CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 11:01 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2020-36944 | IL ILIAS Learning Management System ilias.de | 3.3 | Jan 28 | ILIAS Learning Management System 4.3 - SSRF |
| CVE-2026-23553 | XE Xen Xen | 2.9 | Jan 28 | x86: incomplete IBPB for vCPU isolation |
| CVE-2026-1237 | JU juju Canonical | 2.1 | Jan 28 | Vulnerable cross-model authorization in juju |
| CVE-2026-1520 | RE rethinkdb | 2.4 | Jan 28 | rethinkdb Secondary Index cross site scripting |
| CVE-2026-1485 | RH Red Hat Enterprise Linux 10 Red Hat | 2.8 | Jan 27 | Glib: glib: local denial of service via buffer underflow in content type parsing |
| CVE-2026-1444 | BO Books_Manager iJason-Liu | 2.4 | Jan 26 | iJason-Liu Books_Manager add_book_check.php cross site scripting |
| CVE-2025-9615 | RH Red Hat Enterprise Linux 10 Red Hat | 3.3 | Jan 26 | Networkmanager: networkmanager file access |
| CVE-2026-1190 | RH Red Hat build of Keycloak 26.4 Red Hat | 3.1 | Jan 26 | Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata |
| CVE-2025-57784 | HW Hiawatha Web server Hiawatha | 3.3 | Jan 26 | Tomahawk authentication timing attack due to usage of 'strcmp' |
| CVE-2026-24656 | AK Apache Karaf Apache Software Foundation | 3.7 | Jan 26 | Apache Karaf: Decanter log-socket collector has deserialization vulnerability |
| CVE-2026-1417 | GP GPAC Gpac | 3.3 | Jan 26 | GPAC filedump.c dump_isom_rtp null pointer dereference |
| CVE-2026-1416 | GP GPAC Gpac | 3.3 | Jan 26 | GPAC filedump.c DumpMovieInfo null pointer dereference |
| CVE-2026-1415 | GP GPAC Gpac | 3.3 | Jan 26 | GPAC media_export.c gf_media_export_webvtt_metadata null pointer dereference |
| CVE-2026-1406 | BO BootDo lcg0124 | 3.5 | Jan 25 | lcg0124 BootDo Host Header AccessControlFilter.java redirectToLogin |
| CVE-2026-0633 | MC MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor roxnor | 3.7 | Jan 24 | MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value |
| CVE-2026-22978 | KE Kernel Linux | 3.3 | Jan 23 | wifi: avoid kernel-infoleak from struct iw_point |
| CVE-2025-71148 | KE Kernel Linux | 3.3 | Jan 23 | net/handshake: restore destructor on submit failure |
| CVE-2026-24515 | LI libexpat libexpat project | 2.5 | Jan 23 | In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data |
| CVE-2026-0798 | GO Gitea Open Source Git Server Gitea | 3.5 | Jan 22 | Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation |
| CVE-2026-22411 | DO Dolcino Mikado-Themes | 3.8 | Jan 22 | WordPress Dolcino theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22409 | JU Justicia Mikado-Themes | 3.8 | Jan 22 | WordPress Justicia theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22407 | RO Roam Mikado-Themes | 3.8 | Jan 22 | WordPress Roam theme <= 2.1.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22406 | OV Overton Mikado-Themes | 3.8 | Jan 22 | WordPress Overton theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22404 | IN Innovio Mikado-Themes | 3.8 | Jan 22 | WordPress Innovio theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-47555 | TL Tutor LMS Themeum | 3.8 | Jan 22 | WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-12738 | EE Enterprise Edition neo4j | 1.3 | Jan 22 | Enumeration of restricted property value |
| CVE-2026-1225 | LO Logback-core QOS.CH Sarl | 1.8 | Jan 22 | Malicious logback.xml configuration file allows instantiation of arbitrary classes |
| CVE-2026-24048 | BA backstage backstage | 3.7 | Jan 21 | Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow` |
| CVE-2026-23996 | FA fastapi-api-key Athroniaeth | 3.7 | Jan 21 | FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection |
| CVE-2025-14083 | RH Red Hat build of Keycloak 26.4 Red Hat | 2.7 | Jan 21 | Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosure |
| CVE-2026-0988 | RH Red Hat Enterprise Linux 10 Red Hat | 3.7 | Jan 21 | Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek() |
| CVE-2026-1035 | RH Red Hat build of Keycloak 26.4 Red Hat | 3.1 | Jan 21 | Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition |
| CVE-2026-21977 | OZ Oracle Zero Data Loss Recovery Appliance Software Oracle Corporation | 3.1 | Jan 20 | Vulnerability in the Oracle Zero Data Loss Recovery Appliance Software product of Oracle Zero Data Loss Recovery Appliance (component: Security) |
| CVE-2026-21965 | MS MySQL Server Oracle Corporation | 2.7 | Jan 20 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth) |
| CVE-2026-21947 | OJ Oracle Java SE Oracle Corporation | 3.1 | Jan 20 | Vulnerability in Oracle Java SE (component: JavaFX) |
| CVE-2026-21930 | OZ Oracle ZFS Storage Appliance Kit Oracle Corporation | 2.3 | Jan 20 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems) |
| CVE-2026-21640 | RA Revive Adserver Revive | 2.7 | Jan 20 | HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings |
| CVE-2025-36411 | AP ApplinX IBM | 3.5 | Jan 20 | Multiple vulnerabilities found in IBM ApplinX. |
| CVE-2026-1197 | MI MineAdmin Mineadmin | 3.1 | Jan 20 | MineAdmin downloadById information disclosure |
| CVE-2026-23522 | LO lobe-chat lobehub | 3.7 | Jan 19 | Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion |
| CVE-2026-1161 | HR hrms pbrong | 3.5 | Jan 19 | pbrong hrms recruitment.go UpdateRecruitmentById cross site scripting |
| CVE-2026-1136 | BO BootDo lcg0124 | 3.5 | Jan 19 | lcg0124 BootDo ContentController save cross site scripting |
| CVE-2025-15535 | CL clay nicbarker | 3.3 | Jan 18 | nicbarker clay clay.h Clay__MeasureTextCached null pointer dereference |
| CVE-2026-0682 | CA Church Admin andy_moyle | 2.2 | Jan 17 | Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter |
| CVE-2026-0519 | SA Secure Access Absolute Security | 3.4 | Jan 17 | Information Disclosure in Secure Access Between 12.70 and 14.20 |
| CVE-2025-31186 | XC Xcode Apple | 3.3 | Jan 16 | A permissions issue was addressed with additional restrictions |
| CVE-2025-24090 | IO iOS Apple | 3.3 | Jan 16 | A permissions issue was addressed with additional restrictions |
| CVE-2024-44210 | MA macOS Apple | 3.3 | Jan 16 | This issue was addressed with improved permissions checking |
| CVE-2024-54556 | IO iOS Apple | 2.4 | Jan 16 | This issue was addressed through improved state management |
| CVE-2025-61873 | RT Request Tracker bestpractical | 2.6 | Jan 16 | Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used |