CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 10:45 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-27471 | ER erpnext frappe | 9.1 | Feb 21 | ERP: Document access through endpoints due to missing validation |
| CVE-2026-27211 | CL cloud-hypervisor cloud-hypervisor | 10.0 | Feb 21 | Cloud Hypervisor: Host File Exfiltration via QCOW Backing File Abuse |
| CVE-2026-27197 | SE sentry getsentry | 9.1 | Feb 21 | Sentry: Improper Authentication on SAML SSO process allows user identity linking |
| CVE-2026-27194 | DT dtale man-group | 9.8 | Feb 21 | D-Tale affected by Remote Code Execution through the /save-column-filter endpoint |
| CVE-2026-27168 | SA sail HappySeaFox | 9.8 | Feb 20 | SAIL: Heap-based Buffer Overflow in Sail-codecs-xwd |
| CVE-2019-25441 | TH thesystem kostasmitroglou | 9.8 | Feb 20 | thesystem 1.0 Command Injection via run_command endpoint |
| CVE-2026-2039 | AR Archiver GFI | 9.8 | Feb 20 | GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability |
| CVE-2026-2038 | AR Archiver GFI | 9.8 | Feb 20 | GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability |
| CVE-2026-27112 | KA kargo akuity | 9.9 | Feb 20 | Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints |
| CVE-2026-25896 | FA fast-xml-parser NaturalIntelligence | 9.3 | Feb 20 | fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names |
| CVE-2026-27190 | DE deno denoland | 9.8 | Feb 20 | Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process |
| CVE-2019-25444 | FC Fiverr Clone Script Phpscriptsmall | 9.1 | Feb 20 | Fiverr Clone Script 1.2.2 SQL Injection via page Parameter |
| CVE-2026-26093 | OP opds Owl | 9.8 | Feb 20 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds |
| CVE-2026-2333 | OP opds Owl | 9.8 | Feb 20 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds |
| CVE-2026-2848 | SR Simple Responsive Tourism Website SourceCodester | 9.8 | Feb 20 | SourceCodester Simple Responsive Tourism Website Registration Master.php sql injection |
| CVE-2026-25715 | US USR-W610 Jinan USR IOT Technology Limited (PUSR) | 9.8 | Feb 20 | Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements |
| CVE-2026-24956 | DM Download Manager Addons for Elementor Shahjada | 9.3 | Feb 20 | WordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerability |
| CVE-2026-22384 | AS Applay - Shortcodes leafcolor | 9.8 | Feb 20 | WordPress Applay - Shortcodes plugin <= 3.7 - PHP Object Injection vulnerability |
| CVE-2025-69405 | LI Lorem Ipsum | Books & Media Store ThemeREX | 9.8 | Feb 20 | WordPress Lorem Ipsum | Books & Media Store theme <= 1.2.11 - PHP Object Injection vulnerability |
| CVE-2025-69404 | ES Extreme Store ThemeREX | 9.8 | Feb 20 | WordPress Extreme Store theme <= 1.5.10 - PHP Object Injection vulnerability |
| CVE-2025-69403 | BA Bravis Addons Bravis-Themes | 9.9 | Feb 20 | WordPress Bravis Addons plugin <= 1.3.0 - Arbitrary File Upload vulnerability |
| CVE-2025-69382 | TE Themesflat Elementor themesflat | 9.8 | Feb 20 | WordPress Themesflat Elementor plugin <= 1.0.1 - PHP Object Injection vulnerability |
| CVE-2025-69372 | SE SevenHills AncoraThemes | 9.8 | Feb 20 | WordPress SevenHills theme <= 1.6.2 - PHP Object Injection vulnerability |
| CVE-2025-69371 | KI KindlyCare AncoraThemes | 9.8 | Feb 20 | WordPress KindlyCare theme <= 1.6.1 - PHP Object Injection vulnerability |
| CVE-2025-69370 | CA Capella ThemeGoods | 9.8 | Feb 20 | WordPress Capella theme <= 2.5.5 - PHP Object Injection vulnerability |
| CVE-2025-69366 | EC Emerce Core TeconceTheme | 9.3 | Feb 20 | WordPress Emerce Core plugin <= 1.8 - SQL Injection vulnerability |
| CVE-2025-69365 | UC Uroan Core TeconceTheme | 9.3 | Feb 20 | WordPress Uroan Core plugin <= 1.4.4 - SQL Injection vulnerability |
| CVE-2025-69337 | WC Wolmart Core don-themes | 9.3 | Feb 20 | WordPress Wolmart Core plugin <= 1.9.6 - SQL Injection vulnerability |
| CVE-2025-69329 | PR Prestige Jthemes | 9.8 | Feb 20 | WordPress Prestige theme < 1.4.1 - PHP Object Injection vulnerability |
| CVE-2025-69310 | WC Woodly Core TeconceTheme | 9.3 | Feb 20 | WordPress Woodly Core plugin <= 1.4 - SQL Injection vulnerability |
| CVE-2025-69309 | SC Saasplate Core TeconceTheme | 9.3 | Feb 20 | WordPress Saasplate Core plugin <= 1.2.8 - SQL Injection vulnerability |
| CVE-2025-69308 | NC Nestbyte Core TeconceTheme | 9.3 | Feb 20 | WordPress Nestbyte Core plugin <= 1.2 - SQL Injection vulnerability |
| CVE-2025-69307 | MC Medinik Core TeconceTheme | 9.3 | Feb 20 | WordPress Medinik Core plugin <= 1.3.6 - SQL Injection vulnerability |
| CVE-2025-69306 | EC Electio Core TeconceTheme | 9.3 | Feb 20 | WordPress Electio Core plugin <= 1.4 - SQL Injection vulnerability |
| CVE-2025-69305 | CC Crete Core TeconceTheme | 9.3 | Feb 20 | WordPress Crete Core plugin <= 1.4.3 - SQL Injection vulnerability |
| CVE-2025-69304 | AL Allmart TeconceTheme | 9.3 | Feb 20 | WordPress Allmart plugin <= 1.1 - SQL Injection vulnerability |
| CVE-2025-69301 | PH PhotoMe ThemeGoods | 9.8 | Feb 20 | WordPress PhotoMe theme <= 5.6.11 - PHP Object Injection vulnerability |
| CVE-2025-69295 | CC Coven Core TeconceTheme | 9.3 | Feb 20 | WordPress Coven Core plugin <= 1.3 - SQL Injection vulnerability |
| CVE-2025-68549 | WI Wiguard zozothemes | 9.9 | Feb 20 | WordPress Wiguard theme < 2.0.1 - Arbitrary File Upload vulnerability |
| CVE-2025-68541 | IP Ippsum BoldThemes | 9.8 | Feb 20 | WordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerability |
| CVE-2025-67997 | TR Travelicious BoldThemes | 9.8 | Feb 20 | WordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerability |
| CVE-2025-67996 | NE Nestin BoldThemes | 9.8 | Feb 20 | WordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerability |
| CVE-2025-67995 | PA PatioTime LoftOcean | 9.8 | Feb 20 | WordPress PatioTime theme < 2.1 - PHP Object Injection vulnerability |
| CVE-2025-67979 | WG WPForms Google Sheet Connector WesternDeal | 9.9 | Feb 20 | WordPress WPForms Google Sheet Connector plugin <= 4.0.1 - Remote Code Execution (RCE) vulnerability |
| CVE-2026-21627 | AC Advanced Custom Fields tassos.gr | 9.5 | Feb 20 | Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla |
| CVE-2025-10970 | TA Talentics Kolay Software Inc. | 9.8 | Feb 20 | SQLi in Kolay Software's Talentics |
| CVE-2026-26988 | LI librenms librenms | 9.1 | Feb 20 | LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream |
| CVE-2026-26974 | SL Slyde Tygo-van-den-Hurk | 9.8 | Feb 20 | Sylde has Improper Control of Generation of Code |
| CVE-2025-30416 | AC Acronis Cyber Protect 15 Acronis | 10.0 | Feb 20 | Sensitive data disclosure and manipulation due to missing authorization |
| CVE-2025-30410 | AC Acronis Cyber Protect 15 Acronis | 9.8 | Feb 20 | Sensitive data disclosure and manipulation due to missing authentication |