CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 03:14 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2020-37184 | AV Allok Video Converter Allok Soft | 9.8 | Feb 11 | Allok Video Converter 4.6.1217 - Stack Overflow (SEH) |
| CVE-2020-37183 | AR Allok RM RMVB to AVI MPEG DVD Converter Allok Soft | 9.8 | Feb 11 | Allok RM RMVB to AVI MPEG DVD Converter 3.6.1217 - Stack Overflow (SEH) |
| CVE-2020-37181 | TF Torrent FLV Converter TorrentRockYou | 9.8 | Feb 11 | Torrent FLV Converter 1.51 Build 117 - Stack Oveflow (SEH partial overwrite) |
| CVE-2020-37176 | T3 Torrent 3GP Converter Torrentrockyou | 9.8 | Feb 11 | Torrent 3GP Converter 1.51 - Stack Overflow (SEH) |
| CVE-2020-37172 | AP AVideo Platform AVideo | 9.8 | Feb 11 | AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset) |
| CVE-2026-24789 | ZL ZLAN5143D ZLAN Information Technology Co. | 9.8 | Feb 11 | ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function |
| CVE-2026-25084 | ZL ZLAN5143D ZLAN Information Technology Co. | 9.8 | Feb 11 | ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function |
| CVE-2026-2249 | MD METIS DFS METIS Cyberspace Technology SA | 9.8 | Feb 11 | Unauthenticated Remote Command Execution via Web Console in METIS DFS |
| CVE-2026-2248 | MW METIS WIC METIS Cyberspace Technology SA | 9.8 | Feb 11 | Unauthenticated Remote Root Shell Access via Web Console in METIS WIC |
| CVE-2025-12059 | LJ Logo j-Platform Logo Software Industry and Trade Inc. | 9.8 | Feb 11 | Improper Access Control in Logo Software's Logo j-Platform |
| CVE-2025-8668 | TU Turboard E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. | 9.4 | Feb 11 | Reflected XSS in E-Kalite Software Hardware Engineering's Turboard |
| CVE-2025-8025 | DE Dinosoft ERP Dinosoft Business Solutions | 9.8 | Feb 11 | Improper Access Control in Dinosoft Business Solutions' Dinosoft ERP |
| CVE-2025-66277 | QT QTS QNAP Systems Inc. | 9.8 | Feb 11 | QTS, QuTS hero |
| CVE-2025-7659 | GI GitLab GitLab | 9.1 | Feb 11 | Origin Validation Error in GitLab |
| CVE-2026-1357 | WB WPvivid — Backup, Migration & Staging wpvividplugins | 9.8 | Feb 11 | Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload |
| CVE-2025-64075 | Product not mapped yet | 10.0 | Feb 11 | A path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authentication and perform… |
| CVE-2025-69874 | NA Nanotar Unjs | 9.8 | Feb 11 | nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction… |
| CVE-2025-69872 | RH Red Hat AI Inference Server Red Hat | 9.8 | Feb 11 | DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default |
| CVE-2025-67135 | Product not mapped yet | 9.8 | Feb 11 | Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack |
| CVE-2025-70085 | OP Opensatkit Opensatkit | 9.8 | Feb 11 | An issue was discovered in OpenSatKit 2.2.1 |
| CVE-2026-26009 | CA catalyst karutoil | 9.9 | Feb 10 | Catalyst Affected by Remote Code Execution as Root via Containerized Install Script Execution |
| CVE-2026-21531 | AA Azure AI Language Authoring Microsoft | 9.8 | Feb 10 | Azure SDK for Python Remote Code Execution Vulnerability |
| CVE-2026-25993 | EV evershop evershopcommerce | 9.8 | Feb 10 | EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys |
| CVE-2025-52436 | FO FortiSandbox Fortinet | 9.6 | Feb 10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1,… |
| CVE-2026-1774 | CA CASL Ability CASL Ability | 9.8 | Feb 10 | CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability. |
| CVE-2026-23906 | AD Apache Druid Apache Software Foundation | 9.8 | Feb 10 | Apache Druid: Authentication Bypass via LDAP Anonymous Bind |
| CVE-2025-11242 | OK Okulistik Teknolist Computer Systems Software Publishing Industry and Trade Inc. | 9.8 | Feb 10 | SSRF in Teknolist Computer's Okulistik |
| CVE-2026-2096 | AG Agentflow Flowring | 9.8 | Feb 10 | Flowring｜Agentflow - Missing Authenticaton |
| CVE-2026-2095 | AG Agentflow Flowring | 9.8 | Feb 10 | Flowring｜Agentflow - Authentication Bypass |
| CVE-2026-0509 | SN SAP NetWeaver Application Server ABAP and ABAP Platform SAP_SE | 9.6 | Feb 10 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform |
| CVE-2026-0488 | SC SAP CRM and SAP S/4HANA (Scripting Editor) SAP_SE | 9.9 | Feb 10 | Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor) |
| CVE-2026-25895 | FU FUXA frangoteam | 9.8 | Feb 9 | FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API |
| CVE-2026-25894 | FU FUXA frangoteam | 9.8 | Feb 9 | FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration |
| CVE-2026-25893 | FU FUXA frangoteam | 9.8 | Feb 9 | FUXA Unauthenticated Remote Code Execution via Admin JWT Minting |
| CVE-2026-25939 | FU FUXA frangoteam | 9.1 | Feb 9 | FUXA Unauthenticated Remote Arbitrary Scheduler Write |
| CVE-2026-25938 | FU FUXA frangoteam | 9.8 | Feb 9 | FUXA Unauthenticated Remote Code Execution in Node-RED Integration |
| CVE-2026-25923 | MY mylittleforum My-Little-Forum | 9.1 | Feb 9 | Phar Deserialization leading to Arbitrary File Deletion in my little forum |
| CVE-2026-25881 | SA SandboxJS nyariv | 10.0 | Feb 9 | @nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape) |
| CVE-2026-25875 | AS assessment-placipy Praskla-Technology | 9.8 | Feb 9 | PlaciPy Admin Privilege Escalation via Trusted JWT Claims |
| CVE-2026-25814 | AS assessment-placipy Praskla-Technology | 9.8 | Feb 9 | NoSQL Injection Risk via Unsanitized Query Parameters |
| CVE-2026-25811 | AS assessment-placipy Praskla-Technology | 9.1 | Feb 9 | PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure) |
| CVE-2026-25809 | AS assessment-placipy Praskla-Technology | 9.8 | Feb 9 | PlaciPy Code Execution Allowed Without Assessment Active State Validation |
| CVE-2026-25810 | AS assessment-placipy Praskla-Technology | 9.1 | Feb 9 | PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts |
| CVE-2026-25876 | AS assessment-placipy Praskla-Technology | 9.1 | Feb 9 | PlaciPy is Missing Authorization on Assessment Results Endpoint |
| CVE-2026-25057 | MA Markus MarkUsProject | 9.1 | Feb 9 | Zip Slip in MarkUs config upload allowing RCE |
| CVE-2026-24679 | FR FreeRDP FreeRDP | 9.1 | Feb 9 | FreeRDP has a heap-buffer-overflow in urb_select_interface |
| CVE-2026-24677 | FR FreeRDP FreeRDP | 9.1 | Feb 9 | FreeRDP has a heap-buffer-overflow in ecam_encoder_compress_h264 |
| CVE-2025-66630 | FI fiber gofiber | 9.4 | Feb 9 | Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure |
| CVE-2025-6830 | PM Password Module Xpoda Türkiye Information Technology Inc. | 9.8 | Feb 9 | SQLi in Xpoda Türkiye Information Technology's Password Module |
| CVE-2026-25848 | HU Hub JetBrains | 9.8 | Feb 9 | In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible |