CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:57 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2020-37066 | Product not mapped yet | 9.8 | Feb 3 | GoldWave 5.70 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting malicious input in the File Open URL dialog |
| CVE-2020-37065 | Product not mapped yet | 9.8 | Feb 3 | StreamRipper32 version 2.6 contains a buffer overflow vulnerability in the Station/Song Section that allows attackers to overwrite memory by manipulating the SongPattern input |
| CVE-2020-37070 | CL CloudMe CloudMe | 9.8 | Feb 3 | CloudMe 1.11.2 - Buffer Overflow (SEH,DEP,ASLR) |
| CVE-2025-65078 | Product not mapped yet | 9.3 | Feb 3 | An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices |
| CVE-2025-62799 | DL Debian Linux Debian | 9.8 | Feb 3 | Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ) |
| CVE-2025-10878 | FO Fikir Odalari Adminpando Omran | 10.0 | Feb 3 | A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26 |
| CVE-2026-25241 | PE Pearweb Pear | 9.8 | Feb 3 | PEAR is a framework and distribution system for reusable PHP components |
| CVE-2026-25240 | PE Pearweb Pear | 9.8 | Feb 3 | PEAR is a framework and distribution system for reusable PHP components |
| CVE-2026-25238 | PE Pearweb Pear | 9.8 | Feb 3 | PEAR is a framework and distribution system for reusable PHP components |
| CVE-2026-25237 | PE Pearweb Pear | 9.8 | Feb 3 | PEAR is a framework and distribution system for reusable PHP components |
| CVE-2026-25236 | PE Pearweb Pear | 9.8 | Feb 3 | PEAR is a framework and distribution system for reusable PHP components |
| CVE-2026-25234 | PE Pearweb Pear | 9.8 | Feb 3 | PEAR is a framework and distribution system for reusable PHP components |
| CVE-2026-25233 | PE Pearweb Pear | 9.1 | Feb 3 | PEAR is a framework and distribution system for reusable PHP components |
| CVE-2025-69983 | FU Fuxa Frangoteam | 9.8 | Feb 3 | FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality |
| CVE-2025-69981 | FU Fuxa Frangoteam | 9.8 | Feb 3 | FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint |
| CVE-2025-69971 | FU Fuxa Frangoteam | 9.8 | Feb 3 | FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js |
| CVE-2025-69970 | FU Fuxa Frangoteam | 9.3 | Feb 3 | FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js |
| CVE-2025-67188 | AF A950rg Firmware Totolink | 9.8 | Feb 3 | A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112 |
| CVE-2025-67187 | AF A950rg Firmware Totolink | 9.8 | Feb 3 | A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112 |
| CVE-2025-67186 | AF A950rg Firmware Totolink | 9.8 | Feb 3 | TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules interface of /lib/cste_modules/firewall.so |
| CVE-2025-65875 | FP Fpdf Fpdf | 9.8 | Feb 3 | An arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file |
| CVE-2025-63624 | IS Iot Smart Water Meter Firmware Sdkede | 9.8 | Feb 3 | SQL Injection vulnerability in Shandong Kede Electronics Co., Ltd IoT smart water meter monitoring platform v.1.0 allows a remote attacker to execute arbitrary code via the… |
| CVE-2025-61506 | ME Mediacrush Mediacrush | 9.8 | Feb 3 | An issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to upload arbitrary files of any size to the /upload endpoint |
| CVE-2025-57529 | CA Cpas Audit Management System Youdatasum | 9.8 | Feb 3 | YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input validation |
| CVE-2025-52626 | AI Aion Hcltech | 9.8 | Feb 3 | A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying… |
| CVE-2020-37110 | 60 60cyclecms Opensourcecms | 9.8 | Feb 3 | 60CycleCMS 2.5.2 contains an SQL injection vulnerability in news.php and common/lib.php that allows attackers to manipulate database queries through unvalidated user input |
| CVE-2026-1568 | Product not mapped yet | 9.6 | Feb 3 | Rapid7 InsightVM versions before 8.34.0 contain a signature verification issue on the Assertion Consumer Service (ACS) cloud endpoint that could allow an attacker to gain… |
| CVE-2025-5319 | Product not mapped yet | 9.8 | Feb 3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Emit Informatics and Communication Technologies Industry and Trade Ltd |
| CVE-2026-1432 | Product not mapped yet | 9.3 | Feb 3 | SQL injection vulnerability in the Buroweb platform version 2505.0.12, specifically in the 'tablon' component |
| CVE-2025-67856 | MO Moodle Moodle | 9.8 | Feb 3 | A flaw was found in Moodle |
| CVE-2026-24465 | WF Wab-s300iw-ac Firmware Elecom | 9.8 | Feb 3 | Stack-based buffer overflow vulnerability exists in ELECOM wireless LAN access point devices |
| CVE-2026-24936 | DM Data Master Asustor | 9.8 | Feb 3 | When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated… |
| CVE-2025-67484 | ME Mediawiki Mediawiki | 9.8 | Feb 3 | Vulnerability in Wikimedia Foundation MediaWiki |
| CVE-2026-25142 | SA Sandboxjs Nyariv | 10.0 | Feb 2 | SandboxJS is a JavaScript sandboxing library |
| CVE-2026-25137 | Product not mapped yet | 9.1 | Feb 2 | The NixOs Odoo package is an open source ERP and CRM system |
| CVE-2026-24471 | Product not mapped yet | 9.3 | Feb 2 | continuwuity is a Matrix homeserver written in Rust |
| CVE-2026-23997 | FA Facturascripts Facturascripts | 9.0 | Feb 2 | FacturaScripts is open-source enterprise resource planning and accounting software |
| CVE-2026-22778 | VL Vllm Vllm | 9.8 | Feb 2 | vLLM is an inference and serving engine for large language models (LLMs) |
| CVE-2025-66480 | IM Im-server Wildfirechat | 9.8 | Feb 2 | Wildfire IM is an instant messaging and real-time audio/video solution |
| CVE-2022-50981 | Product not mapped yet | 9.8 | Feb 2 | An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and setting one is not enforced |
| CVE-2025-8587 | SK Skspro Akceyazilim | 9.8 | Feb 2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AKCE Software Technology R&D Industry and Trade Inc |
| CVE-2024-5986 | Product not mapped yet | 9.1 | Feb 2 | A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server |
| CVE-2024-2356 | Product not mapped yet | 9.6 | Feb 2 | A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint of the parisneo/lollms-webui application, specifically within the `name` parameter of the… |
| CVE-2026-20418 | MA Matter Google | 9.8 | Feb 2 | In Thread, there is a possible out of bounds write due to a missing bounds check |
| CVE-2026-20407 | NS Nbiot Sdk Mediatek | 9.3 | Feb 2 | In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check |
| CVE-2025-15030 | Product not mapped yet | 9.8 | Feb 2 | The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user… |
| CVE-2026-25202 | M9 Magicinfo 9 Server Samsung | 9.8 | Feb 2 | The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects MagicINFO 9 Server: less than… |
| CVE-2026-25200 | M9 Magicinfo 9 Server Samsung | 9.8 | Feb 2 | A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover This issue… |
| CVE-2026-1740 | AF A8004t Firmware Iptime | 9.8 | Feb 2 | A vulnerability was found in EFM ipTIME A8004T 14.18.2 |
| CVE-2026-25069 | Product not mapped yet | 9.3 | Feb 1 | SunFounder Pironman Dashboard (pm_dashboard) version 1.3.13 and prior contain a path traversal vulnerability in the log file API endpoints |