Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

7.2

HIGH

CVE-2025-12007

There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image....

Affected Products :
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Authentication
8.2

HIGH

CVE-2025-14844

The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the 'rcp_stripe_create_setup_intent_for_saved_card' function due to missing capability check. Additional...

Affected Products : membership_plugin_-_restrict_content
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Authentication
9.8

CRITICAL

CVE-2025-14236

Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series...

Affected Products : imageclass_x_mf1238_ii_firmware imageclass_x_mf1643i_ii_firmware imageclass_x_mf1643if_ii_firmware imageclass_x_lbp1238_ii_firmware imagerunner_1643if_ii_firmware imagerunner_1643i_ii_firmware
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Memory Corruption
9.8

CRITICAL

CVE-2025-14235

Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP...

Affected Products : imageclass_x_mf1238_ii_firmware imageclass_x_mf1643i_ii_firmware imageclass_x_mf1643if_ii_firmware imageclass_x_lbp1238_ii_firmware imagerunner_1643if_ii_firmware imagerunner_1643i_ii_firmware
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Memory Corruption
6.5

MEDIUM

CVE-2026-0696

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values....

Affected Products : professional_service_automation
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Cross-Site Scripting
7.3

HIGH

CVE-2026-0615

The Librarian `supervisord` status page can be retrieved by the `web_fetch` tool, which can be used to retrieve running processes within TheLibrarian backend. The vendor has fixed the vulnerability in all affected versions....

Affected Products :
Published: Jan. 16, 2026

Modified: Jan. 16, 2026
6.1

MEDIUM

CVE-2025-14375

The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 5.0.10 due to insufficient input sanitizat...

Affected Products : wp_rss_aggregator
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Cross-Site Scripting
8.8

HIGH

CVE-2025-12957

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.5.7. This is due to insufficient file type validation detecting VTT files, allowing double extension files to bypass sanitizat...

Affected Products : all-in-one_video_gallery
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Denial of Service
4.3

MEDIUM

CVE-2025-14853

The LEAV Last Email Address Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions <= 1.7.1. This is due to missing or incorrect nonce validation on the display_settings_page function. This makes it possible for unauthentic...

Affected Products :
Published: Jan. 16, 2026

Modified: Jan. 16, 2026

Vuln Type: Cross-Site Request Forgery
4.1

MEDIUM

CVE-2026-23766

Istio through 1.28.2 allows iptables rule injection for changing firewall behavior via the traffic.sidecar.istio.io/excludeInterfaces annotation. NOTE: the reporter's position is "this doesn't represent a security vulnerability (pod creators can already e...

Affected Products : istio
Published: Jan. 15, 2026

Modified: Jan. 16, 2026

Vuln Type: Injection
6.6

MEDIUM

CVE-2026-0227

A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Repeated attempts to trigger this issue results in the firewall entering into maintenance mode....

Affected Products : pan-os prisma_access
Published: Jan. 15, 2026

Modified: Jan. 16, 2026

Vuln Type: Denial of Service
7.8

HIGH

CVE-2026-20940

Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 +3 more products
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
5.5

MEDIUM

CVE-2026-20939

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally....

Affected Products : windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 +3 more products
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
7.8

HIGH

CVE-2026-20938

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally....

Affected Products : windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_2h2
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
5.5

MEDIUM

CVE-2026-20937

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally....

Affected Products : windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 +3 more products
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
4.3

MEDIUM

CVE-2026-20936

Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 +8 more products
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
6.2

MEDIUM

CVE-2026-20935

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unauthorized attacker to disclose information locally....

Affected Products : windows_11_23h2 windows_11_24h2 windows_11_25h2
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
7.5

HIGH

CVE-2026-20934

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network....

Affected Products : windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 +5 more products
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
8.8

HIGH

CVE-2025-68707

An authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0 allows unauthenticated network-adjacent attackers to perform arbitrary configuration changes without providing credentials, as long as a valid admin session is ...

Affected Products :
Published: Jan. 13, 2026

Modified: Jan. 16, 2026

Vuln Type: Authentication
5.5

MEDIUM

CVE-2026-20932

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally....

Affected Products : windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 +3 more products
Published: Jan. 13, 2026

Modified: Jan. 16, 2026

Showing 20 of 4364 Results

Browse by Apps

Latest CVE Feed

7.2

8.2

9.8

9.8

6.5

7.3

6.1

8.8

4.3

4.1

6.6

7.8

5.5

7.8

5.5

4.3

6.2

7.5

8.8

5.5

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable