CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 10:12 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-0989 | RH Red Hat Enterprise Linux 10 Red Hat | 3.7 | Jan 15 | Libxml2: unbounded relaxng include recursion leading to stack overflow |
| CVE-2026-0976 | RH Red Hat Build of Keycloak Red Hat | 3.7 | Jan 15 | Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths |
| CVE-2025-14058 | IT Idea Tab Pro TB373FU Lenovo | 3.2 | Jan 14 | A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Control Center settings… |
| CVE-2026-22819 | OU outray akinloluwami | 3.1 | Jan 14 | Outray has a Race Condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts |
| CVE-2026-22820 | OU outray akinloluwami | 3.7 | Jan 14 | Outray cli is vulnerable to race conditions in tunnels creation |
| CVE-2025-58409 | GD Graphics DDK Imagination Technologies | 3.5 | Jan 13 | GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory |
| CVE-2025-67685 | FO FortiSandbox Fortinet | 3.8 | Jan 13 | A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSandbox 4.2 all… |
| CVE-2026-0510 | NA NW AS Java UME User Mapping SAP_SE | 3.0 | Jan 13 | Obsolete Encryption Algorithm Used in NW AS Java UME User Mapping |
| CVE-2026-0504 | SI SAP Identity Management SAP_SE | 3.8 | Jan 13 | Insufficient Input Handling in JNDI Operations of SAP Identity Management |
| CVE-2025-15506 | OP OpenColorIO AcademySoftwareFoundation | 3.3 | Jan 11 | AcademySoftwareFoundation OpenColorIO FileRules.cpp ConvertToRegularExpression out-of-bounds |
| CVE-2025-15505 | XW XWR-600 Luxul | 2.4 | Jan 11 | Luxul XWR-600 Web Administration cross site scripting |
| CVE-2026-0824 | UI ui questdb | 3.5 | Jan 10 | questdb ui Web Console cross site scripting |
| CVE-2025-53470 | AM Apache Mynewt NimBLE Apache Software Foundation | 3.1 | Jan 10 | Apache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver |
| CVE-2026-22611 | AW aws-sdk-net aws | 3.7 | Jan 10 | AWS SDK for .NET V4 adopted defense in depth enhancement for region parameter value |
| CVE-2026-22597 | GH Ghost TryGhost | 2.7 | Jan 10 | Ghost has SSRF via External Media Inliner |
| CVE-2026-22602 | OP openproject opf | 3.5 | Jan 10 | OpenProject is Vulnerable to User Enumeration via User ID |
| CVE-2026-22025 | CR CryptoLib nasa | 3.7 | Jan 10 | CryptoLib Memory Leak on HTTP Error Response in KMC Client |
| CVE-2025-62487 | CO com.palantir.acme:dossier-app Palantir | 3.5 | Jan 9 | Under certain configurations, file artifacts uploaded to the Dossier and Slides apps did not inherit security markings of their parent artifact. This lack of security markings could lead to unintended access to the uploaded files. |
| CVE-2025-3950 | GI GitLab GitLab | 3.5 | Jan 9 | Exposure of Private Personal Information to an Unauthorized Actor in GitLab |
| CVE-2026-20972 | SM Samsung Mobile Devices Samsung Mobile | 3.3 | Jan 9 | Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB |
| CVE-2026-22714 | MM Mediawiki - Monaco Skin The Wikimedia Foundation | 2.3 | Jan 8 | i18n XSS, DoS and config SQLI in Monaco |
| CVE-2026-0747 | RD Remote Desktop Manager Devolutions | 3.3 | Jan 8 | Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows allows an external… |
| CVE-2025-15224 | CU curl curl | 3.1 | Jan 8 | libssh key passphrase bypass without agent set |
| CVE-2025-62224 | ME Microsoft Edge for Android Microsoft | 3.5 | Jan 7 | Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability |
| CVE-2025-12958 | RS Rankology SEO and Analytics Tool rankology | 2.7 | Jan 7 | Rankology SEO and Analytics Tool <= 2.0 - Incorrect Authorization to Authenticated (Editor+) Header & Footer Code Creation |
| CVE-2025-31963 | BI BigFix IVR HCLSoftware | 3.3 | Jan 7 | HCL BigFix IVR is impacted by improper authentication and missing CSRF protection |
| CVE-2025-9543 | FL FlexTable | 3.5 | Jan 5 | FlexTable Google Sheets Connector < 3.19.2 - Admin+ Stored XSS |
| CVE-2025-15454 | LE lettura zhanglun | 3.1 | Jan 5 | zhanglun lettura RSS ContentRender.tsx cross site scripting |
| CVE-2025-62840 | H3 HBS 3 Hybrid Backup Sync QNAP Systems Inc. | 3.3 | Jan 2 | HBS 3 Hybrid Backup Sync |
| CVE-2025-69412 | ME messagelib KDE | 3.4 | Dec 31 | KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing of threat data |
| CVE-2019-25262 | RA Razgover elinicksic | 3.5 | Dec 31 | elinicksic Razgover Chat Message send.php cross site scripting |
| CVE-2025-11964 | LI libpcap The Tcpdump Group | 1.9 | Dec 31 | OOBW in utf_16le_to_utf_8_truncated() in libpcap |
| CVE-2025-11961 | LI libpcap The Tcpdump Group | 1.9 | Dec 31 | OOBR and OOBW in pcap_ether_aton() in libpcap |
| CVE-2025-14986 | TE Temporal Temporal | 1.3 | Dec 30 | ExecuteMultiOperation Namespace Policy Bypass |
| CVE-2025-15249 | WO work_platform zhujunliang3 | 3.5 | Dec 30 | zhujunliang3 work_platform Content cross site scripting |
| CVE-2025-15248 | P商 product-review 商品评价系统 sunhailin12315 | 3.5 | Dec 30 | sunhailin12315 product-review 商品评价系统 Write a Review cross site scripting |
| CVE-2025-15245 | DC DCS-850L D-Link | 3.3 | Dec 30 | D-Link DCS-850L Firmware Update Service uploadfirmware path traversal |
| CVE-2025-69015 | CF Crowdsignal Forms Automattic | 3.8 | Dec 30 | WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability |
| CVE-2025-15244 | PH PHPEMS Phpems | 3.7 | Dec 30 | PHPEMS Purchase Request race condition |
| CVE-2025-15242 | PH PHPEMS Phpems | 3.1 | Dec 30 | PHPEMS Coupon race condition |
| CVE-2025-15241 | CE Community Edition CloudPanel | 3.5 | Dec 30 | CloudPanel Community Edition HTTP Header users redirect |
| CVE-2025-15284 | QS QS QS Project | 3.7 | Dec 29 | arrayLimit bypass in bracket notation allows DoS via memory exhaustion |
| CVE-2025-66861 | BI Binutils Gnu | 2.5 | Dec 29 | An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file |
| CVE-2025-15151 | LI Lin-CMS TaleLin | 3.7 | Dec 28 | TaleLin Lin-CMS Tests Folder config.py password in configuration file |
| CVE-2025-15149 | EC ecms rawchen | 2.4 | Dec 28 | rawchen ecms Add New Product updateProductServlet.java updateProductServlet cross site scripting |
| CVE-2025-15141 | HA Halo Halo | 3.1 | Dec 28 | Halo Configuration actuator information disclosure |
| CVE-2025-15134 | MO MOOC yourmaileyes | 3.5 | Dec 28 | yourmaileyes MOOC Submission MainController.java subreview cross site scripting |
| CVE-2025-15125 | JE JeecgBoot | 3.1 | Dec 28 | JeecgBoot queryDepartPermission improper authorization |
| CVE-2025-15124 | JE JeecgBoot | 3.1 | Dec 28 | JeecgBoot list getParameterMap improper authorization |
| CVE-2025-15123 | JE JeecgBoot | 3.1 | Dec 28 | JeecgBoot datarule improper authorization |