Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

8.8

HIGH

CVE-2025-52664

SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in users...

Affected Products : revive_adserver
Published: Oct. 31, 2025

Modified: Nov. 04, 2025

Vuln Type: Injection
8.8

HIGH

CVE-2025-11589

A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/user-payment.php. Performing manipulation of the argument plan results in sql injection. It is possible to initiate the attack r...

Affected Products : gym_management_system
Published: Oct. 10, 2025

Modified: Oct. 20, 2025

Vuln Type: Injection
8.8

HIGH

CVE-2025-43433

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to memory corruption....

Affected Products : iphone_os tvos watchos safari ipados visionos
Published: Nov. 04, 2025

Modified: Nov. 05, 2025

Vuln Type: Memory Corruption
8.7

HIGH

CVE-2025-55669

When the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End ...

Affected Products : big-ip_access_policy_manager big-ip_application_security_manager
Published: Oct. 15, 2025

Modified: Oct. 22, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-58071

When IPsec is configured on the BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated....

Affected Products : big-ip_access_policy_manager big-ip_advanced_firewall_manager big-ip_analytics big-ip_application_acceleration_manager big-ip_application_security_manager big-ip_domain_name_system big-ip_fraud_protection_service big-ip_global_traffic_manager big-ip_link_controller big-ip_local_traffic_manager +13 more products
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2016-15047

AVTECH devices that include the CloudSetup.cgi management endpoint are vulnerable to authenticated OS command injection. The `exefile` parameter in CloudSetup.cgi is passed to the underlying system command execution without proper validation or whitelisti...

Affected Products :
Published: Oct. 09, 2025

Modified: Oct. 14, 2025

Vuln Type: Injection
8.7

HIGH

CVE-2025-34518

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a relative path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customer...

Affected Products : eve_x1_server_firmware eve_x1_server
Published: Oct. 16, 2025

Modified: Oct. 23, 2025

Vuln Type: Path Traversal
8.7

HIGH

CVE-2025-59781

When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated....

Affected Products : big-ip_access_policy_manager big-ip_advanced_firewall_manager big-ip_analytics big-ip_application_acceleration_manager big-ip_application_security_manager big-ip_domain_name_system big-ip_fraud_protection_service big-ip_global_traffic_manager big-ip_link_controller big-ip_local_traffic_manager +12 more products
Published: Oct. 15, 2025

Modified: Oct. 22, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-60016

When Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cipher Rule or Cipher Group, and that profile is applied to a virtual server, undisclosed traffic can cause the Traffic Management Microke...

Affected Products : big-ip_access_policy_manager big-ip_next_service_proxy_for_kubernetes big-ip_next_cloud-native_network_functions
Published: Oct. 15, 2025

Modified: Oct. 22, 2025

Vuln Type: Cryptography
8.7

HIGH

CVE-2024-13991

Huijietong Cloud Video Platform contains a path traversal vulnerability that allows an unauthenticated attacker can supply arbitrary file paths to the `fullPath` parameter of the `/fileDownload?action=downloadBackupFile` endpoint and retrieve files from t...

Affected Products :
Published: Oct. 15, 2025

Modified: Nov. 03, 2025

Vuln Type: Path Traversal
8.7

HIGH

CVE-2025-41337

A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarSSOParametros.php'....

Affected Products : canaldenuncia.app
Published: Nov. 04, 2025

Modified: Nov. 05, 2025

Vuln Type: Authorization
8.7

HIGH

CVE-2025-48008

When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions whic...

Affected Products : big-ip_access_policy_manager big-ip_advanced_firewall_manager big-ip_analytics big-ip_application_acceleration_manager big-ip_application_security_manager big-ip_domain_name_system big-ip_fraud_protection_service big-ip_global_traffic_manager big-ip_link_controller big-ip_local_traffic_manager +13 more products
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-53856

When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to t...

Affected Products : big-ip_access_policy_manager big-ip_advanced_firewall_manager big-ip_analytics big-ip_application_acceleration_manager big-ip_application_security_manager big-ip_domain_name_system big-ip_fraud_protection_service big-ip_global_traffic_manager big-ip_link_controller big-ip_local_traffic_manager +11 more products
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2012-10063

Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowi...

Affected Products : xi
Published: Oct. 30, 2025

Modified: Nov. 04, 2025

Vuln Type: Injection
8.7

HIGH

CVE-2025-61935

When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated....

Affected Products : big-ip_access_policy_manager big-ip_application_security_manager big-ip_advanced_web_application_firewall
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-41112

A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarConfiguracionParametros2.php'....

Affected Products : canaldenuncia.app
Published: Nov. 04, 2025

Modified: Nov. 05, 2025

Vuln Type: Authorization
8.7

HIGH

CVE-2020-36859

The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple SQL injection vulnerabilities in the object edit pages. Unsanitized user-supplied input was incorporated into SQL queries used by configuration obje...

Affected Products : xi
Published: Oct. 30, 2025

Modified: Nov. 04, 2025

Vuln Type: Injection
8.7

HIGH

CVE-2025-60004

An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-Of-Service (DoS). When an aff...

Affected Products : junos junos_os_evolved
Published: Oct. 09, 2025

Modified: Oct. 14, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-59975

An Uncontrolled Resource Consumption vulnerability in the HTTP daemon (httpd) of Juniper Networks Junos Space allows an unauthenticated network-based attacker flooding the device with inbound API calls to consume all resources on the system, leading to a ...

Affected Products : junos_space
Published: Oct. 09, 2025

Modified: Oct. 14, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-6892

An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authentication mechanism allows unauthorized access to protected API endpoints, including those intended for administrative f...

Affected Products : tn-4900_firmware
Published: Oct. 17, 2025

Modified: Oct. 21, 2025

Vuln Type: Authorization

Showing 20 of 3913 Results

Browse by Apps

Latest CVE Feed

8.8

8.8

8.8

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable