Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

8.7

HIGH

CVE-2025-11898

Agentflow developed by Flowring has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files....

Affected Products : agentflow
Published: Oct. 17, 2025

Modified: Oct. 17, 2025

Vuln Type: Path Traversal
5.3

MEDIUM

CVE-2025-6894

An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authorization logic of the affected device allows an authenticated, low-privileged user to execute the administ...

Affected Products : tn-4900_firmware
Published: Oct. 17, 2025

Modified: Oct. 17, 2025

Vuln Type: Authorization
9.3

CRITICAL

CVE-2025-6893

An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in broken access control has been identified in the /api/v1/setting/data endpoint of the affected device. This flaw allows...

Affected Products : tn-4900_firmware
Published: Oct. 17, 2025

Modified: Oct. 17, 2025

Vuln Type: Authorization
8.7

HIGH

CVE-2025-6892

An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authentication mechanism allows unauthorized access to protected API endpoints, including those intended for administrative f...

Affected Products : tn-4900_firmware
Published: Oct. 17, 2025

Modified: Oct. 17, 2025

Vuln Type: Authorization
8.1

HIGH

CVE-2025-62506

MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege escalation vulnerability allows service accounts and STS (Security Token Service) accounts with restricted session policies to bypass the...

Affected Products : minio
Published: Oct. 16, 2025

Modified: Oct. 16, 2025

Vuln Type: Authorization
6.5

MEDIUM

CVE-2025-62504

Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script executing in the response phase rewrites a response body so that i...

Affected Products : envoy
Published: Oct. 16, 2025

Modified: Oct. 16, 2025

Vuln Type: Memory Corruption
2.1

LOW

CVE-2025-11896

In Xpdf 4.05 (and earlier), a PDF object loop in a CMap, via the "UseCMap" entry, leads to infinite recursion and a stack overflow....

Affected Products : xpdf
Published: Oct. 16, 2025

Modified: Oct. 16, 2025

Vuln Type: Denial of Service
6.1

MEDIUM

CVE-2025-43280

The issue was resolved by not loading remote images This issue is fixed in iOS 18.6 and iPadOS 18.6. Forwarding an email could display remote images in Mail in Lockdown Mode....

Affected Products : iphone_os ipados
Published: Oct. 15, 2025

Modified: Oct. 16, 2025

Vuln Type: Misconfiguration
7.5

HIGH

CVE-2025-11864

A vulnerability was identified in NucleoidAI Nucleoid up to 0.7.10. The impacted element is the function extension.apply of the file /src/cluster.ts of the component Outbound Request Handler. Such manipulation of the argument https/ip/port/path/headers le...

Affected Products :
Published: Oct. 16, 2025

Modified: Oct. 16, 2025

Vuln Type: Server-Side Request Forgery
5.5

MEDIUM

CVE-2024-42192

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications....

Affected Products :
Published: Oct. 16, 2025

Modified: Oct. 16, 2025

Vuln Type: Information Disclosure
7.8

HIGH

CVE-2025-59238

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally....

Affected Products : office 365_apps powerpoint office_long_term_servicing_channel office_2024 office_2021 office_2019 powerpoint_2016
Published: Oct. 14, 2025

Modified: Oct. 16, 2025
7.8

HIGH

CVE-2025-59243

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally....

Affected Products : 365_apps office_long_term_servicing_channel office_2024 office_2021
Published: Oct. 14, 2025

Modified: Oct. 16, 2025
7.0

HIGH

CVE-2025-59221

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally....

Affected Products : office word sharepoint_server 365_apps office_long_term_servicing_channel office_macos_2024 office_macos_2021 sharepoint_server_2016 word_2016 sharepoint_server_2019 +3 more products
Published: Oct. 14, 2025

Modified: Oct. 16, 2025
7.8

HIGH

CVE-2025-59222

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally....

Affected Products : office word sharepoint_server 365_apps office_long_term_servicing_channel office_macos_2024 office_macos_2021 sharepoint_server_2016 word_2016 sharepoint_server_2019 +3 more products
Published: Oct. 14, 2025

Modified: Oct. 16, 2025
7.1

HIGH

CVE-2025-59232

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally....

Affected Products : office access sharepoint_server 365_apps excel office_online_server office_long_term_servicing_channel office_macos_2024 office_macos_2021 sharepoint_server_2016 +6 more products
Published: Oct. 14, 2025

Modified: Oct. 16, 2025
7.1

HIGH

CVE-2025-59235

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally....

Affected Products : office access sharepoint_server 365_apps excel office_online_server office_long_term_servicing_channel office_macos_2024 office_macos_2021 sharepoint_server_2016 +6 more products
Published: Oct. 14, 2025

Modified: Oct. 16, 2025
9.6

CRITICAL

CVE-2025-59218

Azure Entra ID Elevation of Privilege Vulnerability...

Affected Products : microsoft_entra_id entra_id
Published: Oct. 09, 2025

Modified: Oct. 16, 2025
9.8

CRITICAL

CVE-2025-59246

Azure Entra ID Elevation of Privilege Vulnerability...

Affected Products : microsoft_entra_id entra_id
Published: Oct. 09, 2025

Modified: Oct. 16, 2025
10.0

CRITICAL

CVE-2025-10035

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection....

Affected Products : goanywhere_managed_file_transfer
Actively Exploited

Published: Sep. 18, 2025

Modified: Oct. 16, 2025

Vuln Type: Injection
7.8

HIGH

CVE-2025-50175

Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_22h2 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 +3 more products
Published: Oct. 14, 2025

Modified: Oct. 16, 2025

Showing 20 of 3947 Results

Browse by Apps

Latest CVE Feed

8.7

5.3

9.3

8.7

8.1

6.5

2.1

6.1

7.5

5.5

7.8

7.8

7.0

7.8

7.1

7.1

9.6

9.8

10.0

7.8

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable