Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 08:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

181-70% vs 7-day avg of 598

2 critical, 65 high, 73 medium, 31 low

Expand	Severity	Score	Advisory	Title	Source	Flags	Published
	Medium	5.5	CVE-2026-116223	A flaw has been found in icret EasyImage up to 2.8.7 icreticret EasyImage, icret EasyImages2.0	NVD		Oct 26 07:17 UTC
CVE-2026-116223A flaw has been found in icret EasyImage up to 2.8.7 Executive summary A flaw has been found in icret EasyImage up to version 2.8.7, a PHP image hosting product. The advisory says an unauthenticated attacker can delete hosted images, and the exploit write-up describes possible permanent data loss. The advisory does not state a CVSS score from the NVD record; the disclosure text it contains gives a CVSS 3.1 base score of 7.4 (High), and the vendor's recommended fixes are to put the delete path behind the admin login check and to replace the weak key derivation. Technical summary The advisory describes CWE-326 (inadequate encryption strength): delete links are AES-128-XTS encryptions of the file path keyed with a 32-bit value derived from crc32 of the admin password, with a hardcoded tweak. The hash-based delete branch in app/del.php runs before the admin authentication check, so a forged or recovered token deletes files without a session. The advisory states that anonymous upload is enabled by default and that a full 2^32 key sweep took about 850.7 seconds on 16 workers. Affected version is stated as 2.8.7 (master branch, commit dcb9776cb9567b9280306471a66d96b4b733a0a1); the advisory does not state a fixed version. Workarounds beyond the listed remediation steps and vendor patch status are not stated, and no detection guidance is given beyond the control test showing the denial without a hash parameter. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/yyz8097/bc58546872ad90208d2b35260d84b1d9 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects icret icret EasyImage icret EasyImages2.0 NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee