Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

7.0

HIGH

CVE-2025-59507

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 +3 more products
Published: Nov. 11, 2025

Modified: Nov. 17, 2025
7.0

HIGH

CVE-2025-60717

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 windows_11_25h2
Published: Nov. 11, 2025

Modified: Nov. 17, 2025
7.0

HIGH

CVE-2025-62213

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 +8 more products
Published: Nov. 11, 2025

Modified: Nov. 17, 2025
7.0

HIGH

CVE-2025-60716

Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 +1 more products
Published: Nov. 11, 2025

Modified: Nov. 17, 2025
7.0

HIGH

CVE-2025-34500

Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the u...

Affected Products :
Published: Oct. 24, 2025

Modified: Oct. 27, 2025

Vuln Type: Cryptography
7.0

HIGH

CVE-2025-34502

Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem a...

Affected Products :
Published: Oct. 24, 2025

Modified: Oct. 27, 2025

Vuln Type: Misconfiguration
7.0

HIGH

CVE-2025-34501

Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often throu...

Affected Products :
Published: Nov. 03, 2025

Modified: Nov. 04, 2025

Vuln Type: Authentication
7.0

HIGH

CVE-2025-61667

The Datadog Agent collects events and metrics from hosts and sends them to Datadog. A vulnerability within the Datadog Linux Host Agent versions 7.65.0 through 7.70.2 exists due to insufficient permissions being set on the `opt/datadog-agent/python-script...

Affected Products :
Published: Nov. 12, 2025

Modified: Nov. 14, 2025

Vuln Type: Misconfiguration
7.0

HIGH

CVE-2025-59506

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 +5 more products
Published: Nov. 11, 2025

Modified: Nov. 17, 2025
7.0

HIGH

CVE-2025-37735

Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM. In some cases, this could result in local privilege escalation....

Affected Products : kibana
Published: Nov. 06, 2025

Modified: Nov. 06, 2025

Vuln Type: Misconfiguration
7.0

HIGH

CVE-2025-34324

GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS chan...

Affected Products :
Published: Nov. 18, 2025

Modified: Nov. 19, 2025

Vuln Type: Supply Chain
7.0

HIGH

CVE-2025-62219

Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally....

Affected Products : windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
7.0

HIGH

CVE-2025-62217

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 +8 more products
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
7.0

HIGH

CVE-2025-59508

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 +3 more products
Published: Nov. 11, 2025

Modified: Nov. 17, 2025
6.9

MEDIUM

CVE-2025-12284

Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5....

Affected Products : blu-ic2_firmware blu-ic2 blu-ic4_firmware blu-ic4
Published: Oct. 26, 2025

Modified: Nov. 10, 2025

Vuln Type: Injection
6.9

MEDIUM

CVE-2025-12119

A mongoc_bulk_operation_t may read invalid memory if large options are passed....

Affected Products :
Published: Nov. 18, 2025

Modified: Nov. 19, 2025

Vuln Type: Memory Corruption
6.9

MEDIUM

CVE-2025-62250

Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote att...

Affected Products : liferay_portal dxp
Published: Oct. 21, 2025

Modified: Oct. 21, 2025

Vuln Type: Authentication
6.9

MEDIUM

CVE-2025-58152

FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. With some crafted HTTP request, they can be accessed without authentication....

Affected Products :
Published: Oct. 31, 2025

Modified: Nov. 04, 2025

Vuln Type: Authentication
6.9

MEDIUM

CVE-2025-42895

Due to insufficient validation of connection property values, the SAP HANA JDBC Client allows a high-privilege locally authenticated user to supply crafted parameters that lead to unauthorized code loading, resulting in low impact on confidentiality and i...

Affected Products :
Published: Nov. 11, 2025

Modified: Nov. 12, 2025

Vuln Type: Misconfiguration
6.9

MEDIUM

CVE-2025-62259

Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verifie...

Affected Products : liferay_portal dxp
Published: Oct. 27, 2025

Modified: Oct. 30, 2025

Vuln Type: Authentication

Showing 20 of 3967 Results

Browse by Apps

Latest CVE Feed

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

6.9

6.9

6.9

6.9

6.9

6.9

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable