Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2024-11182 | not reported | — | Listed | MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via... | — |
| CVE-2025-27920 | not reported | — | Listed | Srimax Output Messenger contains a directory traversal vulnerability that allows an attacker to access sensitive files outside the intended... | — |
| CVE-2024-27443 | not reported | — | Listed | Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user in... | — |
| CVE-2023-38950 | not reported | — | Listed | ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via... | — |
| CVE-2025-4632 | not reported | — | Listed | Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority. | — |
| CVE-2023-39780 | not reported | — | Listed | ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary co... | — |
| CVE-2024-56145 | not reported | — | Listed | Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini con... | — |
| CVE-2025-35939 | not reported | — | Listed | Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated c... | — |
| CVE-2025-3935 | not reported | — | Listed | ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attac... | — |
| CVE-2021-32030 | not reported | — | Listed | ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized acce... | — |
| CVE-2025-27038 | not reported | — | Listed | Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics... | — |
| CVE-2025-21480 | not reported | — | Listed | Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthor... | — |
| CVE-2025-21479 | not reported | — | Listed | Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthor... | — |
| CVE-2025-5419 | not reported | — | Listed | Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap cor... | — |
| CVE-2025-32433 | not reported | — | Listed | Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute... | — |
| CVE-2024-42009 | not reported | — | Listed | RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails o... | — |
| CVE-2025-24016 | not reported | — | Listed | Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code execution on Wazuh servers. | — |
| CVE-2025-33053 | not reported | — | Listed | Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote... | — |
| CVE-2023-33538 | not reported | — | Listed | TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetw... | — |
| CVE-2023-0386 | not reported | — | Listed | Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with cap... | — |