CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 14:35 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-2014 | SM School Management System Itsourcecode | 9.8 | Feb 6 | A security flaw has been discovered in itsourcecode Student Management System 1.0 |
| CVE-2026-2013 | SM School Management System Itsourcecode | 9.8 | Feb 6 | A vulnerability was identified in itsourcecode Student Management System 1.0 |
| CVE-2026-2012 | SM School Management System Itsourcecode | 9.8 | Feb 6 | A vulnerability was determined in itsourcecode Student Management System 1.0 |
| CVE-2026-2011 | SM School Management System Itsourcecode | 9.8 | Feb 6 | A vulnerability was found in itsourcecode Student Management System 1.0 |
| CVE-2026-21643 In wildKEV | FO FortiClientEMS Fortinet | 9.8 | Feb 6 | Fortinet FortiClient EMS SQL Injection Vulnerability |
| CVE-2026-24302 | AA Azure Arc Microsoft | 9.8 | Feb 5 | Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network |
| CVE-2026-24300 | AF Azure Front Door Microsoft | 9.8 | Feb 5 | Azure Front Door Elevation of Privilege Vulnerability |
| CVE-2026-1963 | WE Wekan Wekan Project | 9.8 | Feb 5 | A vulnerability was found in WeKan up to 8.20 |
| CVE-2026-1962 | WE Wekan Wekan Project | 9.8 | Feb 5 | A vulnerability has been found in WeKan up to 8.20 |
| CVE-2026-0106 | AN Android Google | 9.3 | Feb 5 | In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing bounds check |
| CVE-2025-68121 | GO GO Golang | 10.0 | Feb 5 | During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed… |
| CVE-2025-68723 | AM Axigen Mail Server Axigen | 9.0 | Feb 5 | Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface |
| CVE-2020-37138 | Product not mapped yet | 9.8 | Feb 5 | 10-Strike Network Inventory Explorer 9.03 contains a buffer overflow vulnerability in the file import functionality that allows remote attackers to execute arbitrary code |
| CVE-2020-37137 | PH Phpfusion Php-fusion | 9.8 | Feb 5 | PHP-Fusion 9.03.50 contains a remote code execution vulnerability in the 'add_panel_form()' function that allows attackers to execute arbitrary code through an eval() function… |
| CVE-2020-37129 | Product not mapped yet | 9.8 | Feb 5 | Memu Play 7.1.3 contains an insecure folder permissions vulnerability that allows low-privileged users to modify the MemuService.exe executable |
| CVE-2020-37126 | Product not mapped yet | 9.8 | Feb 5 | Free Desktop Clock 3.0 contains a stack overflow vulnerability in the Time Zones display name input that allows attackers to overwrite Structured Exception Handler (SEH) registers |
| CVE-2020-37125 | EM Ew-7438rpn Mini Firmware Edimax | 9.8 | Feb 5 | Edimax EW-7438RPn-v3 Mini 1.27 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands through the /goform/mp endpoint |
| CVE-2020-37124 | Product not mapped yet | 9.8 | Feb 5 | B64dec 1.1.2 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) with crafted input |
| CVE-2020-37123 | Product not mapped yet | 9.8 | Feb 5 | Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters |
| CVE-2020-37120 | Product not mapped yet | 9.8 | Feb 5 | Rubo DICOM Viewer 2.0 contains a buffer overflow vulnerability in the DICOM server name input field that allows attackers to overwrite Structured Exception Handler (SEH) |
| CVE-2020-37119 | NS Nsauditor Nsasoft | 9.8 | Feb 5 | Nsauditor 3.0.28 and 3.2.1.0 contains a buffer overflow vulnerability in the DNS Lookup tool that allows attackers to execute arbitrary code by overwriting memory |
| CVE-2026-23796 | QU Quick.cart Opensolution | 9.8 | Feb 5 | Quick.Cart allows a user's session identifier to be set before authentication |
| CVE-2025-62616 | AP Autogpt Platform Agpt | 9.8 | Feb 4 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows |
| CVE-2025-62615 | AP Autogpt Platform Agpt | 9.8 | Feb 4 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows |
| CVE-2026-25547 | Product not mapped yet | 9.2 | Feb 4 | @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion |
| CVE-2026-25526 | JI Jinjava Hubspot | 9.8 | Feb 4 | JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates |
| CVE-2026-25519 | OP Openslides Openslides | 9.8 | Feb 4 | OpenSlides is a free, web based presentation and assembly system for managing and projecting agenda, motions and elections of an assembly |
| CVE-2025-13375 | Product not mapped yet | 9.8 | Feb 4 | IBM Common Cryptographic Architecture (CCA) 7.5.52 and 8.4.82 could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system |
| CVE-2026-25505 | BA Bambuddy Bambuddy | 9.8 | Feb 4 | Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers |
| CVE-2026-25481 | LA Langroid Langroid | 9.6 | Feb 4 | Langroid is a framework for building large-language-model-powered applications |
| CVE-2026-25139 | RI Riot Riot-os | 9.1 | Feb 4 | RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices |
| CVE-2026-22247 | GL Glpi Glpi-project | 9.1 | Feb 4 | GLPI is a free asset and IT management software package |
| CVE-2025-64712 | UN Unstructured Unstructured | 9.8 | Feb 4 | The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more |
| CVE-2026-25115 | N8 N8n N8n | 9.9 | Feb 4 | n8n is an open source workflow automation platform |
| CVE-2026-25053 | N8 N8n N8n | 9.9 | Feb 4 | n8n is an open source workflow automation platform |
| CVE-2026-25052 | N8 N8n N8n | 9.9 | Feb 4 | n8n is an open source workflow automation platform |
| CVE-2026-25049 | N8 N8n N8n | 9.9 | Feb 4 | n8n is an open source workflow automation platform |
| CVE-2025-5329 | Product not mapped yet | 9.8 | Feb 4 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martcode Software Inc |
| CVE-2025-59818 | TF Tcis-3 Firmware Zenitel | 9.8 | Feb 4 | This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file |
| CVE-2026-1813 | BO Bolo-solo Adlered | 9.8 | Feb 4 | A vulnerability was found in bolo-blog bolo-solo up to 2.6.4 |
| CVE-2026-1633 | Product not mapped yet | 10.0 | Feb 4 | The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authentication, allowing unauthenticated users to modify… |
| CVE-2026-1812 | BO Bolo-solo Adlered | 9.8 | Feb 3 | A vulnerability has been found in bolo-blog bolo-solo up to 2.6.4 |
| CVE-2026-1632 | Product not mapped yet | 9.1 | Feb 3 | MOMA Seismic Station Version v2.4.2520 and prior exposes its web management interface without requiring authentication, which could allow an unauthenticated attacker to modify… |
| CVE-2026-25150 | QW Qwik Qwik | 10.0 | Feb 3 | Qwik is a performance focused javascript framework |
| CVE-2026-1341 | Product not mapped yet | 9.3 | Feb 3 | Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control |
| CVE-2020-37090 | SE School Erp Pro Arox | 9.8 | Feb 3 | School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system |
| CVE-2020-37089 | SE School Erp Pro Arox | 9.8 | Feb 3 | School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to manipulate database queries through GET requests |
| CVE-2020-37080 | Product not mapped yet | 9.8 | Feb 3 | webTareas 2.0.p8 contains a file deletion vulnerability in the print_layout.php administration component that allows authenticated attackers to delete arbitrary files |
| CVE-2020-37075 | Product not mapped yet | 9.8 | Feb 3 | LanSend 3.2 contains a buffer overflow vulnerability in the Add Computers Wizard file import functionality that allows remote attackers to execute arbitrary code |
| CVE-2020-37074 | Product not mapped yet | 9.8 | Feb 3 | Remote Desktop Audit 2.3.0.157 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code during the Add Computers Wizard file import process |