FXBIA/cve-intelligence-stream huggingface dataset:
CVE ID: CVE-2026-5525 Severity: HIGH (CVSS 7.8) CWE: CWE-121 Affected: cpe:2.3:a:notepad-plus-plus:notepad\+\+:8.9.3:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A stack-based buffer overflow vulnerability exists in Notepad++ version 8.9.3 in the file drop handler component. When a user drags and drops a directory path of exactly 259 characters without a trailing backslash, the application appends a backslash and null terminator without proper bounds checking, resulting in a stack buffer overflow and application crash (STATUS_STACK_BUFFER_OVERRUN).
CVE ID: CVE-2026-40989 Severity: MEDIUM (CVSS 6.5) CWE: CWE-674 Affected: cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.
CVE ID: CVE-2026-40990 Severity: MEDIUM (CVSS 6.5) CWE: CWE-770 Affected: cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.
CVE ID: CVE-2026-34993 Severity: HIGH (CVSS 7.3) CWE: CWE-502 Affected: cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.
CVE ID: CVE-2026-47265 Severity: MEDIUM (CVSS 6.6) CWE: CWE-346 Affected: cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.
CVE ID: CVE-2026-50256 Severity: HIGH (CVSS 7.8) CWE: CWE-121 KEV (actively exploited): NO Description: A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE ID: CVE-2026-50257 Severity: HIGH (CVSS 7.8) CWE: CWE-416 KEV (actively exploited): NO Description: A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE ID: CVE-2026-50258 Severity: HIGH (CVSS 7.8) CWE: CWE-121 KEV (actively exploited): NO Description: A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE ID: CVE-2026-50259 Severity: HIGH (CVSS 7.8) CWE: CWE-121 KEV (actively exploited): NO Description: A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE ID: CVE-2026-50260 Severity: HIGH (CVSS 7.8) CWE: CWE-416 KEV (actively exploited): NO Description: A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE ID: CVE-2026-50261 Severity: HIGH (CVSS 7.8) CWE: CWE-416 KEV (actively exploited): NO Description: A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE ID: CVE-2026-50262 Severity: MEDIUM (CVSS 5.5) CWE: CWE-125 KEV (actively exploited): NO Description: An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.
CVE ID: CVE-2026-50263 Severity: MEDIUM (CVSS 5.5) CWE: CWE-416 KEV (actively exploited): NO Description: A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.
CVE ID: CVE-2026-50264 Severity: HIGH (CVSS 7.8) CWE: CWE-787 KEV (actively exploited): NO Description: An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE ID: CVE-2026-11312 Severity: LOW (CVSS 1.9) CWE: CWE-404, CWE-407 KEV (actively exploited): NO Description: A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE ID: CVE-2026-49777 Severity: CRITICAL (CVSS 10.0) CWE: CWE-1284 KEV (actively exploited): NO Description: Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.3. No patched version is available - the vendor has applied a fix to an existing release without publishing a new version. While the patch provided by the vendor is valid, releasing it under the existing version number leaves users unable to reliably determine whether they are running a patched or vulnerable installation. As a result, we treat this as an unpatched version.
CVE ID: CVE-2026-11329 Severity: LOW (CVSS 2.0) CWE: CWE-327, CWE-328 KEV (actively exploited): NO Description: A vulnerability has been found in onnx onnx-mlir up to 0.5.0.0. Affected by this issue is the function generate_hash_key of the file src/Runtime/python/torch_onnxmlir/src/torch_onnxmlir/backend.py of the component Placeholder Node Cache Handler. Such manipulation leads to use of weak hash. An attack has to be approached locally. A high complexity level is associated with this attack. The exploitation is known to be difficult. The name of the patch is 72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4. Applying a patch is advised to resolve this issue.
CVE ID: CVE-2026-10870 Severity: HIGH (CVSS 7.3) CWE: CWE-77, CWE-78 KEV (actively exploited): NO Description: A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This project is superseded by FreshTomato.
CVE ID: CVE-2026-10871 Severity: HIGH (CVSS 7.3) CWE: CWE-77, CWE-78 KEV (actively exploited): NO Description: A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function start_6rd_tunnel of the file /sbin/rc of the component Web UI. Such manipulation of the argument ipv6_6rd_borderrelay leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This project is superseded by FreshTomato.
