CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 09:32 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-70830 | Product not mapped yet | 9.9 | Feb 17 | A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via… |
| CVE-2026-2439 | CO Concierge::Sessions BVA | 9.8 | Feb 16 | Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids |
| CVE-2025-15578 | MA Maypole TEEJAY | 9.8 | Feb 16 | Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely |
| CVE-2026-2550 | IA iptime A6004MX EFM | 9.8 | Feb 16 | EFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted upload |
| CVE-2026-2577 | NA nanobot HKUDS | 10.0 | Feb 16 | Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge |
| CVE-2026-2532 | DE DeepAudit lintsinghua | 9.8 | Feb 16 | lintsinghua DeepAudit IP Address embedding_config.py server-side request forgery |
| CVE-2026-2529 | WL WL-WN579A3 Wavlink | 9.8 | Feb 16 | Wavlink WL-WN579A3 wireless.cgi DeleteMac command injection |
| CVE-2026-2528 | WL WL-WN579A3 Wavlink | 9.8 | Feb 16 | Wavlink WL-WN579A3 wireless.cgi Delete_Mac_list command injection |
| CVE-2026-2527 | WL WL-WN579A3 Wavlink | 9.8 | Feb 16 | Wavlink WL-WN579A3 login.cgi command injection |
| CVE-2026-2522 | OP Open5GS Open5gs | 9.8 | Feb 15 | Open5GS MME esm-build.c memory corruption |
| CVE-2026-2521 | OP Open5GS Open5gs | 9.8 | Feb 15 | Open5GS SGW-C sgwc_s5c_handle_create_session_response memory corruption |
| CVE-2026-26366 | ES eNet SMART HOME server JUNG | 9.8 | Feb 15 | JUNG eNet SMART HOME server 2.2.1/2.3.1 Use of Default Credentials |
| CVE-2025-32058 | IS Infotainment system ECU Bosch | 9.3 | Feb 15 | Stack Overflow in processing requests over INC interface on RH850 side of Infotainment ECU |
| CVE-2026-1490 | SP Spam protection, Honeypot, Anti-Spam by CleanTalk cleantalk | 9.8 | Feb 15 | Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation |
| CVE-2025-8572 | TC Truelysell Core dreamstechnologies | 9.8 | Feb 14 | Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration |
| CVE-2026-1306 | MI midi-Synth adminkov | 9.8 | Feb 14 | midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action |
| CVE-2026-24853 | CA caido caido | 9.8 | Feb 13 | Caido has an insufficient patch for DNS rebind leading to RCE |
| CVE-2026-26273 | KN known idno | 9.8 | Feb 13 | Known affected by Account Takeover via Password Reset Token Leakage |
| CVE-2026-26333 | VE VeraSMART Calero | 9.8 | Feb 13 | Calero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE |
| CVE-2026-26335 | VE VeraSMART Calero | 9.8 | Feb 13 | Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE |
| CVE-2026-26190 | MI milvus milvus-io | 9.8 | Feb 13 | Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise |
| CVE-2026-26268 | CU cursor cursor | 9.9 | Feb 13 | Cursor sandbox escape via Git hooks |
| CVE-2026-26221 | OW OnBase Workflow Timer Service Hyland | 9.8 | Feb 13 | Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE |
| CVE-2026-23112 | KE Kernel Linux | 9.8 | Feb 13 | nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec |
| CVE-2025-69770 | Product not mapped yet | 10.0 | Feb 13 | A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file |
| CVE-2025-69633 | Product not mapped yet | 9.8 | Feb 13 | A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through 1.2.6 (Fixed in version 1.2.7) allows remote… |
| CVE-2019-25337 | OW OwnCloud OwnCloud | 9.8 | Feb 12 | OwnCloud 8.1.8 - Username Disclosure |
| CVE-2019-25327 | PR Prime95 Mersenne Research, Inc | 9.8 | Feb 12 | Prime95 Version 29.8 build 6 - Buffer Overflow (SEH) |
| CVE-2019-25321 | FN FTP Navigator Softpedia | 9.8 | Feb 12 | FTP Navigator 8.03 - Stack Overflow (SEH) |
| CVE-2019-25319 | DQ Domain Quester Pro Internet-Soft | 9.8 | Feb 12 | Domain Quester Pro 6.02 - Stack Overflow (SEH) |
| CVE-2026-26068 | EM emp3r0r jm33-m0 | 9.9 | Feb 12 | emp3r0r Agent-Controlled Metadata to Operator RCE (tmux Command Injection) |
| CVE-2026-1358 | AM Airleader Master Airleader GmbH | 9.8 | Feb 12 | Airleader Master Unrestricted Upload of File with Dangerous Type |
| CVE-2026-26011 | NA navigation2 ros-navigation | 9.8 | Feb 12 | Critical Heap Out-of-bounds Access in `pf_cluster_stats()` via Malicious /initialpose Covariance -- Potential Remote Code Execution |
| CVE-2026-25996 | IN inspektor-gadget inspektor-gadget | 9.8 | Feb 12 | Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode |
| CVE-2026-24895 | PH PHP PHP | 9.8 | Feb 12 | FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files |
| CVE-2026-24044 | ES ess-helm element-hq | 9.2 | Feb 12 | ESS Community Helm Chart has a weak server key generation method |
| CVE-2026-26219 | NE newbee-mall newbee-ltd | 9.1 | Feb 12 | newbee-mall Unsalted MD5 Password Hashing Enables Offline Credential Cracking |
| CVE-2026-26218 | NE newbee-mall newbee-ltd | 9.8 | Feb 12 | newbee-mall Default Seeded Administrator Credentials Allow Account Takeover |
| CVE-2026-26216 | CR Crawl4AI unclecode | 10.0 | Feb 12 | Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter |
| CVE-2025-14014 | SP Smart Panel NTN Information Processing Services Computer Software Hardware Industry and Trade Ltd. Co. | 9.8 | Feb 12 | Insecure File Upload in NTN Informatics' Smart Panel |
| CVE-2025-10969 | EP E-Commerce Package Farktor Software E-Commerce Services Inc. | 9.8 | Feb 12 | SQLi in Farktor Software's E-Commerce Package |
| CVE-2025-15573 | PW Pocket WiFi 3.0 SolaX Power | 9.4 | Feb 12 | Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud Connection |
| CVE-2025-14892 | PL Prime Listing Manager | 9.8 | Feb 12 | Prime Listing Manager <= 1.1 - Unauthenticated Privilege Escalation |
| CVE-2026-1729 | AD AdForest scriptsbundle | 9.8 | Feb 12 | AdForest <= 6.0.12 - Authentication Bypass |
| CVE-2025-70314 | WE Webfsd Ourway | 9.8 | Feb 12 | webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request |
| CVE-2025-70981 | CC Cordys Crm Fit2cloud | 9.8 | Feb 12 | CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter |
| CVE-2025-69634 | Product not mapped yet | 9.0 | Feb 12 | Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by… |
| CVE-2026-20677 | MA macOS Apple | 9.0 | Feb 11 | A race condition was addressed with improved handling of symbolic links |
| CVE-2026-26215 | MA manga-image-translator zyddnys | 9.3 | Feb 11 | manga-image-translator Shared API Unsafe Deserialization RCE |
| CVE-2026-26021 | SE set-in ahdinosaur | 9.8 | Feb 11 | Prototype pollution in set-in |