Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

7.8

HIGH

CVE-2026-20809

Time-of-check time-of-use (toctou) race condition in Windows Kernel Memory allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 +5 more products
Published: Jan. 13, 2026

Modified: Jan. 14, 2026
7.0

HIGH

CVE-2026-20808

Concurrent execution using shared resource with improper synchronization ('race condition') in Printer Association Object allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 windows_11_25h2
Published: Jan. 13, 2026

Modified: Jan. 14, 2026
9.3

CRITICAL

CVE-2023-53982

PMB 7.4.6 contains a SQL injection vulnerability in the storage parameter of the ajax.php endpoint that allows remote attackers to manipulate database queries. Attackers can exploit the unsanitized 'id' parameter by injecting conditional sleep statements ...

Affected Products : pmb
Published: Dec. 23, 2025

Modified: Jan. 14, 2026

Vuln Type: Injection
7.7

HIGH

CVE-2026-20804

Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally....

Affected Products : windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 +3 more products
Published: Jan. 13, 2026

Modified: Jan. 14, 2026
8.5

HIGH

CVE-2023-53937

Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to o...

Affected Products : hubstaff
Published: Dec. 18, 2025

Modified: Jan. 14, 2026

Vuln Type: Misconfiguration
7.5

HIGH

CVE-2026-0386

Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_server_2022 windows_server_2022_23h2 windows_server_23h2 windows_server_2012_r2 windows_server_2008_r2 windows_server_2008_sp2 +1 more products
Published: Jan. 13, 2026

Modified: Jan. 14, 2026
8.4

HIGH

CVE-2026-20953

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally....

Affected Products : office 365_apps office_long_term_servicing_channel office_macos_2024 office_macos_2021 office_2016 office_2024 office_2021 office_2019
Published: Jan. 13, 2026

Modified: Jan. 14, 2026
8.4

HIGH

CVE-2026-20952

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally....

Affected Products : office 365_apps office_long_term_servicing_channel office_macos_2024 office_macos_2021 office_2016 office_2024 office_2021 office_2019
Published: Jan. 13, 2026

Modified: Jan. 14, 2026
7.8

HIGH

CVE-2026-20950

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally....

Affected Products : office 365_apps excel office_online_server office_long_term_servicing_channel office_macos_2024 office_macos_2021 excel_2016 office_2024 office_2021 +1 more products
Published: Jan. 13, 2026

Modified: Jan. 14, 2026
7.8

HIGH

CVE-2026-20955

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally....

Affected Products : office 365_apps office_online_server office_long_term_servicing_channel office_macos_2024 office_macos_2021 office_2024 office_2021 office_2019
Published: Jan. 13, 2026

Modified: Jan. 14, 2026
7.8

HIGH

CVE-2026-20956

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally....

Affected Products : 365_apps office_long_term_servicing_channel office_macos_2024 office_macos_2021 office_2024 office_2021
Published: Jan. 13, 2026

Modified: Jan. 14, 2026
7.8

HIGH

CVE-2026-20957

Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally....

Affected Products : office 365_apps excel office_online_server office_long_term_servicing_channel office_macos_2024 office_macos_2021 excel_2016 office_2024 office_2021 +1 more products
Published: Jan. 13, 2026

Modified: Jan. 14, 2026
8.8

HIGH

CVE-2019-25254

KYOCERA Net Admin 3.4.0906 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft malicious web pages that automatically submit forms to add new admin...

Affected Products : net_admin
Published: Dec. 24, 2025

Modified: Jan. 14, 2026

Vuln Type: Cross-Site Request Forgery
7.5

HIGH

CVE-2019-25253

KYOCERA Net Admin 3.4.0906 contains an XML External Entity (XXE) injection vulnerability in the Multi-Set Template Editor that allows unauthenticated attackers to read arbitrary system files. Attackers can craft a malicious XML file with external entity r...

Affected Products : net_admin
Published: Dec. 24, 2025

Modified: Jan. 14, 2026

Vuln Type: XML External Entity
6.1

MEDIUM

CVE-2026-22198

GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value (for example, to /api/v1/ticket.php), an ...

Affected Products : gestsup
Published: Jan. 09, 2026

Modified: Jan. 14, 2026

Vuln Type: Cross-Site Scripting
7.5

HIGH

CVE-2025-66866

An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file....

Affected Products : binutils
Published: Dec. 29, 2025

Modified: Jan. 14, 2026

Vuln Type: Denial of Service
8.1

HIGH

CVE-2026-22197

GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality. Multiple request parameters used to filter, search, or sort assets are incorporated into SQL queries without sufficient neutralization, allowi...

Affected Products : gestsup
Published: Jan. 09, 2026

Modified: Jan. 14, 2026

Vuln Type: Injection
7.5

HIGH

CVE-2025-66865

An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file....

Affected Products : binutils
Published: Dec. 29, 2025

Modified: Jan. 14, 2026

Vuln Type: Denial of Service
7.5

HIGH

CVE-2025-66864

An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file....

Affected Products : binutils
Published: Dec. 29, 2025

Modified: Jan. 14, 2026

Vuln Type: Denial of Service
7.5

HIGH

CVE-2025-66863

An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file....

Affected Products : binutils
Published: Dec. 29, 2025

Modified: Jan. 14, 2026

Vuln Type: Denial of Service

Showing 20 of 4680 Results

Browse by Apps

Latest CVE Feed

7.8

7.0

9.3

7.7

8.5

7.5

8.4

8.4

7.8

7.8

7.8

7.8

8.8

7.5

6.1

7.5

8.1

7.5

7.5

7.5

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable