Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-58086 | high | 8.1 | No | As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jail... | 2026-10-27 |
| CVE-2026-58085 | high | 7.5 | No | After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step su... | 2026-10-27 |
| CVE-2026-58084 | medium | 5.5 | No | To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a time... | 2026-10-27 |
| CVE-2026-58083 | high | 8.4 | No | While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list be... | 2026-10-27 |
| CVE-2026-58082 | critical | 9.8 | No | The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Some ISO-2022 variants can... | 2026-10-27 |
| CVE-2026-58081 | critical | 9.8 | No | Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before wri... | 2026-10-27 |
| CVE-2026-49425 | medium | 5.5 | No | The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct... | 2026-10-27 |
| CVE-2026-49424 | medium | 5.5 | No | The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the sta... | 2026-10-27 |
| CVE-2025-62686 | medium | 6.2 | No | A local privilege escalation vulnerability exists in the Plugin Alliance InstallationHelper service included with Plugin Alliance Installati... | 2026-10-27 |
| CVE-2025-63334 | critical | 9.8 | No | PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php compo... | 2026-10-27 |
| CVE-2025-63418 | medium | 6.1 | No | A DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows attackers to execute arbitrary JavaScript in the... | 2026-10-27 |
| CVE-2025-63417 | high | 7.2 | No | A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest platform 2023.3 allows authenticated attackers t... | 2026-10-27 |
| CVE-2025-63248 | high | 7.5 | No | DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire, replacing the questionnaire ID with the ID of anot... | 2026-10-27 |
| CVE-2025-57244 | medium | 5.4 | No | OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. The Name field ac... | 2026-10-27 |
| CVE-2025-54335 | medium | 6.5 | No | An issue was discovered in the GPU driver in Samsung Mobile Processor Exynos 1480, 2400, 1580, 2500. There is a use-after-free in the Xclips... | 2026-10-27 |
| CVE-2025-52910 | critical | 9.8 | No | An issue was discovered in the GPU in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1330, 1380, 1480, 2400. A Use-After... | 2026-10-27 |
| CVE-2025-50363 | medium | 5.4 | No | Phpgurukul Maid Hiring Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in /maid-hiring.php va the name field. | 2026-10-27 |
| CVE-2025-63561 | high | 7.5 | No | Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition... | 2026-10-27 |
| CVE-2025-60749 | high | 7.8 | No | DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchup_webhelper.exe. | 2026-10-27 |
| CVE-2025-61498 | high | 7.5 | No | A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows attackers to cause a Denial of Service (DoS) via supplying a... | 2026-10-27 |