Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-59230 | not reported | — | Listed | Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authori... | — |
| CVE-2025-24990 | not reported | — | Listed | Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attack... | — |
| CVE-2025-47827 | not reported | — | Listed | IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module impr... | — |
| CVE-2025-54253 | not reported | — | Listed | Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution. | — |
| CVE-2025-33073 | not reported | — | Listed | Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could... | — |
| CVE-2025-2747 | not reported | — | Listed | Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to con... | — |
| CVE-2025-2746 | not reported | — | Listed | Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to con... | — |
| CVE-2022-48503 | not reported | — | Listed | Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead... | — |
| CVE-2025-59287 | not reported | — | Listed | Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execut... | — |
| CVE-2025-54236 | not reported | — | Listed | Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer... | — |
| CVE-2025-6205 | not reported | — | Listed | Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the... | — |
| CVE-2025-6204 | not reported | — | Listed | Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code. | — |
| CVE-2025-24893 | not reported | — | Listed | XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a requ... | — |
| CVE-2025-48703 | not reported | — | Listed | CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code exe... | — |
| CVE-2025-9242 | not reported | — | Listed | WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to... | — |
| CVE-2025-62215 | not reported | — | Listed | Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileg... | — |
| CVE-2025-13223 | not reported | — | Listed | Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption. | — |
| CVE-2021-26829 | not reported | — | Listed | OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm. | — |
| CVE-2021-26828 | not reported | — | Listed | OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload a... | — |
| CVE-2025-66644 | not reported | — | Listed | Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands. | — |