# CVEs published 2025-10-07

240 CVEs were published on October 7, 2025: 6 critical, 66 high. Days are UTC.

- [CVE-2025-11417](https://cve.now/CVE-2025-11417.md): Campcodes Advanced Online Voting Management System voters\_add.php unrestricted upload (CVSS 5.3, Campcodes Advanced Online Voting Management System)
- [CVE-2025-61999](https://cve.now/CVE-2025-61999.md): OPEXUS FOIAXpress stored XSS via logo image (CVSS 4.3, OPEXUS FOIAXpress)
- [CVE-2025-61998](https://cve.now/CVE-2025-61998.md): OPEXUS FOIAXpress stored XSS via Hyperlink Manager (CVSS 4.8, OPEXUS FOIAXpress)
- [CVE-2025-61997](https://cve.now/CVE-2025-61997.md): OPEXUS FOIAXpress stored XSS via banner image (CVSS 4.8, OPEXUS FOIAXpress)
- [CVE-2025-61996](https://cve.now/CVE-2025-61996.md): OPEXUS FOIAXpress stored XSS via annual report template (CVSS 4.3, OPEXUS FOIAXpress)
- [CVE-2025-11416](https://cve.now/CVE-2025-11416.md): PHPGurukul Beauty Parlour Management System invoices.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-11415](https://cve.now/CVE-2025-11415.md): PHPGurukul Beauty Parlour Management System customer-list.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-11414](https://cve.now/CVE-2025-11414.md): GNU Binutils Linker elflink.c get\_link\_hash\_entry out-of-bounds (CVSS 4.8, GNU Binutils)
- [CVE-2025-43822](https://cve.now/CVE-2025-43822.md): Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2 (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-11413](https://cve.now/CVE-2025-11413.md): GNU Binutils Linker elflink.c elf\_link\_add\_object\_symbols out-of-bounds (CVSS 4.8, GNU Binutils)
- [CVE-2025-11412](https://cve.now/CVE-2025-11412.md): GNU Binutils Linker elflink.c bfd\_elf\_gc\_record\_vtentry out-of-bounds (CVSS 4.8, GNU Binutils)
- [CVE-2025-43823](https://cve.now/CVE-2025-43823.md): Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 202 (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-11410](https://cve.now/CVE-2025-11410.md): Campcodes Advanced Online Voting Management System voters\_add.php sql injection (CVSS 5.3, Campcodes Advanced Online Voting Management System)
- [CVE-2025-11409](https://cve.now/CVE-2025-11409.md): Campcodes Advanced Online Voting Management System index.php sql injection (CVSS 5.3, Campcodes Advanced Online Voting Management System)
- [CVE-2025-11408](https://cve.now/CVE-2025-11408.md): D-Link DI-7001 MINI dbsrv.asp buffer overflow (CVSS 8.7, D-Link DI-7001 MINI)
- [CVE-2025-11407](https://cve.now/CVE-2025-11407.md): D-Link DI-7001 MINI upgrade\_filter.asp os command injection (CVSS 5.3, D-Link DI-7001 MINI)
- [CVE-2025-36565](https://cve.now/CVE-2025-36565.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 releas (CVSS 6.7, Dell PowerProtect Data Domain with Data Domain Operating… +1)
- [CVE-2025-6242](https://cve.now/CVE-2025-6242.md): Vllm: server side request forgery (ssrf) in mediaconnector (CVSS 7.1, Red Hat AI Inference Server · Red Hat Enterprise Linux AI +1)
- [CVE-2025-11462](https://cve.now/CVE-2025-11462.md): Local Privilege Escalation Vulnerability in AWS Client VPN macOS Client (CVSS 9.3, AWS Client VPN)
- [CVE-2025-36566](https://cve.now/CVE-2025-36566.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 releas (CVSS 6.7, Dell PowerProtect Data Domain with Data Domain Operating… +1)
- [CVE-2025-36569](https://cve.now/CVE-2025-36569.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 releas (CVSS 6.7, Dell PowerProtect Data Domain with Data Domain Operating… +1)
- [CVE-2025-11406](https://cve.now/CVE-2025-11406.md): kaifangqian kaifangqian-base SysUserController.java getAllUsers information disclosure (CVSS 5.3, kaifangqian-base)
- [CVE-2025-36567](https://cve.now/CVE-2025-36567.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 releas (CVSS 6.7, Dell PowerProtect Data Domain with Data Domain Operating… +1)
- [CVE-2025-61910](https://cve.now/CVE-2025-61910.md): NASA ION-DTN BPv7 4.1.3s Uncontrolled Memory Allocation that leads to Denial-of-Service (CVSS 7.5, nasa-jpl ION-DTN)
- [CVE-2025-43727](https://cve.now/CVE-2025-43727.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 releas (CVSS 7.5, Dell PowerProtect Data Domain with Data Domain Operating… +1)
