Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-49425 | medium | 5.5 | No | The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct... | 2026-10-27 |
| CVE-2026-49424 | medium | 5.5 | No | The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the sta... | 2026-10-27 |
| CVE-2025-62686 | medium | 6.2 | No | A local privilege escalation vulnerability exists in the Plugin Alliance InstallationHelper service included with Plugin Alliance Installati... | 2026-10-27 |
| CVE-2025-63334 | critical | 9.8 | No | PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php compo... | 2026-10-27 |
| CVE-2025-63418 | medium | 6.1 | No | A DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows attackers to execute arbitrary JavaScript in the... | 2026-10-27 |
| CVE-2025-63417 | high | 7.2 | No | A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest platform 2023.3 allows authenticated attackers t... | 2026-10-27 |
| CVE-2025-63248 | high | 7.5 | No | DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire, replacing the questionnaire ID with the ID of anot... | 2026-10-27 |
| CVE-2025-57244 | medium | 5.4 | No | OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. The Name field ac... | 2026-10-27 |
| CVE-2025-54335 | medium | 6.5 | No | An issue was discovered in the GPU driver in Samsung Mobile Processor Exynos 1480, 2400, 1580, 2500. There is a use-after-free in the Xclips... | 2026-10-27 |
| CVE-2025-52910 | critical | 9.8 | No | An issue was discovered in the GPU in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1330, 1380, 1480, 2400. A Use-After... | 2026-10-27 |
| CVE-2025-50363 | medium | 5.4 | No | Phpgurukul Maid Hiring Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in /maid-hiring.php va the name field. | 2026-10-27 |
| CVE-2025-63561 | high | 7.5 | No | Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition... | 2026-10-27 |
| CVE-2025-60749 | high | 7.8 | No | DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchup_webhelper.exe. | 2026-10-27 |
| CVE-2025-61498 | high | 7.5 | No | A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows attackers to cause a Denial of Service (DoS) via supplying a... | 2026-10-27 |
| CVE-2025-61196 | high | 8.8 | No | An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter. | 2026-10-27 |
| CVE-2025-60319 | medium | 6.5 | No | PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint... | 2026-10-27 |
| CVE-2025-60542 | medium | 6.5 | No | SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call u... | 2026-10-27 |
| CVE-2025-60355 | critical | 9.8 | No | zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. | 2026-10-27 |
| CVE-2025-60424 | high | 7.6 | No | A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication v... | 2026-10-27 |
| CVE-2025-60553 | critical | 9.8 | No | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard52. | 2026-10-27 |