CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 22:37 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-24936 | AD ADM ASUSTOR | 9.8 | Feb 3 | An improper input validation vulnerability was found in ADM while joining a AD Domain. |
| CVE-2025-67484 | ME MediaWiki Wikimedia Foundation | 9.8 | Feb 3 | Action API xslt option allows JavaScript execution by administrators who are not interface administrators |
| CVE-2025-10878 | FO Fikir Odalari AdminPando Insaat | 10.0 | Feb 3 | A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26 |
| CVE-2025-65875 | FP Fpdf Fpdf | 9.8 | Feb 3 | An arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file |
| CVE-2025-57529 | CA Cpas Audit Management System Youdatasum | 9.8 | Feb 3 | YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input validation |
| CVE-2025-63624 | IS Iot Smart Water Meter Firmware Sdkede | 9.8 | Feb 3 | SQL Injection vulnerability in Shandong Kede Electronics Co., Ltd IoT smart water meter monitoring platform v.1.0 allows a remote attacker to execute arbitrary code via the… |
| CVE-2025-61506 | ME Mediacrush Mediacrush | 9.8 | Feb 3 | An issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to upload arbitrary files of any size to the /upload endpoint |
| CVE-2025-67186 | AF A950rg Firmware Totolink | 9.8 | Feb 3 | TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules interface of /lib/cste_modules/firewall.so |
| CVE-2025-67187 | AF A950rg Firmware Totolink | 9.8 | Feb 3 | A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112 |
| CVE-2025-69981 | FU Fuxa Frangoteam | 9.8 | Feb 3 | FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint |
| CVE-2025-69983 | FU Fuxa Frangoteam | 9.8 | Feb 3 | FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality |
| CVE-2025-69971 | FU Fuxa Frangoteam | 9.8 | Feb 3 | FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js |
| CVE-2025-67188 | AF A950rg Firmware Totolink | 9.8 | Feb 3 | A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112 |
| CVE-2025-69970 | FU Fuxa Frangoteam | 9.3 | Feb 3 | FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js |
| CVE-2026-25142 | SA SandboxJS nyariv | 10.0 | Feb 2 | SandboxJS Prototype Pollution -> Sandbox Escape -> RCE |
| CVE-2026-25137 | NI nixpkgs NixOS | 9.1 | Feb 2 | NixOs Odoo database and filestore publicly accessible with default odoo configuration |
| CVE-2025-66480 | IM im-server wildfirechat | 9.8 | Feb 2 | Wildfire has Arbitrary File Upload via Directory Traversal in UploadFileAction |
| CVE-2026-22778 | VL vllm vllm-project | 9.8 | Feb 2 | vLLM leaks a heap address when PIL throws an error |
| CVE-2026-23997 | FA facturascripts NeoRazorX | 9.0 | Feb 2 | FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View |
| CVE-2026-24471 | CO continuwuity continuwuity | 9.3 | Feb 2 | Improper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy') |
| CVE-2022-50981 | AA AvibiaLine AVLX1 HD 5.0 avibia | 9.8 | Feb 2 | Multiple Innomic VibroLine VLX HD 5.0 and avibia AVLX weak password requirements |
| CVE-2025-8587 | SK SKSPro AKCE Software Technology R&D Industry and Trade Inc. | 9.8 | Feb 2 | Time-Based Blind SQLi in AKCE Software's SKSPro |
| CVE-2024-5986 | H2 h2oai/h2o-3 h2oai | 9.1 | Feb 2 | Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3 |
| CVE-2024-2356 | PA parisneo/lollms-webui parisneo | 9.6 | Feb 2 | Remote Code Execution due to LFI in '/reinstall_extension' in parisneo/lollms-webui |
| CVE-2026-20418 | MC MediaTek chipset MediaTek, Inc. | 9.8 | Feb 2 | In Thread, there is a possible out of bounds write due to a missing bounds check |
| CVE-2026-20407 | MC MediaTek chipset MediaTek, Inc. | 9.3 | Feb 2 | In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check |
| CVE-2025-15030 | UP User Profile Builder | 9.8 | Feb 2 | User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset |
| CVE-2026-25202 | M9 MagicINFO 9 Server Samsung Electronics | 9.8 | Feb 2 | The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects MagicINFO 9 Server: less than… |
| CVE-2026-25200 | M9 MagicINFO 9 Server Samsung Electronics | 9.8 | Feb 2 | A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover This issue… |
| CVE-2026-1740 | IA ipTIME A8004T EFM | 9.8 | Feb 2 | EFM ipTIME A8004T Hidden Hiddenloginsetup timepro.cgi httpcon_check_session_url improper authentication |
| CVE-2026-25069 | PD Pironman Dashboard (pm_dashboard) SunFounder | 9.3 | Jan 31 | SunFounder Pironman Dashboard <= 1.3.13 Path Traversal Arbitrary File Read/Deletion |
| CVE-2020-37057 | ON Online-Exam-System sunnygkp10 | 9.8 | Jan 30 | Online-Exam-System 2015 - 'fid' SQL Injection |
| CVE-2020-37056 | HT http-protection Crystal Shard | 9.8 | Jan 30 | Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass |
| CVE-2020-37052 | AI AirControl Ubiquiti, Inc. | 9.8 | Jan 30 | AirControl 1.4.2 - PreAuth Remote Code Execution |
| CVE-2020-37050 | QP Quick Player M.J.M Soft | 9.8 | Jan 30 | Quick Player 1.3 - '.m3l' Buffer Overflow |
| CVE-2020-37043 | BM Bandwidth Monitor 10-Strike Software | 9.8 | Jan 30 | 10-Strike Bandwidth Monitor 3.9 - Buffer Overflow |
| CVE-2020-37027 | SI Sickbeard midgetspy | 9.8 | Jan 30 | Sickbeard 0.1 - Remote Command Injection |
| CVE-2019-25232 | NE NetPCLinker NetPCLinker | 9.8 | Jan 30 | NetPCLinker 1.0.0.0 - Buffer Overflow |
| CVE-2026-1723 | X6 X6000R TOTOLINK | 9.2 | Jan 30 | TOTOLINK X6000R Unauthenticated Command Injection Vulnerability |
| CVE-2026-25141 | OR orval orval-labs | 9.8 | Jan 30 | Orval has a code injection via unsanitized x-enum-descriptions uing JS comments |
| CVE-2026-25130 | CA cai aliasrobotics | 9.6 | Jan 30 | Cybersecurity AI vulnerable to command Injection through argument injection in find_file Agent tool |
| CVE-2026-1701 | SM School Management System itsourcecode | 9.8 | Jan 30 | itsourcecode School Management System index.php sql injection |
| CVE-2026-1688 | DM Directory Management System itsourcecode | 9.8 | Jan 30 | itsourcecode Directory Management System index.php sql injection |
| CVE-2025-7964 | SL Silicon Labs Zigbee Stack silabs.com | 9.2 | Jan 30 | Zigbee Router Denial of Service |
| CVE-2025-26385 | ME Metasys Johnson Controls | 9.5 | Jan 30 | Metasys product command injection vulnerability could allow remote SQL execution |
| CVE-2026-24729 | DR DreamMaker Internet Information Co., Ltd | 10.0 | Jan 30 | Interinfo DreamMaker - Unrestricted Upload of File with Dangerous Type |
| CVE-2026-24728 | DR DreamMaker Internet Information Co., Ltd | 9.3 | Jan 30 | Interinfo DreamMaker - Missing Authentication for Critical Function |
| CVE-2025-51958 | RU Runcommand Aelsantex | 9.8 | Jan 30 | aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugins/runcommand/postaction.php |
| CVE-2026-1340 In wildKEV | EM Endpoint Manager Mobile Ivanti | 9.8 | Jan 29 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability |
| CVE-2026-1281 In wildKEV | EM Endpoint Manager Mobile Ivanti | 9.8 | Jan 29 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability |