Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 8.7

    HIGH
    CVE-2025-63611

    Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /register-complaint.php are stored and rendered unescaped in the admin viewer (/admin/complaint-details.php?cid=<id>). Wh... Read more

    Affected Products : hostel_management_system
    • Published: Jan. 08, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Cross-Site Scripting

  • 8.1

    HIGH
    CVE-2026-21694

    Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time entries in private projects they have not been granted access to. This issue is fixed in versio... Read more

    Affected Products : titra
    • Published: Jan. 08, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Authorization

  • 4.3

    MEDIUM
    CVE-2026-21695

    Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customf... Read more

    Affected Products : titra
    • Published: Jan. 08, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Injection

  • 7.5

    HIGH
    CVE-2025-50334

    An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting component... Read more

    Affected Products : dnsserver
    • Published: Jan. 08, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Denial of Service

  • 9.4

    CRITICAL
    CVE-2025-64424

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a ... Read more

    Affected Products : coolify
    • Published: Jan. 05, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Injection

  • 8.5

    HIGH
    CVE-2025-64425

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim, and modify the host header of the request ... Read more

    Affected Products : coolify
    • Published: Jan. 05, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Cross-Site Request Forgery

  • 5.5

    MEDIUM
    CVE-2026-21492

    iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a NULL pointer member call vulnerability. This vul... Read more

    Affected Products : iccdev
    • Published: Jan. 06, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Memory Corruption

  • 7.1

    HIGH
    CVE-2026-21494

    iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vulnerability present in versions prior to 2.3.1.2 affects users of the iccDEV ... Read more

    Affected Products : iccdev
    • Published: Jan. 06, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Memory Corruption

  • 7.1

    HIGH
    CVE-2026-21491

    iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vulnerability present in versions prior to 2.3.1.2 affects users of the iccDEV ... Read more

    Affected Products : iccdev
    • Published: Jan. 06, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Memory Corruption

  • 6.5

    MEDIUM
    CVE-2025-68436

    Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously cr... Read more

    Affected Products : craft_cms
    • Published: Jan. 05, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Authorization

  • 8.8

    HIGH
    CVE-2026-21693

    iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccSegmentedCu... Read more

    Affected Products : iccdev
    • Published: Jan. 07, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Memory Corruption

  • 7.1

    HIGH
    CVE-2026-21490

    iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vulnerability present in versions prior to 2.3.1.2 affects users of the iccDEV ... Read more

    Affected Products : iccdev
    • Published: Jan. 06, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Memory Corruption

  • 6.8

    MEDIUM
    CVE-2025-68437

    Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craft CMS GraphQL `save_<VolumeName>_Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). This vulnerability aris... Read more

    Affected Products : craft_cms
    • Published: Jan. 05, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Server-Side Request Forgery

  • 8.8

    HIGH
    CVE-2026-21692

    iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `ToXmlCurve()` a... Read more

    Affected Products : iccdev
    • Published: Jan. 07, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Memory Corruption

  • 6.5

    MEDIUM
    CVE-2026-21691

    iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccTag:IsTypeC... Read more

    Affected Products : iccdev
    • Published: Jan. 07, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Memory Corruption

  • 6.3

    MEDIUM
    CVE-2026-21690

    iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccTagXmlTagDa... Read more

    Affected Products : iccdev
    • Published: Jan. 07, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Memory Corruption

  • 6.5

    MEDIUM
    CVE-2026-21689

    iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccProfileXml:... Read more

    Affected Products : iccdev
    • Published: Jan. 07, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Memory Corruption

  • 8.8

    HIGH
    CVE-2025-68454

    Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to ... Read more

    Affected Products : craft_cms
    • Published: Jan. 05, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Injection

  • 4.3

    MEDIUM
    CVE-2025-31962

    Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.... Read more

    • Published: Jan. 07, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Authentication

  • 8.6

    HIGH
    CVE-2025-68455

    Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior. Note that attackers must have administra... Read more

    Affected Products : craft_cms
    • Published: Jan. 05, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Authentication
Showing 20 of 4185 Results