CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 06:32 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-15119 | JE JeecgBoot | 3.1 | Dec 28 | JeecgBoot list queryPageList improper authorization |
| CVE-2025-15117 | SA Sa-Token Dromara | 3.1 | Dec 28 | Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization |
| CVE-2025-15108 | PA PandaX PandaXGO | 3.7 | Dec 27 | PandaXGO PandaX JWT Secret config.yml hard-coded key |
| CVE-2025-36228 | AF Aspera Faspex 5 IBM | 3.8 | Dec 26 | Incorrect Execution-Assigned Permissions in IBM Aspera Faspex |
| CVE-2025-52598 | QN QNV-C8012 Hanwha Vision Co., Ltd. | 3.7 | Dec 26 | Insufficient certificate validation |
| CVE-2025-15095 | HT httpbin postmanlabs | 3.5 | Dec 26 | postmanlabs httpbin core.py cross site scripting |
| CVE-2025-15084 | YO youlai-mall youlaitech | 3.1 | Dec 25 | youlaitech youlai-mall Order Payment OrderController.java orderService.payOrder access control |
| CVE-2025-68585 | WD WP Document Revisions Ben Balter | 2.7 | Dec 24 | WordPress WP Document Revisions plugin <= 3.7.2 - Broken Access Control vulnerability |
| CVE-2025-57840 | MO Magic OS Honor | 2.2 | Dec 24 | Privilege Bypass in ADB |
| CVE-2025-14408 | DE Desktop Soda PDF | 3.3 | Dec 23 | Soda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability |
| CVE-2021-47722 | ZA Zucchetti Axess CLOKI Access Control Axesstmc | 3.5 | Dec 23 | Zucchetti Axess CLOKI Access Control 1.64 Cross-Site Request Forgery |
| CVE-2025-61738 | I4 IQPanel2, IQHub,IQPanel2+,IQPanel 4,PowerG Johnson Controls | 2.3 | Dec 22 | Johnson Controls PowerG and IQPanel cleartext transmission of sensitive information |
| CVE-2025-15005 | CO CouchCMS Couchcms | 3.7 | Dec 22 | CouchCMS reCAPTCHA config.example.php hard-coded key |
| CVE-2025-12654 | WB WPvivid — Backup, Migration & Staging wpvividplugins | 2.7 | Dec 21 | Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.120 - Authenticated (Admin+) Arbitrary Directory Creation |
| CVE-2025-14955 | OP Open5GS Open5gs | 3.7 | Dec 19 | Open5GS PFCP handler.c ogs_pfcp_handle_create_pdr initialization |
| CVE-2025-14881 | PR pretix pretix | 3.8 | Dec 19 | Insecure direct object reference |
| CVE-2025-14882 | PR pretix-offlinesales pretix | 3.8 | Dec 19 | Insecure direct object reference |
| CVE-2025-65046 | ME Microsoft Edge for Android Microsoft | 3.1 | Dec 18 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
| CVE-2025-68469 | IM ImageMagick ImageMagick | 3.3 | Dec 18 | ImageMagick vulnerable to heap-buffer-overflow |
| CVE-2025-68462 | FR FreedomBox Debian | 3.2 | Dec 18 | Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases |
| CVE-2025-14841 | DC DCMTK OFFIS | 3.3 | Dec 18 | OFFIS DCMTK dcmqrscp dcmqrdbi.cc startMoveRequest null pointer dereference |
| CVE-2025-14836 | ZZ ZZCMS Zzcms | 2.7 | Dec 17 | ZZCMS User Data Storage user_save.php cleartext storage in file |
| CVE-2025-46279 | MA macOS Apple | 3.3 | Dec 17 | A permissions issue was addressed with additional restrictions |
| CVE-2025-43531 | MA macOS Apple | 3.1 | Dec 17 | A race condition was addressed with improved state handling |
| CVE-2025-46277 | MA macOS Apple | 3.3 | Dec 17 | A logging issue was addressed with improved data redaction |
| CVE-2025-13326 | MA Mattermost Mattermost | 3.9 | Dec 17 | Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store |
| CVE-2025-13324 | MA Mattermost Mattermost | 3.7 | Dec 17 | Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation |
| CVE-2025-13321 | MA Mattermost Mattermost | 3.3 | Dec 17 | Mattermost Desktop App logging sensitive information and fails to clear data on server deletion |
| CVE-2025-14266 | CR Cryptobox Ercom | 0.6 | Dec 17 | CSRF in Ercom Cryptobox administration console |
| CVE-2025-13352 | MA Mattermost Mattermost | 3.0 | Dec 17 | Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking |
| CVE-2025-65185 | IN Informer Entrinsik | 2.8 | Dec 17 | There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and new password then… |
| CVE-2025-68164 | TE TeamCity JetBrains | 2.7 | Dec 16 | In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test |
| CVE-2025-68162 | TE TeamCity JetBrains | 2.7 | Dec 16 | In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration |
| CVE-2025-54004 | WF WCFM – Frontend Manager for WooCommerce WC Lovers | 2.7 | Dec 16 | WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.24 - Broken Access Control vulnerability |
| CVE-2025-49300 | TO Traveler Option Tree Shinetheme | 2.7 | Dec 16 | WordPress Traveler Option Tree plugin <= 2.8 - Sensitive Data Exposure vulnerability |
| CVE-2025-14722 | DM DMadmin vion707 | 2.4 | Dec 15 | vion707 DMadmin Backend AddonsController.class.php add cross site scripting |
| CVE-2025-14697 | SS Sixun Shanghui Group Business Management System Shenzhen Sixun Software | 3.7 | Dec 15 | Shenzhen Sixun Software Sixun Shanghui Group Business Management System ExportFiles file access |
| CVE-2025-55703 | PI Power IQ Sunbirddcim | 3.3 | Dec 15 | An error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API |
| CVE-2025-67899 | UR uriparser uriparser project | 2.9 | Dec 14 | uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas |
| CVE-2025-14651 | ON one-hub MartialBE | 3.7 | Dec 14 | MartialBE one-hub docker-compose.yml hard-coded key |
| CVE-2025-14636 | AX AX9 Tenda | 3.7 | Dec 13 | Tenda AX9 httpd image_check weak hash |
| CVE-2025-9218 | RF rtMedia for WordPress, BuddyPress and bbPress rtcamp | 3.7 | Dec 13 | rtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Function |
| CVE-2025-43518 | MA macOS Apple | 3.3 | Dec 12 | A logic issue was addressed with improved checks |
| CVE-2025-43522 | MA macOS Apple | 3.3 | Dec 12 | A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions |
| CVE-2025-43410 | MA macOS Apple | 2.4 | Dec 12 | The issue was addressed with improved handling of caches |
| CVE-2025-43532 | MA macOS Apple | 2.8 | Dec 12 | A memory corruption issue was addressed with improved bounds checking |
| CVE-2025-43437 | IO iOS Apple | 3.3 | Dec 12 | An information disclosure issue was addressed with improved privacy controls |
| CVE-2025-43516 | MA macOS Apple | 3.3 | Dec 12 | A session management issue was addressed with improved checks |
| CVE-2025-43404 | MA macOS Apple | 3.3 | Dec 12 | A permissions issue was addressed with additional sandbox restrictions |
| CVE-2025-43517 | MA macOS Apple | 3.3 | Dec 12 | A privacy issue was addressed with improved private data redaction for log entries |