CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 5:23 PM ET)

What this means for you

This week: 3,250 CVEs published, 240 critical, and 5 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,250; Show in the list
Critical, last 7 days: 240; Show in the list
Healthcare-tagged, last 7 days: 6; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product rockoa:rockoa. Show all products

8 CVEs

Showing 1 to 8.

CVE	Severity	Title	Published
CVE-2025-9602	Medium 6.3	Xinhu RockOA index.php publicsaveAjax improper authorization Assigned by VulDB	Aug 28, 2025
CVE-2025-63742	Critical 9.8	SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator ac… Assigned by mitre	Dec 8, 2025
CVE-2025-63740	Medium 4.3	SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, passw… Assigned by mitre	Dec 8, 2025
CVE-2025-63739	Medium 4.3	An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authenticated users to modify PHP configuratio… Assigned by mitre	Dec 8, 2025
CVE-2025-63738	Medium 4.3	An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via the a parameter to the index.php. Assigned by mitre	Dec 8, 2025
CVE-2025-63737	Medium 6.1	Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attackers to inject arbitrary web script or HTML via the m parame… Assigned by mitre	Dec 8, 2025
CVE-2026-0587	Low 3.5	Xinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scripting Assigned by VulDB	Jan 5, 2026
CVE-2026-0588	Low 3.5	Xinhu Rainrock RockOA API rockfun.php cross site scripting Assigned by VulDB	Jan 5, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.