Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-15034 | critical | 9.8 | No | A security flaw has been discovered in itsourcecode Student Management System 1.0. This affects an unknown part of the file /record.php. The... | 2026-10-19 |
| CVE-2025-12049 | critical | 9.8 | No | Missing Authentication for Critical Function vulnerability in Sharp Display Solutions Media Player MP-01 All Verisons allows a attacker may... | 2026-10-19 |
| CVE-2025-15011 | critical | 9.8 | No | A vulnerability was found in code-projects Simple Stock System 1.0. Impacted is an unknown function of the file /logout.php. The manipulatio... | 2026-10-19 |
| CVE-2025-15008 | critical | 9.8 | No | A vulnerability was detected in Tenda WH450 1.0.0.18. This affects an unknown part of the file /goform/L7Port of the component HTTP Request... | 2026-10-19 |
| CVE-2025-14990 | critical | 9.8 | No | A security flaw has been discovered in Campcodes Complete Online Beauty Parlor Management System 1.0. Impacted is an unknown function of the... | 2026-10-19 |
| CVE-2025-14989 | critical | 9.8 | No | A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This issue affects some unknown processing... | 2026-10-19 |
| CVE-2026-111865 | medium | 5.3 | No | A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the f... | 2026-10-19 |
| CVE-2025-23390 | medium | 6.3 | No | A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connec... | 2026-10-19 |
| CVE-2025-68404 | not reported | — | No | A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability coul... | 2026-10-19 |
| CVE-2025-68403 | not reported | — | No | An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an admi... | 2026-10-19 |
| CVE-2025-66275 | medium | 6.5 | No | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit t... | 2026-10-19 |
| CVE-2025-66272 | medium | 6.5 | No | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit t... | 2026-10-19 |
| CVE-2025-29897 | not reported | — | No | A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user acco... | 2026-10-19 |
| CVE-2025-29896 | not reported | — | No | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then... | 2026-10-19 |
| CVE-2025-29895 | not reported | — | No | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then... | 2026-10-19 |
| CVE-2025-58771 | not reported | — | No | AMI APTIOV contains vulnerabilities in BIOS where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation... | 2026-10-19 |
| CVE-2025-71432 | high | 8.1 | No | Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validatio... | 2026-10-19 |
| CVE-2025-71431 | medium | 5.3 | No | Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-suppli... | 2026-10-19 |
| CVE-2025-71430 | medium | 5.4 | No | Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user nam... | 2026-10-19 |
| CVE-2025-71429 | critical | 9.8 | No | GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to... | 2026-10-19 |