CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 31, 04:52 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-25851 | CH chargemap.com Chargemap | 9.8 | Feb 26 | Chargemap chargemap.com Missing Authentication for Critical Function |
| CVE-2026-28215 | HO hoppscotch hoppscotch | 9.1 | Feb 26 | hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover |
| CVE-2026-28213 | EV evershop evershopcommerce | 9.8 | Feb 26 | EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response |
| CVE-2026-3261 | SM School Management System itsourcecode | 9.8 | Feb 26 | itsourcecode School Management System Setting index.php sql injection |
| CVE-2026-22207 | OP OpenViking Volcengine | 9.8 | Feb 26 | OpenViking Missing root_api_key Allows Anonymous ROOT Access |
| CVE-2026-27975 | AJ ajenti ajenti | 9.8 | Feb 26 | Ajenti has a potential Remote Code Execution |
| CVE-2026-27966 | LA langflow langflow-ai | 9.8 | Feb 26 | Langflow has Remote Code Execution in CSV Agent |
| CVE-2026-27965 | VI vitess vitessio | 9.9 | Feb 26 | Vitess users with backup storage access can gain unauthorized access to production deployment environments |
| CVE-2026-27952 | AG agenta-api Agenta-AI | 9.9 | Feb 26 | Agenta has Python Sandbox Escape, Leading to Remote Code Execution (RCE) |
| CVE-2026-27941 | OP openlit openlit | 9.9 | Feb 26 | OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions Workflows |
| CVE-2026-27837 | DO dottie.js mickhansen | 9.8 | Feb 26 | Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform() |
| CVE-2026-27812 | SU sub2api Wei-Shaw | 9.1 | Feb 26 | Sub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account Takeover |
| CVE-2025-50857 | Product not mapped yet | 9.8 | Feb 26 | ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php |
| CVE-2026-27809 | PS psd-tools psd-tools | 9.1 | Feb 25 | psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps |
| CVE-2026-27804 | PA parse-server parse-community | 9.1 | Feb 25 | Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter |
| CVE-2026-27613 | TI TinyWeb maximmasiutin | 9.8 | Feb 25 | CGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam) |
| CVE-2026-27577 | N8 n8n n8n-io | 9.9 | Feb 25 | n8n: Expression Sandbox Escape Leads to RCE |
| CVE-2026-27495 | N8 n8n n8n-io | 9.9 | Feb 25 | n8n has a Sandbox Escape in its JavaScript Task Runner |
| CVE-2026-27494 | N8 n8n n8n-io | 9.9 | Feb 25 | n8n has Arbitrary File Read via Python Code Node Sandbox Escape |
| CVE-2026-27493 | N8 n8n n8n-io | 9.0 | Feb 25 | n8n has Unauthenticated Expression Evaluation via Form Node |
| CVE-2026-27148 | ST storybook storybookjs | 9.6 | Feb 25 | Storybook Dev Server Vulnerable to WebSocket Hijacking |
| CVE-2026-27575 | VI vikunja go-vikunja | 9.1 | Feb 25 | Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change |
| CVE-2026-25997 | FR FreeRDP FreeRDP | 9.8 | Feb 25 | FreeRDP has heap-use-after-free in xf_clipboard_format_equal |
| CVE-2026-25959 | FR FreeRDP FreeRDP | 9.8 | Feb 25 | FreeRDP has heap-use-after-free in xf_cliprdr_provide_data_ |
| CVE-2026-0542 | SA ServiceNow AI Platform ServiceNow | 9.2 | Feb 25 | Remote Code Execution in ServiceNow AI Platform |
| CVE-2026-25955 | FR FreeRDP FreeRDP | 9.8 | Feb 25 | FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (stale XImage) |
| CVE-2026-25953 | FR FreeRDP FreeRDP | 9.8 | Feb 25 | FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (freed appWindow) |
| CVE-2026-25952 | FR FreeRDP FreeRDP | 9.8 | Feb 25 | FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo |
| CVE-2026-22720 | VA VMware Aria Operations VMware | 9.0 | Feb 25 | VMware Aria Operations stored cross-site scripting vulnerability |
| CVE-2026-21902 | JO Junos OS Evolved Juniper Networks | 9.8 | Feb 25 | Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root |
| CVE-2026-27739 | NG @nguniversal/common angular | 9.2 | Feb 25 | Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline |
| CVE-2026-27849 | MR MR9600 Linksys | 9.8 | Feb 25 | Missing neutralization in Linksys MR9600, Linksys MX4200 |
| CVE-2026-20127 In wildKEV | CC Cisco Catalyst SD-WAN Manager Cisco | 10.0 | Feb 25 | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability |
| CVE-2026-20129 | CC Cisco Catalyst SD-WAN Manager Cisco | 9.8 | Feb 25 | Cisco Catayst SD-WAN Authentication Bypass Vulnerability |
| CVE-2026-27727 | MC mchange-commons-java swaldman | 9.8 | Feb 25 | mchange-commons-java: Remote Code Execution via JNDI Reference Resolution |
| CVE-2025-1242 | HK Home Kit Gardyn | 9.1 | Feb 25 | Administrative Credentials Can Be Extracted Through Gardyn API Responses |
| CVE-2026-27848 | MR MR9600 Linksys | 9.8 | Feb 25 | Missing neutralization in Linksys MR9600, Linksys MX4200 |
| CVE-2026-27702 | BU budibase Budibase | 9.0 | Feb 25 | Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud) |
| CVE-2026-27847 | MR MR9600 Linksys | 9.8 | Feb 25 | Missing authentication in Linksys MR9600, Linksys MX4200 |
| CVE-2026-27699 | BA basic-ftp patrickjuchli | 9.8 | Feb 25 | Basic FTP has Path Traversal Vulnerability in its downloadToDir() method |
| CVE-2026-3187 | SZ sz-boot-parent feiyuchuixue | 9.8 | Feb 25 | feiyuchuixue sz-boot-parent API Endpoint upload unrestricted upload |
| CVE-2026-2624 | AN Antikor Next Generation Firewall (NGFW) ePati Cyber Security Technologies Inc. | 9.8 | Feb 25 | Authentication Bypass in ePati's Antikor NGFW |
| CVE-2026-0704 | OS Octopus Server Octopus Deploy | 9.1 | Feb 25 | In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint |
| CVE-2025-62878 | RA Rancher SUSE | 9.9 | Feb 25 | Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern |
| CVE-2026-3164 | NP News Portal Project itsourcecode | 9.8 | Feb 25 | itsourcecode News Portal Project contactus.php sql injection |
| CVE-2026-25785 | LE Lanscope Endpoint Manager (On-Premises) Sub-Manager Server MOTEX Inc. | 9.8 | Feb 25 | Path traversal vulnerability exists in Lanscope Endpoint Manager (On-Premises) Sub-Manager Server Ver.9.4.7.3 and earlier, which may allow an attacker to tamper with arbitrary… |
| CVE-2026-3153 | DM Document Management System itsourcecode | 9.8 | Feb 25 | itsourcecode Document Management System register.php sql injection |
| CVE-2026-3152 | CM College Management System itsourcecode | 9.8 | Feb 25 | itsourcecode College Management System teacher-salary.php sql injection |
| CVE-2026-3151 | CM College Management System itsourcecode | 9.8 | Feb 25 | itsourcecode College Management System login.php sql injection |
| CVE-2026-3148 | SA Simple and Nice Shopping Cart Script SourceCodester | 9.8 | Feb 25 | SourceCodester Simple and Nice Shopping Cart Script signup.php sql injection |