CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 03:44 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-2751 | CW Centreon Web on Central Server Centreon | 9.8 | Feb 27 | Blind SQL Injection |
| CVE-2025-11252 | WI windesk.fm Signum Technology Promotion and Training Inc. | 9.8 | Feb 27 | SQLi in Signum Technologies' windesk.fm |
| CVE-2025-11251 | EP E-Commerce Platform Dayneks Software Industry and Trade Inc. | 9.8 | Feb 27 | SQLi in Dayneks Software's E-Commerce Platform |
| CVE-2026-24352 | PC PluXml CMS PluXml | 9.8 | Feb 27 | Session Fixation in PluXml CMS |
| CVE-2026-21660 | FC Frick Controls Quantum HD Johnson Controls | 9.8 | Feb 27 | Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware |
| CVE-2026-21659 | FC Frick Controls Quantum HD Johnson Controls | 9.8 | Feb 27 | Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion |
| CVE-2026-21658 | FC Frick Controls Quantum HD Johnson Controls | 9.8 | Feb 27 | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution |
| CVE-2026-21657 | FC Frick Controls Quantum HD Johnson Controls | 9.8 | Feb 27 | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution |
| CVE-2026-21656 | FC Frick Controls Quantum HD Johnson Controls | 9.8 | Feb 27 | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution |
| CVE-2026-1626 | SL SICK LMS1000 SICK AG | 9.1 | Feb 27 | An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH communication, if they… |
| CVE-2026-21654 | FC Frick Controls Quantum HD Johnson Controls | 9.8 | Feb 27 | Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution |
| CVE-2026-2251 | FC FreeFlow Core Xerox | 9.8 | Feb 27 | Path Traversal leading to Remote Code Execution (RCE) |
| CVE-2025-12981 | LI Listee dreamstechnologies | 9.8 | Feb 27 | Listee <= 1.1.6 - Unauthenticated Privilege Escalation |
| CVE-2026-3301 | N3 N300RH Totolink | 9.8 | Feb 27 | Totolink N300RH Web Management cstecgi.cgi setWebWlanIdx os command injection |
| CVE-2026-28370 | VI Vitrage OpenStack | 9.1 | Feb 27 | In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host… |
| CVE-2026-3289 | PU PublicCMS Sanluan | 9.8 | Feb 27 | Sanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversal |
| CVE-2026-3287 | YO youlai-mall youlaitech | 9.8 | Feb 27 | youlaitech youlai-mall App-side Product Pagination Endpoint SpuController.java listPagedSpuForApp sql injection |
| CVE-2026-24497 | TH ThinkWise SimTech Systems, Inc. | 9.8 | Feb 27 | Stack-based Buffer Overflow vulnerability in SimTech Systems, Inc |
| CVE-2026-20797 | CX Copeland XWEB 300D PRO Copeland | 9.8 | Feb 27 | Copeland XWEB and XWEB Pro Stack-based Buffer Overflow |
| CVE-2026-22877 | CX Copeland XWEB 300D PRO Copeland | 9.1 | Feb 27 | Copeland XWEB and XWEB Pro Path Traversal |
| CVE-2026-24663 | CX Copeland XWEB 300D PRO Copeland | 9.8 | Feb 27 | Copeland XWEB and XWEB Pro OS Command Injection |
| CVE-2026-21718 | CX Copeland XWEB 300D PRO Copeland | 9.8 | Feb 27 | Copeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic Algorithm |
| CVE-2026-25085 | CX Copeland XWEB 300D PRO Copeland | 9.8 | Feb 27 | Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value |
| CVE-2026-27647 | MO mobility46.se Mobility46 | 9.8 | Feb 27 | Mobility46 mobility46.se Insufficient Session Expiration |
| CVE-2026-26305 | MO mobility46.se Mobility46 | 9.8 | Feb 27 | Mobility46 mobility46.se Improper Restriction of Excessive Authentication Attempts |
| CVE-2026-27028 | MO mobility46.se Mobility46 | 9.8 | Feb 27 | Mobility46 mobility46.se Missing Authentication for Critical Function |
| CVE-2026-26290 | EV ev.energy EV Energy | 9.8 | Feb 27 | EV Energy ev.energy Insufficient Session Expiration |
| CVE-2026-24445 | EV ev.energy EV Energy | 9.8 | Feb 27 | EV Energy ev.energy Improper Restriction of Excessive Authentication Attempts |
| CVE-2026-27772 | EV ev.energy EV Energy | 9.8 | Feb 27 | EV Energy ev.energy Missing Authentication for Critical Function |
| CVE-2026-3271 | F4 F453 Tenda | 9.8 | Feb 27 | Tenda F453 httpd P2pListFilterof fromP2pListFilter buffer overflow |
| CVE-2026-25113 | SW swtchenergy.com SWITCH EV | 9.8 | Feb 26 | SWITCH EV swtchenergy.com Improper Restriction of Excessive Authentication Attempts |
| CVE-2026-27767 | SW swtchenergy.com SWITCH EV | 9.8 | Feb 26 | SWITCH EV swtchenergy.com Missing Authentication for Critical Function |
| CVE-2026-25945 | EV ev2go.io EV2GO | 9.8 | Feb 26 | EV2GO ev2go.io Improper Restriction of Excessive Authentication Attempts |
| CVE-2026-24731 | EV ev2go.io EV2GO | 9.8 | Feb 26 | EV2GO ev2go.io Missing Authentication for Critical Function |
| CVE-2026-25114 | CL cloudcharge.se CloudCharge | 9.8 | Feb 26 | CloudCharge cloudcharge.se Improper Restriction of Excessive Authentication Attempts |
| CVE-2026-20781 | CL cloudcharge.se CloudCharge | 9.8 | Feb 26 | CloudCharge cloudcharge.se Missing Authentication for Critical Function |
| CVE-2026-20792 | CH chargemap.com Chargemap | 9.8 | Feb 26 | Chargemap chargemap.com Improper Restriction of Excessive Authentication Attempts |
| CVE-2026-25851 | CH chargemap.com Chargemap | 9.8 | Feb 26 | Chargemap chargemap.com Missing Authentication for Critical Function |
| CVE-2026-28215 | HO hoppscotch hoppscotch | 9.1 | Feb 26 | hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover |
| CVE-2026-28213 | EV evershop evershopcommerce | 9.8 | Feb 26 | EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response |
| CVE-2026-3261 | SM School Management System itsourcecode | 9.8 | Feb 26 | itsourcecode School Management System Setting index.php sql injection |
| CVE-2026-22207 | OP OpenViking Volcengine | 9.8 | Feb 26 | OpenViking Missing root_api_key Allows Anonymous ROOT Access |
| CVE-2026-27975 | AJ ajenti ajenti | 9.8 | Feb 26 | Ajenti has a potential Remote Code Execution |
| CVE-2026-27966 | LA langflow langflow-ai | 9.8 | Feb 26 | Langflow has Remote Code Execution in CSV Agent |
| CVE-2026-27965 | VI vitess vitessio | 9.9 | Feb 26 | Vitess users with backup storage access can gain unauthorized access to production deployment environments |
| CVE-2026-27952 | AG agenta-api Agenta-AI | 9.9 | Feb 26 | Agenta has Python Sandbox Escape, Leading to Remote Code Execution (RCE) |
| CVE-2026-27941 | OP openlit openlit | 9.9 | Feb 26 | OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions Workflows |
| CVE-2026-27837 | DO dottie.js mickhansen | 9.8 | Feb 26 | Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform() |
| CVE-2026-27812 | SU sub2api Wei-Shaw | 9.1 | Feb 26 | Sub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account Takeover |
| CVE-2025-50857 | Product not mapped yet | 9.8 | Feb 26 | ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php |