# CVEs published 2025-10-02

120 CVEs were published on October 2, 2025: 17 critical, 39 high. Days are UTC.

- [CVE-2025-61668](https://cve.now/CVE-2025-61668.md): @plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user (CVSS 8.7, plone volto · @plone/volto)
- [CVE-2025-61600](https://cve.now/CVE-2025-61600.md): Unbounded Memory Allocation in Stalwart IMAP parser (CVSS 7.5, stalwartlabs stalwart)
- [CVE-2025-61666](https://cve.now/CVE-2025-61666.md): Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File (CVSS 8.7, traccar)
- [CVE-2025-61665](https://cve.now/CVE-2025-61665.md): WeGIA: Broken Access Control in \`get\_relatorios\_socios.php\` Endpoint (CVSS 8.7, LabRedesCefetRJ WeGIA)
- [CVE-2025-61606](https://cve.now/CVE-2025-61606.md): WeGIA: Open Redirect Vulnerability in \`control.php\` endpoint (CVSS 4.8, LabRedesCefetRJ WeGIA)
- [CVE-2025-54089](https://cve.now/CVE-2025-54089.md): Cross-site Scripting vulnerability in Secure Access prior to 14.10 (CVSS 4.6, Absolute Security Secure Access)
- [CVE-2025-61605](https://cve.now/CVE-2025-61605.md): WeGIA: SQL Injection (Blind Time-Based) Vulnerability in /pet/profile\_pet.php Endpoint (CVSS 9.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-54088](https://cve.now/CVE-2025-54088.md): Open Redirect in Secure Access prior to 14.10 (CVSS 5.5, Absolute Security Secure Access)
- [CVE-2025-61604](https://cve.now/CVE-2025-61604.md): WeGIA: Cross-Site Request Forgery (CSRF) Vulnerability in \`control.php\` Endpoint (CVSS 7.1, LabRedesCefetRJ WeGIA)
- [CVE-2025-54087](https://cve.now/CVE-2025-54087.md): Server-side request forgery in Secure Access (CVSS 1.8, Absolute Security Secure Access)
- [CVE-2025-10653](https://cve.now/CVE-2025-10653.md): Raise3D Pro2 Series 3D Printers Authentication Bypass Using an Alternate Path or Channel (CVSS 8.6, Raise3D Pro2 Series)
- [CVE-2025-54086](https://cve.now/CVE-2025-54086.md): Excess Permissions in Warehouse (CVSS 5.3, Absolute Security Secure Access)
- [CVE-2025-61603](https://cve.now/CVE-2025-61603.md): WeGIA: SQL Injection (Blind Time-Based) Vulnerability in API \`descricao\` Parameter (CVSS 9.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-61595](https://cve.now/CVE-2025-61595.md): MANTRA tx gas limit is not enforced in send hooks (CVSS 8.8, MANTRA-Chain mantrachain · github.com/MANTRA-Chain/mantr… +3)
- [CVE-2025-59835](https://cve.now/CVE-2025-59835.md): LangBot has a cross-directory file upload vulnerability, which could lead to system takeover (CVSS 8.6, langbot-app LangBot)
- [CVE-2025-34210](https://cve.now/CVE-2025-34210.md): Vasion Print (formerly PrinterLogic) Readable Cleartext Passwords (CVSS 9.4, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-34208](https://cve.now/CVE-2025-34208.md): Vasion Print (formerly PrinterLogic) Insecure Password Hashing (CVSS 8.2, Vasion Print Virtual Appliance Host · Vasion Print Applicat…)
- [CVE-2025-59774](https://cve.now/CVE-2025-59774.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59773](https://cve.now/CVE-2025-59773.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59772](https://cve.now/CVE-2025-59772.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59771](https://cve.now/CVE-2025-59771.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59770](https://cve.now/CVE-2025-59770.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59769](https://cve.now/CVE-2025-59769.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59768](https://cve.now/CVE-2025-59768.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59767](https://cve.now/CVE-2025-59767.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59766](https://cve.now/CVE-2025-59766.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59765](https://cve.now/CVE-2025-59765.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59764](https://cve.now/CVE-2025-59764.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59763](https://cve.now/CVE-2025-59763.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59762](https://cve.now/CVE-2025-59762.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59761](https://cve.now/CVE-2025-59761.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59760](https://cve.now/CVE-2025-59760.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59759](https://cve.now/CVE-2025-59759.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59758](https://cve.now/CVE-2025-59758.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59757](https://cve.now/CVE-2025-59757.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59756](https://cve.now/CVE-2025-59756.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59755](https://cve.now/CVE-2025-59755.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 6.9, AndSoft e-TMS)
- [CVE-2025-59754](https://cve.now/CVE-2025-59754.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59753](https://cve.now/CVE-2025-59753.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59752](https://cve.now/CVE-2025-59752.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59751](https://cve.now/CVE-2025-59751.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59750](https://cve.now/CVE-2025-59750.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 5.1, AndSoft e-TMS)
- [CVE-2025-59749](https://cve.now/CVE-2025-59749.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 6.9, AndSoft e-TMS)
- [CVE-2025-59748](https://cve.now/CVE-2025-59748.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 6.9, AndSoft e-TMS)
- [CVE-2025-59747](https://cve.now/CVE-2025-59747.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 6.9, AndSoft e-TMS)
- [CVE-2025-59746](https://cve.now/CVE-2025-59746.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 6.9, AndSoft e-TMS)
- [CVE-2025-59745](https://cve.now/CVE-2025-59745.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 6.9, AndSoft e-TMS)
- [CVE-2025-59744](https://cve.now/CVE-2025-59744.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 8.7, AndSoft e-TMS)
- [CVE-2025-59743](https://cve.now/CVE-2025-59743.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 9.3, AndSoft e-TMS)
- [CVE-2025-59742](https://cve.now/CVE-2025-59742.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 9.3, AndSoft e-TMS)
- [CVE-2025-59741](https://cve.now/CVE-2025-59741.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 9.3, AndSoft e-TMS)
- [CVE-2025-59740](https://cve.now/CVE-2025-59740.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 9.3, AndSoft e-TMS)
- [CVE-2025-59739](https://cve.now/CVE-2025-59739.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 9.3, AndSoft e-TMS)
- [CVE-2025-59738](https://cve.now/CVE-2025-59738.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 9.3, AndSoft e-TMS)
- [CVE-2025-59737](https://cve.now/CVE-2025-59737.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 9.3, AndSoft e-TMS)
- [CVE-2025-59736](https://cve.now/CVE-2025-59736.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 9.3, AndSoft e-TMS)
- [CVE-2025-59735](https://cve.now/CVE-2025-59735.md): Multiple vulnerabilities in AndSoft's e-TMS (CVSS 9.3, AndSoft e-TMS)
- [CVE-2025-53881](https://cve.now/CVE-2025-53881.md): SUSE-specific logrotate configuration allows escalation from mail user/group to root (CVSS 6.9, openSUSE Tumbleweed)
- [CVE-2025-22862](https://cve.now/CVE-2025-22862.md): An Authentication Bypass Using an Alternate Path or Channel vulnerability \[CWE-288\] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7. (CVSS 6.3, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2025-0642](https://cve.now/CVE-2025-0642.md): Hard-coded Credentials in PosCube's Assist (CVSS 6.3, PosCube Hardware Software and Consulting Ltd. Assist)
- [CVE-2025-11240](https://cve.now/CVE-2025-11240.md): Open redirect vulnerability in KNIME Business Hub (CVSS 5.3, KNIME Business Hub)
- [CVE-2025-11239](https://cve.now/CVE-2025-11239.md): Job details are visible to all team members on KNIME Business Hub (CVSS 2.3, KNIME Business Hub)
- [CVE-2025-41010](https://cve.now/CVE-2025-41010.md): Cross-origin resource sharing (CORS) in Hiberus Sintra (CVSS 5.1, Hiberus Sintra)
- [CVE-2024-58260](https://cve.now/CVE-2024-58260.md): Rancher update on users can deny the service to the admin (CVSS 7.6, SUSE rancher · github.com/rancher/rancher)
- [CVE-2024-58267](https://cve.now/CVE-2024-58267.md): Rancher CLI SAML authentication is vulnerable to phishing attacks (CVSS 8.0, SUSE rancher · github.com/rancher/rancher)
- [CVE-2025-41064](https://cve.now/CVE-2025-41064.md): Incorrect authentication in GTT´s group OpenSIAC (CVSS 9.3, GTT OpenSIAC)
- [CVE-2025-40992](https://cve.now/CVE-2025-40992.md): Stored XSS in Creativeitem Sociopro (CVSS 5.1, Creativeitem Sociopro)
- [CVE-2025-40991](https://cve.now/CVE-2025-40991.md): Stored XSS in Creativeitem Ekushey CRM (CVSS 5.1, Creativeitem Ekushey CRM)
- [CVE-2025-54293](https://cve.now/CVE-2025-54293.md): Path Traversal in LXD Instance Log File Retrieval (CVSS 7.1, Canonical LXD · github.com/canonical/lxd)
- [CVE-2025-40990](https://cve.now/CVE-2025-40990.md): Stored XSS in Creativeitem Ekushey CRM (CVSS 5.1, Creativeitem Ekushey CRM)
- [CVE-2025-40989](https://cve.now/CVE-2025-40989.md): Stored XSS in Creativeitem Ekushey CRM (CVSS 5.1, Creativeitem Ekushey CRM)
- [CVE-2025-54468](https://cve.now/CVE-2025-54468.md): Rancher sends sensitive information to external services through the \`/meta/proxy\` endpoint (CVSS 4.7, SUSE rancher · github.com/rancher/rancher)
- [CVE-2025-61735](https://cve.now/CVE-2025-61735.md): Apache Kylin: Server-Side Request Forgery (CVSS 7.3, Apache Software Foundation Apache Kylin · org.apache.kyl… +6)
- [CVE-2025-61733](https://cve.now/CVE-2025-61733.md): Apache Kylin: Authentication bypass (CVSS 7.5, Apache Software Foundation Apache Kylin · org.apache.kyl… +1)
- [CVE-2025-61734](https://cve.now/CVE-2025-61734.md): Apache Kylin: improper restriction of file read (CVSS 7.5, Apache Software Foundation Apache Kylin · org.apache.kyl… +6)
- [CVE-2025-40646](https://cve.now/CVE-2025-40646.md): Exposure of sensitive information in Viday (CVSS 5.9, ViDay)
- [CVE-2025-40645](https://cve.now/CVE-2025-40645.md): Exposure of sensitive information in Viday (CVSS 8.7, ViDay)
- [CVE-2025-54292](https://cve.now/CVE-2025-54292.md): Client-Side Path Traversal in LXD-UI (CVSS 4.8, Canonical LXD)
- [CVE-2025-54291](https://cve.now/CVE-2025-54291.md): Project existence disclosure in LXD images API (CVSS 6.9, Canonical LXD · github.com/canonical/lxd)
- [CVE-2025-54290](https://cve.now/CVE-2025-54290.md): Project Existence Disclosure via Error Handling in LXD Image Export (CVSS 6.9, Canonical LXD · github.com/canonical/lxd)
- [CVE-2025-54289](https://cve.now/CVE-2025-54289.md): Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API (CVSS 7.4, Canonical LXD · github.com/canonical/lxd)
- [CVE-2025-54288](https://cve.now/CVE-2025-54288.md): Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server (CVSS 5.1, Canonical LXD · github.com/canonical/lxd)
- [CVE-2025-54287](https://cve.now/CVE-2025-54287.md): Arbitrary File Read via Template Injection in Snapshot Patterns (CVSS 7.1, Canonical LXD · github.com/lxc/lxd +1)
- [CVE-2025-54286](https://cve.now/CVE-2025-54286.md): CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI (CVSS 7.5, Canonical LXD · github.com/canonical/lxd)
- [CVE-2025-9697](https://cve.now/CVE-2025-9697.md): Ajax WooSearch \<= 1.0.0 - Unauthenticated SQL Injection (CVSS 9.8, Ajax WooSearch)
- [CVE-2025-9587](https://cve.now/CVE-2025-9587.md): CTL Behance Importer Lite \<= 1.0 - Unauthenticated SQL Injection (CVSS 8.6, CTL Behance Importer Lite)
- [CVE-2025-61690](https://cve.now/CVE-2025-61690.md): KV STUDIO versions 12.23 and prior contain a buffer underflow vulnerability. (CVSS 7.8, KEYENCE KV STUDIO)
- [CVE-2025-61692](https://cve.now/CVE-2025-61692.md): VT STUDIO versions 8.53 and prior contain a use after free vulnerability. (CVSS 7.8, KEYENCE VT STUDIO)
- [CVE-2025-61691](https://cve.now/CVE-2025-61691.md): VT STUDIO versions 8.53 and prior contain an out-of-bounds read vulnerability. (CVSS 7.8, KEYENCE VT STUDIO)
- [CVE-2025-58777](https://cve.now/CVE-2025-58777.md): VT Studio versions 8.53 and prior contain an access of uninitialized pointer vulnerability. (CVSS 7.8, KEYENCE VT STUDIO)
- [CVE-2025-58776](https://cve.now/CVE-2025-58776.md): KV Studio versions 12.23 and prior contain a stack-based buffer overflow vulnerability. (CVSS 7.8, KEYENCE KV STUDIO)
- [CVE-2025-58775](https://cve.now/CVE-2025-58775.md): KV STUDIO and VT5-WX15/WX12 contain a stack-based buffer overflow vulnerability. (CVSS 7.8, KEYENCE KV STUDIO · KEYENCE VT5-WX15/WX12)
- [CVE-2025-11020](https://cve.now/CVE-2025-11020.md): Remote Code Execution in MarkAny SafePC Enterprise (CVSS 8.7, MarkAny SafePC Enterprise)
- [CVE-2025-11221](https://cve.now/CVE-2025-11221.md): Remote Code Execution in GTONE ChangeFlow (CVSS 9.4, GTONE ChangeFlow)
- [CVE-2025-11182](https://cve.now/CVE-2025-11182.md): File Download in GTONE ChangeFlow (CVSS 7.1, GTONE ChangeFlow)
- [CVE-2023-28760](https://cve.now/CVE-2023-28760.md): TP-Link AX1800 WiFi 6 Router (Archer AX21) devices allow unauthenticated attackers (on the LAN) to execute arbitrary code as root via the db (CVSS 7.5)
- [CVE-2025-32942](https://cve.now/CVE-2025-32942.md): SSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic. (CVSS 7.2, SSH Tectia Server)
- [CVE-2025-49090](https://cve.now/CVE-2025-49090.md): The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution. (CVSS 7.1, Matrix specification)
- [CVE-2025-54315](https://cve.now/CVE-2025-54315.md): The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness. (CVSS 7.1, Matrix specification)
- [CVE-2025-56019](https://cve.now/CVE-2025-56019.md): An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to co (CVSS 6.5)
- [CVE-2025-56154](https://cve.now/CVE-2025-56154.md): htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. (CVSS 6.1)
- [CVE-2025-56161](https://cve.now/CVE-2025-56161.md): YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. (CVSS 7.5)
- [CVE-2025-56162](https://cve.now/CVE-2025-56162.md): YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. (CVSS 6.5)
- [CVE-2025-56379](https://cve.now/CVE-2025-56379.md): A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scr (CVSS 5.4)
- [CVE-2025-56380](https://cve.now/CVE-2025-56380.md): Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get\_value (CVSS 6.5)
- [CVE-2025-56381](https://cve.now/CVE-2025-56381.md): ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via (CVSS 6.5)
- [CVE-2025-57305](https://cve.now/CVE-2025-57305.md): VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp. (CVSS 6.5)
- [CVE-2025-57443](https://cve.now/CVE-2025-57443.md): FrostWire 6.14.0-build-326 for macOS contains permissive entitlements (allow-dyld-environment-variables, disable-library-validation) that al (CVSS 5.1)
- [CVE-2025-59403](https://cve.now/CVE-2025-59403.md): The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentication. (CVSS 9.8)
- [CVE-2025-59405](https://cve.now/CVE-2025-59405.md): The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate (CVSS 7.5)
- [CVE-2025-59406](https://cve.now/CVE-2025-59406.md): The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers (CVSS 6.2)
- [CVE-2025-59407](https://cve.now/CVE-2025-59407.md): The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow Licens (CVSS 9.8)
- [CVE-2025-59409](https://cve.now/CVE-2025-59409.md): Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test\_flck) stored in cleartex (CVSS 7.5)
- [CVE-2025-60660](https://cve.now/CVE-2025-60660.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the mac parameter in the fromAdvSetMacMtuWan function. (CVSS 7.5)
- [CVE-2025-60661](https://cve.now/CVE-2025-60661.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the cloneType parameter in the fromAdvSetMacMtuWan function. (CVSS 5.3)
- [CVE-2025-60662](https://cve.now/CVE-2025-60662.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanSpeed parameter in the fromAdvSetMacMtuWan function. (CVSS 7.5)
- [CVE-2025-60663](https://cve.now/CVE-2025-60663.md): Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanMTU parameter in the fromAdvSetMacMtuWan function. (CVSS 7.5)
- [CVE-2025-60782](https://cve.now/CVE-2025-60782.md): PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) stored Cross-Site Scripting (XSS) vulnerability in the topics managem (CVSS 5.4)
- [CVE-2025-61087](https://cve.now/CVE-2025-61087.md): SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer M (CVSS 6.1)
- [CVE-2025-61096](https://cve.now/CVE-2025-61096.md): PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping/login.php via the fullname parameter. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.