Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

8.7

HIGH

CVE-2025-13161

IQ-Support developed by IQ Service International has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files....

Affected Products :
Published: Nov. 14, 2025

Modified: Nov. 14, 2025

Vuln Type: Path Traversal
5.3

MEDIUM

CVE-2025-41069

Insecure Direct Object Reference (IDOR) vulnerability in DeporSite of T-INNOVA. This vulnerability allows an attacker to access or modify unauthorized resources by manipulating requests using the 'idUsuario' parameter in ‘/ajax/TInnova_v2/Formulario_Conse...

Affected Products :
Published: Nov. 13, 2025

Modified: Nov. 14, 2025

Vuln Type: Authorization
5.0

MEDIUM

CVE-2025-64706

Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token...

Affected Products :
Published: Nov. 13, 2025

Modified: Nov. 14, 2025

Vuln Type: Authorization
4.3

MEDIUM

CVE-2025-12015

The Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_wpqai_disconnect_quicq_...

Affected Products :
Published: Nov. 13, 2025

Modified: Nov. 14, 2025

Vuln Type: Authorization
5.1

MEDIUM

CVE-2025-60686

A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.614_B20230630, LR1200GB V9.1.0u.6619_B20230130, and NR1800X V9.1.0u.6681_B20230703). Both programs parse the contents...

Affected Products :
Published: Nov. 13, 2025

Modified: Nov. 14, 2025

Vuln Type: Memory Corruption
4.3

MEDIUM

CVE-2025-64739

External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access....

Affected Products : rooms meeting_software_development_kit virtual_desktop_infrastructure vdi_windows_meeting_clients meeting_sdk workplace_desktop rooms_controller workplace_virtual_desktop_infrastructure
Published: Nov. 13, 2025

Modified: Nov. 14, 2025

Vuln Type: Information Disclosure
8.5

HIGH

CVE-2025-13130

A vulnerability has been found in Radarr 5.28.0.10274. The affected element is an unknown function of the file C:\ProgramData\Radarr\bin\Radarr.Console.exe of the component Service. Such manipulation leads to incorrect default permissions. The attack can ...

Affected Products :
Published: Nov. 13, 2025

Modified: Nov. 14, 2025

Vuln Type: Misconfiguration
4.3

MEDIUM

CVE-2025-64749

Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The `/items/{collection}` API returns differe...

Affected Products : directus
Published: Nov. 13, 2025

Modified: Nov. 14, 2025

Vuln Type: Information Disclosure
7.0

HIGH

CVE-2025-62217

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 +8 more products
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
7.0

HIGH

CVE-2025-62218

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally....

Affected Products : windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
7.0

HIGH

CVE-2025-62219

Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally....

Affected Products : windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
8.8

HIGH

CVE-2025-62220

Heap-based buffer overflow in Windows Subsystem for Linux GUI allows an unauthorized attacker to execute code over a network....

Affected Products : windows_subsystem_for_linux windows_subsystem_for_linux_gui
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
8.8

HIGH

CVE-2025-62222

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network....

Affected Products : visual_studio_code_copilot_chat_extension github_copilot_chat
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
8.0

HIGH

CVE-2025-62452

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 +8 more products
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
5.0

MEDIUM

CVE-2025-62453

Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally....

Affected Products : visual_studio_code
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
6.5

MEDIUM

CVE-2025-43205

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in watchOS 11.4, tvOS 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4. An app may be able to bypass ASLR....

Affected Products : iphone_os tvos watchos ipados visionos
Published: Nov. 12, 2025

Modified: Nov. 14, 2025

Vuln Type: Memory Corruption
7.5

HIGH

CVE-2024-12125

A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information....

Affected Products :
Published: Nov. 06, 2025

Modified: Nov. 14, 2025

Vuln Type: Cross-Site Request Forgery
5.3

MEDIUM

CVE-2025-10259

Improper Validation of Specified Quantity in Input vulnerability in TCP Communication Function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote attacker to disconnect the connection by sending specially crafted TCP packets ...

Affected Products : melsec_iq-fx5u-32mt\/es_firmware melsec_iq-fx5u-32mt\/ds_firmware melsec_iq-fx5u-32mt\/ess_firmware melsec_iq-fx5u-32mt\/dss_firmware melsec_iq-fx5u-32mr\/es_firmware melsec_iq-fx5u-32mr\/ds_firmware melsec_iq-fx5u-64mt\/es_firmware melsec_iq-fx5u-64mt\/ds_firmware melsec_iq-fx5u-64mt\/ess_firmware melsec_iq-fx5u-64mt\/dss_firmware +11 more products
Published: Nov. 06, 2025

Modified: Nov. 14, 2025

Vuln Type: Denial of Service
7.0

HIGH

CVE-2025-62215

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 +1 more products
Actively Exploited

Published: Nov. 11, 2025

Modified: Nov. 14, 2025
9.1

CRITICAL

CVE-2025-12480

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete....

Affected Products : triofox
Actively Exploited

Published: Nov. 10, 2025

Modified: Nov. 14, 2025

Vuln Type: Authorization

Showing 20 of 3947 Results

Browse by Apps

Latest CVE Feed

8.7

5.3

5.0

4.3

5.1

4.3

8.5

4.3

7.0

7.0

7.0

8.8

8.8

8.0

5.0

6.5

7.5

5.3

7.0

9.1

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable