CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 07:38 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-15579 | DS Directory Services OpenText™ | 9.5 | Feb 18 | An Insecure Deserialization vulnerability has been discovered in OpenText™ Directory Services. |
| CVE-2026-2329 | GX GXP1610 Grandstream | 9.8 | Feb 18 | Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow |
| CVE-2026-2654 | SM smolagents huggingface | 9.8 | Feb 18 | huggingface smolagents LocalPythonExecutor requests.post server-side request forgery |
| CVE-2026-1435 | GW Graylog Web Interface Graylog | 9.8 | Feb 18 | Incorrect management of session invalidation vulnerability in Graylog Web Interface |
| CVE-2025-65791 | ZO Zoneminder Zoneminder | 9.8 | Feb 18 | ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php |
| CVE-2025-70149 | MM Membership Management System Codeastro | 9.8 | Feb 18 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter |
| CVE-2025-70998 | 8F 810 Firmware Utt | 9.8 | Feb 18 | UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote attacker to gain… |
| CVE-2025-70152 | ST Scholars Tracking System Fabian | 9.8 | Feb 18 | code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /admin/update_user.php |
| CVE-2025-70150 | MM Membership Management System Codeastro | 9.8 | Feb 18 | CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delete arbitrary member… |
| CVE-2025-70141 | CS Customer Support System Oretnom23 | 9.4 | Feb 18 | SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php |
| CVE-2025-70146 | OT Online Time Table Generator Projectworlds | 9.1 | Feb 18 | Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perform unauthorized… |
| CVE-2026-1670 | 2I 25M IPC Honeywell | 9.8 | Feb 17 | Honeywell CCTV Products Missing Authentication for Critical Function |
| CVE-2026-22769 In wildKEV | RF RecoverPoint for Virtual Machines Dell | 10.0 | Feb 17 | Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability |
| CVE-2025-33089 | CO Concert IBM | 9.8 | Feb 17 | Multiple Vulnerabilities in IBM Concert Software. |
| CVE-2025-66614 | TO Tomcat Apache | 9.1 | Feb 17 | Apache Tomcat: Client certificate verification bypass due to virtual host mapping |
| CVE-2026-23647 | RB RBG-100 Glory Global Solutions | 9.8 | Feb 17 | Glory RBG-100 Recycler System Hard-coded OS Credentials |
| CVE-2026-2616 | 77 777VR1 Beetel | 9.8 | Feb 17 | Beetel 777VR1 Web Management hard-coded credentials |
| CVE-2026-22208 | OP OpenS100 OpenS100 Project | 9.6 | Feb 17 | OpenS100 Portrayal Engine Unrestricted Lua Standard Library Access |
| CVE-2026-26220 | LI LightLLM ModelTC | 9.3 | Feb 17 | LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE |
| CVE-2025-70830 | Product not mapped yet | 9.9 | Feb 17 | A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via… |
| CVE-2025-59793 | TE Trufusion Enterprise Rocketsoftware | 9.9 | Feb 17 | Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files |
| CVE-2026-2439 | CO Concierge::Sessions BVA | 9.8 | Feb 16 | Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids |
| CVE-2025-15578 | MA Maypole TEEJAY | 9.8 | Feb 16 | Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely |
| CVE-2026-2550 | IA iptime A6004MX EFM | 9.8 | Feb 16 | EFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted upload |
| CVE-2026-2577 | NA nanobot HKUDS | 10.0 | Feb 16 | Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge |
| CVE-2026-2532 | DE DeepAudit lintsinghua | 9.8 | Feb 16 | lintsinghua DeepAudit IP Address embedding_config.py server-side request forgery |
| CVE-2026-2529 | WL WL-WN579A3 Wavlink | 9.8 | Feb 16 | Wavlink WL-WN579A3 wireless.cgi DeleteMac command injection |
| CVE-2026-2528 | WL WL-WN579A3 Wavlink | 9.8 | Feb 16 | Wavlink WL-WN579A3 wireless.cgi Delete_Mac_list command injection |
| CVE-2026-2527 | WL WL-WN579A3 Wavlink | 9.8 | Feb 16 | Wavlink WL-WN579A3 login.cgi command injection |
| CVE-2026-2522 | OP Open5GS Open5gs | 9.8 | Feb 15 | Open5GS MME esm-build.c memory corruption |
| CVE-2026-2521 | OP Open5GS Open5gs | 9.8 | Feb 15 | Open5GS SGW-C sgwc_s5c_handle_create_session_response memory corruption |
| CVE-2026-26366 | ES eNet SMART HOME server JUNG | 9.8 | Feb 15 | JUNG eNet SMART HOME server 2.2.1/2.3.1 Use of Default Credentials |
| CVE-2025-32058 | IS Infotainment system ECU Bosch | 9.3 | Feb 15 | Stack Overflow in processing requests over INC interface on RH850 side of Infotainment ECU |
| CVE-2026-1490 | SP Spam protection, Honeypot, Anti-Spam by CleanTalk cleantalk | 9.8 | Feb 15 | Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation |
| CVE-2025-8572 | TC Truelysell Core dreamstechnologies | 9.8 | Feb 14 | Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration |
| CVE-2026-1306 | MI midi-Synth adminkov | 9.8 | Feb 14 | midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action |
| CVE-2026-24853 | CA caido caido | 9.8 | Feb 13 | Caido has an insufficient patch for DNS rebind leading to RCE |
| CVE-2026-26273 | KN known idno | 9.8 | Feb 13 | Known affected by Account Takeover via Password Reset Token Leakage |
| CVE-2026-26333 | VE VeraSMART Calero | 9.8 | Feb 13 | Calero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE |
| CVE-2026-26335 | VE VeraSMART Calero | 9.8 | Feb 13 | Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE |
| CVE-2026-26190 | MI milvus milvus-io | 9.8 | Feb 13 | Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise |
| CVE-2026-26268 | CU cursor cursor | 9.9 | Feb 13 | Cursor sandbox escape via Git hooks |
| CVE-2026-26221 | OW OnBase Workflow Timer Service Hyland | 9.8 | Feb 13 | Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE |
| CVE-2026-23112 | KE Kernel Linux | 9.8 | Feb 13 | nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec |
| CVE-2025-69770 | Product not mapped yet | 10.0 | Feb 13 | A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file |
| CVE-2025-69633 | Product not mapped yet | 9.8 | Feb 13 | A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through 1.2.6 (Fixed in version 1.2.7) allows remote… |
| CVE-2019-25337 | OW OwnCloud OwnCloud | 9.8 | Feb 12 | OwnCloud 8.1.8 - Username Disclosure |
| CVE-2019-25327 | PR Prime95 Mersenne Research, Inc | 9.8 | Feb 12 | Prime95 Version 29.8 build 6 - Buffer Overflow (SEH) |
| CVE-2019-25321 | FN FTP Navigator Softpedia | 9.8 | Feb 12 | FTP Navigator 8.03 - Stack Overflow (SEH) |
| CVE-2019-25319 | DQ Domain Quester Pro Internet-Soft | 9.8 | Feb 12 | Domain Quester Pro 6.02 - Stack Overflow (SEH) |