CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 05:57 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-1358 | AM Airleader Master Airleader GmbH | 9.8 | Feb 12 | Airleader Master Unrestricted Upload of File with Dangerous Type |
| CVE-2026-26011 | NA navigation2 ros-navigation | 9.8 | Feb 12 | Critical Heap Out-of-bounds Access in `pf_cluster_stats()` via Malicious /initialpose Covariance -- Potential Remote Code Execution |
| CVE-2026-25996 | IN inspektor-gadget inspektor-gadget | 9.8 | Feb 12 | Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode |
| CVE-2026-24895 | PH PHP PHP | 9.8 | Feb 12 | FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files |
| CVE-2026-24044 | ES ess-helm element-hq | 9.2 | Feb 12 | ESS Community Helm Chart has a weak server key generation method |
| CVE-2026-26219 | NE newbee-mall newbee-ltd | 9.1 | Feb 12 | newbee-mall Unsalted MD5 Password Hashing Enables Offline Credential Cracking |
| CVE-2026-26218 | NE newbee-mall newbee-ltd | 9.8 | Feb 12 | newbee-mall Default Seeded Administrator Credentials Allow Account Takeover |
| CVE-2026-26216 | CR Crawl4AI unclecode | 10.0 | Feb 12 | Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter |
| CVE-2025-14014 | SP Smart Panel NTN Information Processing Services Computer Software Hardware Industry and Trade Ltd. Co. | 9.8 | Feb 12 | Insecure File Upload in NTN Informatics' Smart Panel |
| CVE-2025-10969 | EP E-Commerce Package Farktor Software E-Commerce Services Inc. | 9.8 | Feb 12 | SQLi in Farktor Software's E-Commerce Package |
| CVE-2025-15573 | PW Pocket WiFi 3.0 SolaX Power | 9.4 | Feb 12 | Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud Connection |
| CVE-2025-14892 | PL Prime Listing Manager | 9.8 | Feb 12 | Prime Listing Manager <= 1.1 - Unauthenticated Privilege Escalation |
| CVE-2026-1729 | AD AdForest scriptsbundle | 9.8 | Feb 12 | AdForest <= 6.0.12 - Authentication Bypass |
| CVE-2025-70314 | WE Webfsd Ourway | 9.8 | Feb 12 | webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request |
| CVE-2025-70981 | CC Cordys Crm Fit2cloud | 9.8 | Feb 12 | CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter |
| CVE-2025-69634 | Product not mapped yet | 9.0 | Feb 12 | Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by… |
| CVE-2026-20677 | MA macOS Apple | 9.0 | Feb 11 | A race condition was addressed with improved handling of symbolic links |
| CVE-2026-26215 | MA manga-image-translator zyddnys | 9.3 | Feb 11 | manga-image-translator Shared API Unsafe Deserialization RCE |
| CVE-2026-26021 | SE set-in ahdinosaur | 9.8 | Feb 11 | Prototype pollution in set-in |
| CVE-2026-25994 | PJ pjproject pjsip | 9.8 | Feb 11 | PJSIP has a heap buffer overflow in ICE with long username |
| CVE-2020-37153 | AS ASTPP ASTPP | 9.8 | Feb 11 | ASTPP VoIP 4.0.1 - Remote Code Execution |
| CVE-2020-37186 | CH Chevereto Chevere SpA | 9.8 | Feb 11 | Chevereto 3.13.4 Core - Remote Code Execution |
| CVE-2020-37184 | AV Allok Video Converter Allok Soft | 9.8 | Feb 11 | Allok Video Converter 4.6.1217 - Stack Overflow (SEH) |
| CVE-2020-37183 | AR Allok RM RMVB to AVI MPEG DVD Converter Allok Soft | 9.8 | Feb 11 | Allok RM RMVB to AVI MPEG DVD Converter 3.6.1217 - Stack Overflow (SEH) |
| CVE-2020-37181 | TF Torrent FLV Converter TorrentRockYou | 9.8 | Feb 11 | Torrent FLV Converter 1.51 Build 117 - Stack Oveflow (SEH partial overwrite) |
| CVE-2020-37176 | T3 Torrent 3GP Converter Torrentrockyou | 9.8 | Feb 11 | Torrent 3GP Converter 1.51 - Stack Overflow (SEH) |
| CVE-2020-37172 | AP AVideo Platform AVideo | 9.8 | Feb 11 | AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset) |
| CVE-2026-24789 | ZL ZLAN5143D ZLAN Information Technology Co. | 9.8 | Feb 11 | ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function |
| CVE-2026-25084 | ZL ZLAN5143D ZLAN Information Technology Co. | 9.8 | Feb 11 | ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function |
| CVE-2026-2249 | MD METIS DFS METIS Cyberspace Technology SA | 9.8 | Feb 11 | Unauthenticated Remote Command Execution via Web Console in METIS DFS |
| CVE-2026-2248 | MW METIS WIC METIS Cyberspace Technology SA | 9.8 | Feb 11 | Unauthenticated Remote Root Shell Access via Web Console in METIS WIC |
| CVE-2025-12059 | LJ Logo j-Platform Logo Software Industry and Trade Inc. | 9.8 | Feb 11 | Improper Access Control in Logo Software's Logo j-Platform |
| CVE-2025-8668 | TU Turboard E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. | 9.4 | Feb 11 | Reflected XSS in E-Kalite Software Hardware Engineering's Turboard |
| CVE-2025-8025 | DE Dinosoft ERP Dinosoft Business Solutions | 9.8 | Feb 11 | Improper Access Control in Dinosoft Business Solutions' Dinosoft ERP |
| CVE-2025-66277 | QT QTS QNAP Systems Inc. | 9.8 | Feb 11 | QTS, QuTS hero |
| CVE-2025-7659 | GI GitLab GitLab | 9.1 | Feb 11 | Origin Validation Error in GitLab |
| CVE-2026-1357 | WB WPvivid — Backup, Migration & Staging wpvividplugins | 9.8 | Feb 11 | Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload |
| CVE-2025-64075 | Product not mapped yet | 10.0 | Feb 11 | A path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authentication and perform… |
| CVE-2025-67135 | Product not mapped yet | 9.8 | Feb 11 | Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack |
| CVE-2025-70085 | OP Opensatkit Opensatkit | 9.8 | Feb 11 | An issue was discovered in OpenSatKit 2.2.1 |
| CVE-2025-69874 | NA Nanotar Unjs | 9.8 | Feb 11 | nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction… |
| CVE-2025-69872 | RH Red Hat AI Inference Server Red Hat | 9.8 | Feb 11 | DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default |
| CVE-2026-26009 | CA catalyst karutoil | 9.9 | Feb 10 | Catalyst Affected by Remote Code Execution as Root via Containerized Install Script Execution |
| CVE-2026-21531 | AA Azure AI Language Authoring Microsoft | 9.8 | Feb 10 | Azure SDK for Python Remote Code Execution Vulnerability |
| CVE-2026-25993 | EV evershop evershopcommerce | 9.8 | Feb 10 | EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys |
| CVE-2025-52436 | FO FortiSandbox Fortinet | 9.6 | Feb 10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1,… |
| CVE-2026-1774 | CA CASL Ability CASL Ability | 9.8 | Feb 10 | CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability. |
| CVE-2026-23906 | AD Apache Druid Apache Software Foundation | 9.8 | Feb 10 | Apache Druid: Authentication Bypass via LDAP Anonymous Bind |
| CVE-2025-11242 | OK Okulistik Teknolist Computer Systems Software Publishing Industry and Trade Inc. | 9.8 | Feb 10 | SSRF in Teknolist Computer's Okulistik |
| CVE-2026-2096 | AG Agentflow Flowring | 9.8 | Feb 10 | Flowring｜Agentflow - Missing Authenticaton |