Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

7.8

HIGH

CVE-2025-62462

Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 +1 more products
Published: Dec. 09, 2025

Modified: Dec. 10, 2025
6.5

MEDIUM

CVE-2025-62463

Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally....

Affected Products : windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 windows_11_25h2
Published: Dec. 09, 2025

Modified: Dec. 10, 2025
7.8

HIGH

CVE-2025-62464

Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 +1 more products
Published: Dec. 09, 2025

Modified: Dec. 10, 2025
6.5

MEDIUM

CVE-2025-62465

Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally....

Affected Products : windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 windows_11_25h2
Published: Dec. 09, 2025

Modified: Dec. 10, 2025
8.4

HIGH

CVE-2025-62554

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally....

Affected Products : office 365_apps office_long_term_servicing_channel office_macos_2024 office_macos_2021 office_2016 office_2024 office_2021 office_2019
Published: Dec. 09, 2025

Modified: Dec. 10, 2025
7.0

HIGH

CVE-2025-62555

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally....

Affected Products : office word sharepoint_server 365_apps office_long_term_servicing_channel office_macos_2024 office_macos_2021 sharepoint_server_2016 word_2016 sharepoint_server_2019 +3 more products
Published: Dec. 09, 2025

Modified: Dec. 10, 2025
7.5

HIGH

CVE-2025-63036

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DFDevelopment Ronneby Theme Core ronneby-core allows PHP Local File Inclusion.This issue affects Ronneby Theme Core: from n/a through ...

Affected Products :
Published: Dec. 09, 2025

Modified: Dec. 10, 2025

Vuln Type: Path Traversal
5.4

MEDIUM

CVE-2025-63034

Missing Authorization vulnerability in Steve Truman Page View Count page-views-count allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page View Count: from n/a through <= 2.8.7....

Affected Products : page_view_count
Published: Dec. 09, 2025

Modified: Dec. 10, 2025

Vuln Type: Authorization
4.3

MEDIUM

CVE-2025-63025

Missing Authorization vulnerability in Xagio SEO Xagio SEO xagio-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xagio SEO: from n/a through <= 7.1.0.29....

Affected Products :
Published: Dec. 09, 2025

Modified: Dec. 10, 2025

Vuln Type: Authorization
5.4

MEDIUM

CVE-2025-63024

Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: f...

Affected Products :
Published: Dec. 09, 2025

Modified: Dec. 10, 2025

Vuln Type: Authorization
2.7

LOW

CVE-2025-36102

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input into the application as trusted data, due to client-side enforcement of server-side security....

Affected Products : cognos_controller controller
Published: Dec. 08, 2025

Modified: Dec. 10, 2025

Vuln Type: Authorization
4.3

MEDIUM

CVE-2025-33111

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations which may expose sensitive information to an authenticated user due to race condition attacks....

Affected Products : cognos_controller controller
Published: Dec. 08, 2025

Modified: Dec. 10, 2025

Vuln Type: Race Condition
6.5

MEDIUM

CVE-2025-36015

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified quantity size input....

Affected Products : cognos_controller controller
Published: Dec. 08, 2025

Modified: Dec. 10, 2025

Vuln Type: Denial of Service
6.5

MEDIUM

CVE-2025-36017

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obtained by an authenticated user....

Affected Products : controller
Published: Dec. 08, 2025

Modified: Dec. 10, 2025

Vuln Type: Information Disclosure
9.0

HIGH

CVE-2025-14133

A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this vulnerability is the function AP_get_wireless_clientlist_setClientsName of the file mod_form.s...

Affected Products : re6500_firmware re6300_firmware re6300 re6500 re9000_firmware re9000 re6250_firmware re6250 re6350_firmware re6350 +2 more products
Published: Dec. 06, 2025

Modified: Dec. 10, 2025

Vuln Type: Memory Corruption
9.0

HIGH

CVE-2025-14134

A vulnerability was determined in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this issue is the function RE2000v2Repeater_get_wireless_clientlist_setClientsName of the file...

Affected Products : re6500_firmware re6300_firmware re6300 re6500 re9000_firmware re9000 re6250_firmware re6250 re6350_firmware re6350 +2 more products
Published: Dec. 06, 2025

Modified: Dec. 10, 2025

Vuln Type: Memory Corruption
9.0

HIGH

CVE-2025-14135

A vulnerability was identified in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function AP_get_wired_clientlist_setClientsName of the file mod_form.so. The manipulation...

Affected Products : re6500_firmware re6300_firmware re6300 re6500 re9000_firmware re9000 re6250_firmware re6250 re6350_firmware re6350 +2 more products
Published: Dec. 06, 2025

Modified: Dec. 10, 2025

Vuln Type: Memory Corruption
9.0

HIGH

CVE-2025-14136

A security flaw has been discovered in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function RE2000v2Repeater_get_wired_clientlist_setClientsName of the f...

Affected Products : re6500_firmware re6300_firmware re6300 re6500 re9000_firmware re9000 re6250_firmware re6250 re6350_firmware re6350 +2 more products
Published: Dec. 06, 2025

Modified: Dec. 10, 2025

Vuln Type: Memory Corruption
8.8

HIGH

CVE-2025-14193

A vulnerability was determined in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file /view_personnel.php. Executing manipulation of the argument per_id can lead to sql injection. The attack can be lau...

Affected Products : employee_profile_management_system employee_profile_management_system
Published: Dec. 07, 2025

Modified: Dec. 10, 2025

Vuln Type: Injection
5.4

MEDIUM

CVE-2025-14194

A vulnerability was identified in code-projects Employee Profile Management System 1.0. This issue affects some unknown processing of the file /view_personnel.php. The manipulation of the argument per_address/dr_school/other_school leads to cross site scr...

Affected Products : employee_profile_management_system employee_profile_management_system
Published: Dec. 07, 2025

Modified: Dec. 10, 2025

Vuln Type: Cross-Site Scripting

Showing 20 of 4039 Results

Browse by Apps

Latest CVE Feed

7.8

6.5

7.8

6.5

8.4

7.0

7.5

5.4

4.3

5.4

2.7

4.3

6.5

6.5

9.0

9.0

9.0

9.0

8.8

5.4

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable