Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

8.7

HIGH

CVE-2025-53474

When an iRule using an ILX::call command is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated....

Affected Products : big-ip_access_policy_manager big-ip_advanced_firewall_manager big-ip_analytics big-ip_application_acceleration_manager big-ip_application_security_manager big-ip_domain_name_system big-ip_fraud_protection_service big-ip_global_traffic_manager big-ip_link_controller big-ip_local_traffic_manager +11 more products
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-46706

When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated....

Affected Products : big-ip_access_policy_manager big-ip_advanced_firewall_manager big-ip_analytics big-ip_application_acceleration_manager big-ip_application_security_manager big-ip_domain_name_system big-ip_fraud_protection_service big-ip_global_traffic_manager big-ip_link_controller big-ip_local_traffic_manager +13 more products
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Memory Corruption
8.7

HIGH

CVE-2025-59478

When a BIG-IP AFM denial-of-service (DoS) protection profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Supp...

Affected Products : big-ip_access_policy_manager big-ip_advanced_firewall_manager
Published: Oct. 15, 2025

Modified: Oct. 22, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-62159

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. A vulnerability was discovered in the BeyondTrust provider implementation for External Secrets Operator versions 0.10.1 thro...

Affected Products : external_secrets_operator
Published: Oct. 10, 2025

Modified: Oct. 14, 2025

Vuln Type: Authorization
8.7

HIGH

CVE-2025-41344

A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'id_archivo' in '/backend/api/verArchivo.php'....

Affected Products : canaldenuncia.app
Published: Nov. 04, 2025

Modified: Nov. 05, 2025

Vuln Type: Authorization
8.7

HIGH

CVE-2025-61974

When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated....

Affected Products : big-ip_access_policy_manager big-ip_next_service_proxy_for_kubernetes big-ip_next_cloud-native_network_functions big-ip_next_for_kubernetes
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-61938

When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement setting, either manually or through the automatic Policy Builder, the bd process can terminate repe...

Affected Products : big-ip_access_policy_manager big-ip_application_security_manager big-ip_advanced_web_application_firewall
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-41339

A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'id_sociedad' in '/backend/api/buscarTipoDenuncia.php'....

Affected Products : canaldenuncia.app
Published: Nov. 04, 2025

Modified: Nov. 05, 2025

Vuln Type: Authorization
8.7

HIGH

CVE-2025-11949

EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain database administrator credentials via a specific functionality....

Affected Products : easyflow_.net
Published: Oct. 21, 2025

Modified: Oct. 21, 2025

Vuln Type: Authentication
8.7

HIGH

CVE-2025-53521

When a BIG-IP APM Access Policy is configured on a virtual server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated....

Affected Products : big-ip_access_policy_manager big-ip_advanced_firewall_manager big-ip_analytics big-ip_application_acceleration_manager big-ip_application_security_manager big-ip_domain_name_system big-ip_fraud_protection_service big-ip_global_traffic_manager big-ip_link_controller big-ip_local_traffic_manager +11 more products
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-25018

Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)...

Affected Products : kibana
Published: Oct. 10, 2025

Modified: Oct. 30, 2025

Vuln Type: Cross-Site Scripting
8.7

HIGH

CVE-2025-54858

When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed JSON schema, and the security policy is applied to a virtual server, undisclosed requests can cause the bd process to terminate. Note...

Affected Products : big-ip_access_policy_manager big-ip_application_security_manager big-ip_advanced_web_application_firewall
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-53880

A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthe...

Affected Products :
Published: Oct. 30, 2025

Modified: Oct. 30, 2025

Vuln Type: Path Traversal
8.7

HIGH

CVE-2025-55036

When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled, undisclosed traffic may cause memory corruption. Note: Software versions which have reached End of Technical Support (EoTS) ar...

Affected Products : big-ip_access_policy_manager big-ip_ssl_orchestrator
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Memory Corruption
8.7

HIGH

CVE-2025-54459

Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request metadata, session...

Affected Products : hospital_manager_backend_services hospital_manager_backend_services
Published: Oct. 29, 2025

Modified: Nov. 06, 2025

Vuln Type: Information Disclosure
8.7

HIGH

CVE-2025-34518

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a relative path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customer...

Affected Products : eve_x1_server_firmware eve_x1_server
Published: Oct. 16, 2025

Modified: Oct. 23, 2025

Vuln Type: Path Traversal
8.7

HIGH

CVE-2025-41338

A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id_denuncia' and 'id_user' in '/backend/api/buscarTestigoByIdD...

Affected Products : canaldenuncia.app
Published: Nov. 04, 2025

Modified: Nov. 05, 2025

Vuln Type: Authorization
8.7

HIGH

CVE-2025-10557

A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's brow...

Affected Products : 3dexperience 3dexperience_enovia
Published: Oct. 13, 2025

Modified: Oct. 21, 2025

Vuln Type: Cross-Site Scripting
8.7

HIGH

CVE-2025-54854

When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not...

Affected Products : big-ip_access_policy_manager
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-10556

A stored Cross-site Scripting (XSS) vulnerability affecting Specification Management in ENOVIA Specification Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser...

Affected Products : 3dexperience_enovia
Published: Oct. 13, 2025

Modified: Oct. 21, 2025

Vuln Type: Cross-Site Scripting

Showing 20 of 3897 Results

Browse by Apps

Latest CVE Feed

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

8.7

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable