Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2024-11120 | not reported | — | Listed | Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execut... | — |
| CVE-2025-47729 | not reported | — | Listed | TeleMessage TM SGNL contains a hidden functionality vulnerability in which the archiving backend holds cleartext copies of messages from TM... | — |
| CVE-2025-30400 | not reported | — | Listed | Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. | — |
| CVE-2025-32701 | not reported | — | Listed | Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate... | — |
| CVE-2025-32706 | not reported | — | Listed | Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacke... | — |
| CVE-2025-30397 | not reported | — | Listed | Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a netwo... | — |
| CVE-2025-32709 | not reported | — | Listed | Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escala... | — |
| CVE-2025-32756 | not reported | — | Listed | Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated... | — |
| CVE-2024-12987 | not reported | — | Listed | DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cg... | — |
| CVE-2025-42999 | not reported | — | Listed | SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the... | — |
| CVE-2025-4427 | not reported | — | Listed | Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access... | — |
| CVE-2025-4428 | not reported | — | Listed | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to... | — |
| CVE-2024-11182 | not reported | — | Listed | MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via... | — |
| CVE-2025-27920 | not reported | — | Listed | Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended... | — |
| CVE-2024-27443 | not reported | — | Listed | Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user in... | — |
| CVE-2023-38950 | not reported | — | Listed | ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via... | — |
| CVE-2025-4632 | not reported | — | Listed | Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority. | — |
| CVE-2023-39780 | not reported | — | Listed | ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary co... | — |
| CVE-2024-56145 | not reported | — | Listed | Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini con... | — |
| CVE-2025-35939 | not reported | — | Listed | Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated c... | — |