Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 5.5

    MEDIUM
    CVE-2024-57360

    https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: `nm --without-symbol-version` function.... Read more

    Affected Products :
    • Published: Jan. 21, 2025
    • Modified: Mar. 18, 2025

  • 9.1

    CRITICAL
    CVE-2024-55959

    Northern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions.... Read more

    Affected Products :
    • Published: Jan. 21, 2025
    • Modified: Mar. 18, 2025

  • 4.8

    MEDIUM
    CVE-2024-55958

    Northern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.21.5, and below allows XSS. The fixed versions are 3.24.1 and 3.21.6.... Read more

    Affected Products :
    • Published: Jan. 21, 2025
    • Modified: Jan. 22, 2025

  • 5.4

    MEDIUM
    CVE-2024-48392

    OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover.... Read more

    Affected Products :
    • Published: Jan. 21, 2025
    • Modified: Jan. 22, 2025

  • 5.4

    MEDIUM
    CVE-2024-21245

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with networ... Read more

    Affected Products : jd_edwards_enterpriseone_tools
    • Published: Jan. 21, 2025
    • Modified: Mar. 17, 2025

  • 9.1

    CRITICAL
    CVE-2025-24024

    Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration components if enab... Read more

    Affected Products : mjolnir
    • Published: Jan. 21, 2025
    • Modified: Jan. 21, 2025

  • 9.8

    CRITICAL
    CVE-2024-42936

    The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker message.... Read more

    Affected Products : reyee_os rg-ew300n
    • Published: Jan. 21, 2025
    • Modified: Jun. 18, 2025

  • 6.1

    MEDIUM
    CVE-2023-45908

    Homarr before v0.14.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notebook widget.... Read more

    Affected Products :
    • Published: Jan. 21, 2025
    • Modified: Jan. 21, 2025

  • 7.6

    HIGH
    CVE-2025-23369

    An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already... Read more

    Affected Products : enterprise_server
    • Published: Jan. 21, 2025
    • Modified: Feb. 05, 2025

  • 5.5

    MEDIUM
    CVE-2024-55504

    An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote control and unauthorized access to sensitive user data via the exploit_combined.dylib component on MacOS.... Read more

    Affected Products :
    • Published: Jan. 21, 2025
    • Modified: Feb. 04, 2025

  • 6.4

    MEDIUM
    CVE-2024-51417

    An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields.... Read more

    Affected Products :
    • Published: Jan. 21, 2025
    • Modified: Feb. 04, 2025

  • 6.5

    MEDIUM
    CVE-2025-24461

    In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint... Read more

    Affected Products : teamcity
    • Published: Jan. 21, 2025
    • Modified: Jan. 30, 2025

  • 4.3

    MEDIUM
    CVE-2025-24460

    In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool... Read more

    Affected Products : teamcity
    • Published: Jan. 21, 2025
    • Modified: Jan. 30, 2025

  • 6.1

    MEDIUM
    CVE-2025-24459

    In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page... Read more

    Affected Products : teamcity
    • Published: Jan. 21, 2025
    • Modified: Jan. 30, 2025

  • 7.8

    HIGH
    CVE-2025-24458

    In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration... Read more

    Affected Products : youtrack
    • Published: Jan. 21, 2025
    • Modified: Jan. 30, 2025

  • 5.5

    MEDIUM
    CVE-2025-24457

    In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs... Read more

    Affected Products : youtrack
    • Published: Jan. 21, 2025
    • Modified: Jan. 30, 2025

  • 8.8

    HIGH
    CVE-2025-24456

    In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping... Read more

    Affected Products : hub
    • Published: Jan. 21, 2025
    • Modified: Jan. 30, 2025

  • 6.1

    MEDIUM
    CVE-2025-24020

    WeGIA is a Web manager for charitable institutions. An Open Redirect vulnerability was identified in the `control.php` endpoint of versions up to and including 3.2.10 of the WeGIA application. The vulnerability allows the `nextPage` parameter to be manipu... Read more

    Affected Products : wegia
    • Published: Jan. 21, 2025
    • Modified: Feb. 13, 2025

  • 7.1

    HIGH
    CVE-2025-24019

    YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager to delete any file owned by the user running the FastCGI Process Manager (FPM) on the host withou... Read more

    Affected Products : yeswiki
    • Published: Jan. 21, 2025
    • Modified: May. 09, 2025

  • 4.3

    MEDIUM
    CVE-2025-23996

    Cross-Site Request Forgery (CSRF) vulnerability in anyroad.com AnyRoad allows Cross Site Request Forgery. This issue affects AnyRoad: from n/a through 1.3.2.... Read more

    Affected Products :
    • Published: Jan. 21, 2025
    • Modified: Jan. 21, 2025
Showing 20 of 291058 Results