CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 15:22 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-25150 | QW qwik QwikDev | 10.0 | Feb 3 | Prototype Pollution via FormData Processing in Qwik City |
| CVE-2025-65078 | CC CSTAT, CXTAT, MSLBD, MXLBD, CSLBL, CXLBL, CSLBN, CXLBN, CSTMH, CXTMH, CSTPP, CXTPP, MSLSG, MXLSG Lexmark | 9.3 | Feb 3 | Untrusted search path vulnerability in Embedded Solutions Framework |
| CVE-2025-62799 | FA Fast-DDS eProsima | 9.8 | Feb 3 | FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS (potential RCE) |
| CVE-2026-25241 | PE pearweb pear | 9.8 | Feb 3 | PEAR is Vulnerable to SQL Injection in /get/<package>/<version> Endpoint |
| CVE-2026-25240 | PE pearweb pear | 9.8 | Feb 3 | PEAR is Vulnerable to SQL Injection in user::maintains() Role IN() Filter |
| CVE-2026-25238 | PE pearweb pear | 9.8 | Feb 3 | PEAR is Vulnerable to SQL Injection in Bug Subscription Deletion via Weak Email Validation |
| CVE-2026-25237 | PE pearweb pear | 9.8 | Feb 3 | PEAR is Vulnerable to PHP Code Execution via preg_replace /e in Bug Update Emails |
| CVE-2026-25236 | PE pearweb pear | 9.8 | Feb 3 | PEAR is Vulnerable to SQL Injection in Damblan_Karma IN() Query via Literal Substitution |
| CVE-2026-25234 | PE pearweb pear | 9.8 | Feb 3 | PEAR is Vulnerable to SQL Injection in Category Deletion |
| CVE-2026-25233 | PE pearweb pear | 9.1 | Feb 3 | PEAR Has a Roadmap Authorization Bypass via Operator Precedence Bug |
| CVE-2025-52626 | AI AION HCL | 9.8 | Feb 3 | HCL AION is susceptible to Potential Command Injection vulnerability |
| CVE-2020-37110 | 60 60CycleCMS Davidvg | 9.8 | Feb 3 | 60CycleCMS 2.5.2 - 'news.php' SQL Injection Vulnerability |
| CVE-2026-1568 | VM Vulnerability Management Rapid7 | 9.6 | Feb 3 | Rapid7 InsightVM Signature Validation Vulnerability |
| CVE-2025-5319 | DE DIGITA Efficiency Management System Emit Informatics and Communication Technologies Industry and Trade Ltd. Co. | 9.8 | Feb 3 | SQLi in Emit Informatics' DIGITA Efficiency Management System |
| CVE-2026-1432 | BU Buroweb T-Systems | 9.3 | Feb 3 | SQL injection (SQLi) on the Buroweb platform |
| CVE-2025-67856 | MO Moodle Moodle | 9.8 | Feb 3 | Moodle: moodle: privilege escalation via incomplete role checks in badge awarding |
| CVE-2026-24465 | WA WAB-S300IW-AC ELECOM CO.,LTD. | 9.8 | Feb 3 | Stack-based buffer overflow vulnerability exists in ELECOM wireless LAN access point devices |
| CVE-2026-24936 | AD ADM ASUSTOR | 9.8 | Feb 3 | An improper input validation vulnerability was found in ADM while joining a AD Domain. |
| CVE-2025-67484 | ME MediaWiki Wikimedia Foundation | 9.8 | Feb 3 | Action API xslt option allows JavaScript execution by administrators who are not interface administrators |
| CVE-2025-10878 | FO Fikir Odalari AdminPando Insaat | 10.0 | Feb 3 | A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26 |
| CVE-2025-57529 | CA Cpas Audit Management System Youdatasum | 9.8 | Feb 3 | YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input validation |
| CVE-2025-63624 | IS Iot Smart Water Meter Firmware Sdkede | 9.8 | Feb 3 | SQL Injection vulnerability in Shandong Kede Electronics Co., Ltd IoT smart water meter monitoring platform v.1.0 allows a remote attacker to execute arbitrary code via the… |
| CVE-2025-69971 | FU Fuxa Frangoteam | 9.8 | Feb 3 | FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js |
| CVE-2025-69981 | FU Fuxa Frangoteam | 9.8 | Feb 3 | FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint |
| CVE-2025-69983 | FU Fuxa Frangoteam | 9.8 | Feb 3 | FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality |
| CVE-2025-67188 | AF A950rg Firmware Totolink | 9.8 | Feb 3 | A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112 |
| CVE-2025-67187 | AF A950rg Firmware Totolink | 9.8 | Feb 3 | A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112 |
| CVE-2025-67186 | AF A950rg Firmware Totolink | 9.8 | Feb 3 | TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules interface of /lib/cste_modules/firewall.so |
| CVE-2025-65875 | FP Fpdf Fpdf | 9.8 | Feb 3 | An arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file |
| CVE-2025-61506 | ME Mediacrush Mediacrush | 9.8 | Feb 3 | An issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to upload arbitrary files of any size to the /upload endpoint |
| CVE-2025-69970 | FU Fuxa Frangoteam | 9.3 | Feb 3 | FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js |
| CVE-2026-25142 | SA SandboxJS nyariv | 10.0 | Feb 2 | SandboxJS Prototype Pollution -> Sandbox Escape -> RCE |
| CVE-2026-25137 | NI nixpkgs NixOS | 9.1 | Feb 2 | NixOs Odoo database and filestore publicly accessible with default odoo configuration |
| CVE-2025-66480 | IM im-server wildfirechat | 9.8 | Feb 2 | Wildfire has Arbitrary File Upload via Directory Traversal in UploadFileAction |
| CVE-2026-22778 | VL vllm vllm-project | 9.8 | Feb 2 | vLLM leaks a heap address when PIL throws an error |
| CVE-2026-23997 | FA facturascripts NeoRazorX | 9.0 | Feb 2 | FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View |
| CVE-2026-24471 | CO continuwuity continuwuity | 9.3 | Feb 2 | Improper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy') |
| CVE-2022-50981 | AA AvibiaLine AVLX1 HD 5.0 avibia | 9.8 | Feb 2 | Multiple Innomic VibroLine VLX HD 5.0 and avibia AVLX weak password requirements |
| CVE-2025-8587 | SK SKSPro AKCE Software Technology R&D Industry and Trade Inc. | 9.8 | Feb 2 | Time-Based Blind SQLi in AKCE Software's SKSPro |
| CVE-2024-5986 | H2 h2oai/h2o-3 h2oai | 9.1 | Feb 2 | Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3 |
| CVE-2024-2356 | PA parisneo/lollms-webui parisneo | 9.6 | Feb 2 | Remote Code Execution due to LFI in '/reinstall_extension' in parisneo/lollms-webui |
| CVE-2026-20418 | MC MediaTek chipset MediaTek, Inc. | 9.8 | Feb 2 | In Thread, there is a possible out of bounds write due to a missing bounds check |
| CVE-2026-20407 | MC MediaTek chipset MediaTek, Inc. | 9.3 | Feb 2 | In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check |
| CVE-2025-15030 | UP User Profile Builder | 9.8 | Feb 2 | User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset |
| CVE-2026-25202 | M9 MagicINFO 9 Server Samsung Electronics | 9.8 | Feb 2 | The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects MagicINFO 9 Server: less than… |
| CVE-2026-25200 | M9 MagicINFO 9 Server Samsung Electronics | 9.8 | Feb 2 | A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover This issue… |
| CVE-2026-1740 | IA ipTIME A8004T EFM | 9.8 | Feb 2 | EFM ipTIME A8004T Hidden Hiddenloginsetup timepro.cgi httpcon_check_session_url improper authentication |
| CVE-2026-25069 | PD Pironman Dashboard (pm_dashboard) SunFounder | 9.3 | Jan 31 | SunFounder Pironman Dashboard <= 1.3.13 Path Traversal Arbitrary File Read/Deletion |
| CVE-2020-37057 | ON Online-Exam-System sunnygkp10 | 9.8 | Jan 30 | Online-Exam-System 2015 - 'fid' SQL Injection |
| CVE-2020-37056 | HT http-protection Crystal Shard | 9.8 | Jan 30 | Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass |