CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 10:45 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-3422 | UF U-Office Force e-Excellence | 9.8 | Mar 2 | e-Excellence｜U-Office Force - Insecure Deserialization |
| CVE-2026-3000 | IW IDExpert Windows Logon Agent Changing | 9.8 | Mar 2 | Changing｜IDExpert Windows Logon Agent - Remote Code Execution |
| CVE-2026-3413 | UM University Management System itsourcecode | 9.8 | Mar 2 | itsourcecode University Management System admin_single_student.php sql injection |
| CVE-2026-2999 | IW IDExpert Windows Logon Agent Changing | 9.8 | Mar 2 | Changing｜IDExpert Windows Logon Agent - Remote Code Execution |
| CVE-2026-3411 | UM University Management System itsourcecode | 9.8 | Mar 2 | itsourcecode University Management System admin_single_student_update.php sql injection |
| CVE-2026-3410 | SM Society Management System itsourcecode | 9.8 | Mar 2 | itsourcecode Society Management System check_studid.php sql injection |
| CVE-2026-3406 | OA Online Art Gallery Shop projectworlds | 9.8 | Mar 2 | projectworlds Online Art Gallery Shop Registration registration.php sql injection |
| CVE-2026-24105 | AF Ac15 Firmware Tenda | 9.8 | Mar 2 | An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi |
| CVE-2026-24111 | WF W20e Firmware Tenda | 9.8 | Mar 2 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6 |
| CVE-2026-26701 | PP Personnel Property Equipment System Jon-remus-sevellejo | 9.8 | Mar 2 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user.php |
| CVE-2026-26695 | SS Simple Student Alumni System Carmelo | 9.8 | Mar 2 | code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordstudent_edit.php |
| CVE-2026-26700 | PP Personnel Property Equipment System Jon-remus-sevellejo | 9.8 | Mar 2 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php |
| CVE-2026-26696 | SS Simple Student Alumni System Carmelo | 9.8 | Mar 2 | code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_edit.php |
| CVE-2026-26710 | SF Simple Food Order System Carmelo | 9.8 | Mar 2 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/edit-orders.php |
| CVE-2026-26709 | SG Simple Gym Management System Carmelo | 9.8 | Mar 2 | code-projects Simple Gym Management System v1.0 is vulnerable to SQL Injection in /gym/trainer_search.php |
| CVE-2026-26713 | SF Simple Food Order System Carmelo | 9.8 | Mar 2 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/cancel-order.php |
| CVE-2026-24114 | WF W20e Firmware Tenda | 9.8 | Mar 2 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6 |
| CVE-2026-26720 | TW Twenty Twenty | 9.8 | Mar 2 | An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module |
| CVE-2026-26694 | SS Simple Student Alumni System Carmelo | 9.8 | Mar 2 | code-projects Simple Student Alumni System v1.0 is vulnerale to SQL Injection in /TracerStudy/modal_view.php |
| CVE-2026-24108 | WF W20e Firmware Tenda | 9.8 | Mar 2 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6 |
| CVE-2026-24107 | WF W20e Firmware Tenda | 9.8 | Mar 2 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6 |
| CVE-2026-26706 | PP Pharmacy Point OF Sale System Oretnom23 | 9.8 | Mar 2 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_receipt.php |
| CVE-2026-26712 | SF Simple Food Order System Carmelo | 9.8 | Mar 2 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket-admin.php |
| CVE-2026-26702 | PP Personnel Property Equipment System Jon-remus-sevellejo | 9.8 | Mar 2 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/myitem_reuse.php |
| CVE-2026-24113 | WF W20e Firmware Tenda | 9.8 | Mar 2 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6 |
| CVE-2026-24115 | WF W20e Firmware Tenda | 9.8 | Mar 2 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6 |
| CVE-2026-26704 | PP Pharmacy Point OF Sale System Oretnom23 | 9.8 | Mar 2 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_category.php |
| CVE-2026-24101 | AF Ac15 Firmware Tenda | 9.8 | Mar 2 | An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi |
| CVE-2026-24110 | WF W20e Firmware Tenda | 9.8 | Mar 2 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6 |
| CVE-2026-26705 | PP Pharmacy Point OF Sale System Oretnom23 | 9.8 | Mar 2 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_product.php |
| CVE-2026-26708 | PP Pharmacy Point OF Sale System Oretnom23 | 9.8 | Mar 2 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php |
| CVE-2026-26707 | PP Pharmacy Point OF Sale System Oretnom23 | 9.8 | Mar 2 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_supplier.php |
| CVE-2026-26711 | SF Simple Food Order System Carmelo | 9.8 | Mar 2 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket.php |
| CVE-2026-26703 | PP Personnel Property Equipment System Jon-remus-sevellejo | 9.8 | Mar 2 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/advance_search.php |
| CVE-2026-24112 | WF W20e Firmware Tenda | 9.8 | Mar 2 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6 |
| CVE-2026-24109 | WF W20e Firmware Tenda | 9.8 | Mar 2 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6 |
| CVE-2026-3400 | AC AC15 Tenda | 9.8 | Mar 1 | Tenda AC15 TextEditingConversion stack-based overflow |
| CVE-2026-3395 | CM CMS MaxSite | 9.8 | Mar 1 | MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection |
| CVE-2026-28562 | WF wpForo Forum gVectors Team | 9.8 | Feb 28 | wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter |
| CVE-2026-28517 | OP openDCIM openDCIM | 9.8 | Feb 27 | openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter |
| CVE-2026-28411 | WE WeGIA LabRedesCefetRJ | 9.8 | Feb 27 | WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)` |
| CVE-2026-28408 | WE WeGIA LabRedesCefetRJ | 9.8 | Feb 27 | WeGIA lacks authentication verification in adicionar_tipo_docs_atendido.php |
| CVE-2026-28268 | VI vikunja go-vikunja | 9.8 | Feb 27 | Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse |
| CVE-2026-28231 | PI pillow_heif bigcat88 | 9.1 | Feb 27 | pillow_heif Has Integer Overflow in Encode Path Buffer Validation that Leads to Heap Out-of-Bounds Read |
| CVE-2026-27707 | SE seerr seerr-team | 9.8 | Feb 27 | Plex-configured Seerr instances vulnerable to unauthenticated account registration via Jellyfin authentication endpoint |
| CVE-2026-2880 | FA @fastify/middie @fastify/middie | 9.1 | Feb 27 | @fastify/middie has an improper path normalization vulnerability |
| CVE-2026-27755 | SS SODOLA SL902-SWTGW124AS Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks) | 9.8 | Feb 27 | SODOLA SL902-SWTGW124AS <= 200.1.20 Predictable Session ID |
| CVE-2026-27751 | SS SODOLA SL902-SWTGW124AS Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks) | 9.8 | Feb 27 | SODOLA SL902-SWTGW124AS <= 200.1.20 Use of Default Credentials |
| CVE-2019-25489 | HB Homey BNB (Airbnb Clone Script) Doditsolutions | 9.1 | Feb 27 | Homey BNB V4 SQL Injection via ajax_refresh_subtotal |
| CVE-2026-2293 | NE nest.js nest.js | 9.8 | Feb 27 | NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass |