Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

8.5

HIGH

CVE-2021-39151

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is a...

Affected Products : fedora debian_linux snapmanager commerce_guided_search retail_xstore_point_of_service communications_cloud_native_core_policy webcenter_portal xstream communications_unified_inventory_management utilities_framework +6 more products
Published: Aug. 23, 2021

Modified: May. 23, 2025
8.5

HIGH

CVE-2021-39144

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is a...

Affected Products : fedora debian_linux snapmanager commerce_guided_search retail_xstore_point_of_service communications_cloud_native_core_policy webcenter_portal xstream communications_unified_inventory_management utilities_framework +6 more products
Actively Exploited

Published: Aug. 23, 2021

Modified: May. 23, 2025
4.7

MEDIUM

CVE-2025-0522

The LikeBot WordPress plugin through 0.85 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack....

Affected Products : likebot
Published: Feb. 06, 2025

Modified: May. 23, 2025

Vuln Type: Cross-Site Request Forgery
8.5

HIGH

CVE-2021-39146

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is a...

Affected Products : fedora debian_linux snapmanager commerce_guided_search retail_xstore_point_of_service communications_cloud_native_core_policy webcenter_portal xstream communications_unified_inventory_management utilities_framework +6 more products
Published: Aug. 23, 2021

Modified: May. 23, 2025
8.5

HIGH

CVE-2021-39148

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is a...

Affected Products : fedora debian_linux snapmanager commerce_guided_search retail_xstore_point_of_service communications_cloud_native_core_policy webcenter_portal xstream communications_unified_inventory_management utilities_framework +6 more products
Published: Aug. 23, 2021

Modified: May. 23, 2025
8.5

HIGH

CVE-2021-39150

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input st...

Affected Products : fedora debian_linux snapmanager commerce_guided_search retail_xstore_point_of_service communications_cloud_native_core_policy webcenter_portal xstream communications_unified_inventory_management utilities_framework +6 more products
Published: Aug. 23, 2021

Modified: May. 23, 2025
8.5

HIGH

CVE-2021-39152

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input st...

Affected Products : fedora debian_linux snapmanager commerce_guided_search retail_xstore_point_of_service communications_cloud_native_core_policy webcenter_portal xstream communications_unified_inventory_management utilities_framework +6 more products
Published: Aug. 23, 2021

Modified: May. 23, 2025
8.5

HIGH

CVE-2021-39154

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is a...

Affected Products : fedora debian_linux snapmanager commerce_guided_search retail_xstore_point_of_service communications_cloud_native_core_policy webcenter_portal xstream communications_unified_inventory_management utilities_framework +6 more products
Published: Aug. 23, 2021

Modified: May. 23, 2025
8.8

HIGH

CVE-2022-30550

An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. ...

Affected Products : debian_linux dovecot
Published: Jul. 17, 2022

Modified: May. 23, 2025
7.1

HIGH

CVE-2024-13352

The Legull WordPress plugin through 1.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin....

Affected Products : legull
Published: Feb. 07, 2025

Modified: May. 23, 2025

Vuln Type: Cross-Site Scripting
6.1

MEDIUM

CVE-2024-13492

The Guten Free Options WordPress plugin through 0.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin....

Affected Products : guten_free_options
Published: Feb. 07, 2025

Modified: May. 23, 2025

Vuln Type: Cross-Site Scripting
3.5

LOW

CVE-2024-55416

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed....

Affected Products : voyager
Published: Jan. 30, 2025

Modified: May. 23, 2025

Vuln Type: Cross-Site Scripting
4.3

MEDIUM

CVE-2024-55417

DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server....

Affected Products : voyager
Published: Jan. 30, 2025

Modified: May. 23, 2025

Vuln Type: Authentication
9.8

CRITICAL

CVE-2025-5099

An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory corruption and potentially arbitrary code execution....

Affected Products :
Published: May. 23, 2025

Modified: May. 23, 2025

Vuln Type: Memory Corruption
9.1

CRITICAL

CVE-2025-5098

PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account without proper authorization....

Affected Products :
Published: May. 23, 2025

Modified: May. 23, 2025

Vuln Type: Authentication
8.8

HIGH

CVE-2025-45472

Insecure permissions in autodeploy-layer v1.2.0 allows attackers to escalate privileges and compromise the customer cloud account....

Affected Products :
Published: May. 22, 2025

Modified: May. 23, 2025

Vuln Type: Authorization
6.1

MEDIUM

CVE-2025-0470

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and ou...

Affected Products : forminator forminator_forms
Published: Jan. 31, 2025

Modified: May. 23, 2025

Vuln Type: Cross-Site Scripting
9.8

CRITICAL

CVE-2025-0493

The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited Local File Inclusion in all versions up to, and including, 4.2.14 via the tabname parameter. This makes it possible for unauthentic...

Affected Products : multivendorx
Published: Jan. 31, 2025

Modified: May. 23, 2025

Vuln Type: Path Traversal
6.1

MEDIUM

CVE-2024-13100

The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin....

Affected Products : opsi_israel_domestic_shipments
Published: Jan. 31, 2025

Modified: May. 23, 2025

Vuln Type: Cross-Site Scripting
4.8

MEDIUM

CVE-2024-12872

The Zalomení WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for ex...

Affected Products : zalomeni
Published: Jan. 31, 2025

Modified: May. 23, 2025

Vuln Type: Cross-Site Scripting

Showing 20 of 293304 Results

1
...
1167
1168
1169
1170
1171
1172
1173
...
14666

Browse by Apps

Latest CVE Feed

8.5

8.5

4.7

8.5

8.5

8.5

8.5

8.5

8.8

7.1

6.1

3.5

4.3

9.8

9.1

8.8

6.1

9.8

6.1

4.8

Theme Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable