Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-66489 | critical | 9.8 | No | Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password v... | 2026-10-18 |
| CVE-2025-66409 | critical | 9.1 | No | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is en... | 2026-10-18 |
| CVE-2025-66410 | critical | 9.1 | No | Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at wi... | 2026-10-18 |
| CVE-2025-66405 | critical | 9.8 | No | Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL... | 2026-10-18 |
| CVE-2025-13788 | critical | 9.8 | No | A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribut... | 2026-10-18 |
| CVE-2025-13787 | critical | 9.1 | No | A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of... | 2026-10-18 |
| CVE-2025-13786 | critical | 9.8 | No | A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Impacted is the function fetch of the file /ind... | 2026-10-18 |
| CVE-2025-13783 | critical | 9.8 | No | A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/... | 2026-10-18 |
| CVE-2025-66034 | critical | 9.8 | No | fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3... | 2026-10-18 |
| CVE-2025-66222 | critical | 9.6 | No | DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability... | 2026-10-18 |
| CVE-2025-64443 | critical | 9.6 | No | MCP Gateway allows easy and secure running and deployment of MCP servers. In versions 0.27.0 and earlier, when MCP Gateway runs in sse or st... | 2026-10-18 |
| CVE-2025-13390 | critical | 9.8 | No | The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrec... | 2026-10-18 |
| CVE-2025-55182 | critical | 10.0 | Listed | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 inclu... | 2026-10-18 |
| CVE-2025-64081 | critical | 9.8 | No | SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attac... | 2026-10-18 |
| CVE-2025-66509 | critical | 9.8 | No | LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header... | 2026-10-18 |
| CVE-2025-66576 | critical | 9.8 | No | Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing un... | 2026-10-18 |
| CVE-2025-14015 | critical | 9.8 | No | A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file /goform/aspForm. This ma... | 2026-10-18 |
| CVE-2026-96425 | medium | 5.5 | No | Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus | 2026-10-18 |
| CVE-2026-96424 | high | 7.8 | No | Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over... | 2026-10-18 |
| CVE-2026-86573 | medium | 5.1 | No | Out-of-bounds write vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. This issue aff... | 2026-10-18 |