CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 22:42 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-0509 | SN SAP NetWeaver Application Server ABAP and ABAP Platform SAP_SE | 9.6 | Feb 10 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform |
| CVE-2026-0488 | SC SAP CRM and SAP S/4HANA (Scripting Editor) SAP_SE | 9.9 | Feb 10 | Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor) |
| CVE-2026-25895 | FU FUXA frangoteam | 9.8 | Feb 9 | FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API |
| CVE-2026-25894 | FU FUXA frangoteam | 9.8 | Feb 9 | FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration |
| CVE-2026-25893 | FU FUXA frangoteam | 9.8 | Feb 9 | FUXA Unauthenticated Remote Code Execution via Admin JWT Minting |
| CVE-2026-25939 | FU FUXA frangoteam | 9.1 | Feb 9 | FUXA Unauthenticated Remote Arbitrary Scheduler Write |
| CVE-2026-25938 | FU FUXA frangoteam | 9.8 | Feb 9 | FUXA Unauthenticated Remote Code Execution in Node-RED Integration |
| CVE-2026-25923 | MY mylittleforum My-Little-Forum | 9.1 | Feb 9 | Phar Deserialization leading to Arbitrary File Deletion in my little forum |
| CVE-2026-25881 | SA SandboxJS nyariv | 10.0 | Feb 9 | @nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape) |
| CVE-2026-25875 | AS assessment-placipy Praskla-Technology | 9.8 | Feb 9 | PlaciPy Admin Privilege Escalation via Trusted JWT Claims |
| CVE-2026-25814 | AS assessment-placipy Praskla-Technology | 9.8 | Feb 9 | NoSQL Injection Risk via Unsanitized Query Parameters |
| CVE-2026-25811 | AS assessment-placipy Praskla-Technology | 9.1 | Feb 9 | PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure) |
| CVE-2026-25809 | AS assessment-placipy Praskla-Technology | 9.8 | Feb 9 | PlaciPy Code Execution Allowed Without Assessment Active State Validation |
| CVE-2026-25810 | AS assessment-placipy Praskla-Technology | 9.1 | Feb 9 | PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts |
| CVE-2026-25876 | AS assessment-placipy Praskla-Technology | 9.1 | Feb 9 | PlaciPy is Missing Authorization on Assessment Results Endpoint |
| CVE-2026-25057 | MA Markus MarkUsProject | 9.1 | Feb 9 | Zip Slip in MarkUs config upload allowing RCE |
| CVE-2026-24679 | FR FreeRDP FreeRDP | 9.1 | Feb 9 | FreeRDP has a heap-buffer-overflow in urb_select_interface |
| CVE-2026-24677 | FR FreeRDP FreeRDP | 9.1 | Feb 9 | FreeRDP has a heap-buffer-overflow in ecam_encoder_compress_h264 |
| CVE-2025-66630 | FI fiber gofiber | 9.4 | Feb 9 | Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure |
| CVE-2025-6830 | PM Password Module Xpoda Türkiye Information Technology Inc. | 9.8 | Feb 9 | SQLi in Xpoda Türkiye Information Technology's Password Module |
| CVE-2026-25848 | HU Hub JetBrains | 9.8 | Feb 9 | In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible |
| CVE-2026-2225 | NP News Portal Project itsourcecode | 9.8 | Feb 9 | itsourcecode News Portal Project Administrator Login index.php sql injection |
| CVE-2026-2223 | OR Online Reviewer System code-projects | 9.8 | Feb 9 | code-projects Online Reviewer System index.php sql injection |
| CVE-2026-22906 | 08 0852-1322 WAGO | 9.8 | Feb 9 | Hardcoded Key Allows Credential Disclosure |
| CVE-2026-22904 | 08 0852-1322 WAGO | 9.8 | Feb 9 | Stack Overflow via Oversized Cookie Fields in lighttpd |
| CVE-2026-22903 | 08 0852-1322 WAGO | 9.8 | Feb 9 | Stack Overflow via SESSIONID Cookie in lighttpd |
| CVE-2026-2234 | CP C&Cm@il package olln-base HGiga | 9.1 | Feb 9 | HGiga｜C&Cm@il - Missing Authentication |
| CVE-2026-2221 | OR Online Reviewer System code-projects | 9.8 | Feb 9 | code-projects Online Reviewer System Login index.php sql injection |
| CVE-2026-1868 | GA GitLab AI Gateway GitLab | 9.9 | Feb 9 | Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway |
| CVE-2026-2220 | OR Online Reviewer System code-projects | 9.8 | Feb 9 | code-projects Online Reviewer System btn_functions.php sql injection |
| CVE-2026-2217 | EM Event Management System itsourcecode | 9.8 | Feb 9 | itsourcecode Event Management System manage_user.php sql injection |
| CVE-2026-1615 | JS jsonpath | 9.8 | Feb 9 | Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions |
| CVE-2025-66602 | FA FAST/TOOLS Yokogawa Electric Corporation | 9.8 | Feb 9 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation |
| CVE-2025-66603 | FA FAST/TOOLS Yokogawa Electric Corporation | 9.8 | Feb 9 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation |
| CVE-2025-66606 | FA FAST/TOOLS Yokogawa Electric Corporation | 9.6 | Feb 9 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation |
| CVE-2026-2212 | OM Online Music Site code-projects | 9.8 | Feb 9 | code-projects Online Music Site AdminEditCategory.php sql injection |
| CVE-2026-2211 | OM Online Music Site code-projects | 9.8 | Feb 9 | code-projects Online Music Site AdminDeleteCategory.php sql injection |
| CVE-2026-2199 | OR Online Reviewer System code-projects | 9.8 | Feb 9 | code-projects Online Reviewer System user-delete.php sql injection |
| CVE-2026-2198 | OR Online Reviewer System code-projects | 9.8 | Feb 9 | code-projects Online Reviewer System loaddata.php sql injection |
| CVE-2026-2197 | OR Online Reviewer System code-projects | 9.8 | Feb 9 | code-projects Online Reviewer System exam-delete.php sql injection |
| CVE-2026-2196 | OR Online Reviewer System code-projects | 9.8 | Feb 9 | code-projects Online Reviewer System exam-update.php sql injection |
| CVE-2026-2195 | OR Online Reviewer System code-projects | 9.8 | Feb 8 | code-projects Online Reviewer System questions-view.php sql injection |
| CVE-2026-2190 | SM School Management System itsourcecode | 9.8 | Feb 8 | itsourcecode School Management System controller.php sql injection |
| CVE-2026-2189 | SM School Management System itsourcecode | 9.8 | Feb 8 | itsourcecode School Management System index.php sql injection |
| CVE-2026-2184 | CG Certificate Generation System Great Developers | 9.8 | Feb 8 | Great Developers Certificate Generation System csv.php os command injection |
| CVE-2026-2183 | CG Certificate Generation System Great Developers | 9.8 | Feb 8 | Great Developers Certificate Generation System csv.php unrestricted upload |
| CVE-2026-2174 | CM Contact Management System code-projects | 9.8 | Feb 8 | code-projects Contact Management System CRUD Endpoint improper authentication |
| CVE-2026-2173 | OE Online Examination System code-projects | 9.8 | Feb 8 | code-projects Online Examination System login.php sql injection |
| CVE-2026-2172 | OA Online Application System for Admission code-projects | 9.8 | Feb 8 | code-projects Online Application System for Admission Login Endpoint index.php sql injection |
| CVE-2026-2171 | OS Online Student Management System code-projects | 9.8 | Feb 8 | code-projects Online Student Management System Login accounts.php sql injection |