CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 18:57 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-55174 | SK Skanpage KDE | 3.2 | Nov 26 | In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of the old file at the… |
| CVE-2025-65942 | VI VictoriaMetrics VictoriaMetrics | 2.7 | Nov 25 | VictoriaMetrics Snappy Decoder DoS Vulnerability is Causing OOM |
| CVE-2025-33200 | DS DGX Spark NVIDIA | 3.3 | Nov 25 | NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused |
| CVE-2025-33199 | DS DGX Spark NVIDIA | 3.8 | Nov 25 | NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause incorrect control flow behavior |
| CVE-2025-33198 | DS DGX Spark NVIDIA | 3.3 | Nov 25 | NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused |
| CVE-2025-59485 | SP Security Point (Windows) of MaLion Intercom, Inc. | 3.3 | Nov 25 | Incorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4 |
| CVE-2025-13596 | CI CIGES ATISoluciones | 2.7 | Nov 24 | Improper Error Handling Leading to Sensitive Information Disclosure in CIGES ≤ 2.15.6 |
| CVE-2025-13584 | EI Eigenfocus | 3.5 | Nov 24 | Eigenfocus Description cross site scripting |
| CVE-2025-13566 | NN nnn jarun | 3.3 | Nov 23 | jarun nnn nnn.c run_cmd_as_plugin double free |
| CVE-2025-54515 | AV Alveo™ V80 Compute Accelerator AMD | 1.0 | Nov 23 | The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination Interface (PSCI) commands were incorrectly set… |
| CVE-2025-11934 | WO wolfSSL wolfSSL | 2.7 | Nov 21 | Improper Validation of Signature Algorithm Used in TLS 1.3 CertificateVerify |
| CVE-2025-31216 | IO iOS Apple | 2.4 | Nov 21 | The issue was addressed with improved checks |
| CVE-2025-66062 | WY WP YouTube Lyte Frank Goossens | 3.4 | Nov 21 | WordPress WP YouTube Lyte plugin <= 1.7.28 - Open Redirection vulnerability |
| CVE-2025-64299 | LC LogStare Collector (for Linux) LogStare Inc. | 2.7 | Nov 21 | LogStare Collector improperly handles the password hash data |
| CVE-2025-52666 | RA Revive Adserver Revive | 2.7 | Nov 20 | Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console… |
| CVE-2025-13425 | OS OSV-SCALIBR Google | 1.9 | Nov 20 | Denial of Service in OSV-SCALIBR |
| CVE-2025-13469 | OJ ojs Public Knowledge Project | 2.4 | Nov 20 | Public Knowledge Project omp/ojs Payment Instructions Setting paymentForm.tpl cross site scripting |
| CVE-2025-11884 | UC uCMDB OpenText™ | 2.3 | Nov 19 | Cross-site Scripting vulnerability discovered in OpenText™ Universal Discovery and CMDB |
| CVE-2025-64757 | AS astro withastro | 3.5 | Nov 19 | Astro Development Server is Vulnerable to Arbitrary Local File Read |
| CVE-2025-65014 | LI librenms librenms | 3.7 | Nov 18 | LibreNMS has Weak Password Policy |
| CVE-2025-12119 | MO MongoDB MongoDB | 3.3 | Nov 18 | Bulk write with options may read invalid memory |
| CVE-2025-12761 | DR Drupal Drupal | 3.5 | Nov 18 | Simple multi step form - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-116 |
| CVE-2025-13083 | DR Drupal Drupal | 3.7 | Nov 18 | Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008 |
| CVE-2025-55074 | MA Mattermost Mattermost | 3.5 | Nov 18 | Channel member objects leak read status |
| CVE-2025-64734 | TR T21 Reader Gallagher | 2.4 | Nov 18 | Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-service attack… |
| CVE-2025-12792 | CA Canva Canva | 3.2 | Nov 18 | The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime |
| CVE-2025-63292 | M4 Mini 4k Firmware Freebox | 3.5 | Nov 17 | Freebox v5 HD (firmware = 1.7.20), Freebox v5 Crystal (firmware = 1.7.20), Freebox v6 Révolution r1–r3 (firmware = 4.7.x), Freebox Mini 4K (firmware = 4.7.x), and Freebox One… |
| CVE-2025-65083 | GD GoSign Desktop Tinexta Infocert | 3.2 | Nov 17 | GoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server |
| CVE-2025-13232 | PR projectsend Projectsend | 3.5 | Nov 16 | projectsend File Editor/Custom Download Aliases cross site scripting |
| CVE-2025-6945 | GI GitLab GitLab | 3.5 | Nov 15 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab |
| CVE-2025-11990 | GI GitLab GitLab | 3.5 | Nov 15 | Improper Handling of URL Encoding (Hex Encoding) in GitLab |
| CVE-2025-4617 | PB Prisma Browser Palo Alto Networks | 1.1 | Nov 14 | Prisma Browser: Insufficient Policy Enforcement Vulnerability in Prisma Browser |
| CVE-2025-4616 | PB Prisma Browser Palo Alto Networks | 1.1 | Nov 14 | Prisma Browser: Insufficient Validation of Untrusted Input Vulnerability in Prisma Browser |
| CVE-2025-54560 | PA Pingalert Application Server Desktopalert | 3.8 | Nov 14 | A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Probing of internal… |
| CVE-2025-54559 | PA Pingalert Application Server Desktopalert | 3.7 | Nov 14 | An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote Path Traversal for loading arbitrary external content |
| CVE-2025-54342 | PA Pingalert Application Server Desktopalert | 3.3 | Nov 14 | A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 |
| CVE-2025-64754 | JI jitsi-meet jitsi | 2.7 | Nov 13 | Jitsi Meet has DOM Redirect on Microsoft OAuth Flow |
| CVE-2025-64744 | OP openobserve openobserve | 3.5 | Nov 13 | OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails |
| CVE-2025-12817 | PO PostgreSQL PostgreSQL | 3.1 | Nov 13 | PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege |
| CVE-2025-64503 | CU cups-filters OpenPrinting | 3.3 | Nov 12 | [BIGSLEEP-434615384] cups-filters 1.x: out of bounds write in pdftoraster |
| CVE-2025-64345 | WA wasmtime bytecodealliance | 1.8 | Nov 12 | Wasmtime provides unsound API access to a WebAssembly shared linear memory |
| CVE-2025-64170 | SU sudo-rs trifectatechfoundation | 3.8 | Nov 12 | sudo-rs: Partial password reveal is possible after timeout |
| CVE-2025-57812 | LI libcupsfilters OpenPrinting | 3.7 | Nov 12 | [BIGSLEEP-434612419] CUPS-Filters has heap-buffer-overflow write in `cfImageLut()` |
| CVE-2025-20379 | SC Splunk Cloud Platform Splunk | 3.5 | Nov 12 | Risky command safeguards bypass using the “/services/streams/search“ REST endpoint through “q“ parameter in Splunk Enterprise |
| CVE-2025-63396 | PY Pytorch Linuxfoundation | 3.3 | Nov 12 | An issue was discovered in PyTorch v2.5 and v2.7.1 |
| CVE-2025-41116 | GR Grafana Grafana | 2.1 | Nov 11 | Incorrect oauth passthrough in Grafana Databricks Datasource |
| CVE-2025-3717 | GR Grafana Grafana | 2.1 | Nov 11 | Incorrect oauth passthrough in Grafana Snowflake Datasource |
| CVE-2025-32088 | IQ Intel(R) QAT Windows software | 3.3 | Nov 11 | Improper conditions check for some Intel(R) QAT Windows software before version 2.6.0 |
| CVE-2025-32037 | IP Intel(R) PresentMon | 2.0 | Nov 11 | Improper access control for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow a denial of service |
| CVE-2025-31948 | IO Intel(R) oneAPI Math Kernel Library | 3.3 | Nov 11 | Improper input validation for some Intel(R) oneAPI Math Kernel Library before version 2025.2 within Ring 3: User Applications may allow a denial of service |