CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 18:29 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-2889 | CC CCExtractor | 3.3 | Feb 21 | CCExtractor mp4.c processmp4 use after free |
| CVE-2026-27467 | BI bigbluebutton bigbluebutton | 2.4 | Feb 21 | BigBlueButton: Audio from participants to the server initially unmuted |
| CVE-2019-25447 | OR OrientDB Orientdb | 3.5 | Feb 20 | OrientDB 3.0.17 Cross-Site Request Forgery |
| CVE-2026-22885 | SI SmartServer IoT EnOcean Edge Inc | 3.7 | Feb 20 | EnOcean SmartServer IoT Out-of-bounds Read |
| CVE-2025-52603 | CO Connections HCLSoftware | 3.5 | Feb 20 | HCL Connections is vulnerable to information disclosure |
| CVE-2025-14055 | SS Simplicity SDK, Gecko SDK silabs.com | 2.4 | Feb 20 | Integer underflow in Secure NCP host |
| CVE-2025-14547 | GS Gecko SDK silabs.com | 2.3 | Feb 20 | ECJ-PAKE Integer Underflow Vulnerability in Silicon Labs PSA Crypto and SE Manager APIs |
| CVE-2026-21620 | OT OTP Erlang | 2.3 | Feb 20 | TFTP Path Traversal |
| CVE-2026-2825 | WW WeRSS we-mp-rss rachelos | 3.5 | Feb 20 | rachelos WeRSS we-mp-rss Article fix.py fix_html cross site scripting |
| CVE-2026-26964 | WI windmill windmill-labs | 2.7 | Feb 19 | Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members |
| CVE-2026-27007 | OP openclaw openclaw | 3.3 | Feb 19 | OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation |
| CVE-2026-26958 | FI filippo.io/edwards25519 FiloSottile | 1.7 | Feb 19 | filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity |
| CVE-2026-24122 | CO cosign sigstore | 3.7 | Feb 19 | Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked |
| CVE-2026-25423 | R3 Real 3D FlipBook creativeinteractivemedia | 3.8 | Feb 19 | WordPress Real 3D FlipBook plugin <= 4.19.1 - Broken Access Control vulnerability |
| CVE-2026-2733 | RH Red Hat Build of Keycloak Red Hat | 3.8 | Feb 19 | Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol |
| CVE-2026-2709 | BU busy | 3.5 | Feb 19 | busy Callback app.js redirect |
| CVE-2025-14270 | OC OneClick Chat to Order walterpinem | 2.7 | Feb 19 | OneClick Chat to Order <= 1.0.9 - Missing Authorization to Authenticated (Editor+) Plugin Settings Update |
| CVE-2026-2702 | 77 777VR1 Beetel | 3.1 | Feb 19 | Beetel 777VR1 WPA2 PSK hard-coded credentials |
| CVE-2026-25120 | GO gogs gogs | 2.7 | Feb 19 | Gogs Allows Cross-Repository Comment Deletion via DeleteComment |
| CVE-2026-24764 | CL clawdbot clawdbot | 3.7 | Feb 19 | OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions |
| CVE-2025-8860 | Product not mapped yet | 3.3 | Feb 18 | Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback |
| CVE-2026-2656 | CH ChaiScript | 2.5 | Feb 18 | ChaiScript type_info.hpp bare_equal use after free |
| CVE-2026-2655 | CH ChaiScript | 2.5 | Feb 18 | ChaiScript chaiscript_defines.hpp operator use after free |
| CVE-2026-1582 | WA WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel soflyy | 3.7 | Feb 18 | WP All Export <= 1.4.14 - Unauthenticated Sensitive Information Exposure via PHP Type Juggling |
| CVE-2026-1831 | YW YayMail – WooCommerce Email Customizer yaycommerce | 2.7 | Feb 18 | YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation |
| CVE-2026-2419 | WP WP-DownloadManager gamerz | 2.7 | Feb 18 | WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' Parameter |
| CVE-2026-2642 | TH the_silver_searcher ggreer | 3.3 | Feb 18 | ggreer the_silver_searcher search.c search_stream null pointer dereference |
| CVE-2026-2641 | CT ctags universal-ctags | 3.3 | Feb 18 | universal-ctags V Language v.c parseExprList recursion |
| CVE-2025-36183 | WA watsonx.data IBM | 2.7 | Feb 17 | Privileged User File Upload Vulnerability Leading to Limited Server-Side Execution affects watsonx.data |
| CVE-2026-0102 | ME Microsoft Edge (Chromium-based) Microsoft | 3.1 | Feb 17 | Microsoft Edge (Chromium-based) Defense in Depth Vulnerability |
| CVE-2026-24733 | TO Tomcat Apache | 3.7 | Feb 17 | Apache Tomcat: Security constraint bypass with HTTP/0.9 |
| CVE-2024-55271 | GM Gym Management System Phpgurukul | 3.5 | Feb 17 | A Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym Management System 1.0 |
| CVE-2025-14573 | MA Mattermost Mattermost | 2.7 | Feb 16 | Team Admin Bypass of Invite Permissions via allow_open_invite Field |
| CVE-2026-2543 | VI vichan vichan-devel | 2.7 | Feb 16 | vichan-devel vichan Password Change pages.php unverified password change |
| CVE-2026-20796 | MA Mattermost Mattermost | 3.1 | Feb 13 | Time-of-check time-of-use vulnerability in common teams API |
| CVE-2026-0872 | SA SafeNet Agent for Windows Logon Thalesgroup | 2.5 | Feb 13 | Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon |
| CVE-2026-20681 | MA macOS Apple | 3.3 | Feb 11 | A privacy issue was addressed with improved private data redaction for log entries |
| CVE-2026-20642 | IO iOS Apple | 2.4 | Feb 11 | An input validation issue was addressed |
| CVE-2026-20663 | IO iOS Apple | 3.3 | Feb 11 | The issue was resolved by sanitizing logging |
| CVE-2026-20601 | MA macOS Apple | 3.3 | Feb 11 | A permissions issue was addressed with additional restrictions |
| CVE-2026-20656 | MA macOS Apple | 3.3 | Feb 11 | A logic issue was addressed with improved validation |
| CVE-2026-20646 | MA macOS Apple | 3.3 | Feb 11 | A logging issue was addressed with improved data redaction |
| CVE-2026-20671 | MA macOS Apple | 3.1 | Feb 11 | A logic issue was addressed with improved checks |
| CVE-2026-0228 | PA PAN-OS Palo Alto Networks | 1.3 | Feb 11 | PAN-OS: Improper Validation of Terminal Server Agent Certificate |
| CVE-2026-2345 | SE Secure Exam Proctor Extension Proctorio | 3.6 | Feb 11 | Insufficient Origin Validation in Proctorio Chrome Extension postMessage Handlers |
| CVE-2025-14594 | GI GitLab GitLab | 3.5 | Feb 11 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2025-69873 | AJ ajv ajv.js | 2.9 | Feb 11 | ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled |
| CVE-2026-26013 | LA langchain langchain-ai | 3.7 | Feb 10 | LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages |
| CVE-2026-1762 | EN Enervista GE Vernova | 2.9 | Feb 10 | Enervista UR Setup Directory Traversal Vulnerability |
| CVE-2021-26410 | AR AMD Radeon™ PRO V520 AMD | 1.8 | Feb 10 | Improper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memory space allowing an attacker to infer… |