CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 21:15 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-62615 | AU AutoGPT Significant-Gravitas | 9.8 | Feb 4 | AutoGPT has SSRF vulnerability in ReadRSSFeedBlock |
| CVE-2026-25547 | BR brace-expansion isaacs | 9.2 | Feb 4 | Uncontrolled Resource Consumption in @isaacs/brace-expansion |
| CVE-2026-25526 | JI jinjava HubSpot | 9.8 | Feb 4 | JinJava Bypass through ForTag leads to Arbitrary Java Execution |
| CVE-2026-25519 | OP OpenSlides OpenSlides | 9.8 | Feb 4 | OpenSlides has incorrect access control vulnerability in authentication service |
| CVE-2025-13375 | CC Common Cryptographic Architecture IBM | 9.8 | Feb 4 | IBM Common Cryptographic Architecture Arbitrary Command Execution |
| CVE-2026-25505 | BA bambuddy maziggy | 9.8 | Feb 4 | Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication |
| CVE-2026-25481 | LA langroid langroid | 9.6 | Feb 4 | Langroid has WAF Bypass Leading to RCE in TableChatAgent |
| CVE-2026-25139 | RI RIOT RIOT-OS | 9.1 | Feb 4 | RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments |
| CVE-2025-64712 | UN unstructured Unstructured-IO | 9.8 | Feb 4 | Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write |
| CVE-2026-22247 | GL glpi glpi-project | 9.1 | Feb 4 | GLPI is Vulnerable to SSRF via Webhooks |
| CVE-2026-25115 | N8 n8n n8n-io | 9.9 | Feb 4 | n8n is vulnerable to Python sandbox escape |
| CVE-2026-25053 | N8 n8n n8n-io | 9.9 | Feb 4 | n8n is Vulnerable to OS Command Injection in Git Node |
| CVE-2026-25052 | N8 n8n n8n-io | 9.9 | Feb 4 | n8n Improper File Access Controls Allow Arbitrary File Read by Authenticated Users |
| CVE-2026-25049 | N8 n8n n8n-io | 9.9 | Feb 4 | n8n Has an Expression Escape Vulnerability Leading to RCE |
| CVE-2025-5329 | DC Delta Course Automation Martcode Software Inc. | 9.8 | Feb 4 | SQLi in Martcode Software's Delta Course Automation |
| CVE-2025-59818 | TC TCIS-3+ Zenitel | 9.8 | Feb 4 | Authenticated Remote Code Execution via the file name of an uploaded file |
| CVE-2026-1813 | BO bolo-solo bolo-blog | 9.8 | Feb 3 | bolo-blog bolo-solo FreeMarker Template PicUploadProcessor.java unrestricted upload |
| CVE-2026-1633 | L2 LAN 232 TRIO Synectix | 10.0 | Feb 3 | Synectix LAN 232 TRIO Missing Authentication for Critical Function |
| CVE-2026-1632 | MS MOMA Seismic Station RISS SRL | 9.1 | Feb 3 | RISS SRL MOMA Seismic Station Missing Authentication for Critical Function |
| CVE-2026-1812 | BO bolo-solo bolo-blog | 9.8 | Feb 3 | bolo-blog bolo-solo Filename BackupService.java importFromCnblogs path traversal |
| CVE-2020-37090 | SE School ERP Pro Arox | 9.8 | Feb 3 | School ERP Pro 1.0 - Remote Code Execution |
| CVE-2020-37089 | SE School ERP Pro Arox | 9.8 | Feb 3 | School ERP Pro 1.0 - 'es_messagesid' SQL Injection |
| CVE-2020-37080 | WE webTareas luiswang | 9.8 | Feb 3 | webTareas 2.0.p8 - Arbitrary File Deletion |
| CVE-2020-37075 | LA LanSend LizardSystems | 9.8 | Feb 3 | LanSend 3.2 - Buffer Overflow (SEH) |
| CVE-2020-37074 | RD Remote Desktop Audit LizardSystems | 9.8 | Feb 3 | Remote Desktop Audit 2.3.0.157 - Buffer Overflow (SEH) |
| CVE-2020-37071 | CR CraftCMS CraftCMS | 9.8 | Feb 3 | CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution |
| CVE-2020-37070 | CL CloudMe CloudMe | 9.8 | Feb 3 | CloudMe 1.11.2 - Buffer Overflow (SEH,DEP,ASLR) |
| CVE-2020-37069 | FU FTP Utility Konica Minolta | 9.8 | Feb 3 | Konica Minolta FTP Utility 1.0 - 'NLST' Denial of Service |
| CVE-2020-37068 | FU FTP Utility Konica Minolta | 9.8 | Feb 3 | Konica Minolta FTP Utility 1.0 - 'LIST' Denial of Service |
| CVE-2020-37067 | FI Filetto Utillyty | 9.8 | Feb 3 | Filetto 1.0 - 'FEAT' Denial of Service |
| CVE-2020-37066 | GO GoldWave GoldWave | 9.8 | Feb 3 | GoldWave 5.70 – Buffer Overflow (SEH Unicode) |
| CVE-2020-37065 | ST StreamRipper32 StreamRipper | 9.8 | Feb 3 | StreamRipper32 2.6 - Buffer Overflow |
| CVE-2026-1341 | AL Avation Light Engine Pro Avation | 9.3 | Feb 3 | Missing Authentication for Critical Function in Avation Light Engine Pro |
| CVE-2026-25150 | QW qwik QwikDev | 10.0 | Feb 3 | Prototype Pollution via FormData Processing in Qwik City |
| CVE-2025-65078 | CC CSTAT, CXTAT, MSLBD, MXLBD, CSLBL, CXLBL, CSLBN, CXLBN, CSTMH, CXTMH, CSTPP, CXTPP, MSLSG, MXLSG Lexmark | 9.3 | Feb 3 | Untrusted search path vulnerability in Embedded Solutions Framework |
| CVE-2025-62799 | FA Fast-DDS eProsima | 9.8 | Feb 3 | FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS (potential RCE) |
| CVE-2026-25241 | PE pearweb pear | 9.8 | Feb 3 | PEAR is Vulnerable to SQL Injection in /get/<package>/<version> Endpoint |
| CVE-2026-25240 | PE pearweb pear | 9.8 | Feb 3 | PEAR is Vulnerable to SQL Injection in user::maintains() Role IN() Filter |
| CVE-2026-25238 | PE pearweb pear | 9.8 | Feb 3 | PEAR is Vulnerable to SQL Injection in Bug Subscription Deletion via Weak Email Validation |
| CVE-2026-25237 | PE pearweb pear | 9.8 | Feb 3 | PEAR is Vulnerable to PHP Code Execution via preg_replace /e in Bug Update Emails |
| CVE-2026-25236 | PE pearweb pear | 9.8 | Feb 3 | PEAR is Vulnerable to SQL Injection in Damblan_Karma IN() Query via Literal Substitution |
| CVE-2026-25234 | PE pearweb pear | 9.8 | Feb 3 | PEAR is Vulnerable to SQL Injection in Category Deletion |
| CVE-2026-25233 | PE pearweb pear | 9.1 | Feb 3 | PEAR Has a Roadmap Authorization Bypass via Operator Precedence Bug |
| CVE-2025-52626 | AI AION HCL | 9.8 | Feb 3 | HCL AION is susceptible to Potential Command Injection vulnerability |
| CVE-2020-37110 | 60 60CycleCMS Davidvg | 9.8 | Feb 3 | 60CycleCMS 2.5.2 - 'news.php' SQL Injection Vulnerability |
| CVE-2026-1568 | VM Vulnerability Management Rapid7 | 9.6 | Feb 3 | Rapid7 InsightVM Signature Validation Vulnerability |
| CVE-2025-5319 | DE DIGITA Efficiency Management System Emit Informatics and Communication Technologies Industry and Trade Ltd. Co. | 9.8 | Feb 3 | SQLi in Emit Informatics' DIGITA Efficiency Management System |
| CVE-2026-1432 | BU Buroweb T-Systems | 9.3 | Feb 3 | SQL injection (SQLi) on the Buroweb platform |
| CVE-2025-67856 | MO Moodle Moodle | 9.8 | Feb 3 | Moodle: moodle: privilege escalation via incomplete role checks in badge awarding |
| CVE-2026-24465 | WA WAB-S300IW-AC ELECOM CO.,LTD. | 9.8 | Feb 3 | Stack-based buffer overflow vulnerability exists in ELECOM wireless LAN access point devices |