Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

5.3

MEDIUM

CVE-2026-0939

The Rede Itaú for WooCommerce plugin for WordPress is vulnerable to order status manipulation due to insufficient verification of data authenticity in all versions up to, and including, 5.1.2. This is due to the plugin failing to verify the authenticity o...

Affected Products :
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Authentication
7.1

HIGH

CVE-2026-22876

Path Traversal vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If this vulnerability is exploited, arbitrary files on the affected product may be retrieved by a logged-in user with the low("monitoring user") ...

Affected Products :
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Path Traversal
8.8

HIGH

CVE-2026-20759

OS Command Injection vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation, which may allow a logged-in user with the low("monitoring user") or higher privilege to execute an arbitrary OS command....

Affected Products :
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Injection
9.2

CRITICAL

CVE-2025-14510

Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 before 6.3.1-251120, from 6.4.0 before 6.4.1-251120....

Affected Products :
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Authentication
9.8

CRITICAL

CVE-2025-14235

Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP...

Affected Products : imageclass_x_mf1238_ii_firmware imageclass_x_mf1643i_ii_firmware imageclass_x_mf1643if_ii_firmware imageclass_x_lbp1238_ii_firmware imagerunner_1643if_ii_firmware imagerunner_1643i_ii_firmware
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Memory Corruption
9.8

CRITICAL

CVE-2025-14236

Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series...

Affected Products : imageclass_x_mf1238_ii_firmware imageclass_x_mf1643i_ii_firmware imageclass_x_mf1643if_ii_firmware imageclass_x_lbp1238_ii_firmware imagerunner_1643if_ii_firmware imagerunner_1643i_ii_firmware
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Memory Corruption
4.1

MEDIUM

CVE-2026-23766

Istio through 1.28.2 allows iptables rule injection for changing firewall behavior via the traffic.sidecar.istio.io/excludeInterfaces annotation. NOTE: the reporter's position is "this doesn't represent a security vulnerability (pod creators can already e...

Affected Products : istio
Published: Jan. 15, 2026

Modified: Jan. 16, 2026

Vuln Type: Injection
6.1

MEDIUM

CVE-2025-67025

Cross Site Scripting vulnerability in Anycomment anycomment.io 0.4.4 allows a remote attacker to execute arbitrary code via the Anycomment comment section...

Affected Products :
Published: Jan. 15, 2026

Modified: Jan. 16, 2026

Vuln Type: Cross-Site Scripting
8.7

HIGH

CVE-2026-1022

Statistics Database System developed by Gotac has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files....

Affected Products :
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Path Traversal
4.3

MEDIUM

CVE-2025-14384

The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/aioseo/v1/ai/credits` REST route in all versions up to, and incl...

Affected Products : all_in_one_seo
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Information Disclosure
4.3

MEDIUM

CVE-2025-15370

The Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 21.0.9 via the MfaGoogleAuthToggle class due to missing validation on a us...

Affected Products :
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Authorization
9.0

CRITICAL

CVE-2026-1009

A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when...

Affected Products :
Published: Jan. 15, 2026

Modified: Jan. 16, 2026

Vuln Type: Cross-Site Scripting
7.6

HIGH

CVE-2026-1008

A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribut...

Affected Products :
Published: Jan. 15, 2026

Modified: Jan. 16, 2026

Vuln Type: Cross-Site Scripting
7.8

HIGH

CVE-2026-20940

Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 +3 more products
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
5.5

MEDIUM

CVE-2026-20939

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally....

Affected Products : windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 +3 more products
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
7.8

HIGH

CVE-2026-20938

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally....

Affected Products : windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_2h2
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
5.5

MEDIUM

CVE-2026-20937

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally....

Affected Products : windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 +3 more products
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
4.3

MEDIUM

CVE-2026-20936

Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 +8 more products
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
6.2

MEDIUM

CVE-2026-20935

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unauthorized attacker to disclose information locally....

Affected Products : windows_11_23h2 windows_11_24h2 windows_11_25h2
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
7.5

HIGH

CVE-2026-20934

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network....

Affected Products : windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 +5 more products
Published: Jan. 13, 2026

Modified: Jan. 16, 2026

Showing 20 of 4387 Results

Browse by Apps

Latest CVE Feed

5.3

7.1

8.8

9.2

9.8

9.8

4.1

6.1

8.7

4.3

4.3

9.0

7.6

7.8

5.5

7.8

5.5

4.3

6.2

7.5

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable