CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:57 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2020-37057 | ON Online-exam-system- Sunnygkp10 | 9.8 | Jan 30 | Online-Exam-System 2015 contains a SQL injection vulnerability in the feedback module that allows attackers to manipulate database queries through the 'fid' parameter |
| CVE-2020-37056 | Product not mapped yet | 9.8 | Jan 30 | Crystal Shard http-protection 0.2.0 contains an IP spoofing vulnerability that allows attackers to bypass protection middleware by manipulating request headers |
| CVE-2020-37052 | Product not mapped yet | 9.8 | Jan 30 | AirControl 1.4.2 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through malicious… |
| CVE-2020-37050 | Product not mapped yet | 9.8 | Jan 30 | Quick Player 1.3 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting a malicious .m3l file with carefully constructed payload |
| CVE-2020-37043 | Product not mapped yet | 9.8 | Jan 30 | 10-Strike Bandwidth Monitor 3.9 contains a buffer overflow vulnerability that allows attackers to bypass SafeSEH, ASLR, and DEP protections through carefully crafted input |
| CVE-2020-37027 | Product not mapped yet | 9.8 | Jan 30 | Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands through the extra scripts configuration |
| CVE-2019-25232 | Product not mapped yet | 9.8 | Jan 30 | NetPCLinker 1.0.0.0 contains a buffer overflow vulnerability in the Clients Control Panel DNS/IP field that allows attackers to execute arbitrary shellcode |
| CVE-2026-25141 | OR Orval Orval | 9.8 | Jan 30 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification |
| CVE-2026-25130 | Product not mapped yet | 9.6 | Jan 30 | Cybersecurity AI (CAI) is a framework for AI Security |
| CVE-2026-1723 | Product not mapped yet | 9.2 | Jan 30 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R:… |
| CVE-2025-51958 | RU Runcommand Aelsantex | 9.8 | Jan 30 | aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugins/runcommand/postaction.php |
| CVE-2026-1701 | SM School Management System Itsourcecode | 9.8 | Jan 30 | A security vulnerability has been detected in itsourcecode School Management System 1.0 |
| CVE-2026-1688 | DM Directory Management System Clive 21 | 9.8 | Jan 30 | A security vulnerability has been detected in itsourcecode Directory Management System 1.0 |
| CVE-2025-7964 | Product not mapped yet | 9.2 | Jan 30 | After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigbee router resulting in the Zigbee Router getting stuck in a… |
| CVE-2025-26385 | Product not mapped yet | 9.5 | Jan 30 | Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability |
| CVE-2026-24729 | Product not mapped yet | 10.0 | Jan 30 | An unrestricted upload of file with dangerous type vulnerability in the file upload function of Interinfo DreamMaker versions before 2025/10/22 allows remote attackers to execute… |
| CVE-2026-24728 | Product not mapped yet | 9.3 | Jan 30 | A missing authentication for critical function vulnerability in the /servlet/baServer3 endpoint of Interinfo DreamMaker versions before 2025/10/22 allows remote attackers to… |
| CVE-2026-1340 In wildKEV | EM Endpoint Manager Mobile Ivanti | 9.8 | Jan 29 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability |
| CVE-2026-1281 In wildKEV | EM Endpoint Manager Mobile Ivanti | 9.8 | Jan 29 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability |
| CVE-2026-22806 | Product not mapped yet | 9.1 | Jan 29 | vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing |
| CVE-2025-69929 | WU Web User Interface N3uron | 9.8 | Jan 29 | An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over… |
| CVE-2026-1453 | Product not mapped yet | 9.8 | Jan 29 | A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts |
| CVE-2026-24054 | KC Kata Containers Katacontainers | 10.0 | Jan 29 | Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers |
| CVE-2026-1595 | SM Society Management System Angeljudesuarez | 9.8 | Jan 29 | A vulnerability was detected in itsourcecode Society Management System 1.0 |
| CVE-2026-1594 | SM Society Management System Angeljudesuarez | 9.8 | Jan 29 | A security vulnerability has been detected in itsourcecode Society Management System 1.0 |
| CVE-2026-1593 | SM Society Management System Angeljudesuarez | 9.8 | Jan 29 | A weakness has been identified in itsourcecode Society Management System 1.0 |
| CVE-2026-1590 | SM School Management System Angeljudesuarez | 9.8 | Jan 29 | A vulnerability was identified in itsourcecode School Management System 1.0 |
| CVE-2026-1589 | SM School Management System Angeljudesuarez | 9.8 | Jan 29 | A vulnerability was determined in itsourcecode School Management System 1.0 |
| CVE-2025-7714 | CM Content Management System Globalmedya | 9.8 | Jan 29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc |
| CVE-2020-37012 | Product not mapped yet | 9.8 | Jan 29 | Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php endpoint |
| CVE-2020-37010 | Product not mapped yet | 9.8 | Jan 29 | BearShare Lite 5.2.5 contains a buffer overflow vulnerability in the Advanced Search keywords input that allows attackers to execute arbitrary code |
| CVE-2020-37002 | Product not mapped yet | 9.8 | Jan 29 | Ajenti 2.1.36 contains a post-authenticated remote command execution vulnerability that allows remote attackers to execute arbitrary commands after successful login |
| CVE-2020-37000 | Product not mapped yet | 9.8 | Jan 29 | Free MP3 CD Ripper 2.8 contains a stack buffer overflow vulnerability that allows remote attackers to execute arbitrary code by crafting a malicious WAV file with oversized… |
| CVE-2020-36997 | Product not mapped yet | 9.8 | Jan 29 | BacklinkSpeed 2.4 contains a buffer overflow vulnerability that allows attackers to corrupt the Structured Exception Handler (SEH) chain through malicious file import |
| CVE-2025-7013 | MP Menu Panel Qrmenumpro | 9.8 | Jan 29 | Authorization Bypass Through User-Controlled Key vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Exploitation of Trusted Identifiers |
| CVE-2025-7016 | QM QR Menu Akinsoft | 9.8 | Jan 29 | Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd |
| CVE-2025-7015 | QM QR Menu Akinsoft | 9.8 | Jan 29 | Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd |
| CVE-2026-1188 | OM Omr Eclipse | 9.8 | Jan 29 | In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator… |
| CVE-2026-1552 | SE Semcms Sem-cms | 9.8 | Jan 29 | A security vulnerability has been detected in SEMCMS 5.0 |
| CVE-2026-24888 | MA Maker.js Microsoft | 9.8 | Jan 28 | Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters |
| CVE-2026-24857 | BE Bulk Extractor Simsong | 9.8 | Jan 28 | `bulk_extractor` is a digital forensics exploitation tool |
| CVE-2026-1547 | AF A7000r Firmware Totolink | 9.8 | Jan 28 | A vulnerability was detected in Totolink A7000R 4.1cu.4154 |
| CVE-2026-1546 | JS Jsherp Jishenghua | 9.8 | Jan 28 | A security vulnerability has been detected in jishenghua jshERP up to 3.6 |
| CVE-2026-1545 | SM School Management System Angeljudesuarez | 9.8 | Jan 28 | A weakness has been identified in itsourcecode School Management System 1.0 |
| CVE-2026-24769 | NO Nocodb Nocodb | 9.0 | Jan 28 | NocoDB is software for building databases as spreadsheets |
| CVE-2026-1535 | OM Online Music Site Fabian | 9.8 | Jan 28 | A security vulnerability has been detected in code-projects Online Music Site 1.0 |
| CVE-2026-1534 | OM Online Music Site Fabian | 9.8 | Jan 28 | A weakness has been identified in code-projects Online Music Site 1.0 |
| CVE-2026-1533 | OM Online Music Site Fabian | 9.8 | Jan 28 | A security flaw has been discovered in code-projects Online Music Site 1.0 |
| CVE-2025-68662 | DI Discourse Discourse | 9.9 | Jan 28 | Discourse is an open source discussion platform |
| CVE-2026-24772 | OP Openproject Openproject | 9.0 | Jan 28 | OpenProject is an open-source, web-based project management software |