CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 21:13 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-2014 | SM Student Management System itsourcecode | 9.8 | Feb 6 | itsourcecode Student Management System index.php sql injection |
| CVE-2026-2013 | SM Student Management System itsourcecode | 9.8 | Feb 6 | itsourcecode Student Management System index.php sql injection |
| CVE-2026-2012 | SM Student Management System itsourcecode | 9.8 | Feb 6 | itsourcecode Student Management System index.php sql injection |
| CVE-2026-2011 | SM Student Management System itsourcecode | 9.8 | Feb 6 | itsourcecode Student Management System controller.php sql injection |
| CVE-2026-21643 In wildKEV | FO FortiClientEMS Fortinet | 9.8 | Feb 6 | Fortinet FortiClient EMS SQL Injection Vulnerability |
| CVE-2026-24300 | AF Azure Front Door Microsoft | 9.8 | Feb 5 | Azure Front Door Elevation of Privilege Vulnerability |
| CVE-2026-24302 | AA Azure ARC Microsoft | 9.8 | Feb 5 | Azure Arc Elevation of Privilege Vulnerability |
| CVE-2026-1963 | WE WeKan | 9.8 | Feb 5 | WeKan Attachment Storage attachments.js MoveStorageBleed access control |
| CVE-2026-1962 | WE WeKan | 9.8 | Feb 5 | WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control |
| CVE-2026-0106 | AN Android Google | 9.3 | Feb 5 | In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing bounds check |
| CVE-2025-68121 | CR crypto/tls Go standard library | 10.0 | Feb 5 | Unexpected session resumption in crypto/tls |
| CVE-2020-37138 | NI Network Inventory Explorer 10-Strike Software | 9.8 | Feb 5 | 10-Strike Network Inventory Explorer 9.03 - 'Read from File' Buffer Overflow (SEH)(ROP) |
| CVE-2020-37137 | PF PHP Fusion PHP Fusion | 9.8 | Feb 5 | PHP-Fusion 9.03.50 - 'panels.php' Eval Injection |
| CVE-2020-37129 | MP Memu Play Microvirt | 9.8 | Feb 5 | Memu Play 7.1.3 - Insecure Folder Permissions |
| CVE-2020-37126 | FD Free Desktop Clock Drive Software Company | 9.8 | Feb 5 | Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH) |
| CVE-2020-37125 | EM EW-7438RPn Mini EDIMAX Technology | 9.8 | Feb 5 | Edimax Technology EW-7438RPn-v3 Mini 1.27 - Remote Code Execution |
| CVE-2020-37124 | B6 B64dec 4Mhz | 9.8 | Feb 5 | B64dec 1.1.2 - Buffer Overflow (SEH Overflow + Egg Hunter) |
| CVE-2020-37123 | PI Pinger wcchandler | 9.8 | Feb 5 | Pinger 1.0 - Remote Code Execution |
| CVE-2020-37120 | RD Rubo DICOM Viewer Rubo Medical Imaging | 9.8 | Feb 5 | Rubo DICOM Viewer 2.0 - Buffer Overflow (SEH) |
| CVE-2020-37119 | NS Nsauditor Nsasoft | 9.8 | Feb 5 | Nsauditor 3.2.1.0 - Buffer Overflow (SEH+ASLR bypass (3 bytes overwrite)) |
| CVE-2026-23796 | QU Quick.Cart OpenSolution | 9.8 | Feb 5 | Session Fixation in Quick.Cart |
| CVE-2025-68723 | AM Axigen Mail Server Axigen | 9.0 | Feb 5 | Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface |
| CVE-2025-62616 | AU AutoGPT Significant-Gravitas | 9.8 | Feb 4 | AutoGPT has SSRF vulnerability in SendDiscordFileBlock |
| CVE-2025-62615 | AU AutoGPT Significant-Gravitas | 9.8 | Feb 4 | AutoGPT has SSRF vulnerability in ReadRSSFeedBlock |
| CVE-2026-25547 | BR brace-expansion isaacs | 9.2 | Feb 4 | Uncontrolled Resource Consumption in @isaacs/brace-expansion |
| CVE-2026-25526 | JI jinjava HubSpot | 9.8 | Feb 4 | JinJava Bypass through ForTag leads to Arbitrary Java Execution |
| CVE-2026-25519 | OP OpenSlides OpenSlides | 9.8 | Feb 4 | OpenSlides has incorrect access control vulnerability in authentication service |
| CVE-2025-13375 | CC Common Cryptographic Architecture IBM | 9.8 | Feb 4 | IBM Common Cryptographic Architecture Arbitrary Command Execution |
| CVE-2026-25505 | BA bambuddy maziggy | 9.8 | Feb 4 | Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication |
| CVE-2026-25481 | LA langroid langroid | 9.6 | Feb 4 | Langroid has WAF Bypass Leading to RCE in TableChatAgent |
| CVE-2026-25139 | RI RIOT RIOT-OS | 9.1 | Feb 4 | RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments |
| CVE-2025-64712 | UN unstructured Unstructured-IO | 9.8 | Feb 4 | Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write |
| CVE-2026-22247 | GL glpi glpi-project | 9.1 | Feb 4 | GLPI is Vulnerable to SSRF via Webhooks |
| CVE-2026-25115 | N8 n8n n8n-io | 9.9 | Feb 4 | n8n is vulnerable to Python sandbox escape |
| CVE-2026-25053 | N8 n8n n8n-io | 9.9 | Feb 4 | n8n is Vulnerable to OS Command Injection in Git Node |
| CVE-2026-25052 | N8 n8n n8n-io | 9.9 | Feb 4 | n8n Improper File Access Controls Allow Arbitrary File Read by Authenticated Users |
| CVE-2026-25049 | N8 n8n n8n-io | 9.9 | Feb 4 | n8n Has an Expression Escape Vulnerability Leading to RCE |
| CVE-2025-5329 | DC Delta Course Automation Martcode Software Inc. | 9.8 | Feb 4 | SQLi in Martcode Software's Delta Course Automation |
| CVE-2025-59818 | TC TCIS-3+ Zenitel | 9.8 | Feb 4 | Authenticated Remote Code Execution via the file name of an uploaded file |
| CVE-2026-1813 | BO bolo-solo bolo-blog | 9.8 | Feb 3 | bolo-blog bolo-solo FreeMarker Template PicUploadProcessor.java unrestricted upload |
| CVE-2026-1633 | L2 LAN 232 TRIO Synectix | 10.0 | Feb 3 | Synectix LAN 232 TRIO Missing Authentication for Critical Function |
| CVE-2026-1632 | MS MOMA Seismic Station RISS SRL | 9.1 | Feb 3 | RISS SRL MOMA Seismic Station Missing Authentication for Critical Function |
| CVE-2026-1812 | BO bolo-solo bolo-blog | 9.8 | Feb 3 | bolo-blog bolo-solo Filename BackupService.java importFromCnblogs path traversal |
| CVE-2020-37090 | SE School ERP Pro Arox | 9.8 | Feb 3 | School ERP Pro 1.0 - Remote Code Execution |
| CVE-2020-37089 | SE School ERP Pro Arox | 9.8 | Feb 3 | School ERP Pro 1.0 - 'es_messagesid' SQL Injection |
| CVE-2020-37080 | WE webTareas luiswang | 9.8 | Feb 3 | webTareas 2.0.p8 - Arbitrary File Deletion |
| CVE-2020-37075 | LA LanSend LizardSystems | 9.8 | Feb 3 | LanSend 3.2 - Buffer Overflow (SEH) |
| CVE-2020-37074 | RD Remote Desktop Audit LizardSystems | 9.8 | Feb 3 | Remote Desktop Audit 2.3.0.157 - Buffer Overflow (SEH) |
| CVE-2020-37071 | CR CraftCMS CraftCMS | 9.8 | Feb 3 | CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution |
| CVE-2020-37070 | CL CloudMe CloudMe | 9.8 | Feb 3 | CloudMe 1.11.2 - Buffer Overflow (SEH,DEP,ASLR) |