CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 10:21 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-1994 | SE s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions clavaque | 9.8 | Feb 19 | s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2026-2731 | D9 DynamicWeb 9 DynamicWeb | 10.0 | Feb 19 | Unauthenticated RCE in Dynamicweb 9 and Dynamicweb 8 |
| CVE-2025-13851 | BU Buyent scriptsbundle | 9.8 | Feb 19 | Buyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration |
| CVE-2026-0926 | PC Prodigy Commerce prodigycommerce | 9.8 | Feb 19 | Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name] |
| CVE-2025-13563 | LL Lizza LMS Pro BuddhaThemes | 9.8 | Feb 19 | Lizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation |
| CVE-2026-1405 | SF Slider Future franchidesign | 9.8 | Feb 19 | Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload |
| CVE-2025-15586 | OG OGP-Website OpenGamePanel | 10.0 | Feb 19 | OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can result in authentication bypass without… |
| CVE-2025-12882 | CL Clasifico Listing SmartDataSoft | 9.8 | Feb 19 | Clasifico Listing <= 2.0 - Unauthenticated Privilege Escalation |
| CVE-2026-25242 | GO gogs gogs | 9.8 | Feb 19 | Gogs allows unauthenticated file uploads |
| CVE-2026-2691 | EM Event Management System itsourcecode | 9.8 | Feb 19 | itsourcecode Event Management System manage_register.php sql injection |
| CVE-2026-2690 | EM Event Management System itsourcecode | 9.8 | Feb 19 | itsourcecode Event Management System Admin Login ajax.php sql injection |
| CVE-2026-2689 | EM Event Management System itsourcecode | 9.8 | Feb 19 | itsourcecode Event Management System manage_booking.php sql injection |
| CVE-2026-2686 | G1 G10 SECCN Dingcheng | 9.8 | Feb 19 | SECCN Dingcheng G10 session_login.cgi qq os command injection |
| CVE-2025-67305 | RN Ruckus Network Director Commscope | 9.8 | Feb 19 | In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user |
| CVE-2025-67304 | RN Ruckus Network Director Commscope | 9.8 | Feb 19 | In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user |
| CVE-2025-55853 | WE Webpdf Softvision | 9.1 | Feb 19 | SoftVision webPDF before 10.0.2 is vulnerable to Server-Side Request Forgery (SSRF) |
| CVE-2026-2684 | EA Electronic Archives System Tsinghua Unigroup | 9.8 | Feb 18 | Tsinghua Unigroup Electronic Archives System uploadFile.html unrestricted upload |
| CVE-2026-24126 | WE weblate WeblateOrg | 9.1 | Feb 18 | Weblate has an argument injection in management console |
| CVE-2026-25548 | IN InvoicePlane InvoicePlane | 9.1 | Feb 18 | InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning |
| CVE-2026-2682 | EA Electronic Archives System Tsinghua Unigroup | 9.8 | Feb 18 | Tsinghua Unigroup Electronic Archives System prinReport.html sql injection |
| CVE-2019-25365 | CH ChaosPro Chaospro | 9.8 | Feb 18 | ChaosPro 2.0 - Buffer Overflow |
| CVE-2019-25364 | WM Win10 MailCarrier TABS Laboratories Corporation | 9.8 | Feb 18 | Win10 MailCarrier 2.51 - 'POP3 User' Remote Buffer Overflow |
| CVE-2019-25362 | WT WMV to AVI MPEG DVD WMV Convertor Alloksoft | 9.8 | Feb 18 | WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Buffer OverFlow |
| CVE-2019-25361 | AN Ayukov NFTP client Ayukov | 9.8 | Feb 18 | Ayukov NFTP client 1.71 - 'SYST' Buffer Overflow |
| CVE-2019-25360 | AI Aida64 FinalWire Ltd. | 9.8 | Feb 18 | Aida64 6.10.5200 - Buffer Overflow |
| CVE-2026-27180 | MA MajorDoMo sergejey | 9.8 | Feb 18 | MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning |
| CVE-2026-27179 | MA MajorDoMo sergejey | 9.8 | Feb 18 | MajorDoMo Unauthenticated SQL Injection in Commands Module |
| CVE-2026-27175 | MA MajorDoMo sergejey | 9.8 | Feb 18 | MajorDoMo Command Injection in rc/index.php via Race Condition |
| CVE-2026-27174 | MA MajorDoMo sergejey | 9.8 | Feb 18 | MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval |
| CVE-2026-0573 | ES Enterprise Server GitHub | 9.0 | Feb 18 | Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution |
| CVE-2025-15579 | DS Directory Services OpenText™ | 9.5 | Feb 18 | An Insecure Deserialization vulnerability has been discovered in OpenText™ Directory Services. |
| CVE-2026-2329 | GX GXP1610 Grandstream | 9.8 | Feb 18 | Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow |
| CVE-2026-2654 | SM smolagents huggingface | 9.8 | Feb 18 | huggingface smolagents LocalPythonExecutor requests.post server-side request forgery |
| CVE-2026-1435 | GW Graylog Web Interface Graylog | 9.8 | Feb 18 | Incorrect management of session invalidation vulnerability in Graylog Web Interface |
| CVE-2025-70149 | MM Membership Management System Codeastro | 9.8 | Feb 18 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter |
| CVE-2025-65791 | ZO Zoneminder Zoneminder | 9.8 | Feb 18 | ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php |
| CVE-2025-70152 | ST Scholars Tracking System Fabian | 9.8 | Feb 18 | code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /admin/update_user.php |
| CVE-2025-70150 | MM Membership Management System Codeastro | 9.8 | Feb 18 | CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delete arbitrary member… |
| CVE-2025-70998 | 8F 810 Firmware Utt | 9.8 | Feb 18 | UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote attacker to gain… |
| CVE-2025-70141 | CS Customer Support System Oretnom23 | 9.4 | Feb 18 | SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php |
| CVE-2025-70146 | OT Online Time Table Generator Projectworlds | 9.1 | Feb 18 | Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perform unauthorized… |
| CVE-2026-1670 | 2I 25M IPC Honeywell | 9.8 | Feb 17 | Honeywell CCTV Products Missing Authentication for Critical Function |
| CVE-2026-22769 In wildKEV | RF RecoverPoint for Virtual Machines Dell | 10.0 | Feb 17 | Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability |
| CVE-2025-33089 | CO Concert IBM | 9.8 | Feb 17 | Multiple Vulnerabilities in IBM Concert Software. |
| CVE-2025-66614 | TO Tomcat Apache | 9.1 | Feb 17 | Apache Tomcat: Client certificate verification bypass due to virtual host mapping |
| CVE-2026-23647 | RB RBG-100 Glory Global Solutions | 9.8 | Feb 17 | Glory RBG-100 Recycler System Hard-coded OS Credentials |
| CVE-2026-2616 | 77 777VR1 Beetel | 9.8 | Feb 17 | Beetel 777VR1 Web Management hard-coded credentials |
| CVE-2026-22208 | OP OpenS100 OpenS100 Project | 9.6 | Feb 17 | OpenS100 Portrayal Engine Unrestricted Lua Standard Library Access |
| CVE-2026-26220 | LI LightLLM ModelTC | 9.3 | Feb 17 | LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE |
| CVE-2025-59793 | TE Trufusion Enterprise Rocketsoftware | 9.9 | Feb 17 | Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files |