Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-60749 | high | 7.8 | No | DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchup_webhelper.exe. | 2026-10-27 |
| CVE-2025-61498 | high | 7.5 | No | A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows attackers to cause a Denial of Service (DoS) via supplying a... | 2026-10-27 |
| CVE-2025-61196 | high | 8.8 | No | An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter. | 2026-10-27 |
| CVE-2025-60319 | medium | 6.5 | No | PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint... | 2026-10-27 |
| CVE-2025-60542 | medium | 6.5 | No | SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call u... | 2026-10-27 |
| CVE-2025-60355 | critical | 9.8 | No | zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. | 2026-10-27 |
| CVE-2025-60424 | high | 7.6 | No | A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication v... | 2026-10-27 |
| CVE-2025-60553 | critical | 9.8 | No | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard52. | 2026-10-27 |
| CVE-2025-60552 | high | 7.5 | No | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formTcpipSetup. | 2026-10-27 |
| CVE-2025-60550 | high | 7.5 | No | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formEasySetTimezone. | 2026-10-27 |
| CVE-2025-60549 | high | 7.5 | No | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAutoDetecWAN_wizard4. | 2026-10-27 |
| CVE-2025-60570 | high | 7.5 | No | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLogDnsquery. | 2026-10-27 |
| CVE-2025-46185 | medium | 6.2 | No | An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext stora... | 2026-10-27 |
| CVE-2025-50950 | high | 7.5 | No | Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function. | 2026-10-27 |
| CVE-2025-50949 | medium | 6.5 | No | FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8. | 2026-10-27 |
| CVE-2025-62396 | medium | 5.3 | No | An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP h... | 2026-10-27 |
| CVE-2025-60335 | high | 7.5 | No | A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS... | 2026-10-27 |
| CVE-2025-61035 | high | 7.7 | No | The seffaflik thru 0.0.9 is vulnerable to symlink attacks due to incorrect default permissions given to the .kimlik file and .seffaflik file... | 2026-10-27 |
| CVE-2025-52079 | high | 8.8 | No | The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Ch... | 2026-10-27 |
| CVE-2025-61457 | medium | 6.1 | No | code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php. | 2026-10-27 |