9.8 | No | A vulnerability was found in code-projects Hostel Management System 1.0. This vulnerability affects unknown code of the file /justines/admin... | 2026-09-30 |
| CVE-2025-10768 | critical | 9.8 | No | A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the compon... | 2026-09-30 |
| CVE-2025-10564 | critical | 9.8 | No | A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=... | 2026-09-30 |
| CVE-2025-10479 | critical | 9.8 | No | A security flaw has been discovered in SourceCodester Online Student File Management System 1.0. The impacted element is an unknown function... | 2026-09-30 |
| CVE-2025-10405 | critical | 9.8 | No | A vulnerability was determined in itsourcecode Baptism Information Management System 1.0. Affected is an unknown function of the file /listb... | 2026-09-30 |
| CVE-2025-40690 | critical | 9.8 | No | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and dele... | 2026-09-30 |
| CVE-2025-10097 | critical | 9.8 | No | A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execut... | 2026-09-30 |
| CVE-2025-10091 | critical | 9.8 | No | A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectMana... | 2026-09-30 |
| CVE-2025-10068 | critical | 9.8 | No | A flaw has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin/admin_forum/add_views... | 2026-09-30 |
| CVE-2025-58371 | critical | 9.8 | No | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanit... | 2026-09-30 |
| CVE-2026-91149 | high | 7.5 | No | A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simulta... | 2026-09-30 |
| CVE-2026-47097 | high | 7.5 | No | AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensit... | 2026-09-30 |
| CVE-2026-97316 | medium | 5.8 | No | The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing una... | 2026-09-30 |
| CVE-2026-97026 | low | 3.9 | No | Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems wi... | 2026-09-30 |
| CVE-2026-97059 | high | 8.2 | No | DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the Pixe... | 2026-09-30 |
| CVE-2026-96281 | medium | 6.2 | No | On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing... | 2026-09-30 |
| CVE-2026-94953 | high | 8.8 | No | A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It... | 2026-09-30 |
| CVE-2026-94954 | high | 8.8 | No | A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It... | 2026-09-30 |
| CVE-2026-93332 | medium | 5.4 | No | Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged us... | 2026-09-30 |
| CVE-2026-93353 | low | 3.1 | No | copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, a... | 2026-09-30 |