CVE ID: CVE-2026-10872 Severity: HIGH (CVSS 7.3) CWE: CWE-77, CWE-78 KEV (actively exploited): NO Description: A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. This project is superseded by FreshTomato.
CVE ID: CVE-2026-10874 Severity: LOW (CVSS 2.1) CWE: CWE-74, CWE-89 KEV (actively exploited): NO Description: A vulnerability was identified in projectworlds Online Art Gallery Shop Project 1.0. The affected element is an unknown function of the file /admin/adminHome.php. The manipulation of the argument social_insta leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVE ID: CVE-2026-10875 Severity: LOW (CVSS 2.1) CWE: CWE-74, CWE-89 KEV (actively exploited): NO Description: A security flaw has been discovered in projectworlds Online Art Gallery Shop Project 1.0. The impacted element is an unknown function of the file /admin/adminHome.ph. The manipulation of the argument social_twitter results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVE ID: CVE-2026-10586 Severity: HIGH (CVSS 7.2) CWE: CWE-918 KEV (actively exploited): NO Description: The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.3 via the `save_ai_generated_image()` function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVE ID: CVE-2026-10876 Severity: LOW (CVSS 2.1) CWE: CWE-266, CWE-285 KEV (actively exploited): NO Description: A weakness has been identified in SourceCodester Ship Ferry Ticket Reservation System 1.0. This affects an unknown function of the file /admin/. This manipulation of the argument page causes improper authorization. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
CVE ID: CVE-2026-10877 Severity: MEDIUM (CVSS 5.5) CWE: CWE-74, CWE-89 KEV (actively exploited): NO Description: A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System up to 1.0. This impacts an unknown function of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Username leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVE ID: CVE-2025-8303 Severity: MEDIUM (CVSS 6.5) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in EKA Software Computer Information Advertising Services Ltd. Real Estate Script V5 (With Doping Module – Store Module – New Language System) allows Cross-Site Scripting (XSS). This issue affects Real Estate Script V5 (With Doping Module – Store Module – New Language System): through 17022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-8276 Severity: MEDIUM (CVSS 4.3) CWE: CWE-116, CWE-74, CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Patika Global Technologies HumanSuite allows Cross-Site Scripting (XSS), Phishing. This issue affects HumanSuite: before 53.21.0.
CVE ID: CVE-2025-8079 Severity: MEDIUM (CVSS 4.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. Smart Trade E-Commerce allows Reflected XSS. This issue affects Smart Trade E-Commerce: before 4.5.0.0.1.
CVE ID: CVE-2025-8057 Severity: MEDIUM (CVSS 6.5) CWE: CWE-285, CWE-610, CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key, Externally Controlled Reference to a Resource in Another Sphere, Improper Authorization vulnerability in Patika Global Technologies HumanSuite allows Exploiting Trust in Client. This issue affects HumanSuite: before 53.21.0.
CVE ID: CVE-2025-8025 Severity: CRITICAL (CVSS 9.8) CWE: CWE-284, CWE-306 KEV (actively exploited): NO Description: Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dinosoft ERP: from < 3.0.1 through 11022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-7799 Severity: HIGH (CVSS 8.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. E-Taxpayer Accounting Website allows Reflected XSS. This issue affects e-Taxpayer Accounting Website: through 07082025.
CVE ID: CVE-2025-7760 Severity: HIGH (CVSS 7.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ofisimo Web-Based Software Technologies Association Web Package Flora allows XSS Through HTTP Headers. This issue affects Association Web Package Flora: from v3.0 through 03022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-7744 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 Affected: cpe:2.3:a:dolusoft:omaspot:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dolusoft Omaspot allows SQL Injection. This issue affects Omaspot: before 12.09.2025.
CVE ID: CVE-2025-48041 Severity: HIGH (CVSS 7.1) CWE: CWE-400, CWE-770 KEV (actively exploited): NO Description: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
CVE ID: CVE-2025-48040 Severity: MEDIUM (CVSS 6.9) CWE: CWE-400, CWE-770 KEV (actively exploited): NO Description: Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
CVE ID: CVE-2025-48039 Severity: MEDIUM (CVSS 5.3) CWE: CWE-400, CWE-770 KEV (actively exploited): NO Description: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
CVE ID: CVE-2025-48038 Severity: MEDIUM (CVSS 5.3) CWE: CWE-400, CWE-770 KEV (actively exploited): NO Description: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
CVE ID: CVE-2024-6699 Severity: CRITICAL (CVSS 9.3) CWE: CWE-89 Affected: cpe:2.3:h:mikafon:ma7:-:*:*:*:*:*:*:*, cpe:2.3:o:mikafon:ma7_firmware:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc. Mikafon MA7 allows SQL Injection. This issue affects Mikafon MA7: from v3.0 before v3.1.
CVE ID: CVE-2024-1662 Severity: HIGH (CVSS 7.5) CWE: CWE-306, CWE-862 Affected: cpe:2.3:a:porty:powerbank:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Missing Authentication for Critical Function, Missing Authorization vulnerability in PORTY Smart Tech Technology Joint Stock Company PowerBank Application allows Retrieve Embedded Sensitive Data. This issue affects PowerBank Application: before 2.02.
CVE ID: CVE-2026-35212 Severity: MEDIUM (CVSS 5.3) CWE: CWE-79 Affected: cpe:2.3:a:citeum:opencti:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7.260227.0 are vulnerable to XSS in the rendering of email-message observable body data. The content of the body field isn't appropriately sanitized when being rendered. Does require user interaction but could be exploited by someone sharing stix or any of the ingester. This could lead to CSRF and then large scale session theft. Version 7.260227.0 contains a fix.
CVE ID: CVE-2026-35193 Severity: LOW (CVSS 2.3) CWE: CWE-524 Affected: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue.
CVE ID: CVE-2026-48587 Severity: LOW (CVSS 2.3) CWE: CWE-1023 Affected: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Navid Rezazadeh for reporting this issue.
CVE ID: CVE-2026-6873 Severity: LOW (CVSS 2.3) CWE: CWE-347 Affected: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Peng Zhou for reporting this issue.
CVE ID: CVE-2026-20025 Severity: MEDIUM (CVSS 6.8) CWE: CWE-190 Affected: cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*, cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. To exploit this vulnerability, the attacker must have the OSPF secret key. This vulnerability is due to insufficient input validation when processing OSPF link-state update (LSU) packets. An attacker could exploit this vulnerability by sending crafted OSPF LSU packets. A successful exploit could allow the attacker to corrupt the heap, causing the device to reload, resulting in a DoS condition.
CVE ID: CVE-2026-20016 Severity: MEDIUM (CVSS 6.7) CWE: CWE-88 Affected: cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*, cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. To exploit this vulnerability, the attacker must have valid administrative credentials on an affected device. This vulnerability is due to insufficient input validation of user-supplied command arguments. An attacker could exploit this vulnerability by submitting crafted input for specific CLI commands. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.
CVE ID: CVE-2026-7666 Severity: LOW (CVSS 2.3) CWE: CWE-319 Affected: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to read email content via cleartext interception. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kasper Dupont for reporting this issue.
CVE ID: CVE-2026-8404 Severity: LOW (CVSS 2.3) CWE: CWE-178 Affected: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmed Badawe for reporting this issue.
CVE ID: CVE-2026-41054 Severity: HIGH (CVSS 7.8) CWE: CWE-305 KEV (actively exploited): NO Description: In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it fails to stop execution. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
CVE ID: CVE-2025-9986 Severity: HIGH (CVSS 8.2) CWE: CWE-497 KEV (actively exploited): NO Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vadi Corporate Information Systems Ltd. Co. DIGIKENT allows Excavation. This issue affects DIGIKENT: through 13092025.
CVE ID: CVE-2025-9969 Severity: HIGH (CVSS 7.1) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vizly Web Design Real Estate Packages allows Content Spoofing, CAPEC - 593 - Session Hijacking, CAPEC - 591 - Reflected XSS. This issue affects Real Estate Packages: before 5.1.
CVE ID: CVE-2025-9953 Severity: CRITICAL (CVSS 9.8) CWE: CWE-566 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank Accreditation Software allows SQL Injection. This issue affects Databank Accreditation Software: through 19022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-9902 Severity: HIGH (CVSS 7.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in AKIN Software Computer Import Export Industry and Trade Co. Ltd. QRMenu allows Privilege Abuse. This issue affects QRMenu: from 1.05.12 before Version dated 05.09.2025.
CVE ID: CVE-2025-9846 Severity: CRITICAL (CVSS 10.0) CWE: CWE-434 KEV (actively exploited): NO Description: Unrestricted Upload of File with Dangerous Type vulnerability in TalentSys Consulting Information Technology Industry Inc. Inka.Net allows Command Injection. This issue affects Inka.Net: before 6.7.1.
CVE ID: CVE-2025-9798 Severity: HIGH (CVSS 8.9) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad Software Inc. Netigma allows Stored XSS. This issue affects Netigma: from 6.3.3 before 6.3.5 V8.
CVE ID: CVE-2025-9588 Severity: CRITICAL (CVSS 9.8) CWE: CWE-78 Affected: cpe:2.3:a:ironmountain:envision:*:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows Command Injection. This issue affects enVision: before 250563.
CVE ID: CVE-2025-9342 Severity: MEDIUM (CVSS 6.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Anadolu Hayat Emeklilik Inc. AHE Mobile allows Privilege Abuse. This issue affects AHE Mobile: from 1.9.7 before 1.9.9.
CVE ID: CVE-2025-9062 Severity: HIGH (CVSS 7.3) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter Injection. This issue affects Envanty: before 1.0.6. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. The vulnerability was learned to be remediated through reporter information and testing.
CVE ID: CVE-2025-9035 Severity: MEDIUM (CVSS 5.4) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Horato Internet Technologies Ind. And Trade Inc. Virtual Library Platform allows Reflected XSS. This issue affects Virtual Library Platform: before v202.
CVE ID: CVE-2025-9031 Severity: MEDIUM (CVSS 4.3) CWE: CWE-203, CWE-208 KEV (actively exploited): NO Description: Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing. This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15.
CVE ID: CVE-2025-8887 Severity: MEDIUM (CVSS 6.1) CWE: CWE-200, CWE-639, CWE-862 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Forceful Browsing, Parameter Injection, Input Data Manipulation. This issue affects Aybs Interaktif: from 2024 through 28082025.
CVE ID: CVE-2025-8886 Severity: MEDIUM (CVSS 6.7) CWE: CWE-200, CWE-732, CWE-862, CWE-863 KEV (actively exploited): NO Description: Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization, Incorrect Authorization vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Privilege Abuse, Authentication Bypass. This issue affects Aybs Interaktif: from 2024 through 28082025.
CVE ID: CVE-2025-8884 Severity: MEDIUM (CVSS 5.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Privilege Abuse, Exploitation of Trusted Identifiers. This issue affects ACE Center: from 3.10.100.1768 before 3.10.161.2255.
CVE ID: CVE-2025-8855 Severity: HIGH (CVSS 8.1) CWE: CWE-302, CWE-639, CWE-640 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information. This issue affects Brokerage Automation: before 1.1.71.
CVE ID: CVE-2025-8695 Severity: MEDIUM (CVSS 5.4) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad NetGIS Server allows Reflected XSS. This issue affects NetGIS Server: from 5.2.4 through 22.08.2025.
CVE ID: CVE-2025-8668 Severity: CRITICAL (CVSS 9.4) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard allows Reflected XSS. This issue affects Turboard: from 2025.07 before 2026.02. NOTE: This CVE record updated after the vendor implemented mitigations.
CVE ID: CVE-2025-8664 Severity: MEDIUM (CVSS 6.3) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities E-Municipality Management allows Cross-Site Scripting (XSS). This issue affects StarCities E-Municipality Management: before 20250825.
CVE ID: CVE-2025-8590 Severity: HIGH (CVSS 7.5) CWE: CWE-200 KEV (actively exploited): NO Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Directory Indexing. This issue affects SKSPro: through 07012026.
CVE ID: CVE-2025-8589 Severity: HIGH (CVSS 7.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Reflected XSS. This issue affects SKSPro: through 07012026.
CVE ID: CVE-2025-8587 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 Affected: cpe:2.3:a:akceyazilim:skspro:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows SQL Injection. This issue affects SKSPro: through 07012026.
CVE ID: CVE-2025-8532 Severity: MEDIUM (CVSS 6.4) CWE: CWE-285, CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows Forceful Browsing. This issue affects eBA Document and Workflow Management System: from 6.7.164 before 6.7.166.
CVE ID: CVE-2025-8463 Severity: MEDIUM (CVSS 5.3) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in SecHard Information Technologies SecHard allows Forceful Browsing. This issue affects SecHard: before 3.6.2-20250805.
CVE ID: CVE-2025-8461 Severity: HIGH (CVSS 7.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 03022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-8456 Severity: HIGH (CVSS 7.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kod8 Software Technologies Trade Ltd. Co. Kod8 Individual and SME Website allows Reflected XSS. This issue affects Kod8 Individual and SME Website: through 03022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-8411 Severity: HIGH (CVSS 7.1) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft Technology E-Commerce Web Design Product allows XSS Through HTTP Headers. This issue affects E-Commerce Web Design Product: before 11.08.2025.
CVE ID: CVE-2025-8350 Severity: CRITICAL (CVSS 9.8) CWE: CWE-306, CWE-698 KEV (actively exploited): NO Description: Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting. This issue affects BiEticaret CMS: from 2.1.13 through 19022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-8308 Severity: MEDIUM (CVSS 6.3) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Key Software Solutions Inc. INFOREX- General Information Management System allows XSS Through HTTP Headers. This issue affects INFOREX- General Information Management System: from 2025 and before through 18022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-10161 Severity: HIGH (CVSS 7.3) CWE: CWE-307, CWE-602, CWE-807 KEV (actively exploited): NO Description: Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication Bypass, Functionality Bypass. This issue affects Perfektive: before Version: 12574 Build: 2701.
CVE ID: CVE-2025-10024 Severity: HIGH (CVSS 7.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in EXERT Computer Technologies Software Ltd. Co. Education Management System allows Parameter Injection. This issue affects Education Management System: through 23.09.2025.
CVE ID: CVE-2019-25737 Severity: MEDIUM (CVSS 5.3) CWE: CWE-79 KEV (actively exploited): NO Description: Live Chat Unlimited 2.8.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the chat input field. Attackers can submit payloads containing script tags and event handlers that execute in the admin area, enabling cookie theft or forced redirects to malicious websites.
CVE ID: CVE-2019-25731 Severity: MEDIUM (CVSS 5.3) CWE: CWE-79 KEV (actively exploited): NO Description: Zuz Music 2.1 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript by submitting crafted contact form data. Attackers can inject script code through the name, subject, and message parameters in POST requests to /gmusic/zuzconsole/___contact, which executes when administrators view messages in the inbox interface.
CVE ID: CVE-2026-48840 Severity: MEDIUM (CVSS 5.3) CWE: CWE-839 Affected: cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.
CVE ID: CVE-2025-10438 Severity: HIGH (CVSS 8.6) CWE: CWE-27 KEV (actively exploited): NO Description: Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal. This issue affects Yordam Katalog: before 21.7.
CVE ID: CVE-2025-10437 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. Webpack Management System allows SQL Injection. This issue affects Webpack Management System: through 20251119.
CVE ID: CVE-2025-10228 Severity: HIGH (CVSS 8.8) CWE: CWE-384 KEV (actively exploited): NO Description: Session Fixation vulnerability in Rolantis Information Technologies Agentis allows Session Hijacking. This issue affects Agentis: before 4.44.
CVE ID: CVE-2025-10174 Severity: HIGH (CVSS 8.3) CWE: CWE-319 KEV (actively exploited): NO Description: Cleartext Transmission of Sensitive Information vulnerability in Pan Software & Information Technologies Ltd. PanCafe Pro allows Flooding. This issue affects PanCafe Pro: from < 3.3.2 through 23092025.
CVE ID: CVE-2025-10855 Severity: HIGH (CVSS 7.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Solvera Software Services Trade Inc. Teknoera allows Exploitation of Trusted Identifiers. This issue affects Teknoera: through 01102025.
CVE ID: CVE-2025-10727 Severity: MEDIUM (CVSS 5.4) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArkSigner Software and Hardware Inc. AcBakImzala allows Reflected XSS. This issue affects AcBakImzala: before v5.1.4.
CVE ID: CVE-2025-10612 Severity: MEDIUM (CVSS 6.1) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in giSoft Information Technologies City Guide allows Reflected XSS. This issue affects City Guide: before 1.4.45.
CVE ID: CVE-2025-10610 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting Information Processing Industry and Foreign Trade Inc. Winsure allows Blind SQL Injection. This issue affects Winsure: through Version dated 21.08.2025.
CVE ID: CVE-2025-10609 Severity: MEDIUM (CVSS 5.9) CWE: CWE-798 KEV (actively exploited): NO Description: Use of Hard-coded Credentials vulnerability in Logo Software Inc. TigerWings ERP allows Read Sensitive Constants Within an Executable. This issue affects TigerWings ERP: from 01.01.00 before 3.03.00.
CVE ID: CVE-2025-10468 Severity: HIGH (CVSS 7.5) CWE: CWE-22 KEV (actively exploited): NO Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Beyaz Computer CityPlus allows Path Traversal. This issue affects CityPlus: before 24.29375.
CVE ID: CVE-2025-10467 Severity: HIGH (CVSS 8.9) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information System) allows Stored XSS. This issue affects OBS (Student Affairs Information System): before v25.0401.
CVE ID: CVE-2025-10465 Severity: HIGH (CVSS 8.8) CWE: CWE-434 KEV (actively exploited): NO Description: Unrestricted Upload of File with Dangerous Type vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Sensaway allows Upload a Web Shell to a Web Server. This issue affects Sensaway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.
CVE ID: CVE-2025-10464 Severity: MEDIUM (CVSS 6.5) CWE: CWE-312, CWE-922 KEV (actively exploited): NO Description: Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensitive Data. This issue affects Senseway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.
CVE ID: CVE-2025-10463 Severity: HIGH (CVSS 7.3) CWE: CWE-287 KEV (actively exploited): NO Description: Improper Authentication vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Authentication Abuse. This issue affects Senseway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.
CVE ID: CVE-2025-10449 Severity: HIGH (CVSS 8.6) CWE: CWE-22 KEV (actively exploited): NO Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saysis Computer Systems Trade Ltd. Co. Saysis Web Portal allows Path Traversal. This issue affects Saysis Web Portal: from 3.1.9 & 3.2.0 before 3.2.1.
CVE ID: CVE-2025-10439 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yordam Informatics Yordam Library Automation System allows SQL Injection. This issue affects Yordam Library Automation System: from 21.5 & 21.6 before 21.7.
CVE ID: CVE-2026-42250 Severity: MEDIUM (CVSS 4.8) CWE: CWE-787 KEV (actively exploited): NO Description: bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67
CVE ID: CVE-2025-10969 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 Affected: cpe:2.3:a:farktor:e-commerce_package:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Blind SQL Injection. This issue affects E-Commerce Package: through 27112025.
CVE ID: CVE-2025-10968 Severity: HIGH (CVSS 8.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in GG Soft Software Services Inc. PaperWork allows Blind SQL Injection, SQL Injection. This issue affects PaperWork: from 6.1.0.9390 before 6.1.0.9398.
CVE ID: CVE-2025-10955 Severity: MEDIUM (CVSS 6.1) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad Software Inc. Netigma allows XSS Through HTTP Query Strings. This issue affects Netigma: from 6.3.5 before 6.3.5 V8.
CVE ID: CVE-2025-10914 Severity: HIGH (CVSS 7.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. Co. OBS (Student Affairs Information System) allows Reflected XSS. This issue affects OBS (Student Affairs Information System): before V26.0401.
CVE ID: CVE-2025-10913 Severity: HIGH (CVSS 8.3) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saastech Cleaning and Internet Services Inc. TemizlikYolda allows Cross-Site Scripting (XSS). This issue affects TemizlikYolda: through 11022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-10912 Severity: MEDIUM (CVSS 5.4) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Saastech Cleaning and Internet Services Inc. TemizlikYolda allows Manipulating User-Controlled Variables. This issue affects TemizlikYolda: through 11022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-10876 Severity: MEDIUM (CVSS 5.3) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software e-BAP Automation allows Cross-Site Scripting (XSS). This issue affects e-BAP Automation: from 1.8.96 before v.41815.
CVE ID: CVE-2025-10856 Severity: HIGH (CVSS 8.1) CWE: CWE-434 KEV (actively exploited): NO Description: Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows File Content Injection. This issue affects Teknoera: through 01102025.