Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

7.0

HIGH

CVE-2024-36355

Improper input validation in the SMM handler could allow an attacker with Ring0 access to write to SMRAM and modify execution flow for S3 (sleep) wake up, potentially resulting in arbitrary code execution....

Affected Products :
Published: Feb. 10, 2026

Modified: Feb. 12, 2026

Vuln Type: Memory Corruption
7.0

HIGH

CVE-2025-59104

With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable). Thus, the attacker gains access to the bootloader, where the kernel command line can be changed. An at...

Affected Products :
Published: Jan. 26, 2026

Modified: Jan. 26, 2026

Vuln Type: Authentication
7.0

HIGH

CVE-2026-20980

Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands....

Affected Products : android
Published: Feb. 04, 2026

Modified: Feb. 05, 2026

Vuln Type: Injection
7.0

HIGH

CVE-2026-0715

Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physical access to the device could use this information to access the bootloader menu via a serial i...

Affected Products : uc-8210-t-lx-s_firmware uc-8220-t-lx_firmware uc-8220-t-lx-ap-s_firmware uc-8220-t-lx-eu-s_firmware uc-8220-t-lx-us-s_firmware uc-8220-t-lx uc-8220-t-lx-us-s uc-8220-t-lx-eu-s uc-8220-t-lx-ap-s uc-8210-t-lx-s +60 more products
Published: Feb. 05, 2026

Modified: Feb. 18, 2026

Vuln Type: Authentication
7.0

HIGH

CVE-2026-0714

A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Linux 3, where the discrete TPM is connected to the CPU via an SPI bus. Exploitation requires invasive physical acces...

Affected Products : uc-8210-t-lx-s_firmware uc-8220-t-lx_firmware uc-8220-t-lx-ap-s_firmware uc-8220-t-lx-eu-s_firmware uc-8220-t-lx-us-s_firmware uc-8220-t-lx uc-8220-t-lx-us-s uc-8220-t-lx-eu-s uc-8220-t-lx-ap-s uc-8210-t-lx-s +60 more products
Published: Feb. 05, 2026

Modified: Feb. 18, 2026

Vuln Type: Cryptography
7.0

HIGH

CVE-2026-21241

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 windows_11_25h2 windows_11_26h1
Published: Feb. 10, 2026

Modified: Feb. 11, 2026

Vuln Type: Memory Corruption
7.0

HIGH

CVE-2026-20985

Improper input validation in Samsung Members prior to version 5.6.00.11 allows remote attackers to connect arbitrary URL and launch arbitrary activity with Samsung Members privilege. User interaction is required for triggering this vulnerability....

Affected Products : members
Published: Feb. 04, 2026

Modified: Feb. 04, 2026

Vuln Type: Server-Side Request Forgery
7.0

HIGH

CVE-2026-21242

Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally....

Affected Products : windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 windows_11_25h2 windows_11_26h1
Published: Feb. 10, 2026

Modified: Feb. 11, 2026

Vuln Type: Memory Corruption
7.0

HIGH

CVE-2025-13672

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Reflected XSS. The vulnerability could allow injecting malicious JavaScript inside URL parameters that...

Affected Products :
Published: Feb. 19, 2026

Modified: Feb. 19, 2026

Vuln Type: Cross-Site Scripting
7.0

HIGH

CVE-2026-21508

Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 +6 more products
Published: Feb. 10, 2026

Modified: Feb. 12, 2026

Vuln Type: Authentication
7.0

HIGH

CVE-2026-24051

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go execute...

Affected Products : opentelemetry-go
Published: Feb. 02, 2026

Modified: Feb. 03, 2026

Vuln Type: Path Traversal
7.0

HIGH

CVE-2026-21237

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally....

Affected Products : windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 windows_11_25h2 windows_11_26h1
Published: Feb. 10, 2026

Modified: Feb. 11, 2026

Vuln Type: Race Condition
7.0

HIGH

CVE-2025-59105

With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as "/etc/passwd", as well as stored certificates, cryptographic keys, ...

Affected Products :
Published: Jan. 26, 2026

Modified: Jan. 26, 2026

Vuln Type: Cryptography
7.0

HIGH

CVE-2025-11002

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerabilit...

Affected Products : 7-zip
Published: Jan. 23, 2026

Modified: Jan. 26, 2026

Vuln Type: Path Traversal
7.0

HIGH

CVE-2026-21234

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 +2 more products
Published: Feb. 10, 2026

Modified: Feb. 11, 2026

Vuln Type: Race Condition
7.0

HIGH

CVE-2026-26201

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 3.21.2, multiple shared maps are accessed without consistent synchronization across goroutines. Under concurrent activity, Go runtime can trigger `fatal error: concurrent map...

Affected Products :
Published: Feb. 19, 2026

Modified: Feb. 19, 2026

Vuln Type: Race Condition
7.0

HIGH

CVE-2025-10279

In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the `/tmp` directory to exploit a race cond...

Affected Products : mlflow
Published: Feb. 02, 2026

Modified: Feb. 03, 2026

Vuln Type: Race Condition
7.0

HIGH

CVE-2025-68119

Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how e...

Affected Products : go
Published: Jan. 28, 2026

Modified: Feb. 06, 2026

Vuln Type: Supply Chain
7.0

HIGH

CVE-2026-0775

npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged co...

Affected Products : npm
Published: Jan. 23, 2026

Modified: Jan. 26, 2026
7.0

HIGH

CVE-2026-21253

Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 +6 more products
Published: Feb. 10, 2026

Modified: Feb. 11, 2026

Vuln Type: Memory Corruption

Showing 20 of 4937 Results

Browse by Apps

Latest CVE Feed

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable