GNUnet is a peer-to-peer framework with focus on providing security. All peer-to-peer messages in the network are confidential and authenticated. The framework provides a transport abstraction layer and can currently encapsulate the network traffic in UDP IPv4 and IPv6, TCP IPv4 and IPv6, HTTP, or S...
← All Tools
RSS Hub
Security news and vulnerability advisories from trusted sources.
Vulnerability data is sourced from public feeds. Always verify severity and applicability before action.
📡 Want CyberRamen’s own new tools & updates in your reader? Subscribe to our feed:
Atom · JSON Feed.
Filter by hashtag
Type a word and press Enter to show only matching items. Start with - to hide them instead, e.g. -sponsored. vuln also finds “vulnerability”. Runs in your browser; your tags are never sent.
Try:
My feed: combine sources
Tick up to 10 sources you follow, then press Show my feed. Items are merged newest first; an item published by several sources is shown once, with the other sources named.
Sources in my feed
Recent CVEs (Vulners NVD mirror)
Vulnerabilities
50 items
php2shell-audit Exposure scanner, patch verifier and threat hunter for the October 2026 PHP php2shell vulnerabilities CVE-2026-109618 / CVE-2026-109619. p2s answers two questions in one zero-dependency Go binary: 1. Am I exposed? It inventories PHP binaries, running workers, distro packages, contain...
The vulnerability of XSpider PRO and the vulnerability management system MaxPatrol VM Mobile are related to uncontrolled resource consumption. Exploiting these vulnerabilities can allow remote attackers to cause service failures...
The vulnerability of the ReadyScript e-commerce management system is related to improper session management. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...
The vulnerability of the ReadyScript e-commerce management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to load any desired files...
The vulnerability of the ReadyScript e-commerce management system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
The vulnerability of the ReadyScript e-commerce management system is related to the improper implementation of the sequence of actions to be performed. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information....
The vulnerability of the TrueConf Server software is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a malicious actor operating remotely to execute arbitrary code...
The vulnerability of the Windows Update Orchestrator Service on Windows operating systems is related to the improper handling of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to elevate their privileges to the SYSTEM level...
The vulnerability of the IAM Proxy component of the Identity & Access Management tool in Platform V IAM is related to synchronization errors when using a common resource. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...
The vulnerability of DesktopServicesHelper in macOS operating systems is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain increased privileges...
The vulnerability of the setBufferingPeriodSEI function in the vvdecapp VVdeC component is related to reading data beyond the buffer’s capacity. Exploiting this vulnerability could allow an attacker to cause a service failure or gain access to protected information...
The vulnerability of the reconstructCoeff function in the vvdecapp VVdeC decoder is related to the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow a hacker to cause a service failure or execute arbitrary code...
The vulnerability of the reconstructCoeff function in the vvdecapp VVdeC decoder is related to the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow a hacker to cause a service failure or execute arbitrary code...
The vulnerability of the Aquarius L311 device’s driver for the Avora operating system is related to access control errors. Exploiting this vulnerability can allow attackers to gain access to protected information and affect the system...
The vulnerability of the ReadyScript e-commerce management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to load any desired files...
The vulnerability of the reconstructCoeff function in the vvdecapp VVdeC decoder is related to the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow a hacker to cause a service failure or execute arbitrary code...
The vulnerability of the TrueConf Server software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain access under an arbitrary username without a password...
The vulnerability of the reconstructCoeff function in the vvdecapp VVdeC decoder is related to the use of memory after deallocation when processing specially created VVC streams. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...
The vulnerability of the readAlf function in the vvdecapp VVdeC decoder lies in the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...
The vulnerability of the createSubPicRefBufs function in the vvdecapp VVdeC decoder lies in the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...
The vulnerability of the software for the training and control system “OLIMPOX” is related to the lack of authentication for critical functions. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to confidential information and modify data within the...
The vulnerability of the platform for creating individual web applications in CRM systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow attackers, operating remotely, to circumvent existing security mechanisms and gain unauthorized access to prote...
The vulnerability of the platform for creating individual web applications in CRM involves the failure to take measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected informat...
The vulnerability of the platform for creating individual web applications in CRM involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...
The vulnerability of the platform for creating individual web applications in CRM involves unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to compromise the accessibility of protected information...
The vulnerability of the Windows Update Orchestrator Service on Windows operating systems is related to incorrect handling of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to elevate their privileges to the SYSTEM level and gain unauthorized access to ...
The vulnerability of the Shtab project and task management service is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...
The vulnerability of the YouGile project management service is related to errors in the code of the pseudorandom number generator used for generating host keys. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control over the application...
The vulnerability of the YouGile project management service is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...
The vulnerability of the YouGile project management service is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the YouGile project management service is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the YouGile project management service is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the software for centralized printer control and the Printsupervision printer system is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the DIAFAN.CMS website content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the Dr.Web ConfigD executable module is related to insufficient protection of operational data. Exploiting this vulnerability can allow attackers to disclose the protected information...
The vulnerability of the h2 library in the Rust programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...
The vulnerability of the control console of the MaxPatrol EDR detection and response system is related to access control errors. Exploiting this vulnerability could allow a malicious actor to cause service failures...
The vulnerability of the TOPAZ Metron PTS time synchronization device is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to inject arbitrary OS commands...
The vulnerability of the software interface REST API of the GEO.RITM software lies in the lack of authentication when accessing the function for retrieving object attributes. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to confidential information...
The vulnerability of the “REDAAM” IT-infrastructure centralized management system is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...
The vulnerability of the CommuniGate Pro mail server arises from insufficient access control checks when processing specially crafted requests. Exploiting this vulnerability allows a malicious actor to perform unauthorized modifications to the server’s data remotely...
The vulnerability of the “Tekon” SCADA system exists due to the lack of measures taken to neutralize specific elements within it. Exploiting this vulnerability allows a remote attacker to execute arbitrary codes...
The vulnerability of the “Tekon” SCADA system is related to the incorrect assignment of permissions for critical resources. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...
Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system CMS like 1C-Bitrix. Website management involves unlimited uploading of dangerous files. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely...
Vulnerability of the “KOMTEK Cassa Kurier” module of the 1C-Bitrix content management system: Website management is associated with the absence of authentication for a critical function. Exploitation of this vulnerability may allow an attacker to compromise the integrity and accessibility of protect...
The vulnerability of the “Doctor Around. Telemedicine Premium” platform relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose protected information...
The vulnerability of the “Doctor Near. Telemedicine Premium” platform relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the TrueConf Server software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain an administrator-level token...
The vulnerability of the “OLIMPOX” training and control system’s software is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...
How to use the CVE and security feed hub
- The page opens on Recent CVEs, the newest vulnerability entries from the Vulners mirror of NVD.
- Pick another source in the drop-down; the page reloads with that feed. Sources are grouped as Vendor (Cisco, Red Hat, Ubuntu, Debian, Fortinet, Palo Alto), Vulnerabilities (CISA advisories, ZDI, Exploit-DB, Full Disclosure, the CVE Project), CERT (CERT-EU, NCSC UK, CERT.be, CERT Polska, NCSC-FI, MS-ISAC), Threat Intel, Cloud and News.
- Click a title to read the full advisory on the source site.
- Bookmark a feed directly with its key, for example
/en/tools/cve-feeds?feed=cisa-advisories.
Filtering with hashtags
- Type a word in Filter by hashtag and press Enter (or Add). Only items whose title or summary contain it stay visible, and the match is highlighted. The filter runs in your browser; your tags are never sent to the server.
- A tag finds words that start with it:
vulnfinds “vulnerability”,exploitfinds “exploited”. Case and accents do not matter. - Short tags of 3 characters or fewer must be the whole word, so
AIdoes not match “maintain” andRCEdoes not match “source”. - Tags with a dash, dot or plus match as a phrase:
CVE-2026-12345,log4j-core,c++. Join words with-to search for a phrase, e.g.remote-code. - Start a tag with
-to hide items instead, e.g.-sponsored. With two or more tags you can choose whether an item needs any or all of them.
My feed: several sources in one list
- Open My feed, tick up to 10 sources and press Show my feed. Items from all of them are merged newest first; an item that several sources publish is shown once, with the other sources named.
- Your hashtags apply to My feed too, so
ransomwareover five news sources gives one short list. - If a source does not answer, the others still load; press Retry next to it. A source that is down shows its last saved copy, marked as cached.
- Copy share link puts your tags and sources (nothing else) in a link. Opening it shows those settings without replacing your own until you choose to keep them.
- If you allow it, your tags and sources are kept in this browser for next time. You can remove them under “Your local data”.
Reading the items
Each entry shows the title, the publication date converted to YYYY-MM-DD HH:MM, and up to 300 characters of the source summary. Up to 50 items are shown per feed, newest first as the source orders them. Titles usually carry the identifier you need next: a CVE ID such as CVE-2026-12345, a vendor ID such as RHSA-2026:1234 or USN-7000-1, or a ZDI advisory number.
Feeds are fetched by this server, so the sources do not see your IP address until you open a link. A feed item is a pointer, not a verdict: check the affected versions and the CVSS vector in the full advisory before acting, and score it yourself with the CVSS 4.0 calculator if the vendor has not.
Frequently asked questions
Where can I see the new CVEs published today?
The default feed, Recent CVEs (Vulners NVD mirror), lists the newest vulnerability entries with their publication time. NIST retired the NVD RSS feeds, so this page reads Vulners, which mirrors NVD CVE records. For raw record changes, pick CVE Project (GitHub commits), the commit log of the official cvelistV5 repository.
How often is the CVE feed updated?
Each feed is fetched from its source at most once every 10 minutes and then shared between visitors. If a source is down, the page shows the last cached copy and says when it was fetched.
Which of the new CVEs should I patch first?
A new CVE is not automatically urgent. Start with vulnerabilities known to be exploited: the Actionable CVEs dashboard combines the CISA KEV catalog with EPSS scores, and the EPSS lookup scores a single CVE.
Why does a feed show an error?
Some vendors and government sites refuse requests from cloud servers or are temporarily unavailable. The message says whether the source refused the request or did not respond. Pick another feed, or open the source website directly.
Can I export the feed items?
Yes. Below the list, the export bar copies the items or downloads them as JSON, CSV, TSV, Markdown or plain text, with title, link, date and description for each entry.