CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 11:58 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2020-37079 | WF Wing FTP Server Wing FTP Server | 3.5 | Feb 6 | Wing FTP Server < 6.2.7 - Cross-site Request Forgery |
| CVE-2026-25764 | OP openproject opf | 3.5 | Feb 6 | OpenProject vulnerable to Stored HTML injection |
| CVE-2026-2069 | LL llama.cpp ggml-org | 3.3 | Feb 6 | ggml-org llama.cpp GBNF Grammar llama-grammar.cpp llama_grammar_advance_stack stack-based overflow |
| CVE-2025-15320 | TC Tanium Client Tanium | 3.3 | Feb 6 | Tanium addressed a denial of service vulnerability in Tanium Client. |
| CVE-2026-22254 | WI winter wintercms | 3.5 | Feb 6 | Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager |
| CVE-2026-1990 | OA oatpp | 3.3 | Feb 6 | oatpp Type.hpp ObjectWrapper null pointer dereference |
| CVE-2025-68157 | WE webpack webpack | 3.7 | Feb 5 | webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects |
| CVE-2025-68458 | WE webpack webpack | 3.7 | Feb 5 | webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior |
| CVE-2026-25815 | FO FortiOS Fortinet | 3.2 | Feb 5 | Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 through 2026 (by… |
| CVE-2025-15321 | TA Tanium Appliance Tanium | 2.7 | Feb 5 | Tanium addressed an improper input validation vulnerability in Tanium Appliance. |
| CVE-2025-15323 | TA Tanium Appliance Tanium | 3.7 | Feb 5 | Tanium addressed an improper certificate validation vulnerability in Tanium Appliance. |
| CVE-2025-15289 | IN Interact Tanium | 3.1 | Feb 5 | Tanium addressed an improper access controls vulnerability in Interact. |
| CVE-2020-37148 | FN FNIP-4xSH P5 | 3.5 | Feb 5 | P5 FNIP-8x16A/FNIP-4xSH 1.0.20, 1.0.11 - Stored Cross-Site Scripting (XSS) |
| CVE-2020-37118 | FN FNIP-8x16A P5 | 3.5 | Feb 5 | P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin) |
| CVE-2026-1966 | YA YugabyteDB Anywhere YugabyteDB Inc | 2.4 | Feb 5 | YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI |
| CVE-2025-22873 | OS os Go standard library | 3.8 | Feb 4 | Improper access to parent directory of root in os |
| CVE-2025-2134 | JR Jazz Reporting Service IBM | 3.5 | Feb 4 | IBM Jazz Reporting Service Denial of Service |
| CVE-2025-27550 | JR Jazz Reporting Service IBM | 3.5 | Feb 4 | IBM Jazz Reporting Service Information Disclosure |
| CVE-2025-1823 | JR Jazz Reporting Service IBM | 3.5 | Feb 4 | IBM Jazz Reporting Service Denial of Service |
| CVE-2026-25517 | WA wagtail wagtail | 2.7 | Feb 4 | Wagtail has improper permission handling on admin preview endpoints |
| CVE-2026-20730 | BE BIG-IP Edge Client F5 | 3.3 | Feb 4 | BIG-IP Edge Client for Windows vulnerability |
| CVE-2026-1791 | OA Operation and Maintenance Security Gateway Hillstone Networks | 2.7 | Feb 4 | Arbitrary File Upload Vulnerability in Operation and Maintenance Security Gateway |
| CVE-2026-24513 | IN ingress-nginx Kubernetes | 3.1 | Feb 3 | ingress-nginx auth-url protection bypass |
| CVE-2026-25224 | FA fastify fastify | 3.7 | Feb 3 | Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream |
| CVE-2025-11598 | MO mObywatel Centralny Ośrodek Informatyki | 1.0 | Feb 3 | Exposure of Confidential Information in mObywatel application |
| CVE-2025-58381 | FO Fabric OS Brocade | 2.3 | Feb 3 | Directory transversal vulnerability in Brocade Fabric OS before 9.2.1c2 and 9.2.2 through 9.2.2a using various shell commands |
| CVE-2025-58380 | FO Fabric OS Brocade | 2.3 | Feb 3 | Directory transversal vulnerability in Brocade Fabric OS before 9.2.1 using grep command |
| CVE-2026-24934 | AD ADM ASUSTOR | 3.7 | Feb 3 | An improper certificate validation vulnerability was found in ADM while querying an external server for the device's WAN IP address. |
| CVE-2025-67482 | LU luasandbox Wikimedia Foundation | 1.7 | Feb 3 | Lua segfault in unpack() |
| CVE-2025-61653 | TE TextExtracts Wikimedia Foundation | 2.7 | Feb 3 | Extension:TextExtracts does not check for authorizeRead when returning extracts |
| CVE-2025-61652 | DI DiscussionTools Wikimedia Foundation | 2.7 | Feb 3 | Action API discussiontoolspageinfo does not check for authorizeRead for the page |
| CVE-2025-61649 | CH CheckUser Wikimedia Foundation | 1.1 | Feb 3 | UserInfoCard: Check that performing user has permission to view log entries for number of past blocks |
| CVE-2025-61650 | CH CheckUser Wikimedia Foundation | 1.1 | Feb 3 | UserInfoCard is vulnerable to message key stored XSS |
| CVE-2025-61647 | CH CheckUser Wikimedia Foundation | 0.4 | Feb 3 | UserInfoCard: Don't allow access to information about users who are suppressed if you don't have suppressor rights |
| CVE-2025-61634 | ME MediaWiki Wikimedia Foundation | 3.1 | Feb 2 | HTML rest endpoint needs PoolCounter and proper parser cache check |
| CVE-2025-6589 | ME MediaWiki Wikimedia Foundation | 2.1 | Feb 2 | With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList |
| CVE-2025-6592 | AB AbuseFilter Wikimedia Foundation | 2.1 | Feb 2 | Creating a permanent account from a temporary account associates temp username and IP address with real username in AbuseLog |
| CVE-2025-6593 | ME MediaWiki Wikimedia Foundation | 2.1 | Feb 2 | "{{SITENAME}} registered email address has been changed" email sent to unverified email addresses |
| CVE-2025-6927 | ME MediaWiki Wikimedia Foundation | 2.3 | Feb 2 | Autoblocks from global account suppressions are publicly visible |
| CVE-2025-36194 | PH PowerVM Hypervisor IBM | 3.3 | Feb 2 | This Power System update is being released to address |
| CVE-2026-1703 | PI pip Python Packaging Authority | 2.0 | Feb 2 | Limited path traversal when installing wheel archives |
| CVE-2026-1751 | GI GitLab GitLab | 3.1 | Feb 2 | Missing Authorization in GitLab |
| CVE-2025-13881 | RH Red Hat build of Keycloak 26.4 Red Hat | 2.7 | Feb 2 | Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api |
| CVE-2026-1743 | AI Air DJI | 3.1 | Feb 2 | DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay |
| CVE-2026-1705 | DS DSL-6641K D-Link | 2.4 | Jan 30 | D-Link DSL-6641K Web ad_virtual_server_vdsl cross site scripting |
| CVE-2025-15497 | OP OpenVPN OpenVPN | 3.8 | Jan 30 | Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of service |
| CVE-2026-25211 | LS Llama Stack llamastack | 3.2 | Jan 30 | Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log |
| CVE-2026-25046 | KI kimi-agent-sdk MoonshotAI | 2.9 | Jan 29 | [Kimi VS Code] Command Injection in publish scripts vsix-publish.js and ovsx-publish.js |
| CVE-2026-1588 | JS jshERP jishenghua | 2.7 | Jan 29 | jishenghua jshERP installByPath install path traversal |
| CVE-2025-53869 | MM Multiple MFPs Brother Industries, Ltd. | 3.7 | Jan 29 | Multiple MFPs provided by Brother Industries, Ltd |