Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 5.3

    MEDIUM
    CVE-2022-43422

    Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenk... Read more

    Affected Products : jenkins compuware_topaz_utilities
    • EPSS Score: %0.21
    • Published: Oct. 19, 2022
    • Modified: May. 08, 2025

  • 5.3

    MEDIUM
    CVE-2022-43421

    A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap projects whose configured repository matches the attacker-specified value.... Read more

    Affected Products : tuleap_git_branch_source
    • EPSS Score: %0.20
    • Published: Oct. 19, 2022
    • Modified: May. 08, 2025

  • 5.4

    MEDIUM
    CVE-2022-43420

    Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to contr... Read more

    • EPSS Score: %7.56
    • Published: Oct. 19, 2022
    • Modified: May. 08, 2025

  • 6.5

    MEDIUM
    CVE-2022-43419

    Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.... Read more

    Affected Products : katalon
    • EPSS Score: %0.12
    • Published: Oct. 19, 2022
    • Modified: May. 08, 2025

  • 4.3

    MEDIUM
    CVE-2022-43418

    A cross-site request forgery (CSRF) vulnerability in Jenkins Katalon Plugin 1.0.33 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored ... Read more

    Affected Products : katalon
    • EPSS Score: %0.08
    • Published: Oct. 19, 2022
    • Modified: May. 08, 2025

  • 4.3

    MEDIUM
    CVE-2022-43417

    Jenkins Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through anoth... Read more

    Affected Products : katalon
    • EPSS Score: %0.13
    • Published: Oct. 19, 2022
    • Modified: May. 08, 2025

  • 7.8

    HIGH
    CVE-2022-3577

    An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller driver. This flaw allows a local user to crash or potentially escalate their privileges on the system. It is in bigben_probe of drivers/hid/hid-bigbenff.c. Th... Read more

    Affected Products : linux_kernel
    • EPSS Score: %0.02
    • Published: Oct. 20, 2022
    • Modified: May. 08, 2025

  • 7.5

    HIGH
    CVE-2022-39823

    An issue was discovered in Softing OPC UA C++ SDK 5.66 through 6.x before 6.10. An OPC/UA browse request exceeding the server limit on continuation points may cause a use-after-free error... Read more

    • EPSS Score: %0.22
    • Published: Oct. 20, 2022
    • Modified: May. 08, 2025

  • 7.5

    HIGH
    CVE-2022-37453

    An issue was discovered in Softing OPC UA C++ SDK before 6.10. A buffer overflow or an excess allocation happens due to unchecked array and matrix bounds in structure data types.... Read more

    • EPSS Score: %0.22
    • Published: Oct. 20, 2022
    • Modified: May. 08, 2025

  • 8.1

    HIGH
    CVE-2022-31690

    Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via th... Read more

    • EPSS Score: %0.21
    • Published: Oct. 31, 2022
    • Modified: May. 08, 2025

  • 6.1

    MEDIUM
    CVE-2022-2627

    The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting.... Read more

    Affected Products : newspaper
    • EPSS Score: %23.64
    • Published: Oct. 31, 2022
    • Modified: May. 08, 2025

  • 4.7

    MEDIUM
    CVE-2024-2159

    The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to... Read more

    Affected Products : sassy_social_share
    • Published: Apr. 26, 2024
    • Modified: May. 08, 2025

  • 6.3

    MEDIUM
    CVE-2024-0905

    The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against unauthenticated and admin-level users... Read more

    Affected Products : fancy_product_designer
    • Published: Apr. 26, 2024
    • Modified: May. 08, 2025

  • 4.7

    MEDIUM
    CVE-2024-3265

    The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configuratio... Read more

    Affected Products : advance_search
    • Published: Apr. 25, 2024
    • Modified: May. 08, 2025

  • 4.8

    MEDIUM
    CVE-2024-3261

    The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripti... Read more

    • Published: Apr. 24, 2024
    • Modified: May. 08, 2025

  • 3.8

    LOW
    CVE-2024-2972

    The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t... Read more

    Affected Products : floating_chat_widget
    • Published: Apr. 24, 2024
    • Modified: May. 08, 2025

  • 5.4

    MEDIUM
    CVE-2024-2402

    The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed... Read more

    Affected Products : better_comments
    • Published: Apr. 24, 2024
    • Modified: May. 08, 2025

  • 6.1

    MEDIUM
    CVE-2023-7253

    The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.... Read more

    Affected Products : import_wp
    • Published: Apr. 24, 2024
    • Modified: May. 08, 2025

  • 9.8

    CRITICAL
    CVE-2025-3220

    A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard.php. The manipulation of the argument Category leads to sql injectio... Read more

    Affected Products : e-diary_management_system
    • Published: Apr. 04, 2025
    • Modified: May. 08, 2025
    • Vuln Type: Injection

  • 9.8

    CRITICAL
    CVE-2025-3217

    A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /registration.php. The manipulation of the argument emailid leads to sql injection. The attack can... Read more

    Affected Products : e-diary_management_system
    • Published: Apr. 04, 2025
    • Modified: May. 08, 2025
    • Vuln Type: Injection
Showing 20 of 291712 Results