CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 15:29 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-69337 | WC Wolmart Core don-themes | 9.3 | Feb 20 | WordPress Wolmart Core plugin <= 1.9.6 - SQL Injection vulnerability |
| CVE-2025-69329 | PR Prestige Jthemes | 9.8 | Feb 20 | WordPress Prestige theme < 1.4.1 - PHP Object Injection vulnerability |
| CVE-2025-69310 | WC Woodly Core TeconceTheme | 9.3 | Feb 20 | WordPress Woodly Core plugin <= 1.4 - SQL Injection vulnerability |
| CVE-2025-69309 | SC Saasplate Core TeconceTheme | 9.3 | Feb 20 | WordPress Saasplate Core plugin <= 1.2.8 - SQL Injection vulnerability |
| CVE-2025-69308 | NC Nestbyte Core TeconceTheme | 9.3 | Feb 20 | WordPress Nestbyte Core plugin <= 1.2 - SQL Injection vulnerability |
| CVE-2025-69307 | MC Medinik Core TeconceTheme | 9.3 | Feb 20 | WordPress Medinik Core plugin <= 1.3.6 - SQL Injection vulnerability |
| CVE-2025-69306 | EC Electio Core TeconceTheme | 9.3 | Feb 20 | WordPress Electio Core plugin <= 1.4 - SQL Injection vulnerability |
| CVE-2025-69305 | CC Crete Core TeconceTheme | 9.3 | Feb 20 | WordPress Crete Core plugin <= 1.4.3 - SQL Injection vulnerability |
| CVE-2025-69304 | AL Allmart TeconceTheme | 9.3 | Feb 20 | WordPress Allmart plugin <= 1.1 - SQL Injection vulnerability |
| CVE-2025-69301 | PH PhotoMe ThemeGoods | 9.8 | Feb 20 | WordPress PhotoMe theme <= 5.6.11 - PHP Object Injection vulnerability |
| CVE-2025-69295 | CC Coven Core TeconceTheme | 9.3 | Feb 20 | WordPress Coven Core plugin <= 1.3 - SQL Injection vulnerability |
| CVE-2025-68549 | WI Wiguard zozothemes | 9.9 | Feb 20 | WordPress Wiguard theme < 2.0.1 - Arbitrary File Upload vulnerability |
| CVE-2025-68541 | IP Ippsum BoldThemes | 9.8 | Feb 20 | WordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerability |
| CVE-2025-67997 | TR Travelicious BoldThemes | 9.8 | Feb 20 | WordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerability |
| CVE-2025-67996 | NE Nestin BoldThemes | 9.8 | Feb 20 | WordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerability |
| CVE-2025-67995 | PA PatioTime LoftOcean | 9.8 | Feb 20 | WordPress PatioTime theme < 2.1 - PHP Object Injection vulnerability |
| CVE-2025-67979 | WG WPForms Google Sheet Connector WesternDeal | 9.9 | Feb 20 | WordPress WPForms Google Sheet Connector plugin <= 4.0.1 - Remote Code Execution (RCE) vulnerability |
| CVE-2026-21627 | AC Advanced Custom Fields tassos.gr | 9.5 | Feb 20 | Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla |
| CVE-2025-10970 | TA Talentics Kolay Software Inc. | 9.8 | Feb 20 | SQLi in Kolay Software's Talentics |
| CVE-2026-26988 | LI librenms librenms | 9.1 | Feb 20 | LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream |
| CVE-2026-26974 | SL Slyde Tygo-van-den-Hurk | 9.8 | Feb 20 | Sylde has Improper Control of Generation of Code |
| CVE-2025-30416 | AC Acronis Cyber Protect 15 Acronis | 10.0 | Feb 20 | Sensitive data disclosure and manipulation due to missing authorization |
| CVE-2025-30410 | AC Acronis Cyber Protect 15 Acronis | 9.8 | Feb 20 | Sensitive data disclosure and manipulation due to missing authentication |
| CVE-2025-30412 | AC Acronis Cyber Protect 15 Acronis | 10.0 | Feb 20 | Sensitive data disclosure and manipulation due to improper authentication |
| CVE-2025-30411 | AC Acronis Cyber Protect 15 Acronis | 10.0 | Feb 20 | Sensitive data disclosure and manipulation due to improper authentication |
| CVE-2021-35402 | PR PRC2402M PROLiNK | 10.0 | Feb 20 | PROLiNK PRC2402M 20190909 before 2021-06-13 allows live_api.cgi?page=satellite_list OS command injection via shell metacharacters in the ip parameter (for satellite_status) |
| CVE-2026-26725 | PS Print Shop Pro Webdesk Edubusinesssolutions | 9.8 | Feb 20 | An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76) allows a remote attacker to escalate privileges via the AccessID parameter |
| CVE-2025-70831 | SM Smanga Lkw199711 | 9.8 | Feb 20 | A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface |
| CVE-2025-70833 | SM Smanga Lkw199711 | 9.4 | Feb 20 | An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the… |
| CVE-2026-26722 | GF Global Facilities Management Software Keystorage | 9.4 | Feb 20 | An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to escalate privileges via PIN component of the login functionality |
| CVE-2026-26747 | MO Monica Monicahq | 9.1 | Feb 20 | A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default… |
| CVE-2026-27002 | OP openclaw openclaw | 9.8 | Feb 19 | OpenClaw: Docker container escape via unvalidated bind mount config injection |
| CVE-2026-27476 | RU RustFly Bixat | 9.8 | Feb 19 | RustFly 2.0.0 Command Injection via UDP Remote Control |
| CVE-2026-26057 | SK skill-scanner cisco-ai-defense | 9.1 | Feb 19 | Skill Scanner Unsecured Network Binding Vulnerability |
| CVE-2026-2409 | CS Cloud Suite Delinea | 9.3 | Feb 19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument Injection.This issue affects Cloud Suite:… |
| CVE-2026-26339 | AC Alfresco Community (Transform Core) Hyland | 9.8 | Feb 19 | Hyland Alfresco Transformation Service Argument Injection RCE |
| CVE-2026-26338 | AC Alfresco Community (Transform Core) Hyland | 9.8 | Feb 19 | Hyland Alfresco Transformation Service SSRF |
| CVE-2026-26030 | SE semantic-kernel microsoft | 9.9 | Feb 19 | Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution |
| CVE-2025-71243 | SP Saisies pour formulaire SPIP | 9.8 | Feb 19 | SPIP Saisies Plugin < 5.11.1 Remote Code Execution |
| CVE-2025-9953 | DA Databank Accreditation Software DATABASE Software Training Consulting Ltd. | 9.8 | Feb 19 | SQLi in Database Software's Databank Accreditation Software |
| CVE-2025-8350 | BC BiEticaret CMS Inrove Software and Internet Services | 9.8 | Feb 19 | Authentication Bypass with Redirect in BiEticaret Software's BiEticaret CMS |
| CVE-2025-15559 | WO WorkTime (on-prem/cloud) NesterSoft Inc. | 9.8 | Feb 19 | Unauthenticated OS Command Injection in NesterSoft WorkTime |
| CVE-2026-23549 | WP WpEvently magepeopleteam | 9.8 | Feb 19 | WordPress WpEvently plugin <= 5.1.1 - PHP Object Injection vulnerability |
| CVE-2026-23542 | GR Grand Restaurant ThemeGoods | 9.8 | Feb 19 | WordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerability |
| CVE-2026-1994 | SE s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions clavaque | 9.8 | Feb 19 | s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2026-2731 | D9 DynamicWeb 9 DynamicWeb | 10.0 | Feb 19 | Unauthenticated RCE in Dynamicweb 9 and Dynamicweb 8 |
| CVE-2025-13851 | BU Buyent scriptsbundle | 9.8 | Feb 19 | Buyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration |
| CVE-2026-0926 | PC Prodigy Commerce prodigycommerce | 9.8 | Feb 19 | Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name] |
| CVE-2025-13563 | LL Lizza LMS Pro BuddhaThemes | 9.8 | Feb 19 | Lizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation |
| CVE-2026-1405 | SF Slider Future franchidesign | 9.8 | Feb 19 | Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload |