Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-30201 | critical | 9.1 | No | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wa... | 2026-10-19 |
| CVE-2025-64428 | critical | 9.8 | No | Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was add... | 2026-10-19 |
| CVE-2025-13168 | critical | 9.8 | No | A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_e... | 2026-10-19 |
| CVE-2025-64717 | critical | 9.8 | No | ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulner... | 2026-10-19 |
| CVE-2025-64164 | critical | 9.8 | No | Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly filter when establishi... | 2026-10-19 |
| CVE-2025-64163 | critical | 9.8 | No | DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// a... | 2026-10-19 |
| CVE-2025-62596 | critical | 10.0 | No | Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-ta... | 2026-10-19 |
| CVE-2025-62161 | critical | 10.0 | No | Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, a... | 2026-10-19 |
| CVE-2025-47776 | critical | 9.1 | No | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Due to incorrect use of loose (==) instead of strict (===) comparison in the... | 2026-10-19 |
| CVE-2025-12642 | critical | 9.1 | No | lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Hea... | 2026-10-19 |
| CVE-2025-11201 | critical | 9.8 | No | MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to... | 2026-10-19 |
| CVE-2025-11200 | critical | 9.8 | No | MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication o... | 2026-10-19 |
| CVE-2025-64103 | critical | 9.8 | No | Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requ... | 2026-10-19 |
| CVE-2025-64102 | critical | 9.8 | No | Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force a... | 2026-10-19 |
| CVE-2025-12268 | critical | 9.8 | No | A vulnerability has been found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Impacted is an unknown function of the file /ap... | 2026-10-19 |
| CVE-2025-12480 | critical | 9.1 | Listed | Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even... | 2026-10-19 |
| CVE-2025-62593 | high | 8.8 | Listed | Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE... | 2026-10-19 |
| CVE-2026-69994 | high | 7.5 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-19 |
| CVE-2026-69995 | high | 7.5 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-19 |
| CVE-2026-69996 | high | 7.5 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-19 |