Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 7.5

    HIGH
    CVE-2025-28220

    Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the setcfm function, which allows remote attackers to cause web server crash via parameter funcpara1 passed to the binary through a POST request.... Read more

    Affected Products : w6-s_firmware w6-s
    • Published: Mar. 28, 2025
    • Modified: May. 06, 2025
    • Vuln Type: Denial of Service

  • 8.1

    HIGH
    CVE-2024-1557

    Memory safety bugs present in Firefox 122. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 123.... Read more

    Affected Products : firefox
    • Published: Feb. 20, 2024
    • Modified: May. 06, 2025

  • 5.9

    MEDIUM
    CVE-2024-34535

    In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.... Read more

    Affected Products : mastodon
    • Published: Oct. 03, 2024
    • Modified: May. 06, 2025

  • 7.5

    HIGH
    CVE-2024-23526

    An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory. ... Read more

    Affected Products : avalanche
    • Published: Apr. 19, 2024
    • Modified: May. 06, 2025

  • 8.8

    HIGH
    CVE-2024-24994

    A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. ... Read more

    Affected Products : avalanche
    • Published: Apr. 19, 2024
    • Modified: May. 06, 2025

  • 8.8

    HIGH
    CVE-2024-24992

    A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.... Read more

    Affected Products : avalanche
    • Published: Apr. 19, 2024
    • Modified: May. 06, 2025

  • 8.8

    HIGH
    CVE-2024-23535

    A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. ... Read more

    Affected Products : avalanche
    • Published: Apr. 19, 2024
    • Modified: May. 06, 2025

  • 6.5

    MEDIUM
    CVE-2024-24991

    A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform denial of service attacks. ... Read more

    Affected Products : avalanche
    • Published: Apr. 19, 2024
    • Modified: May. 06, 2025

  • 5.9

    MEDIUM
    CVE-2024-44046

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themify Themify – WooCommerce Product Filter allows Stored XSS.This issue affects Themify – WooCommerce Product Filter: from n/a through 1.5.1.... Read more

    Affected Products : woocommerce_product_filter
    • Published: Oct. 06, 2024
    • Modified: May. 06, 2025

  • 8.8

    HIGH
    CVE-2024-24843

    Cross-Site Request Forgery (CSRF) vulnerability in PowerPack Addons for Elementor PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: from n/a before 2.10.8. ... Read more

    • Published: Feb. 21, 2024
    • Modified: May. 06, 2025

  • 8.8

    HIGH
    CVE-2024-24997

    A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. ... Read more

    Affected Products : avalanche
    • Published: Apr. 19, 2024
    • Modified: May. 06, 2025

  • 8.8

    HIGH
    CVE-2024-24998

    A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. ... Read more

    Affected Products : avalanche
    • Published: Apr. 19, 2024
    • Modified: May. 06, 2025

  • 8.8

    HIGH
    CVE-2024-24849

    Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1. ... Read more

    Affected Products : quicksand_post_filter_jquery
    • Published: Feb. 21, 2024
    • Modified: May. 06, 2025

  • 4.8

    MEDIUM
    CVE-2024-5968

    The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_htm... Read more

    Affected Products : photo_gallery
    • Published: Oct. 09, 2024
    • Modified: May. 06, 2025

  • 8.8

    HIGH
    CVE-2024-24876

    Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor.This issue affects Admin Menu Editor: from n/a through 1.12. ... Read more

    Affected Products : admin_menu_editor admin_menu_editor
    • Published: Feb. 21, 2024
    • Modified: May. 06, 2025

  • 4.4

    MEDIUM
    CVE-2025-25062

    An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaS... Read more

    Affected Products : backdrop
    • Published: Feb. 03, 2025
    • Modified: May. 06, 2025
    • Vuln Type: Cross-Site Scripting

  • 8.8

    HIGH
    CVE-2024-24999

    A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. ... Read more

    Affected Products : avalanche
    • Published: Apr. 19, 2024
    • Modified: May. 06, 2025

  • 8.8

    HIGH
    CVE-2022-3304

    Use after free in CSS in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)... Read more

    Affected Products : chrome edge_chromium
    • EPSS Score: %0.35
    • Published: Nov. 01, 2022
    • Modified: May. 06, 2025

  • 7.8

    HIGH
    CVE-2022-32947

    The issue was addressed with improved memory handling. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13, watchOS 9.1. An app may be able to execute arbitrary code with kernel privileges.... Read more

    Affected Products : macos iphone_os watchos ipados
    • EPSS Score: %0.25
    • Published: Nov. 01, 2022
    • Modified: May. 06, 2025

  • 5.5

    MEDIUM
    CVE-2022-32946

    This issue was addressed with improved entitlements. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to record audio using a pair of connected AirPods.... Read more

    Affected Products : iphone_os ipados
    • EPSS Score: %0.07
    • Published: Nov. 01, 2022
    • Modified: May. 06, 2025
Showing 20 of 291360 Results