Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

7.1

HIGH

CVE-2025-41746

An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulner...

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-66327

Race condition vulnerability in the network module. Impact: Successful exploitation of this vulnerability may affect service confidentiality....

Affected Products : harmonyos
Published: Dec. 08, 2025

Modified: Dec. 08, 2025

Vuln Type: Race Condition
7.1

HIGH

CVE-2025-41745

An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnera...

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-41695

An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerabilit...

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-41748

An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerabili...

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-67534

Cross-Site Request Forgery (CSRF) vulnerability in Jacques Malgrange Rencontre rencontre allows Stored XSS.This issue affects Rencontre: from n/a through <= 3.13.7....

Affected Products :
Published: Dec. 09, 2025

Modified: Dec. 10, 2025

Vuln Type: Cross-Site Request Forgery
7.1

HIGH

CVE-2025-66563

Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.sourc...

Affected Products : monkeytype
Published: Dec. 04, 2025

Modified: Dec. 17, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-67648

Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the...

Affected Products : shopware
Published: Dec. 11, 2025

Modified: Dec. 12, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-41747

An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulne...

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-49341

Cross-Site Request Forgery (CSRF) vulnerability in Alex Furr PDF Creator Lite pdf-creator-lite allows Stored XSS.This issue affects PDF Creator Lite: from n/a through <= 1.2....

Affected Products :
Published: Dec. 09, 2025

Modified: Dec. 11, 2025

Vuln Type: Cross-Site Request Forgery
7.1

HIGH

CVE-2025-41749

An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability ...

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-14261

The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes it extremely easy to crack....

Affected Products : litmus
Published: Dec. 08, 2025

Modified: Dec. 09, 2025

Vuln Type: Authentication
7.1

HIGH

CVE-2025-64893

DNG SDK versions 1.7.0 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure or application denial of service. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. E...

Affected Products : macos windows dng_software_development_kit
Published: Dec. 09, 2025

Modified: Dec. 10, 2025

Vuln Type: Memory Corruption
7.1

HIGH

CVE-2025-23719

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zckevin ZhinaTwitterWidget allows Reflected XSS.This issue affects ZhinaTwitterWidget: from n/a through 1.0....

Affected Products :
Published: Dec. 31, 2025

Modified: Dec. 31, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-47566

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomSounds allows Reflected XSS.This issue affects ZoomSounds: from n/a through 6.91....

Affected Products :
Published: Dec. 31, 2025

Modified: Dec. 31, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-68876

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INVELITY Invelity SPS connect allows Reflected XSS.This issue affects Invelity SPS connect: from n/a through 1.0.8....

Affected Products :
Published: Dec. 29, 2025

Modified: Dec. 31, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-68879

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Councilsoft Content Grid Slider allows Reflected XSS.This issue affects Content Grid Slider: from n/a through 1.5....

Affected Products :
Published: Dec. 29, 2025

Modified: Dec. 31, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-53235

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osuthorpe Easy Social allows Reflected XSS.This issue affects Easy Social: from n/a through 1.3....

Affected Products :
Published: Dec. 31, 2025

Modified: Jan. 02, 2026

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-23554

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakub Glos Off Page SEO allows Reflected XSS.This issue affects Off Page SEO: from n/a through 3.0.3....

Affected Products :
Published: Dec. 30, 2025

Modified: Dec. 31, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-23550

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kemal YAZICI Product Puller allows Reflected XSS.This issue affects Product Puller: from n/a through 1.5.1....

Affected Products :
Published: Dec. 30, 2025

Modified: Dec. 31, 2025

Vuln Type: Cross-Site Scripting

Showing 20 of 5218 Results

Browse by Apps

Latest CVE Feed

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable