CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 20:59 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-10583 | WF WP Fastest Cache Premium emrevona | 3.5 | Dec 12 | WP Fastest Cache Premium <= 1.7.4 - Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forgery |
| CVE-2025-67737 | AZ AzuraCast AzuraCast | 3.7 | Dec 12 | AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE |
| CVE-2025-13053 | AD ADM ASUSTOR | 3.7 | Dec 12 | A missing encryption of sensitive data vulnerability was found in the UPS settings of ADM |
| CVE-2023-29144 | MA Malwarebytes Malwarebytes | 3.3 | Dec 12 | Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios |
| CVE-2025-14538 | W仓 warehouseManager 仓库管理系统 yangshare | 3.5 | Dec 11 | yangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scripting |
| CVE-2025-13912 | WO wolfSSL wolfSSL | 1.0 | Dec 11 | Potential non-constant time compiled code with Clang LLVM |
| CVE-2025-67739 | TE TeamCity JetBrains | 3.1 | Dec 11 | In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure |
| CVE-2025-12734 | GI GitLab GitLab | 3.5 | Dec 11 | Improper Encoding or Escaping of Output in GitLab |
| CVE-2025-55307 | PE Pdf Editor Foxit | 3.3 | Dec 11 | An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2 |
| CVE-2025-67646 | TA TableProgressTracking Telepedia | 3.5 | Dec 10 | TableProgressTracking's missing CSRF protection allows unauthorized state changes |
| CVE-2025-5467 | AP apport Canonical | 3.3 | Dec 10 | Ubuntu Apport Insecure File Permissions Vulnerability |
| CVE-2025-67639 | JE Jenkins Jenkins | 3.5 | Dec 10 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account |
| CVE-2025-13127 | GO GoldenHorn TAC Information Services Internal and External Trade Inc. | 3.5 | Dec 10 | XSS in TACAS Consulting's GoldenHorn |
| CVE-2025-14082 | RH Red Hat build of Keycloak 26.4 Red Hat | 2.7 | Dec 10 | Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure |
| CVE-2025-67500 | MA mastodon mastodon | 3.7 | Dec 9 | Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration |
| CVE-2025-67499 | PL plugins containernetworking | 3.6 | Dec 9 | CNI Plugins Portmap nftables backend intercepts non-local traffic |
| CVE-2025-64786 | AR Acrobat Reader Adobe | 3.3 | Dec 9 | Acrobat Reader | Improper Verification of Cryptographic Signature (CWE-347) |
| CVE-2025-64787 | AR Acrobat Reader Adobe | 3.3 | Dec 9 | Acrobat Reader | Improper Verification of Cryptographic Signature (CWE-347) |
| CVE-2025-57823 | FO FortiAuthenticator Fortinet | 2.7 | Dec 9 | A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions,… |
| CVE-2025-59923 | FO FortiAuthenticator Fortinet | 2.7 | Dec 9 | An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions,… |
| CVE-2025-64255 | AA Admin and Site Enhancements (ASE) Bowo | 2.7 | Dec 9 | WordPress Admin and Site Enhancements (ASE) plugin <= 8.0.8 - Broken Access Control vulnerability |
| CVE-2025-64254 | PB Photo Block Ronald Huereca | 2.7 | Dec 9 | WordPress Photo Block plugin <= 1.5.1 - Broken Access Control vulnerability |
| CVE-2024-56464 | IQ IBM QRadar SIEM IBM | 2.7 | Dec 9 | IBM QRadar SIEM is affected by an information disclosure vulnerability |
| CVE-2025-40818 | SR SINEMA Remote Connect Server Siemens | 3.3 | Dec 9 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4) |
| CVE-2025-64696 | AA Android App "Brother iPrint&Scan" Brother Industries, Ltd. | 3.3 | Dec 9 | Android App "Brother iPrint&Scan" versions 6.13.7 and earlier improperly uses an external cache directory |
| CVE-2025-36102 | CC Cognos Controller IBM | 2.7 | Dec 8 | IBM Controller Validation Bypass |
| CVE-2025-14228 | SE SIP-T21P E2 Yealink | 3.5 | Dec 8 | Yealink SIP-T21P E2 Local Directory cross site scripting |
| CVE-2025-65228 | TF Tlk302t Firmware Rvr | 3.5 | Dec 8 | A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R |
| CVE-2025-60912 | PH Phpipam Phpipam | 3.3 | Dec 8 | phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality |
| CVE-2025-14186 | GX GXP1625 Grandstream | 3.5 | Dec 7 | Grandstream GXP1625 Network Status api.values.post cross site scripting |
| CVE-2025-66549 | SE security-advisories nextcloud | 2.7 | Dec 5 | Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory |
| CVE-2025-66515 | SE security-advisories nextcloud | 2.7 | Dec 5 | Nextcloud Approval app allows users to request approval for other users file |
| CVE-2025-66546 | SE security-advisories nextcloud | 3.3 | Dec 5 | Nextcloud Calendar app allowed booking appointments without the generated token |
| CVE-2025-66479 | SA sandbox-runtime anthropic-experimental | 1.8 | Dec 4 | Anthropic Sandbox Runtime Incorrectly Implemented Network Sandboxing |
| CVE-2025-12997 | CN CareLink Network Medtronic | 3.1 | Dec 4 | Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit… |
| CVE-2025-20388 | SC Splunk Cloud Platform Splunk | 2.7 | Dec 3 | Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise |
| CVE-2025-12954 | TA Timetable and Event Schedule by MotoPress | 2.7 | Dec 3 | Timetable and Event Schedule by MotoPress < 2.4.16 - Contributor+ Event Disclosure via IDOR |
| CVE-2025-13640 | CH Chrome Google | 3.5 | Dec 2 | Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via physical access to the device |
| CVE-2025-13879 | SI SOLIDserver IPAM SOLIDserver | 2.7 | Dec 2 | Directory traversal vulnerability in EfficientIP's SOLIDserver IPAM |
| CVE-2025-58487 | SA Samsung Account Samsung Mobile | 3.3 | Dec 2 | Improper authorization in Samsung Account prior to version 15.5.01.1 allows local attacker to launch arbitrary activity with Samsung Account privilege |
| CVE-2025-58483 | GS Galaxy Store for Galaxy Watch Samsung Mobile | 3.3 | Dec 2 | Improper export of android application components in Galaxy Store for Galaxy Watch prior to version 1.0.06.29 allows local attacker to install arbitrary application on Galaxy… |
| CVE-2025-59700 | N5 Nshield 5c Firmware Entrust | 3.9 | Dec 2 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker with root… |
| CVE-2025-65858 | CA Calibre-web Janeczku | 3.5 | Dec 2 | A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation |
| CVE-2025-59696 | N5 Nshield 5c Firmware Entrust | 3.2 | Dec 2 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker to modify or… |
| CVE-2025-13805 | NU NutzBoot nutzam | 3.7 | Dec 1 | nutzam NutzBoot LiteRpc-Serializer HttpServletRpcEndpoint.java getInputStream deserialization |
| CVE-2025-13795 | SM School Management System codingWithElias | 2.4 | Nov 30 | codingWithElias School Management System Edit Student Info student-view.php cross site scripting |
| CVE-2025-6666 | MI mo.lock Ignition Lock motogadget | 2.0 | Nov 29 | motogadget mo.lock Ignition Lock NFC hard-coded key |
| CVE-2025-58308 | HA HarmonyOS Huawei | 3.3 | Nov 28 | Vulnerability of improper criterion security check in the call module |
| CVE-2025-66372 | MU Mustang mustangproject | 2.8 | Nov 28 | Mustang before 2.16.3 allows exfiltrating files via XXE attacks |
| CVE-2025-13758 | SE Server Devolutions | 3.5 | Nov 27 | Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8 |