- [CVE-2025-43910](https://cve.now/CVE-2025-43910.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas (CVSS 2.3, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-43909](https://cve.now/CVE-2025-43909.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas (CVSS 3.7, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-11192](https://cve.now/CVE-2025-11192.md): Fabric Engine (VOSS) AutoSense Authentication Bypass (CVSS 8.4, Extreme Networks Fabric Engine)
- [CVE-2025-43905](https://cve.now/CVE-2025-43905.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas (CVSS 4.3, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-11405](https://cve.now/CVE-2025-11405.md): SourceCodester Hotel and Lodge Management System del\_tax.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-61784](https://cve.now/CVE-2025-61784.md): LLaMA Factory's Chat API has Critical SSRF and LFI Vulnerabilities (CVSS 7.6, hiyouga LLaMA-Factory · llamafactory)
- [CVE-2025-45375](https://cve.now/CVE-2025-45375.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas (CVSS 4.4, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-61776](https://cve.now/CVE-2025-61776.md): Dependency-Track possibly discloses private NuGet repository credentials to api.nuget.org (CVSS 4.7, DependencyTrack dependency-track)
- [CVE-2025-43913](https://cve.now/CVE-2025-43913.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas (CVSS 5.3, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-61670](https://cve.now/CVE-2025-61670.md): Wasmtime has memory leak in C API with \`externref\` and \`anyref\` types (CVSS 1.0, bytecodealliance wasmtime · wasmtime-bin +1)
- [CVE-2025-43912](https://cve.now/CVE-2025-43912.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas (CVSS 5.3, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-43891](https://cve.now/CVE-2025-43891.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas (CVSS 5.3, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-43889](https://cve.now/CVE-2025-43889.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4, LTS2024 release Ver (CVSS 5.3, Dell PowerProtect Data Domain with Data Domain Operating… +1)
- [CVE-2025-11404](https://cve.now/CVE-2025-11404.md): SourceCodester Hotel and Lodge Management System save\_tax.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-43934](https://cve.now/CVE-2025-43934.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas (CVSS 6.0, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-43908](https://cve.now/CVE-2025-43908.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas (CVSS 6.4, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-3449](https://cve.now/CVE-2025-3449.md): Weak Session Token used in Automation Runtime SDM (CVSS 2.3, B&R Industrial Automation Automation Runtime)
- [CVE-2025-3448](https://cve.now/CVE-2025-3448.md): XSS on SDM (CVSS 5.1, B&R Industrial Automation Automation Runtime)
- [CVE-2025-43907](https://cve.now/CVE-2025-43907.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas (CVSS 6.5, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-8291](https://cve.now/CVE-2025-8291.md): ZIP64 End of Central Directory (EOCD) Locator record offset not checked (CVSS 4.3, Python Software Foundation CPython)
- [CVE-2025-43911](https://cve.now/CVE-2025-43911.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas (CVSS 6.7, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-3450](https://cve.now/CVE-2025-3450.md): Automation Runtime SDM requests may impact system (CVSS 9.3, B&R Industrial Automation Automation Runtime)
- [CVE-2025-43906](https://cve.now/CVE-2025-43906.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas (CVSS 6.7, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-11403](https://cve.now/CVE-2025-11403.md): SourceCodester Hotel and Lodge Management System del\_booking.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-43890](https://cve.now/CVE-2025-43890.md): Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 releas (CVSS 6.7, Dell PowerProtect Data Domain with Data Domain Operating… +2)
- [CVE-2025-1826](https://cve.now/CVE-2025-1826.md): IBM Jazz Foundation cross-site scripting (CVSS 5.4, IBM Jazz Foundation)
- [CVE-2025-43914](https://cve.now/CVE-2025-43914.md): Dell PowerProtect Data Domain BoostFS for Linux Ubuntu systems of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version (CVSS 7.5, Dell PowerProtect Data Domain BoostFS for Linux Ubuntu F… +2)
- [CVE-2025-36156](https://cve.now/CVE-2025-36156.md): IBM InfoSphere Data Replication VSAM for z/OS Remote Source code execution (CVSS 7.4, IBM InfoSphere Data Replication VSAM for z/OS Remote Source)
- [CVE-2025-11402](https://cve.now/CVE-2025-11402.md): SourceCodester Hotel and Lodge Management System del\_curr.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-11401](https://cve.now/CVE-2025-11401.md): SourceCodester Hotel and Lodge Management System save\_curr.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-11400](https://cve.now/CVE-2025-11400.md): SourceCodester Hotel and Lodge Management System del\_room.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-11399](https://cve.now/CVE-2025-11399.md): SourceCodester Hotel and Lodge Management System save\_room.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2023-53687](https://cve.now/CVE-2023-53687.md): tty: serial: samsung\_tty: Fix a memory leak in s3c24xx\_serial\_getclk() when iterating clk (no CVSS, Linux)
- [CVE-2023-53686](https://cve.now/CVE-2023-53686.md): net/handshake: fix null-ptr-deref in handshake\_nl\_done\_doit() (no CVSS, Linux)
- [CVE-2023-53685](https://cve.now/CVE-2023-53685.md): tun: Fix memory leak for detached NAPI queue. (no CVSS, Linux)
- [CVE-2023-53684](https://cve.now/CVE-2023-53684.md): xfrm: Zero padding when dumping algos and encap (no CVSS, Linux)
- [CVE-2023-53683](https://cve.now/CVE-2023-53683.md): fs: hfsplus: remove WARN\_ON() from hfsplus\_cat\_{read,write}\_inode() (CVSS 7.8, Linux)
- [CVE-2023-53682](https://cve.now/CVE-2023-53682.md): hwmon: (xgene) Fix ioremap and memremap leak (no CVSS, Linux)
- [CVE-2023-53681](https://cve.now/CVE-2023-53681.md): bcache: Fix \_\_bch\_btree\_node\_alloc to make the failure behavior consistent (no CVSS, Linux)
- [CVE-2023-53680](https://cve.now/CVE-2023-53680.md): NFSD: Avoid calling OPDESC() with ops-\>opnum == OP\_ILLEGAL (CVSS 7.5, Linux)
- [CVE-2023-53679](https://cve.now/CVE-2023-53679.md): wifi: mt7601u: fix an integer underflow (CVSS 8.3, Linux)
- [CVE-2023-53678](https://cve.now/CVE-2023-53678.md): drm/i915: Fix system suspend without fbdev being initialized (no CVSS, Linux)
- [CVE-2023-53677](https://cve.now/CVE-2023-53677.md): drm/i915: Fix memory leaks in i915 selftests (no CVSS, Linux)
- [CVE-2023-53676](https://cve.now/CVE-2023-53676.md): scsi: target: iscsi: Fix buffer overflow in lio\_target\_nacl\_info\_show() (CVSS 8.8, Linux)
- [CVE-2023-53675](https://cve.now/CVE-2023-53675.md): scsi: ses: Fix possible desc\_ptr out-of-bounds accesses (CVSS 8.8, Linux)
- [CVE-2023-53674](https://cve.now/CVE-2023-53674.md): clk: Fix memory leak in devm\_clk\_notifier\_register() (CVSS 7.8, Linux)
- [CVE-2023-53673](https://cve.now/CVE-2023-53673.md): Bluetooth: hci\_event: call disconnect callback before deleting conn (CVSS 8.8, Linux)
- [CVE-2023-53672](https://cve.now/CVE-2023-53672.md): btrfs: output extra debug info if we failed to find an inline backref (no CVSS, Linux)
- [CVE-2023-53671](https://cve.now/CVE-2023-53671.md): srcu: Delegate work to the boot cpu if using SRCU\_SIZE\_SMALL (no CVSS, Linux)
- [CVE-2023-53670](https://cve.now/CVE-2023-53670.md): nvme-core: fix dev\_pm\_qos memleak (no CVSS, Linux)
- [CVE-2023-53669](https://cve.now/CVE-2023-53669.md): tcp: fix skb\_copy\_ubufs() vs BIG TCP (CVSS 7.8, Linux)
- [CVE-2023-53668](https://cve.now/CVE-2023-53668.md): ring-buffer: Fix deadloop issue on reading trace\_pipe (no CVSS, Linux)
- [CVE-2023-53667](https://cve.now/CVE-2023-53667.md): net: cdc\_ncm: Deal with too low values of dwNtbOutMaxSize (no CVSS, Linux)
- [CVE-2023-53666](https://cve.now/CVE-2023-53666.md): ASoC: codecs: wcd938x: fix missing mbhc init error handling (no CVSS, Linux)
- [CVE-2023-53665](https://cve.now/CVE-2023-53665.md): md: don't dereference mddev after export\_rdev() (no CVSS, Linux)
- [CVE-2023-53664](https://cve.now/CVE-2023-53664.md): OPP: Fix potential null ptr dereference in dev\_pm\_opp\_get\_required\_pstate() (no CVSS, Linux)
- [CVE-2023-53663](https://cve.now/CVE-2023-53663.md): KVM: nSVM: Check instead of asserting on nested TSC scaling support (no CVSS, Linux)
- [CVE-2023-53662](https://cve.now/CVE-2023-53662.md): ext4: fix memory leaks in ext4\_fname\_{setup\_filename,prepare\_lookup} (no CVSS, Linux)
- [CVE-2023-53661](https://cve.now/CVE-2023-53661.md): bnxt: avoid overflow in bnxt\_get\_nvram\_directory() (no CVSS, Linux)
- [CVE-2023-53660](https://cve.now/CVE-2023-53660.md): bpf, cpumap: Handle skb as well when clean up ptr\_ring (CVSS 7.8, Linux)
- [CVE-2023-53659](https://cve.now/CVE-2023-53659.md): iavf: Fix out-of-bounds when setting channels on remove (CVSS 7.8, Linux)
- [CVE-2023-53658](https://cve.now/CVE-2023-53658.md): spi: bcm-qspi: return error if neither hif\_mspi nor mspi is available (no CVSS, Linux)
- [CVE-2023-53657](https://cve.now/CVE-2023-53657.md): ice: Don't tx before switchdev is fully configured (no CVSS, Linux)
- [CVE-2023-53656](https://cve.now/CVE-2023-53656.md): drivers/perf: hisi: Don't migrate perf to the CPU going to teardown (no CVSS, Linux)
- [CVE-2023-53655](https://cve.now/CVE-2023-53655.md): rcu: Avoid stack overflow due to \_\_rcu\_irq\_enter\_check\_tick() being kprobe-ed (no CVSS, Linux)
- [CVE-2022-50555](https://cve.now/CVE-2022-50555.md): tipc: fix a null-ptr-deref in tipc\_topsrv\_accept (CVSS 7.8, Linux)
- [CVE-2022-50554](https://cve.now/CVE-2022-50554.md): blk-mq: avoid double -\>queue\_rq() because of early timeout (no CVSS, Linux)
- [CVE-2022-50553](https://cve.now/CVE-2022-50553.md): tracing/hist: Fix out-of-bound write on 'action\_data.var\_ref\_idx' (no CVSS, Linux)
- [CVE-2022-50552](https://cve.now/CVE-2022-50552.md): blk-mq: use quiesced elevator switch when reinitializing queues (no CVSS, Linux)
- [CVE-2022-50551](https://cve.now/CVE-2022-50551.md): wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf\_fw\_alloc\_request() (no CVSS, Linux)
- [CVE-2022-50550](https://cve.now/CVE-2022-50550.md): blk-iolatency: Fix memory leak on add\_disk() failures (no CVSS, Linux)
- [CVE-2022-50549](https://cve.now/CVE-2022-50549.md): dm thin: Fix ABBA deadlock between shrink\_slab and dm\_pool\_abort\_metadata (no CVSS, Linux)
- [CVE-2022-50548](https://cve.now/CVE-2022-50548.md): media: i2c: hi846: Fix memory leak in hi846\_parse\_dt() (no CVSS, Linux)
- [CVE-2022-50547](https://cve.now/CVE-2022-50547.md): media: solo6x10: fix possible memory leak in solo\_sysfs\_init() (no CVSS, Linux)
- [CVE-2022-50546](https://cve.now/CVE-2022-50546.md): ext4: fix uninititialized value in 'ext4\_evict\_inode' (no CVSS, Linux)
- [CVE-2022-50545](https://cve.now/CVE-2022-50545.md): r6040: Fix kmemleak in probe and remove (no CVSS, Linux)
- [CVE-2022-50544](https://cve.now/CVE-2022-50544.md): usb: host: xhci: Fix potential memory leak in xhci\_alloc\_stream\_info() (no CVSS, Linux)
- [CVE-2022-50543](https://cve.now/CVE-2022-50543.md): RDMA/rxe: Fix mr-\>map double free (CVSS 7.8, Linux)
- [CVE-2022-50542](https://cve.now/CVE-2022-50542.md): media: si470x: Fix use-after-free in si470x\_int\_in\_callback() (no CVSS, Linux)
- [CVE-2022-50541](https://cve.now/CVE-2022-50541.md): dmaengine: ti: k3-udma: Reset UDMA\_CHAN\_RT byte counters to prevent overflow (no CVSS, Linux)
- [CVE-2022-50540](https://cve.now/CVE-2022-50540.md): dmaengine: qcom-adm: fix wrong sizeof config in slave\_config (no CVSS, Linux)
- [CVE-2022-50539](https://cve.now/CVE-2022-50539.md): ARM: OMAP2+: omap4-common: Fix refcount leak bug (no CVSS, Linux)
- [CVE-2022-50538](https://cve.now/CVE-2022-50538.md): vme: Fix error not catched in fake\_init() (no CVSS, Linux)
- [CVE-2022-50537](https://cve.now/CVE-2022-50537.md): firmware: raspberrypi: fix possible memory leak in rpi\_firmware\_probe() (no CVSS, Linux)
- [CVE-2022-50536](https://cve.now/CVE-2022-50536.md): bpf, sockmap: Fix repeated calls to sock\_put() when msg has more\_data (CVSS 7.8, Linux)
- [CVE-2022-50535](https://cve.now/CVE-2022-50535.md): drm/amd/display: Fix potential null-deref in dm\_resume (no CVSS, Linux)
- [CVE-2023-53654](https://cve.now/CVE-2023-53654.md): octeontx2-af: Add validation before accessing cgx and lmac (no CVSS, Linux)
- [CVE-2023-53653](https://cve.now/CVE-2023-53653.md): media: amphion: fix REVERSE\_INULL issues reported by coverity (no CVSS, Linux)
- [CVE-2023-53652](https://cve.now/CVE-2023-53652.md): vdpa: Add features attr to vdpa\_nl\_policy for nlattr length check (no CVSS, Linux)
- [CVE-2023-53651](https://cve.now/CVE-2023-53651.md): Input: exc3000 - properly stop timer on shutdown (CVSS 7.8, Linux)
- [CVE-2023-53650](https://cve.now/CVE-2023-53650.md): fbdev: omapfb: lcd\_mipid: Fix an error handling path in mipid\_spi\_probe() (no CVSS, Linux)
- [CVE-2023-53649](https://cve.now/CVE-2023-53649.md): perf trace: Really free the evsel-\>priv area (no CVSS, Linux)
- [CVE-2023-53648](https://cve.now/CVE-2023-53648.md): ALSA: ac97: Fix possible NULL dereference in snd\_ac97\_mixer (no CVSS, Linux)
- [CVE-2023-53647](https://cve.now/CVE-2023-53647.md): Drivers: hv: vmbus: Don't dereference ACPI root object handle (no CVSS, Linux)
- [CVE-2023-53646](https://cve.now/CVE-2023-53646.md): drm/i915/perf: add sentinel to xehp\_oa\_b\_counters (CVSS 7.8, Linux)
- [CVE-2023-53645](https://cve.now/CVE-2023-53645.md): bpf: Make bpf\_refcount\_acquire fallible for non-owning refs (CVSS 7.8, Linux)
- [CVE-2023-53644](https://cve.now/CVE-2023-53644.md): media: radio-shark: Add endpoint checks (no CVSS, Linux)
- [CVE-2023-53643](https://cve.now/CVE-2023-53643.md): nvme-tcp: don't access released socket during error recovery (CVSS 7.8, Linux)
- [CVE-2023-53642](https://cve.now/CVE-2023-53642.md): x86: fix clear\_user\_rep\_good() exception handling annotation (no CVSS, Linux)
- [CVE-2023-53641](https://cve.now/CVE-2023-53641.md): wifi: ath9k: hif\_usb: fix memory leak of remain\_skbs (no CVSS, Linux)
- [CVE-2023-53640](https://cve.now/CVE-2023-53640.md): ASoC: lpass: Fix for KASAN use\_after\_free out of bounds (CVSS 7.3, Linux)
- [CVE-2023-53639](https://cve.now/CVE-2023-53639.md): wifi: ath6kl: reduce WARN to dev\_dbg() in callback (no CVSS, Linux)
- [CVE-2023-53638](https://cve.now/CVE-2023-53638.md): octeon\_ep: cancel queued works in probe error path (CVSS 7.0, Linux)
- [CVE-2023-53637](https://cve.now/CVE-2023-53637.md): media: i2c: ov772x: Fix memleak in ov772x\_probe() (no CVSS, Linux)
- [CVE-2023-53636](https://cve.now/CVE-2023-53636.md): clk: microchip: fix potential UAF in auxdev release callback (no CVSS, Linux)
- [CVE-2023-53635](https://cve.now/CVE-2023-53635.md): netfilter: conntrack: fix wrong ct-\>timeout value (CVSS 8.2, Linux)
- [CVE-2023-53634](https://cve.now/CVE-2023-53634.md): bpf, arm64: Fixed a BTI error on returning to patched function (no CVSS, Linux)
- [CVE-2023-53633](https://cve.now/CVE-2023-53633.md): accel/qaic: Fix a leak in map\_user\_pages() (no CVSS, Linux)
- [CVE-2023-53632](https://cve.now/CVE-2023-53632.md): net/mlx5e: Take RTNL lock when needed before calling xdp\_set\_features() (no CVSS, Linux)
- [CVE-2023-53631](https://cve.now/CVE-2023-53631.md): platform/x86: dell-sysman: Fix reference leak (no CVSS, Linux)
- [CVE-2023-53630](https://cve.now/CVE-2023-53630.md): iommufd: Fix unpinning of pages when an access is present (CVSS 8.8, Linux)
- [CVE-2023-53629](https://cve.now/CVE-2023-53629.md): fs: dlm: fix use after free in midcomms commit (CVSS 9.8, Linux)
- [CVE-2023-53628](https://cve.now/CVE-2023-53628.md): drm/amdgpu: drop gfx\_v11\_0\_cp\_ecc\_error\_irq\_funcs (no CVSS, Linux)
- [CVE-2023-53627](https://cve.now/CVE-2023-53627.md): scsi: hisi\_sas: Grab sas\_dev lock when traversing the members of sas\_dev.list (CVSS 7.8, Linux)
- [CVE-2023-53626](https://cve.now/CVE-2023-53626.md): ext4: fix possible double unlock when moving a directory (CVSS 7.8, Linux)
- [CVE-2023-53625](https://cve.now/CVE-2023-53625.md): drm/i915/gvt: fix vgpu debugfs clean in remove (no CVSS, Linux)
- [CVE-2023-53624](https://cve.now/CVE-2023-53624.md): net/sched: sch\_fq: fix integer overflow of "credit" (no CVSS, Linux)
- [CVE-2023-53623](https://cve.now/CVE-2023-53623.md): mm/swap: fix swap\_info\_struct race between swapoff and get\_swap\_pages() (no CVSS, Linux)
- [CVE-2023-53622](https://cve.now/CVE-2023-53622.md): gfs2: Fix possible data races in gfs2\_show\_options() (no CVSS, Linux)
- [CVE-2023-53621](https://cve.now/CVE-2023-53621.md): memcontrol: ensure memcg acquired by id is properly set up (no CVSS, Linux)
- [CVE-2023-53620](https://cve.now/CVE-2023-53620.md): md: fix soft lockup in status\_resync (no CVSS, Linux)
- [CVE-2023-53619](https://cve.now/CVE-2023-53619.md): netfilter: conntrack: Avoid nf\_ct\_helper\_hash uses after free (CVSS 7.8, Linux)
- [CVE-2023-53618](https://cve.now/CVE-2023-53618.md): btrfs: reject invalid reloc tree root keys with stack dump (no CVSS, Linux)
- [CVE-2023-53617](https://cve.now/CVE-2023-53617.md): soc: aspeed: socinfo: Add kfree for kstrdup (no CVSS, Linux)
- [CVE-2022-50534](https://cve.now/CVE-2022-50534.md): dm thin: Use last transaction's pmd-\>root when commit failed (no CVSS, Linux)
- [CVE-2022-50533](https://cve.now/CVE-2022-50533.md): wifi: mac80211: mlme: fix null-ptr deref on failed assoc (no CVSS, Linux)
- [CVE-2022-50532](https://cve.now/CVE-2022-50532.md): scsi: mpt3sas: Fix possible resource leaks in mpt3sas\_transport\_port\_add() (no CVSS, Linux)
- [CVE-2022-50531](https://cve.now/CVE-2022-50531.md): tipc: fix an information leak in tipc\_topsrv\_kern\_subscr (no CVSS, Linux)
- [CVE-2022-50530](https://cve.now/CVE-2022-50530.md): blk-mq: fix null pointer dereference in blk\_mq\_clear\_rq\_mapping() (no CVSS, Linux)
- [CVE-2022-50529](https://cve.now/CVE-2022-50529.md): test\_firmware: fix memory leak in test\_firmware\_init() (no CVSS, Linux)
- [CVE-2022-50528](https://cve.now/CVE-2022-50528.md): drm/amdkfd: Fix memory leakage (CVSS 7.8, Linux)
- [CVE-2022-50527](https://cve.now/CVE-2022-50527.md): drm/amdgpu: Fix size validation for non-exclusive domains (v4) (no CVSS, Linux)
- [CVE-2022-50526](https://cve.now/CVE-2022-50526.md): drm/msm/dp: fix memory corruption with too many bridges (no CVSS, Linux)
- [CVE-2022-50525](https://cve.now/CVE-2022-50525.md): iommu/fsl\_pamu: Fix resource leak in fsl\_pamu\_probe() (no CVSS, Linux)
- [CVE-2022-50524](https://cve.now/CVE-2022-50524.md): iommu/mediatek: Check return value after calling platform\_get\_resource() (no CVSS, Linux)
- [CVE-2022-50523](https://cve.now/CVE-2022-50523.md): clk: rockchip: Fix memory leak in rockchip\_clk\_register\_pll() (no CVSS, Linux)
- [CVE-2022-50522](https://cve.now/CVE-2022-50522.md): mcb: mcb-parse: fix error handing in chameleon\_parse\_gdd() (no CVSS, Linux)
- [CVE-2022-50521](https://cve.now/CVE-2022-50521.md): platform/x86: mxm-wmi: fix memleak in mxm\_wmi\_call\_mx\[ds|mx\]() (no CVSS, Linux)
- [CVE-2022-50520](https://cve.now/CVE-2022-50520.md): drm/radeon: Fix PCI device refcount leak in radeon\_atrm\_get\_bios() (no CVSS, Linux)
- [CVE-2022-50519](https://cve.now/CVE-2022-50519.md): nilfs2: replace WARN\_ONs by nilfs\_error for checkpoint acquisition failure (no CVSS, Linux)
- [CVE-2022-50518](https://cve.now/CVE-2022-50518.md): parisc: Fix locking in pdc\_iodc\_print() firmware call (CVSS 7.8, Linux)
- [CVE-2022-50517](https://cve.now/CVE-2022-50517.md): mm/huge\_memory: do not clobber swp\_entry\_t during THP split (CVSS 7.8, Linux)
- [CVE-2022-50516](https://cve.now/CVE-2022-50516.md): fs: dlm: fix invalid derefence of sb\_lvbptr (no CVSS, Linux)
- [CVE-2022-50515](https://cve.now/CVE-2022-50515.md): drm/amdgpu: Fix memory leak in hpd\_rx\_irq\_create\_workqueue() (no CVSS, Linux)
- [CVE-2022-50514](https://cve.now/CVE-2022-50514.md): usb: gadget: f\_hid: fix refcount leak on error path (no CVSS, Linux)
- [CVE-2022-50513](https://cve.now/CVE-2022-50513.md): staging: rtl8723bs: fix a potential memory leak in rtw\_init\_cmd\_priv() (no CVSS, Linux)
- [CVE-2022-50512](https://cve.now/CVE-2022-50512.md): ext4: fix potential memory leak in ext4\_fc\_record\_regions() (no CVSS, Linux)
- [CVE-2022-50511](https://cve.now/CVE-2022-50511.md): lib/fonts: fix undefined behavior in bit shift for get\_default\_font (no CVSS, Linux)
- [CVE-2022-50510](https://cve.now/CVE-2022-50510.md): perf/smmuv3: Fix hotplug callback leak in arm\_smmu\_pmu\_init() (no CVSS, Linux)
- [CVE-2022-50509](https://cve.now/CVE-2022-50509.md): media: coda: Add check for kmalloc (no CVSS, Linux)
- [CVE-2025-61772](https://cve.now/CVE-2025-61772.md): Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVSS 7.5, rack)
- [CVE-2025-61771](https://cve.now/CVE-2025-61771.md): Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVSS 7.5, rack)
- [CVE-2025-11398](https://cve.now/CVE-2025-11398.md): SourceCodester Hotel and Lodge Management System Profile profile.php unrestricted upload (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2023-6215](https://cve.now/CVE-2023-6215.md): HP Sure Start IFD Protection - BIOS Security Update (CVSS 7.2, HP Sure Start IFD Protection)
- [CVE-2025-61770](https://cve.now/CVE-2025-61770.md): Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVSS 7.5, rack)
- [CVE-2025-59425](https://cve.now/CVE-2025-59425.md): vLLM vulnerable to timing attack at bearer auth (CVSS 7.5, vllm-project vllm · vllm)
- [CVE-2025-11397](https://cve.now/CVE-2025-11397.md): SourceCodester Hotel and Lodge Management System login.php sql injection (CVSS 6.9, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-25009](https://cve.now/CVE-2025-25009.md): Kibana Cross-Site Scripting (XSS) (CVSS 8.7, Elastic Kibana)
- [CVE-2025-54402](https://cve.now/CVE-2025-54402.md): Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-54401](https://cve.now/CVE-2025-54401.md): Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-54400](https://cve.now/CVE-2025-54400.md): Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-54399](https://cve.now/CVE-2025-54399.md): Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-54404](https://cve.now/CVE-2025-54404.md): Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-54403](https://cve.now/CVE-2025-54403.md): Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-48826](https://cve.now/CVE-2025-48826.md): A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-54406](https://cve.now/CVE-2025-54406.md): Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-54405](https://cve.now/CVE-2025-54405.md): Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. (CVSS 8.8, Planet WGR-500)
- [CVE-2025-37728](https://cve.now/CVE-2025-37728.md): Kibana Insufficiently Protected Credentials in the CrowdStrike Connector (CVSS 5.4, Elastic Kibana)
- [CVE-2025-53476](https://cve.now/CVE-2025-53476.md): A denial of service vulnerability exists in the ModbusTCP server functionality of OpenPLC \_v3 a931181e8b81e36fadf7b74d5cba99b73c3f6d58. (CVSS 5.3, OpenPLC\_v3)
- [CVE-2021-22291](https://cve.now/CVE-2021-22291.md): EIBPORT Reflected XSS (CVSS 8.5, ABB EIBPORT V3 KNX)
- [CVE-2025-11396](https://cve.now/CVE-2025-11396.md): code-projects Simple Food Ordering System product.php sql injection (CVSS 6.9, code-projects Simple Food Ordering System)
- [CVE-2025-40888](https://cve.now/CVE-2025-40888.md): Authenticated SQL Injection on CLI functionality in Guardian/CMC before 25.3.0 (CVSS 6.0, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40889](https://cve.now/CVE-2025-40889.md): Path traversal in Time Machine functionality in Guardian/CMC before 25.2.0 (CVSS 7.2, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40887](https://cve.now/CVE-2025-40887.md): Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0 (CVSS 6.0, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40886](https://cve.now/CVE-2025-40886.md): Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0 (CVSS 7.7, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40885](https://cve.now/CVE-2025-40885.md): Authenticated SQL Injection on Smart Polling functionality in Guardian/CMC before 25.2.0 (CVSS 6.0, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-3719](https://cve.now/CVE-2025-3719.md): Incorrect authorization for CLI in Guardian/CMC before 25.2.0 (CVSS 7.2, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-3718](https://cve.now/CVE-2025-3718.md): Client-side path traversal in Guardian/CMC before 25.2.0 (CVSS 5.8, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40676](https://cve.now/CVE-2025-40676.md): Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC (CVSS 5.3, BBMRI-ERIC Negotiator)
- [CVE-2025-40649](https://cve.now/CVE-2025-40649.md): Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC (CVSS 5.1, BBMRI-ERIC Negotiator)
- [CVE-2025-11390](https://cve.now/CVE-2025-11390.md): PHPGurukul Cyber Cafe Management System POST Parameter search.php cross site scripting (CVSS 5.3, PHPGurukul Cyber Cafe Management System)
- [CVE-2025-0603](https://cve.now/CVE-2025-0603.md): SQLi in Callvision Healthcare's Callvision Emergency Code (CVSS 9.8, Callvision Healthcare Callvision Emergency Code)
- [CVE-2025-11389](https://cve.now/CVE-2025-11389.md): Tenda AC15 saveAutoQos stack-based overflow (CVSS 8.7, Tenda AC15)
- [CVE-2025-11388](https://cve.now/CVE-2025-11388.md): Tenda AC15 setNotUpgrade stack-based overflow (CVSS 8.7, Tenda AC15)
- [CVE-2025-11387](https://cve.now/CVE-2025-11387.md): Tenda AC15 fast\_setting\_pppoe\_set stack-based overflow (CVSS 8.7, Tenda AC15)
- [CVE-2025-11386](https://cve.now/CVE-2025-11386.md): Tenda AC15 POST Parameter SetDDNSCfg stack-based overflow (CVSS 8.7, Tenda AC15)
- [CVE-2025-11385](https://cve.now/CVE-2025-11385.md): Tenda AC20 fast\_setting\_wifi\_set sscanf buffer overflow (CVSS 8.7, Tenda AC20)
- [CVE-2025-11360](https://cve.now/CVE-2025-11360.md): jakowenko double-take API app.js app.use cross site scripting (CVSS 5.3, jakowenko double-take)
- [CVE-2025-11359](https://cve.now/CVE-2025-11359.md): code-projects Simple Banking System transfermoney.php sql injection (CVSS 5.3, code-projects Simple Banking System)
- [CVE-2025-10645](https://cve.now/CVE-2025-10645.md): WP Reset \<= 2.05 - Unauthenticated Sensitive Information Exposure via wf-licensing.log (CVSS 5.3, webfactory WP Reset)
- [CVE-2025-11358](https://cve.now/CVE-2025-11358.md): code-projects Simple Banking System removeuser.php sql injection (CVSS 5.3, code-projects Simple Banking System)
- [CVE-2025-11357](https://cve.now/CVE-2025-11357.md): code-projects Simple Banking System createuser.php sql injection (CVSS 5.3, code-projects Simple Banking System)
- [CVE-2025-7400](https://cve.now/CVE-2025-7400.md): Featured Image from URL (FIFU) \<= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields (CVSS 6.4, marceljm Featured Image from URL)
- [CVE-2025-11356](https://cve.now/CVE-2025-11356.md): Tenda AC23 SetStaticRouteCfg sscanf buffer overflow (CVSS 8.7, Tenda AC23)
- [CVE-2025-11355](https://cve.now/CVE-2025-11355.md): UTT 1250GW aspChangeChannel strcpy buffer overflow (CVSS 8.7, UTT 1250GW)
- [CVE-2025-11354](https://cve.now/CVE-2025-11354.md): code-projects Online Hotel Reservation System addslideexec.php unrestricted upload (CVSS 5.3, code-projects Online Hotel Reservation System)
- [CVE-2025-10162](https://cve.now/CVE-2025-10162.md): OrderConvo \<= 15.1 - Unauthenticated Arbitrary File Read (CVSS 8.6, Admin and Customer Messages After Order for WooCommerce: Or…)
- [CVE-2025-11353](https://cve.now/CVE-2025-11353.md): code-projects Online Hotel Reservation System addgalleryexec.php unrestricted upload (CVSS 5.3, code-projects Online Hotel Reservation System)
- [CVE-2025-11352](https://cve.now/CVE-2025-11352.md): code-projects Online Hotel Reservation System addexec.php unrestricted upload (CVSS 5.3, code-projects Online Hotel Reservation System)
- [CVE-2025-11362](https://cve.now/CVE-2025-11362.md): Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throt (CVSS 8.7, pdfmake · org.webjars.npm:pdfmake)
- [CVE-2025-11351](https://cve.now/CVE-2025-11351.md): code-projects Online Hotel Reservation System editpicexec.php unrestricted upload (CVSS 5.3, code-projects Online Hotel Reservation System)
- [CVE-2025-11350](https://cve.now/CVE-2025-11350.md): Campcodes Online Apartment Visitor Management System bwdates-reports-details.php sql injection (CVSS 6.9, Campcodes Online Apartment Visitor Management System)
- [CVE-2025-11349](https://cve.now/CVE-2025-11349.md): Campcodes Online Apartment Visitor Management System search-visitor.php sql injection (CVSS 6.9, Campcodes Online Apartment Visitor Management System)
- [CVE-2025-11348](https://cve.now/CVE-2025-11348.md): Campcodes Online Apartment Visitor Management System index.php sql injection (CVSS 6.9, Campcodes Online Apartment Visitor Management System)
- [CVE-2025-11347](https://cve.now/CVE-2025-11347.md): code-projects Student Crud Operation Add Student Page/Edit Student add.php move\_uploaded\_file unrestricted upload (CVSS 6.9, code-projects Student Crud Operation)
- [CVE-2025-44823](https://cve.now/CVE-2025-44823.md): Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.ph (CVSS 9.9, Nagios Log Server)
- [CVE-2025-44824](https://cve.now/CVE-2025-44824.md): Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslo (CVSS 8.5, Nagios Log Server)
- [CVE-2025-50505](https://cve.now/CVE-2025-50505.md): Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key funct (CVSS 7.8)
- [CVE-2025-52021](https://cve.now/CVE-2025-52021.md): A SQL Injection vulnerability exists in the edit\_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0. (CVSS 9.8)
- [CVE-2025-56243](https://cve.now/CVE-2025-56243.md): A Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the event (CVSS 6.1)
- [CVE-2025-57564](https://cve.now/CVE-2025-57564.md): CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/inser (CVSS 8.2)
- [CVE-2025-60312](https://cve.now/CVE-2025-60312.md): Sourcecodester Markdown to HTML Converter v1.0 is vulnerable to a Cross-Site Scripting (XSS) in the "Markdown Input" field, allowing a remot (CVSS 6.1)
- [CVE-2025-62185](https://cve.now/CVE-2025-62185.md): In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed (CVSS 6.7, Ankitects Anki)
- [CVE-2025-62186](https://cve.now/CVE-2025-62186.md): Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme (CVSS 6.7, Ankitects Anki)
- [CVE-2025-62187](https://cve.now/CVE-2025-62187.md): In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (CVSS 2.9, Ankitects Anki)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.