Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 7.8

    HIGH
    CVE-2023-3712

    Files or Directories Accessible to External Parties vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Privilege Escalation.This issue affects PM43 versions prior to P10.19.050004.  Update to the latest available firmware ve... Read more

    Affected Products : pm43_firmware pm43
    • Published: Sep. 12, 2023
    • Modified: Sep. 12, 2025

  • 8.8

    HIGH
    CVE-2023-3711

    Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version ... Read more

    Affected Products : pm43_firmware pm43
    • Published: Sep. 12, 2023
    • Modified: Sep. 12, 2025

  • 9.9

    CRITICAL
    CVE-2023-3710

    Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printer... Read more

    Affected Products : pm43_firmware pm43
    • Published: Sep. 12, 2023
    • Modified: Sep. 12, 2025

  • 9.8

    CRITICAL
    CVE-2025-9406

    A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload cau... Read more

    Affected Products : lemon
    • Published: Aug. 25, 2025
    • Modified: Sep. 12, 2025
    • Vuln Type: Misconfiguration

  • 5.5

    MEDIUM
    CVE-2025-9403

    A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been... Read more

    Affected Products : jq
    • Published: Aug. 25, 2025
    • Modified: Sep. 12, 2025
    • Vuln Type: Denial of Service

  • 9.1

    CRITICAL
    CVE-2017-1000190

    SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.... Read more

    Affected Products : solr simplexml
    • Published: Nov. 17, 2017
    • Modified: Sep. 12, 2025

  • 5.5

    MEDIUM
    CVE-2025-9396

    A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing manipulation results in null pointer dereference. The attack is only possible with local access. The... Read more

    Affected Products : lrzip
    • Published: Aug. 24, 2025
    • Modified: Sep. 12, 2025
    • Vuln Type: Denial of Service

  • 5.5

    MEDIUM
    CVE-2025-9394

    A flaw has been found in PoDoFo 1.1.0-dev. This issue affects the function PdfTokenizer::DetermineDataType of the file src/podofo/main/PdfTokenizer.cpp of the component PDF Dictionary Parser. Executing manipulation can lead to use after free. It is possib... Read more

    Affected Products : podofo
    • Published: Aug. 24, 2025
    • Modified: Sep. 12, 2025
    • Vuln Type: Memory Corruption

  • 5.5

    MEDIUM
    CVE-2022-24614

    When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack aga... Read more

    • Published: Feb. 24, 2022
    • Modified: Sep. 12, 2025

  • 7.5

    HIGH
    CVE-2018-1274

    Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests ag... Read more

    • Published: Apr. 18, 2018
    • Modified: Sep. 12, 2025

  • 7.5

    HIGH
    CVE-2019-11272

    Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has ... Read more

    Affected Products : debian_linux spring_security
    • Published: Jun. 26, 2019
    • Modified: Sep. 12, 2025

  • 9.8

    CRITICAL
    CVE-2019-5312

    An issue was discovered in weixin-java-tools v3.3.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file. NOTE: this issue exists because of an incomplete fix for CVE-2018-20318.... Read more

    Affected Products : wxjava
    • Published: Jan. 04, 2019
    • Modified: Sep. 12, 2025

  • 9.8

    CRITICAL
    CVE-2023-42276

    hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray.... Read more

    Affected Products : hutool
    • Published: Sep. 08, 2023
    • Modified: Sep. 12, 2025

  • 7.8

    HIGH
    CVE-2025-50674

    An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowing local authenticated attackers to escalate privileges to root.... Read more

    Affected Products : openmediavault
    • Published: Aug. 22, 2025
    • Modified: Sep. 12, 2025
    • Vuln Type: Authorization

  • 7.5

    HIGH
    CVE-2023-51080

    The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow.... Read more

    Affected Products : hutool
    • Published: Dec. 27, 2023
    • Modified: Sep. 12, 2025

  • 8.1

    HIGH
    CVE-2025-51605

    An issue was discovered in Shopizer 3.2.7. The server's CORS implementation reflects the client-supplied Origin header verbatim into Access-Control-Allow-Origin without any whitelist validation, while also enabling Access-Control-Allow-Credentials: true. ... Read more

    Affected Products : shopizer
    • Published: Aug. 22, 2025
    • Modified: Sep. 12, 2025
    • Vuln Type: Misconfiguration

  • 9.8

    CRITICAL
    CVE-2024-53496

    Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication.... Read more

    Affected Products : my-site
    • Published: Aug. 22, 2025
    • Modified: Sep. 12, 2025
    • Vuln Type: Authentication

  • 8.8

    HIGH
    CVE-2025-52085

    An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but no... Read more

    Affected Products : yoosee
    • Published: Aug. 22, 2025
    • Modified: Sep. 12, 2025
    • Vuln Type: Injection

  • 8.8

    HIGH
    CVE-2025-52287

    OperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability.... Read more

    Affected Products : elite
    • Published: Aug. 22, 2025
    • Modified: Sep. 12, 2025
    • Vuln Type: Misconfiguration

  • 7.3

    HIGH
    CVE-2025-55581

    D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script. The script monitors and respawns the `dcp` and `signalc` binaries without validating their integrity, origin, or pe... Read more

    Affected Products : dcs-825l dcs-825l_firmware
    • Published: Aug. 22, 2025
    • Modified: Sep. 12, 2025
    • Vuln Type: Authentication
Showing 20 of 293613 Results