CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 17:41 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-25971 | IM ImageMagick ImageMagick | 9.8 | Feb 24 | ImageMagick's MSL: Stack overflow in ProcessMSLScript |
| CVE-2026-3053 | DI dinky DataLinkDC | 9.8 | Feb 24 | DataLinkDC dinky OpenAPI Endpoint AppConfig.java addInterceptors missing authentication |
| CVE-2026-25968 | IM ImageMagick ImageMagick | 9.8 | Feb 24 | ImageMagick has MSL attribute stack buffer overflow that leads to out of bounds write. |
| CVE-2026-25898 | IM ImageMagick ImageMagick | 9.1 | Feb 24 | Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer |
| CVE-2026-25897 | IM ImageMagick ImageMagick | 9.8 | Feb 24 | ImageMagick has heap overflow in sun decoder on 32-bit systems that can result in out of bounds write |
| CVE-2026-3046 | EW E-Logbook with Health Monitoring System for COVID-19 itsourcecode | 9.8 | Feb 24 | itsourcecode E-Logbook with Health Monitoring System for COVID-19 check_profile_old.php sql injection |
| CVE-2025-69985 | FU Fuxa Frangoteam | 9.8 | Feb 24 | FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE) |
| CVE-2024-58041 | SM Smolder WONKO | 9.1 | Feb 23 | Smolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functions |
| CVE-2026-3042 | EM Event Management System itsourcecode | 9.8 | Feb 23 | itsourcecode Event Management System index.php sql injection |
| CVE-2026-3062 | CH Chrome Google | 9.8 | Feb 23 | Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page |
| CVE-2026-3061 | CH Chrome Google | 9.1 | Feb 23 | Out of bounds read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page |
| CVE-2026-23693 | EE ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor Roxnor | 10.0 | Feb 23 | ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint |
| CVE-2026-3025 | SH Smart Heating Integrated Management Platform ShuoRen | 9.8 | Feb 23 | ShuoRen Smart Heating Integrated Management Platform ExampleNodeService.asmx unrestricted upload |
| CVE-2026-2983 | SR Student Result Management System SourceCodester | 9.8 | Feb 23 | SourceCodester Student Result Management System Bulk Import import_users.php access control |
| CVE-2025-41002 | IN Infoticketing MANANTIAL DE IDEAS | 9.3 | Feb 23 | SQL injection in Infoticketing |
| CVE-2026-23552 | AC Apache Camel Apache Software Foundation | 9.1 | Feb 23 | Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy |
| CVE-2026-24494 | OO Online Ordering System Order Up | 9.8 | Feb 23 | SQL injection vulnerability in Order Up Online Ordering System |
| CVE-2026-2964 | WE web-audio-recorder-js higuma | 9.8 | Feb 23 | higuma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollution |
| CVE-2025-70327 | XF X5000r Firmware Totolink | 9.8 | Feb 23 | TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable |
| CVE-2025-70043 | Product not mapped yet | 9.1 | Feb 23 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master |
| CVE-2026-2588 | CR Crypt::NaCl::Sodium TIMLEGGE | 9.1 | Feb 22 | Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems |
| CVE-2026-2954 | UJ UJCMS Dromara | 9.8 | Feb 22 | Dromara UJCMS ImportDataController import-channel importChanel injection |
| CVE-2019-25459 | EM Emlak Web-ofisi | 9.8 | Feb 22 | Web Ofisi Emlak V2 SQL Injection via emlak-ara.html |
| CVE-2019-25458 | FR Firma Rehberi Web-ofisi | 9.8 | Feb 22 | Web Ofisi Firma Rehberi v1 SQL Injection via firmalar.html |
| CVE-2019-25456 | EM Emlak Web-ofisi | 9.1 | Feb 22 | Web Ofisi Emlak v2 SQL Injection via ara Parameter |
| CVE-2026-2953 | UJ UJCMS Dromara | 9.1 | Feb 22 | Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal |
| CVE-2026-2952 | VA Vaelsys Vaelsys | 9.8 | Feb 22 | Vaelsys HTTP POST Request tree_server.php os command injection |
| CVE-2026-2944 | OS Online Store Management System ネット店舗管理システム Tosei | 9.8 | Feb 22 | Tosei Online Store Management System ネット店舗管理システム HTTP POST Request monitor.php system os command injection |
| CVE-2026-2912 | OR Online Reviewer System code-projects | 9.8 | Feb 22 | code-projects Online Reviewer System studentresult-view.php sql injection |
| CVE-2026-2894 | FU funadmin Funadmin | 9.1 | Feb 21 | funadmin forget.html getMember information disclosure |
| CVE-2026-2867 | VM Vehicle Management System itsourcecode | 9.8 | Feb 21 | itsourcecode Vehicle Management System billaction.php sql injection |
| CVE-2026-27574 | ON oneuptime OneUptime | 9.9 | Feb 21 | OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE |
| CVE-2026-2865 | AO Agri-Trading Online Shopping System itsourcecode | 9.8 | Feb 21 | itsourcecode Agri-Trading Online Shopping System HTTP POST Request productcontroller.php sql injection |
| CVE-2026-27471 | ER erpnext frappe | 9.1 | Feb 21 | ERP: Document access through endpoints due to missing validation |
| CVE-2026-27211 | CL cloud-hypervisor cloud-hypervisor | 10.0 | Feb 21 | Cloud Hypervisor: Host File Exfiltration via QCOW Backing File Abuse |
| CVE-2026-27197 | SE sentry getsentry | 9.1 | Feb 21 | Sentry: Improper Authentication on SAML SSO process allows user identity linking |
| CVE-2026-27194 | DT dtale man-group | 9.8 | Feb 21 | D-Tale affected by Remote Code Execution through the /save-column-filter endpoint |
| CVE-2026-27168 | SA sail HappySeaFox | 9.8 | Feb 20 | SAIL: Heap-based Buffer Overflow in Sail-codecs-xwd |
| CVE-2019-25441 | TH thesystem kostasmitroglou | 9.8 | Feb 20 | thesystem 1.0 Command Injection via run_command endpoint |
| CVE-2026-2039 | AR Archiver GFI | 9.8 | Feb 20 | GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability |
| CVE-2026-2038 | AR Archiver GFI | 9.8 | Feb 20 | GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability |
| CVE-2026-27112 | KA kargo akuity | 9.9 | Feb 20 | Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints |
| CVE-2026-25896 | FA fast-xml-parser NaturalIntelligence | 9.3 | Feb 20 | fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names |
| CVE-2026-27190 | DE deno denoland | 9.8 | Feb 20 | Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process |
| CVE-2019-25444 | FC Fiverr Clone Script Phpscriptsmall | 9.1 | Feb 20 | Fiverr Clone Script 1.2.2 SQL Injection via page Parameter |
| CVE-2026-26093 | OP opds Owl | 9.8 | Feb 20 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds |
| CVE-2026-2333 | OP opds Owl | 9.8 | Feb 20 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds |
| CVE-2026-2848 | SR Simple Responsive Tourism Website SourceCodester | 9.8 | Feb 20 | SourceCodester Simple Responsive Tourism Website Registration Master.php sql injection |
| CVE-2026-25715 | US USR-W610 Jinan USR IOT Technology Limited (PUSR) | 9.8 | Feb 20 | Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements |
| CVE-2026-24956 | DM Download Manager Addons for Elementor Shahjada | 9.3 | Feb 20 | WordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerability |