# CVEs published 2025-10-07

240 CVEs were published on October 7, 2025: 6 critical, 66 high. Days are UTC.

- [CVE-2025-11417](https://cve.now/CVE-2025-11417.md): Campcodes Advanced Online Voting Management System voters\_add.php unrestricted upload (CVSS 5.3, Campcodes Advanced Online Voting Management System)
- [CVE-2025-61999](https://cve.now/CVE-2025-61999.md): OPEXUS FOIAXpress stored XSS via logo image (CVSS 4.3, OPEXUS FOIAXpress)
- [CVE-2025-61998](https://cve.now/CVE-2025-61998.md): OPEXUS FOIAXpress stored XSS via Hyperlink Manager (CVSS 4.8, OPEXUS FOIAXpress)
- [CVE-2025-61997](https://cve.now/CVE-2025-61997.md): OPEXUS FOIAXpress stored XSS via banner image (CVSS 4.8, OPEXUS FOIAXpress)
- [CVE-2025-61996](https://cve.now/CVE-2025-61996.md): OPEXUS FOIAXpress stored XSS via annual report template (CVSS 4.3, OPEXUS FOIAXpress)
- [CVE-2025-11416](https://cve.now/CVE-2025-11416.md): PHPGurukul Beauty Parlour Management System invoices.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-11415](https://cve.now/CVE-2025-11415.md): PHPGurukul Beauty Parlour Management System customer-list.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-11414](https://cve.now/CVE-2025-11414.md): GNU Binutils Linker elflink.c get\_link\_hash\_entry out-of-bounds (CVSS 4.8, GNU Binutils)
- [CVE-2025-43822](https://cve.now/CVE-2025-43822.md): Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through… (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-11413](https://cve.now/CVE-2025-11413.md): GNU Binutils Linker elflink.c elf\_link\_add\_object\_symbols out-of-bounds (CVSS 4.8, GNU Binutils)
- [CVE-2025-11412](https://cve.now/CVE-2025-11412.md): GNU Binutils Linker elflink.c bfd\_elf\_gc\_record\_vtentry out-of-bounds (CVSS 4.8, GNU Binutils)
- [CVE-2025-43823](https://cve.now/CVE-2025-43823.md): Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP… (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-11410](https://cve.now/CVE-2025-11410.md): Campcodes Advanced Online Voting Management System voters\_add.php sql injection (CVSS 5.3, Campcodes Advanced Online Voting Management System)
- [CVE-2025-11409](https://cve.now/CVE-2025-11409.md): Campcodes Advanced Online Voting Management System index.php sql injection (CVSS 5.3, Campcodes Advanced Online Voting Management System)
- [CVE-2025-11408](https://cve.now/CVE-2025-11408.md): D-Link DI-7001 MINI dbsrv.asp buffer overflow (CVSS 8.7, D-Link DI-7001 MINI)
- [CVE-2025-11407](https://cve.now/CVE-2025-11407.md): D-Link DI-7001 MINI upgrade\_filter.asp os command injection (CVSS 5.3, D-Link DI-7001 MINI)
- [CVE-2025-36565](https://cve.now/CVE-2025-36565.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024… (CVSS 6.7, Dell PowerProtect Data Domain with Data Domain Operating… +1)
- [CVE-2025-6242](https://cve.now/CVE-2025-6242.md): Vllm: server side request forgery (ssrf) in mediaconnector (CVSS 7.1, Red Hat AI Inference Server · Red Hat Enterprise Linux AI +1)
- [CVE-2025-11462](https://cve.now/CVE-2025-11462.md): Local Privilege Escalation Vulnerability in AWS Client VPN macOS Client (CVSS 9.3, AWS Client VPN)
- [CVE-2025-36566](https://cve.now/CVE-2025-36566.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024… (CVSS 6.7, Dell PowerProtect Data Domain with Data Domain Operating… +1)
- [CVE-2025-36569](https://cve.now/CVE-2025-36569.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024… (CVSS 6.7, Dell PowerProtect Data Domain with Data Domain Operating… +1)
- [CVE-2025-11406](https://cve.now/CVE-2025-11406.md): kaifangqian kaifangqian-base SysUserController.java getAllUsers information disclosure (CVSS 5.3, kaifangqian-base)
- [CVE-2025-36567](https://cve.now/CVE-2025-36567.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024… (CVSS 6.7, Dell PowerProtect Data Domain with Data Domain Operating… +1)
- [CVE-2025-61910](https://cve.now/CVE-2025-61910.md): NASA ION-DTN BPv7 4.1.3s Uncontrolled Memory Allocation that leads to Denial-of-Service (CVSS 7.5, nasa-jpl ION-DTN)
- [CVE-2025-43727](https://cve.now/CVE-2025-43727.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024… (CVSS 7.5, Dell PowerProtect Data Domain with Data Domain Operating… +1)
- [CVE-2025-43910](https://cve.now/CVE-2025-43910.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025… (CVSS 2.3, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-43909](https://cve.now/CVE-2025-43909.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025… (CVSS 3.7, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-11192](https://cve.now/CVE-2025-11192.md): Fabric Engine (VOSS) AutoSense Authentication Bypass (CVSS 8.4, Extreme Networks Fabric Engine)
- [CVE-2025-43905](https://cve.now/CVE-2025-43905.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025… (CVSS 4.3, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-11405](https://cve.now/CVE-2025-11405.md): SourceCodester Hotel and Lodge Management System del\_tax.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-61784](https://cve.now/CVE-2025-61784.md): LLaMA Factory's Chat API has Critical SSRF and LFI Vulnerabilities (CVSS 7.6, hiyouga LLaMA-Factory · llamafactory)
- [CVE-2025-45375](https://cve.now/CVE-2025-45375.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025… (CVSS 4.4, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-61776](https://cve.now/CVE-2025-61776.md): Dependency-Track possibly discloses private NuGet repository credentials to api.nuget.org (CVSS 4.7, DependencyTrack dependency-track)
- [CVE-2025-43913](https://cve.now/CVE-2025-43913.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025… (CVSS 5.3, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-61670](https://cve.now/CVE-2025-61670.md): Wasmtime has memory leak in C API with \`externref\` and \`anyref\` types (CVSS 1.0, bytecodealliance wasmtime · wasmtime-c-api-impl +1)
- [CVE-2025-43912](https://cve.now/CVE-2025-43912.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025… (CVSS 5.3, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-43891](https://cve.now/CVE-2025-43891.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025… (CVSS 5.3, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-43889](https://cve.now/CVE-2025-43889.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4, LTS2024 release… (CVSS 5.3, Dell PowerProtect Data Domain with Data Domain Operating… +1)
- [CVE-2025-11404](https://cve.now/CVE-2025-11404.md): SourceCodester Hotel and Lodge Management System save\_tax.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-43934](https://cve.now/CVE-2025-43934.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025… (CVSS 6.0, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-43908](https://cve.now/CVE-2025-43908.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025… (CVSS 6.4, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-3449](https://cve.now/CVE-2025-3449.md): Weak Session Token used in Automation Runtime SDM (CVSS 2.3, B&R Industrial Automation Automation Runtime)
- [CVE-2025-3448](https://cve.now/CVE-2025-3448.md): XSS on SDM (CVSS 5.1, B&R Industrial Automation Automation Runtime)
- [CVE-2025-43907](https://cve.now/CVE-2025-43907.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025… (CVSS 6.5, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-8291](https://cve.now/CVE-2025-8291.md): ZIP64 End of Central Directory (EOCD) Locator record offset not checked (CVSS 4.3, Python Software Foundation CPython)
- [CVE-2025-43911](https://cve.now/CVE-2025-43911.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025… (CVSS 6.7, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-3450](https://cve.now/CVE-2025-3450.md): Automation Runtime SDM requests may impact system (CVSS 9.3, B&R Industrial Automation Automation Runtime)
- [CVE-2025-43906](https://cve.now/CVE-2025-43906.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025… (CVSS 6.7, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-11403](https://cve.now/CVE-2025-11403.md): SourceCodester Hotel and Lodge Management System del\_booking.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-43890](https://cve.now/CVE-2025-43890.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025… (CVSS 6.7, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-1826](https://cve.now/CVE-2025-1826.md): IBM Jazz Foundation cross-site scripting (CVSS 5.4, IBM Jazz Foundation)
- [CVE-2025-43914](https://cve.now/CVE-2025-43914.md): Dell PowerProtect Data Domain BoostFS for Linux Ubuntu systems of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release… (CVSS 7.5, Dell PowerProtect Data Domain BoostFS for Linux Ubuntu F… +2)
- [CVE-2025-36156](https://cve.now/CVE-2025-36156.md): IBM InfoSphere Data Replication VSAM for z/OS Remote Source code execution (CVSS 7.4, IBM InfoSphere Data Replication VSAM for z/OS Remote Source)
- [CVE-2025-11402](https://cve.now/CVE-2025-11402.md): SourceCodester Hotel and Lodge Management System del\_curr.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-11401](https://cve.now/CVE-2025-11401.md): SourceCodester Hotel and Lodge Management System save\_curr.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-11400](https://cve.now/CVE-2025-11400.md): SourceCodester Hotel and Lodge Management System del\_room.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-11399](https://cve.now/CVE-2025-11399.md): SourceCodester Hotel and Lodge Management System save\_room.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2023-53687](https://cve.now/CVE-2023-53687.md): tty: serial: samsung\_tty: Fix a memory leak in s3c24xx\_serial\_getclk() when iterating clk (no CVSS, Linux)
- [CVE-2023-53686](https://cve.now/CVE-2023-53686.md): net/handshake: fix null-ptr-deref in handshake\_nl\_done\_doit() (no CVSS, Linux)
- [CVE-2023-53685](https://cve.now/CVE-2023-53685.md): tun: Fix memory leak for detached NAPI queue. (no CVSS, Linux)
- [CVE-2023-53684](https://cve.now/CVE-2023-53684.md): xfrm: Zero padding when dumping algos and encap (no CVSS, Linux)
- [CVE-2023-53683](https://cve.now/CVE-2023-53683.md): fs: hfsplus: remove WARN\_ON() from hfsplus\_cat\_{read,write}\_inode() (CVSS 7.8, Linux)
- [CVE-2023-53682](https://cve.now/CVE-2023-53682.md): hwmon: (xgene) Fix ioremap and memremap leak (no CVSS, Linux)
- [CVE-2023-53681](https://cve.now/CVE-2023-53681.md): bcache: Fix \_\_bch\_btree\_node\_alloc to make the failure behavior consistent (no CVSS, Linux)
- [CVE-2023-53680](https://cve.now/CVE-2023-53680.md): NFSD: Avoid calling OPDESC() with ops-\>opnum == OP\_ILLEGAL (CVSS 7.5, Linux)
- [CVE-2023-53679](https://cve.now/CVE-2023-53679.md): wifi: mt7601u: fix an integer underflow (CVSS 8.3, Linux)
- [CVE-2023-53678](https://cve.now/CVE-2023-53678.md): drm/i915: Fix system suspend without fbdev being initialized (no CVSS, Linux)
- [CVE-2023-53677](https://cve.now/CVE-2023-53677.md): drm/i915: Fix memory leaks in i915 selftests (no CVSS, Linux)
- [CVE-2023-53676](https://cve.now/CVE-2023-53676.md): scsi: target: iscsi: Fix buffer overflow in lio\_target\_nacl\_info\_show() (CVSS 8.8, Linux)
- [CVE-2023-53675](https://cve.now/CVE-2023-53675.md): scsi: ses: Fix possible desc\_ptr out-of-bounds accesses (CVSS 8.8, Linux)
- [CVE-2023-53674](https://cve.now/CVE-2023-53674.md): clk: Fix memory leak in devm\_clk\_notifier\_register() (CVSS 7.8, Linux)
- [CVE-2023-53673](https://cve.now/CVE-2023-53673.md): Bluetooth: hci\_event: call disconnect callback before deleting conn (CVSS 8.8, Linux)
- [CVE-2023-53672](https://cve.now/CVE-2023-53672.md): btrfs: output extra debug info if we failed to find an inline backref (no CVSS, Linux)
- [CVE-2023-53671](https://cve.now/CVE-2023-53671.md): srcu: Delegate work to the boot cpu if using SRCU\_SIZE\_SMALL (no CVSS, Linux)
- [CVE-2023-53670](https://cve.now/CVE-2023-53670.md): nvme-core: fix dev\_pm\_qos memleak (no CVSS, Linux)
- [CVE-2023-53669](https://cve.now/CVE-2023-53669.md): tcp: fix skb\_copy\_ubufs() vs BIG TCP (CVSS 7.8, Linux)
- [CVE-2023-53668](https://cve.now/CVE-2023-53668.md): ring-buffer: Fix deadloop issue on reading trace\_pipe (no CVSS, Linux)
- [CVE-2023-53667](https://cve.now/CVE-2023-53667.md): net: cdc\_ncm: Deal with too low values of dwNtbOutMaxSize (no CVSS, Linux)
- [CVE-2023-53666](https://cve.now/CVE-2023-53666.md): ASoC: codecs: wcd938x: fix missing mbhc init error handling (no CVSS, Linux)
- [CVE-2023-53665](https://cve.now/CVE-2023-53665.md): md: don't dereference mddev after export\_rdev() (no CVSS, Linux)
- [CVE-2023-53664](https://cve.now/CVE-2023-53664.md): OPP: Fix potential null ptr dereference in dev\_pm\_opp\_get\_required\_pstate() (no CVSS, Linux)
- [CVE-2023-53663](https://cve.now/CVE-2023-53663.md): KVM: nSVM: Check instead of asserting on nested TSC scaling support (no CVSS, Linux)
- [CVE-2023-53662](https://cve.now/CVE-2023-53662.md): ext4: fix memory leaks in ext4\_fname\_{setup\_filename,prepare\_lookup} (no CVSS, Linux)
- [CVE-2023-53661](https://cve.now/CVE-2023-53661.md): bnxt: avoid overflow in bnxt\_get\_nvram\_directory() (no CVSS, Linux)
- [CVE-2023-53660](https://cve.now/CVE-2023-53660.md): bpf, cpumap: Handle skb as well when clean up ptr\_ring (CVSS 7.8, Linux)
- [CVE-2023-53659](https://cve.now/CVE-2023-53659.md): iavf: Fix out-of-bounds when setting channels on remove (CVSS 7.8, Linux)
- [CVE-2023-53658](https://cve.now/CVE-2023-53658.md): spi: bcm-qspi: return error if neither hif\_mspi nor mspi is available (no CVSS, Linux)
- [CVE-2023-53657](https://cve.now/CVE-2023-53657.md): ice: Don't tx before switchdev is fully configured (no CVSS, Linux)
- [CVE-2023-53656](https://cve.now/CVE-2023-53656.md): drivers/perf: hisi: Don't migrate perf to the CPU going to teardown (no CVSS, Linux)
- [CVE-2023-53655](https://cve.now/CVE-2023-53655.md): rcu: Avoid stack overflow due to \_\_rcu\_irq\_enter\_check\_tick() being kprobe-ed (no CVSS, Linux)
- [CVE-2022-50555](https://cve.now/CVE-2022-50555.md): tipc: fix a null-ptr-deref in tipc\_topsrv\_accept (CVSS 7.8, Linux)
- [CVE-2022-50554](https://cve.now/CVE-2022-50554.md): blk-mq: avoid double -\>queue\_rq() because of early timeout (no CVSS, Linux)
- [CVE-2022-50553](https://cve.now/CVE-2022-50553.md): tracing/hist: Fix out-of-bound write on 'action\_data.var\_ref\_idx' (no CVSS, Linux)
- [CVE-2022-50552](https://cve.now/CVE-2022-50552.md): blk-mq: use quiesced elevator switch when reinitializing queues (no CVSS, Linux)
- [CVE-2022-50551](https://cve.now/CVE-2022-50551.md): wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf\_fw\_alloc\_request() (no CVSS, Linux)
- [CVE-2022-50550](https://cve.now/CVE-2022-50550.md): blk-iolatency: Fix memory leak on add\_disk() failures (no CVSS, Linux)
- [CVE-2022-50549](https://cve.now/CVE-2022-50549.md): dm thin: Fix ABBA deadlock between shrink\_slab and dm\_pool\_abort\_metadata (no CVSS, Linux)
- [CVE-2022-50548](https://cve.now/CVE-2022-50548.md): media: i2c: hi846: Fix memory leak in hi846\_parse\_dt() (no CVSS, Linux)
- [CVE-2022-50547](https://cve.now/CVE-2022-50547.md): media: solo6x10: fix possible memory leak in solo\_sysfs\_init() (no CVSS, Linux)
- [CVE-2022-50546](https://cve.now/CVE-2022-50546.md): ext4: fix uninititialized value in 'ext4\_evict\_inode' (no CVSS, Linux)
- [CVE-2022-50545](https://cve.now/CVE-2022-50545.md): r6040: Fix kmemleak in probe and remove (no CVSS, Linux)
- [CVE-2022-50544](https://cve.now/CVE-2022-50544.md): usb: host: xhci: Fix potential memory leak in xhci\_alloc\_stream\_info() (no CVSS, Linux)
- [CVE-2022-50543](https://cve.now/CVE-2022-50543.md): RDMA/rxe: Fix mr-\>map double free (CVSS 7.8, Linux)
- [CVE-2022-50542](https://cve.now/CVE-2022-50542.md): media: si470x: Fix use-after-free in si470x\_int\_in\_callback() (no CVSS, Linux)
- [CVE-2022-50541](https://cve.now/CVE-2022-50541.md): dmaengine: ti: k3-udma: Reset UDMA\_CHAN\_RT byte counters to prevent overflow (no CVSS, Linux)
- [CVE-2022-50540](https://cve.now/CVE-2022-50540.md): dmaengine: qcom-adm: fix wrong sizeof config in slave\_config (no CVSS, Linux)
- [CVE-2022-50539](https://cve.now/CVE-2022-50539.md): ARM: OMAP2+: omap4-common: Fix refcount leak bug (no CVSS, Linux)
- [CVE-2022-50538](https://cve.now/CVE-2022-50538.md): vme: Fix error not catched in fake\_init() (no CVSS, Linux)
- [CVE-2022-50537](https://cve.now/CVE-2022-50537.md): firmware: raspberrypi: fix possible memory leak in rpi\_firmware\_probe() (no CVSS, Linux)
- [CVE-2022-50536](https://cve.now/CVE-2022-50536.md): bpf, sockmap: Fix repeated calls to sock\_put() when msg has more\_data (CVSS 7.8, Linux)
- [CVE-2022-50535](https://cve.now/CVE-2022-50535.md): drm/amd/display: Fix potential null-deref in dm\_resume (no CVSS, Linux)
- [CVE-2023-53654](https://cve.now/CVE-2023-53654.md): octeontx2-af: Add validation before accessing cgx and lmac (no CVSS, Linux)
- [CVE-2023-53653](https://cve.now/CVE-2023-53653.md): media: amphion: fix REVERSE\_INULL issues reported by coverity (no CVSS, Linux)
- [CVE-2023-53652](https://cve.now/CVE-2023-53652.md): vdpa: Add features attr to vdpa\_nl\_policy for nlattr length check (no CVSS, Linux)
- [CVE-2023-53651](https://cve.now/CVE-2023-53651.md): Input: exc3000 - properly stop timer on shutdown (CVSS 7.8, Linux)
- [CVE-2023-53650](https://cve.now/CVE-2023-53650.md): fbdev: omapfb: lcd\_mipid: Fix an error handling path in mipid\_spi\_probe() (no CVSS, Linux)
- [CVE-2023-53649](https://cve.now/CVE-2023-53649.md): perf trace: Really free the evsel-\>priv area (no CVSS, Linux)
- [CVE-2023-53648](https://cve.now/CVE-2023-53648.md): ALSA: ac97: Fix possible NULL dereference in snd\_ac97\_mixer (no CVSS, Linux)
- [CVE-2023-53647](https://cve.now/CVE-2023-53647.md): Drivers: hv: vmbus: Don't dereference ACPI root object handle (no CVSS, Linux)
- [CVE-2023-53646](https://cve.now/CVE-2023-53646.md): drm/i915/perf: add sentinel to xehp\_oa\_b\_counters (CVSS 7.8, Linux)
- [CVE-2023-53645](https://cve.now/CVE-2023-53645.md): bpf: Make bpf\_refcount\_acquire fallible for non-owning refs (CVSS 7.8, Linux)
- [CVE-2023-53644](https://cve.now/CVE-2023-53644.md): media: radio-shark: Add endpoint checks (no CVSS, Linux)
- [CVE-2023-53643](https://cve.now/CVE-2023-53643.md): nvme-tcp: don't access released socket during error recovery (CVSS 7.8, Linux)
- [CVE-2023-53642](https://cve.now/CVE-2023-53642.md): x86: fix clear\_user\_rep\_good() exception handling annotation (no CVSS, Linux)
- [CVE-2023-53641](https://cve.now/CVE-2023-53641.md): wifi: ath9k: hif\_usb: fix memory leak of remain\_skbs (no CVSS, Linux)
- [CVE-2023-53640](https://cve.now/CVE-2023-53640.md): ASoC: lpass: Fix for KASAN use\_after\_free out of bounds (CVSS 7.3, Linux)
- [CVE-2023-53639](https://cve.now/CVE-2023-53639.md): wifi: ath6kl: reduce WARN to dev\_dbg() in callback (no CVSS, Linux)
- [CVE-2023-53638](https://cve.now/CVE-2023-53638.md): octeon\_ep: cancel queued works in probe error path (CVSS 7.0, Linux)
- [CVE-2023-53637](https://cve.now/CVE-2023-53637.md): media: i2c: ov772x: Fix memleak in ov772x\_probe() (no CVSS, Linux)
- [CVE-2023-53636](https://cve.now/CVE-2023-53636.md): clk: microchip: fix potential UAF in auxdev release callback (no CVSS, Linux)
- [CVE-2023-53635](https://cve.now/CVE-2023-53635.md): netfilter: conntrack: fix wrong ct-\>timeout value (CVSS 8.2, Linux)
- [CVE-2023-53634](https://cve.now/CVE-2023-53634.md): bpf, arm64: Fixed a BTI error on returning to patched function (no CVSS, Linux)
- [CVE-2023-53633](https://cve.now/CVE-2023-53633.md): accel/qaic: Fix a leak in map\_user\_pages() (no CVSS, Linux)
- [CVE-2023-53632](https://cve.now/CVE-2023-53632.md): net/mlx5e: Take RTNL lock when needed before calling xdp\_set\_features() (no CVSS, Linux)
- [CVE-2023-53631](https://cve.now/CVE-2023-53631.md): platform/x86: dell-sysman: Fix reference leak (no CVSS, Linux)
- [CVE-2023-53630](https://cve.now/CVE-2023-53630.md): iommufd: Fix unpinning of pages when an access is present (CVSS 8.8, Linux)
- [CVE-2023-53629](https://cve.now/CVE-2023-53629.md): fs: dlm: fix use after free in midcomms commit (CVSS 9.8, Linux)
- [CVE-2023-53628](https://cve.now/CVE-2023-53628.md): drm/amdgpu: drop gfx\_v11\_0\_cp\_ecc\_error\_irq\_funcs (no CVSS, Linux)
- [CVE-2023-53627](https://cve.now/CVE-2023-53627.md): scsi: hisi\_sas: Grab sas\_dev lock when traversing the members of sas\_dev.list (CVSS 7.8, Linux)
- [CVE-2023-53626](https://cve.now/CVE-2023-53626.md): ext4: fix possible double unlock when moving a directory (CVSS 7.8, Linux)
- [CVE-2023-53625](https://cve.now/CVE-2023-53625.md): drm/i915/gvt: fix vgpu debugfs clean in remove (no CVSS, Linux)
- [CVE-2023-53624](https://cve.now/CVE-2023-53624.md): net/sched: sch\_fq: fix integer overflow of "credit" (no CVSS, Linux)
- [CVE-2023-53623](https://cve.now/CVE-2023-53623.md): mm/swap: fix swap\_info\_struct race between swapoff and get\_swap\_pages() (no CVSS, Linux)
- [CVE-2023-53622](https://cve.now/CVE-2023-53622.md): gfs2: Fix possible data races in gfs2\_show\_options() (no CVSS, Linux)
- [CVE-2023-53621](https://cve.now/CVE-2023-53621.md): memcontrol: ensure memcg acquired by id is properly set up (no CVSS, Linux)
- [CVE-2023-53620](https://cve.now/CVE-2023-53620.md): md: fix soft lockup in status\_resync (no CVSS, Linux)
- [CVE-2023-53619](https://cve.now/CVE-2023-53619.md): netfilter: conntrack: Avoid nf\_ct\_helper\_hash uses after free (CVSS 7.8, Linux)
- [CVE-2023-53618](https://cve.now/CVE-2023-53618.md): btrfs: reject invalid reloc tree root keys with stack dump (no CVSS, Linux)
- [CVE-2023-53617](https://cve.now/CVE-2023-53617.md): soc: aspeed: socinfo: Add kfree for kstrdup (no CVSS, Linux)
- [CVE-2022-50534](https://cve.now/CVE-2022-50534.md): dm thin: Use last transaction's pmd-\>root when commit failed (no CVSS, Linux)
- [CVE-2022-50533](https://cve.now/CVE-2022-50533.md): wifi: mac80211: mlme: fix null-ptr deref on failed assoc (no CVSS, Linux)
- [CVE-2022-50532](https://cve.now/CVE-2022-50532.md): scsi: mpt3sas: Fix possible resource leaks in mpt3sas\_transport\_port\_add() (no CVSS, Linux)
- [CVE-2022-50531](https://cve.now/CVE-2022-50531.md): tipc: fix an information leak in tipc\_topsrv\_kern\_subscr (no CVSS, Linux)
- [CVE-2022-50530](https://cve.now/CVE-2022-50530.md): blk-mq: fix null pointer dereference in blk\_mq\_clear\_rq\_mapping() (no CVSS, Linux)
- [CVE-2022-50529](https://cve.now/CVE-2022-50529.md): test\_firmware: fix memory leak in test\_firmware\_init() (no CVSS, Linux)
- [CVE-2022-50528](https://cve.now/CVE-2022-50528.md): drm/amdkfd: Fix memory leakage (CVSS 7.8, Linux)
- [CVE-2022-50527](https://cve.now/CVE-2022-50527.md): drm/amdgpu: Fix size validation for non-exclusive domains (v4) (no CVSS, Linux)
- [CVE-2022-50526](https://cve.now/CVE-2022-50526.md): drm/msm/dp: fix memory corruption with too many bridges (no CVSS, Linux)
- [CVE-2022-50525](https://cve.now/CVE-2022-50525.md): iommu/fsl\_pamu: Fix resource leak in fsl\_pamu\_probe() (no CVSS, Linux)
- [CVE-2022-50524](https://cve.now/CVE-2022-50524.md): iommu/mediatek: Check return value after calling platform\_get\_resource() (no CVSS, Linux)
- [CVE-2022-50523](https://cve.now/CVE-2022-50523.md): clk: rockchip: Fix memory leak in rockchip\_clk\_register\_pll() (no CVSS, Linux)
- [CVE-2022-50522](https://cve.now/CVE-2022-50522.md): mcb: mcb-parse: fix error handing in chameleon\_parse\_gdd() (no CVSS, Linux)
- [CVE-2022-50521](https://cve.now/CVE-2022-50521.md): platform/x86: mxm-wmi: fix memleak in mxm\_wmi\_call\_mx\[ds|mx\]() (no CVSS, Linux)
- [CVE-2022-50520](https://cve.now/CVE-2022-50520.md): drm/radeon: Fix PCI device refcount leak in radeon\_atrm\_get\_bios() (no CVSS, Linux)
- [CVE-2022-50519](https://cve.now/CVE-2022-50519.md): nilfs2: replace WARN\_ONs by nilfs\_error for checkpoint acquisition failure (no CVSS, Linux)
- [CVE-2022-50518](https://cve.now/CVE-2022-50518.md): parisc: Fix locking in pdc\_iodc\_print() firmware call (CVSS 7.8, Linux)
- [CVE-2022-50517](https://cve.now/CVE-2022-50517.md): mm/huge\_memory: do not clobber swp\_entry\_t during THP split (CVSS 7.8, Linux)
- [CVE-2022-50516](https://cve.now/CVE-2022-50516.md): fs: dlm: fix invalid derefence of sb\_lvbptr (no CVSS, Linux)
- [CVE-2022-50515](https://cve.now/CVE-2022-50515.md): drm/amdgpu: Fix memory leak in hpd\_rx\_irq\_create\_workqueue() (no CVSS, Linux)
- [CVE-2022-50514](https://cve.now/CVE-2022-50514.md): usb: gadget: f\_hid: fix refcount leak on error path (no CVSS, Linux)
- [CVE-2022-50513](https://cve.now/CVE-2022-50513.md): staging: rtl8723bs: fix a potential memory leak in rtw\_init\_cmd\_priv() (no CVSS, Linux)
- [CVE-2022-50512](https://cve.now/CVE-2022-50512.md): ext4: fix potential memory leak in ext4\_fc\_record\_regions() (no CVSS, Linux)
- [CVE-2022-50511](https://cve.now/CVE-2022-50511.md): lib/fonts: fix undefined behavior in bit shift for get\_default\_font (no CVSS, Linux)
- [CVE-2022-50510](https://cve.now/CVE-2022-50510.md): perf/smmuv3: Fix hotplug callback leak in arm\_smmu\_pmu\_init() (no CVSS, Linux)
- [CVE-2022-50509](https://cve.now/CVE-2022-50509.md): media: coda: Add check for kmalloc (no CVSS, Linux)
- [CVE-2025-61772](https://cve.now/CVE-2025-61772.md): Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVSS 7.5, rack)
- [CVE-2025-61771](https://cve.now/CVE-2025-61771.md): Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVSS 7.5, rack)
- [CVE-2025-11398](https://cve.now/CVE-2025-11398.md): SourceCodester Hotel and Lodge Management System Profile profile.php unrestricted upload (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2023-6215](https://cve.now/CVE-2023-6215.md): HP Sure Start IFD Protection - BIOS Security Update (CVSS 7.2, HP Sure Start IFD Protection)
- [CVE-2025-61770](https://cve.now/CVE-2025-61770.md): Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVSS 7.5, rack)
- [CVE-2025-59425](https://cve.now/CVE-2025-59425.md): vLLM vulnerable to timing attack at bearer auth (CVSS 7.5, vllm-project vllm · vllm)
- [CVE-2025-11397](https://cve.now/CVE-2025-11397.md): SourceCodester Hotel and Lodge Management System login.php sql injection (CVSS 6.9, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-25009](https://cve.now/CVE-2025-25009.md): Kibana Cross-Site Scripting (XSS) (CVSS 8.7, Elastic Kibana)
- [CVE-2025-54402](https://cve.now/CVE-2025-54402.md): Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-54401](https://cve.now/CVE-2025-54401.md): Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-54400](https://cve.now/CVE-2025-54400.md): Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-54399](https://cve.now/CVE-2025-54399.md): Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-54404](https://cve.now/CVE-2025-54404.md): Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-54403](https://cve.now/CVE-2025-54403.md): Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-48826](https://cve.now/CVE-2025-48826.md): A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-54406](https://cve.now/CVE-2025-54406.md): Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-54405](https://cve.now/CVE-2025-54405.md): Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-37728](https://cve.now/CVE-2025-37728.md): Kibana Insufficiently Protected Credentials in the CrowdStrike Connector (CVSS 5.4, Elastic Kibana)
- [CVE-2025-53476](https://cve.now/CVE-2025-53476.md): A denial of service vulnerability exists in the ModbusTCP server functionality of OpenPLC \_v3 a931181e8b81e36fadf7b74d5cba99b73c3f6d58. (CVSS 5.3, OpenPLC\_v3)
- [CVE-2021-22291](https://cve.now/CVE-2021-22291.md): EIBPORT Reflected XSS (CVSS 8.5, ABB EIBPORT V3 KNX)
- [CVE-2025-11396](https://cve.now/CVE-2025-11396.md): code-projects Simple Food Ordering System product.php sql injection (CVSS 6.9, code-projects Simple Food Ordering System)
- [CVE-2025-40888](https://cve.now/CVE-2025-40888.md): Authenticated SQL Injection on CLI functionality in Guardian/CMC before 25.3.0 (CVSS 6.0, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40889](https://cve.now/CVE-2025-40889.md): Path traversal in Time Machine functionality in Guardian/CMC before 25.2.0 (CVSS 7.2, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40887](https://cve.now/CVE-2025-40887.md): Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0 (CVSS 6.0, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40886](https://cve.now/CVE-2025-40886.md): Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0 (CVSS 7.7, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40885](https://cve.now/CVE-2025-40885.md): Authenticated SQL Injection on Smart Polling functionality in Guardian/CMC before 25.2.0 (CVSS 6.0, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-3719](https://cve.now/CVE-2025-3719.md): Incorrect authorization for CLI in Guardian/CMC before 25.2.0 (CVSS 7.2, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-3718](https://cve.now/CVE-2025-3718.md): Client-side path traversal in Guardian/CMC before 25.2.0 (CVSS 5.8, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40676](https://cve.now/CVE-2025-40676.md): Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC (CVSS 5.3, BBMRI-ERIC Negotiator)
- [CVE-2025-40649](https://cve.now/CVE-2025-40649.md): Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC (CVSS 5.1, BBMRI-ERIC Negotiator)
- [CVE-2025-11390](https://cve.now/CVE-2025-11390.md): PHPGurukul Cyber Cafe Management System POST Parameter search.php cross site scripting (CVSS 5.3, PHPGurukul Cyber Cafe Management System)
- [CVE-2025-0603](https://cve.now/CVE-2025-0603.md): SQLi in Callvision Healthcare's Callvision Emergency Code (CVSS 9.8, Callvision Healthcare Callvision Emergency Code)
- [CVE-2025-11389](https://cve.now/CVE-2025-11389.md): Tenda AC15 saveAutoQos stack-based overflow (CVSS 8.7, Tenda AC15)
- [CVE-2025-11388](https://cve.now/CVE-2025-11388.md): Tenda AC15 setNotUpgrade stack-based overflow (CVSS 8.7, Tenda AC15)
- [CVE-2025-11387](https://cve.now/CVE-2025-11387.md): Tenda AC15 fast\_setting\_pppoe\_set stack-based overflow (CVSS 8.7, Tenda AC15)
- [CVE-2025-11386](https://cve.now/CVE-2025-11386.md): Tenda AC15 POST Parameter SetDDNSCfg stack-based overflow (CVSS 8.7, Tenda AC15)
- [CVE-2025-11385](https://cve.now/CVE-2025-11385.md): Tenda AC20 fast\_setting\_wifi\_set sscanf buffer overflow (CVSS 8.7, Tenda AC20)
- [CVE-2025-11360](https://cve.now/CVE-2025-11360.md): jakowenko double-take API app.js app.use cross site scripting (CVSS 5.3, jakowenko double-take)
- [CVE-2025-11359](https://cve.now/CVE-2025-11359.md): code-projects Simple Banking System transfermoney.php sql injection (CVSS 5.3, code-projects Simple Banking System)
- [CVE-2025-10645](https://cve.now/CVE-2025-10645.md): WP Reset \<= 2.05 - Unauthenticated Sensitive Information Exposure via wf-licensing.log (CVSS 5.3, webfactory WP Reset)
- [CVE-2025-11358](https://cve.now/CVE-2025-11358.md): code-projects Simple Banking System removeuser.php sql injection (CVSS 5.3, code-projects Simple Banking System)
- [CVE-2025-11357](https://cve.now/CVE-2025-11357.md): code-projects Simple Banking System createuser.php sql injection (CVSS 5.3, code-projects Simple Banking System)
- [CVE-2025-7400](https://cve.now/CVE-2025-7400.md): Featured Image from URL (FIFU) \<= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields (CVSS 6.4, marceljm Featured Image from URL)
- [CVE-2025-11356](https://cve.now/CVE-2025-11356.md): Tenda AC23 SetStaticRouteCfg sscanf buffer overflow (CVSS 8.7, Tenda AC23)
- [CVE-2025-11355](https://cve.now/CVE-2025-11355.md): UTT 1250GW aspChangeChannel strcpy buffer overflow (CVSS 8.7, UTT 1250GW)
- [CVE-2025-11354](https://cve.now/CVE-2025-11354.md): code-projects Online Hotel Reservation System addslideexec.php unrestricted upload (CVSS 5.3, code-projects Online Hotel Reservation System)
- [CVE-2025-10162](https://cve.now/CVE-2025-10162.md): OrderConvo \<= 15.1 - Unauthenticated Arbitrary File Read (CVSS 8.6, Admin and Customer Messages After Order for WooCommerce: Or…)
- [CVE-2025-11353](https://cve.now/CVE-2025-11353.md): code-projects Online Hotel Reservation System addgalleryexec.php unrestricted upload (CVSS 5.3, code-projects Online Hotel Reservation System)
- [CVE-2025-11352](https://cve.now/CVE-2025-11352.md): code-projects Online Hotel Reservation System addexec.php unrestricted upload (CVSS 5.3, code-projects Online Hotel Reservation System)
- [CVE-2025-11362](https://cve.now/CVE-2025-11362.md): Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or… (CVSS 8.7, pdfmake · org.webjars.npm:pdfmake)
- [CVE-2025-11351](https://cve.now/CVE-2025-11351.md): code-projects Online Hotel Reservation System editpicexec.php unrestricted upload (CVSS 5.3, code-projects Online Hotel Reservation System)
- [CVE-2025-11350](https://cve.now/CVE-2025-11350.md): Campcodes Online Apartment Visitor Management System bwdates-reports-details.php sql injection (CVSS 6.9, Campcodes Online Apartment Visitor Management System)
- [CVE-2025-11349](https://cve.now/CVE-2025-11349.md): Campcodes Online Apartment Visitor Management System search-visitor.php sql injection (CVSS 6.9, Campcodes Online Apartment Visitor Management System)
- [CVE-2025-11348](https://cve.now/CVE-2025-11348.md): Campcodes Online Apartment Visitor Management System index.php sql injection (CVSS 6.9, Campcodes Online Apartment Visitor Management System)
- [CVE-2025-11347](https://cve.now/CVE-2025-11347.md): code-projects Student Crud Operation Add Student Page/Edit Student add.php move\_uploaded\_file unrestricted upload (CVSS 6.9, code-projects Student Crud Operation)
- [CVE-2025-44823](https://cve.now/CVE-2025-44823.md): Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a… (CVSS 9.9, Nagios Log Server)
- [CVE-2025-44824](https://cve.now/CVE-2025-44824.md): Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a… (CVSS 8.5, Nagios Log Server)
- [CVE-2025-50505](https://cve.now/CVE-2025-50505.md): Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key… (CVSS 7.8)
- [CVE-2025-52021](https://cve.now/CVE-2025-52021.md): A SQL Injection vulnerability exists in the edit\_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0. (CVSS 9.8)
- [CVE-2025-56243](https://cve.now/CVE-2025-56243.md): A Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the… (CVSS 6.1)
- [CVE-2025-57564](https://cve.now/CVE-2025-57564.md): CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the… (CVSS 8.2)
- [CVE-2025-60312](https://cve.now/CVE-2025-60312.md): Sourcecodester Markdown to HTML Converter v1.0 is vulnerable to a Cross-Site Scripting (XSS) in the "Markdown Input" field, allowing a… (CVSS 6.1)
- [CVE-2025-62185](https://cve.now/CVE-2025-62185.md): In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is… (CVSS 6.7, Ankitects Anki)
- [CVE-2025-62186](https://cve.now/CVE-2025-62186.md): Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL… (CVSS 6.7, Ankitects Anki)
- [CVE-2025-62187](https://cve.now/CVE-2025-62187.md): In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and… (CVSS 2.9, Ankitects Anki)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2025-10-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.