Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

6.8

MEDIUM

CVE-2025-59808

An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7....

Affected Products : fortisoar fortisoaron-premise fortisoarpaas
Published: Dec. 09, 2025

Modified: Dec. 09, 2025

Vuln Type: Authentication
6.8

MEDIUM

CVE-2025-64990

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-LogoffUser instruction prior V21.1. Improper input validation, allowing authenticated attackers with Actioner privileges to...

Affected Products :
Published: Dec. 11, 2025

Modified: Dec. 12, 2025

Vuln Type: Injection
6.8

MEDIUM

CVE-2025-66302

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers with administrative privileges to read arbitrary files on the underlying server filesystem. This vu...

Affected Products : grav grav-plugin-admin
Published: Dec. 01, 2025

Modified: Dec. 03, 2025

Vuln Type: Path Traversal
6.8

MEDIUM

CVE-2025-27232

An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss....

Affected Products : zabbix
Published: Dec. 01, 2025

Modified: Dec. 01, 2025

Vuln Type: Path Traversal
6.8

MEDIUM

CVE-2025-14311

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JMRI.This issue affects JMRI: before 5.13.3....

Affected Products :
Published: Dec. 09, 2025

Modified: Dec. 09, 2025

Vuln Type: Path Traversal
6.8

MEDIUM

CVE-2024-32384

Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer security allows a man-in-the-middle attacker to intercept and modify traffic between the client and ...

Affected Products :
Published: Dec. 01, 2025

Modified: Dec. 02, 2025

Vuln Type: Misconfiguration
6.8

MEDIUM

CVE-2025-53897

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to log information from the system by tricking an administrator into browsing a specifically crafted ...

Affected Products : kiteworks kiteworks_managed_file_transfer
Published: Nov. 29, 2025

Modified: Dec. 03, 2025

Vuln Type: Information Disclosure
6.8

MEDIUM

CVE-2025-59694

The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allows a physically proximate attacker to persistently modify firmware and influence the (insecurely configured) appliance boot process. To ...

Affected Products : nshield_5c_firmware nshield_5c nshield_hsmi_firmware nshield_hsmi nshield_connect_xc_base_firmware nshield_connect_xc_base nshield_connect_xc_mid_firmware nshield_connect_xc_mid nshield_connect_xc_high_firmware nshield_connect_xc_high
Published: Dec. 02, 2025

Modified: Dec. 15, 2025

Vuln Type: Misconfiguration
6.8

MEDIUM

CVE-2025-41697

An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692....

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Authentication
6.8

MEDIUM

CVE-2025-59705

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a Physically Proximate Attacker to Escalate Privileges by enabling the USB interface through chassis probe insertion during system boot, aka "Unauthorized Reactivatio...

Affected Products : nshield_5c_firmware nshield_5c nshield_hsmi_firmware nshield_hsmi nshield_connect_xc_base_firmware nshield_connect_xc_base nshield_connect_xc_mid_firmware nshield_connect_xc_mid nshield_connect_xc_high_firmware nshield_connect_xc_high
Published: Dec. 02, 2025

Modified: Dec. 08, 2025

Vuln Type: Misconfiguration
6.8

MEDIUM

CVE-2025-41692

A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm....

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Authentication
6.8

MEDIUM

CVE-2025-66308

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/config/site en...

Affected Products : grav grav-plugin-admin
Published: Dec. 01, 2025

Modified: Dec. 03, 2025

Vuln Type: Cross-Site Scripting
6.8

MEDIUM

CVE-2025-59698

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, might allow a physically proximate attacker to gain access to the EOL legacy bootloader....

Affected Products : nshield_5c_firmware nshield_5c nshield_hsmi_firmware nshield_hsmi nshield_connect_xc_base_firmware nshield_connect_xc_base nshield_connect_xc_mid_firmware nshield_connect_xc_mid nshield_connect_xc_high_firmware nshield_connect_xc_high
Published: Dec. 02, 2025

Modified: Dec. 08, 2025

Vuln Type: Authentication
6.8

MEDIUM

CVE-2025-48618

In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction...

Affected Products : android
Published: Dec. 08, 2025

Modified: Dec. 08, 2025

Vuln Type: Race Condition
6.8

MEDIUM

CVE-2025-13524

Improper resource release in the call termination process in AWS Wickr before version 6.62.13 on Windows, macOS and Linux may allow a call participant to continue receiving audio input from another user after they close their call window. This issue occur...

Affected Products :
Published: Nov. 21, 2025

Modified: Nov. 25, 2025

Vuln Type: Denial of Service
6.8

MEDIUM

CVE-2025-54838

An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests....

Affected Products : fortiportal
Published: Dec. 09, 2025

Modified: Dec. 09, 2025

Vuln Type: Authorization
6.8

MEDIUM

CVE-2025-59699

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to escalate privileges by booting from a USB device with a valid root filesystem. This occurs because of insecure default settings in ...

Affected Products : nshield_5c_firmware nshield_5c nshield_hsmi_firmware nshield_hsmi nshield_connect_xc_base_firmware nshield_connect_xc_base nshield_connect_xc_mid_firmware nshield_connect_xc_mid nshield_connect_xc_high_firmware nshield_connect_xc_high
Published: Dec. 02, 2025

Modified: Dec. 08, 2025

Vuln Type: Authentication
6.8

MEDIUM

CVE-2025-11266

An out-of-bounds write vulnerability exists in the Grassroots DICOM library (GDCM). The issue is triggered during parsing of a malformed DICOM file containing encapsulated PixelData fragments (compressed image data stored as multiple fragments). This vuln...

Affected Products :
Published: Dec. 12, 2025

Modified: Dec. 15, 2025

Vuln Type: Memory Corruption
6.8

MEDIUM

CVE-2025-65822

The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on an ESP32 in a commercial product an attacker with physical access to the device can connect over this port and reflash the device's fi...

Affected Products :
Published: Dec. 10, 2025

Modified: Dec. 12, 2025

Vuln Type: Misconfiguration
6.8

MEDIUM

CVE-2025-64993

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instructions. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrar...

Affected Products :
Published: Dec. 11, 2025

Modified: Dec. 12, 2025

Vuln Type: Injection

Showing 20 of 4468 Results

Browse by Apps

Latest CVE Feed

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable