Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

6.1

MEDIUM

CVE-2025-60934

Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Employee Notes, ti...

Affected Products :
Published: Oct. 21, 2025

Modified: Oct. 21, 2025

Vuln Type: Cross-Site Scripting
6.1

MEDIUM

CVE-2025-60933

Multiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Goal Name, Goal ...

Affected Products :
Published: Oct. 21, 2025

Modified: Oct. 21, 2025

Vuln Type: Cross-Site Scripting
6.1

MEDIUM

CVE-2025-60932

Multiple stored cross-site scripting (XSS) vulnerabilities in the Current Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Goal Name, Goal...

Affected Products :
Published: Oct. 21, 2025

Modified: Oct. 21, 2025

Vuln Type: Cross-Site Scripting
7.5

HIGH

CVE-2025-60751

GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode....

Affected Products :
Published: Oct. 21, 2025

Modified: Oct. 21, 2025

Vuln Type: Memory Corruption
6.6

MEDIUM

CVE-2025-60344

An unauthenticated Local File Inclusion (LFI) vulnerability in D-Link DSR series routers allows remote attackers to retrieve sensitive configuration files in clear text. The exposed files contain administrative credentials, VPN settings, and other sensiti...

Affected Products :
Published: Oct. 21, 2025

Modified: Oct. 21, 2025

Vuln Type: Path Traversal
6.5

MEDIUM

CVE-2025-56450

Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the `lead_id` parameter in the `/l2s/api/selfcareLeadHistory` endpoint. A remote attacker can exploit this by sending a specially crafted POST request, resulti...

Affected Products :
Published: Oct. 21, 2025

Modified: Oct. 21, 2025

Vuln Type: Injection
8.7

HIGH

CVE-2025-61974

When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated....

Affected Products : big-ip_access_policy_manager big-ip_next_service_proxy_for_kubernetes big-ip_next_cloud-native_network_functions big-ip_next_for_kubernetes
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-61960

When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not ...

Affected Products : big-ip_access_policy_manager
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
9.1

CRITICAL

CVE-2025-61958

A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to a bash shell. For BIG-IP systems running in Appliance mode, a successful exp...

Affected Products : big-ip_access_policy_manager big-ip_advanced_firewall_manager big-ip_analytics big-ip_application_acceleration_manager big-ip_application_security_manager big-ip_domain_name_system big-ip_fraud_protection_service big-ip_global_traffic_manager big-ip_link_controller big-ip_local_traffic_manager +11 more products
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Authentication
8.8

HIGH

CVE-2025-61955

A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have rea...

Affected Products : f5os-a f5os-c
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Authorization
8.7

HIGH

CVE-2025-61951

Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. This issue may occur when a Datagram Transport Layer Security (DTLS) 1.2 virtual server is enabled with a Server SSL profile that is configured with a certificate, key, ...

Affected Products : big-ip_access_policy_manager big-ip_advanced_firewall_manager big-ip_analytics big-ip_application_acceleration_manager big-ip_application_security_manager big-ip_domain_name_system big-ip_fraud_protection_service big-ip_global_traffic_manager big-ip_link_controller big-ip_local_traffic_manager +11 more products
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-61938

When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement setting, either manually or through the automatic Policy Builder, the bd process can terminate repe...

Affected Products : big-ip_access_policy_manager big-ip_application_security_manager big-ip_advanced_web_application_firewall
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
6.9

MEDIUM

CVE-2025-62699

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Translate Extension allows Footprinting. Translate extension appears to use jobs to make edits to translation pages. This causes the CheckUser...

Affected Products :
Published: Oct. 21, 2025

Modified: Oct. 21, 2025
6.9

MEDIUM

CVE-2025-62694

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Extension allows Stored XSS.This issue affects Mediawiki - WikiLove Extension: 1.39....

Affected Products :
Published: Oct. 21, 2025

Modified: Oct. 21, 2025
9.3

CRITICAL

CVE-2025-11534

The affected Raisecom devices allow SSH sessions to be established without completing user authentication. This could allow attackers to gain shell access without valid credentials....

Affected Products :
Published: Oct. 21, 2025

Modified: Oct. 21, 2025

Vuln Type: Authentication
8.7

HIGH

CVE-2025-53521

When a BIG-IP APM Access Policy is configured on a virtual server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated....

Affected Products : big-ip_access_policy_manager big-ip_advanced_firewall_manager big-ip_analytics big-ip_application_acceleration_manager big-ip_application_security_manager big-ip_domain_name_system big-ip_fraud_protection_service big-ip_global_traffic_manager big-ip_link_controller big-ip_local_traffic_manager +11 more products
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-53856

When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to t...

Affected Products : big-ip_access_policy_manager big-ip_advanced_firewall_manager big-ip_analytics big-ip_application_acceleration_manager big-ip_application_security_manager big-ip_domain_name_system big-ip_fraud_protection_service big-ip_global_traffic_manager big-ip_link_controller big-ip_local_traffic_manager +11 more products
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
6.5

MEDIUM

CVE-2025-54805

When an iRule is configured on a virtual server via the declarative API, upon re-instantiation, the cleanup process can cause an increase in the Traffic Management Microkernel (TMM) memory resource utilization. Note: Software versions which have reached ...

Affected Products : big-ip_next_service_proxy_for_kubernetes big-ip_next_cloud-native_network_functions big-ip_next_for_kubernetes
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Misconfiguration
8.7

HIGH

CVE-2025-54858

When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed JSON schema, and the security policy is applied to a virtual server, undisclosed requests can cause the bd process to terminate. Note...

Affected Products : big-ip_access_policy_manager big-ip_application_security_manager big-ip_advanced_web_application_firewall
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-55036

When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled, undisclosed traffic may cause memory corruption. Note: Software versions which have reached End of Technical Support (EoTS) ar...

Affected Products : big-ip_access_policy_manager big-ip_ssl_orchestrator
Published: Oct. 15, 2025

Modified: Oct. 21, 2025

Vuln Type: Memory Corruption

Showing 20 of 4059 Results

Browse by Apps

Latest CVE Feed

6.1

6.1

6.1

7.5

6.6

6.5

8.7

8.7

9.1

8.8

8.7

8.7

6.9

6.9

9.3

8.7

8.7

6.5

8.7

8.7

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable