CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 16:10 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-20131 RansomwareIn wildKEV | CS Cisco Secure Firewall Management Center (FMC) Cisco | 10.0 | Mar 4 | Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability |
| CVE-2026-20079 In wildKEV | CS Cisco Secure Firewall Management Center (FMC) Cisco | 10.0 | Mar 4 | Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability |
| CVE-2019-25506 | FR FreeSMS Freesms | 9.8 | Mar 4 | FreeSMS 2.1.2 Authentication Bypass via SQL Injection |
| CVE-2019-25499 | SJ Simple Job Script niteosoft | 9.8 | Mar 4 | Simple Job Script SQL Injection via get_job_applications_ajax.php |
| CVE-2026-28783 | CM cms craftcms | 9.1 | Mar 4 | Craft has a Twig Function Blocklist Bypass |
| CVE-2026-28697 | CM cms craftcms | 9.1 | Mar 4 | Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates |
| CVE-2025-59786 | 2A 2N Access Commander 2N Telekomunikace a.s. | 9.8 | Mar 4 | Cookies are not Invalidated upon Logout and Password Change |
| CVE-2026-27441 | SE Secure Email Gateway SEPPmail | 9.8 | Mar 4 | PDF Password CMDi |
| CVE-2026-27446 | AA Apache ActiveMQ Artemis Apache Software Foundation | 9.8 | Mar 4 | Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation |
| CVE-2026-29119 | SS SFX2100 Series SuperFlex SatelliteReceiver International Datacasting Corporation (IDC) | 9.8 | Mar 4 | Hardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2100 Satellite Receiver |
| CVE-2026-28778 | IS IDC SFX2100 SuperFlex Satellite Receiver International Datacasting Corporation (IDC) | 9.8 | Mar 4 | Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100 |
| CVE-2026-28777 | SS SFX2100 Satellite Receiver International Datacasting Corporation (IDC) | 9.8 | Mar 4 | Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite Receiver |
| CVE-2026-28776 | IS IDC SFX2100 SuperFlex Satellite Receiver International Datacasting Corporation (IDC) | 9.8 | Mar 4 | Hardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Satellite Receiver |
| CVE-2026-28775 | SS SFX2100 Series SuperFlex SatelliteReceiver International Datacasting Corporation (IDC) | 9.8 | Mar 4 | Unauthenticated RCE via SNMP Default Writable Community String |
| CVE-2025-66944 | DA Databasir Databasir | 9.8 | Mar 4 | SQL Injection vulnerability in vran-dev databaseir v.1.0.7 and before allows a remote attacker to execute arbitrary code via the query parameter in the search API endpoint |
| CVE-2025-66678 | HR Hardware Read & Write Utility Faintsnow | 9.8 | Mar 4 | An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execute arbitrary read and write operations… |
| CVE-2025-70226 | DF Dir-513 Firmware Dlink | 9.8 | Mar 4 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formEasySetupWizard |
| CVE-2025-70220 | DF Dir-513 Firmware Dlink | 9.8 | Mar 4 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAutoDetecWAN_wizard4 |
| CVE-2026-26478 | TM Tichome Mini Firmware Mobvoi | 9.8 | Mar 4 | A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a specially crafted UDP datagram and execute… |
| CVE-2025-70219 | DF Dir-513 Firmware Dlink | 9.8 | Mar 4 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the goform/formDeviceReboot |
| CVE-2025-70218 | DF Dir-513 Firmware Dlink | 9.8 | Mar 4 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via POST to the goform/formAdvFirewall component |
| CVE-2025-70222 | DF Dir-513 Firmware Dlink | 9.8 | Mar 4 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin,goform/getAuthCode |
| CVE-2025-70225 | DF Dir-513 Firmware Dlink | 9.8 | Mar 4 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curtime parameter to the goform/formEasySetupWWConfig component |
| CVE-2025-70223 | DF Dir-513 Firmware Dlink | 9.8 | Mar 4 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvNetwork |
| CVE-2025-70221 | DF Dir-513 Firmware Dlink | 9.8 | Mar 4 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin |
| CVE-2025-46108 | DF Dir-513 Firmware Dlink | 9.8 | Mar 4 | D-link Dir-513 A1FW110 is vulnerable to Buffer Overflow in the function formTcpipSetup |
| CVE-2025-69969 | PP Pebble Prism Ultra Firmware Pebblepower | 9.6 | Mar 4 | A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.2 allows attackers… |
| CVE-2026-27971 | QW qwik QwikDev | 9.8 | Mar 3 | Qwik affected by unauthenticated RCE via server$ Deserialization |
| CVE-2026-26279 | FR Froxlor froxlor | 9.1 | Mar 3 | Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection |
| CVE-2026-3266 | FI Filr OpenText™ | 9.8 | Mar 3 | Improper access control vulnerability has been discovered in OpenText™ Filr. |
| CVE-2026-24898 | OP openemr openemr | 9.8 | Mar 3 | OpenEMR has an Unauthenticated MedEx Token Disclosure |
| CVE-2026-24848 | OP openemr openemr | 9.9 | Mar 3 | OpenEMR Arbitrary File Write leading to Remote Code Execution |
| CVE-2026-27012 | OP openstamanager devcode-it | 9.8 | Mar 3 | Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.php |
| CVE-2026-3130 | SE Server Devolutions | 9.8 | Mar 3 | Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is… |
| CVE-2026-3204 | SE Server Devolutions | 9.8 | Mar 3 | Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially… |
| CVE-2026-2590 | RD Remote Desktop Manager Devolutions | 9.8 | Mar 3 | Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an… |
| CVE-2026-3224 | SE Server Devolutions | 9.8 | Mar 3 | Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an… |
| CVE-2026-3485 | DI DIR-868L D-Link | 9.8 | Mar 3 | D-Link DIR-868L SSDP Service sub_1BF84 os command injection |
| CVE-2025-14923 | WA WebSphere Application Server - Liberty IBM | 9.8 | Mar 3 | IBM WebSphere Application Server Liberty could provide weaker than expected security |
| CVE-2026-3136 | CB Cloud Build Google Cloud | 9.8 | Mar 3 | Google Cloud Build Comment Control Bypass |
| CVE-2026-22891 | LI libbiosig The Biosig Project | 9.8 | Mar 3 | A heap-based buffer overflow vulnerability exists in the Intan CLP parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63) |
| CVE-2025-59059 | AR Apache Ranger Apache Software Foundation | 9.8 | Mar 3 | Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator |
| CVE-2026-22886 | EO Eclipse OpenMQ Eclipse Foundation | 9.8 | Mar 3 | OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication |
| CVE-2026-1492 | UR User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder wpeverest | 9.8 | Mar 3 | User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration |
| CVE-2026-2628 | AM All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login cyberlord92 | 9.8 | Mar 3 | All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 - Authentication Bypass |
| CVE-2026-24103 | AF Ac15 Firmware Tenda | 9.8 | Mar 3 | A buffer overflow vulnerability was discovered in goform/formSetMacFilterCfg in Tenda AC15V1.0 V15.03.05.18_multi |
| CVE-2025-70234 | DF Dir-513 Firmware Dlink | 9.8 | Mar 3 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetQoS |
| CVE-2025-70240 | DF Dir-513 Firmware Dlink | 9.8 | Mar 3 | Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard51 |
| CVE-2024-55020 | CF Cmt-3072xh2 Firmware Weintek | 9.8 | Mar 3 | A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute arbitrary commands… |
| CVE-2025-57622 | Product not mapped yet | 9.8 | Mar 3 | An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) component |