Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 8.1

    HIGH
    CVE-2025-23044

    PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability t... Read more

    Affected Products : pwndoc
    • Published: Jan. 20, 2025
    • Modified: May. 07, 2025
    • Vuln Type: Cross-Site Request Forgery

  • 5.0

    MEDIUM
    CVE-2025-22620

    gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set pe... Read more

    Affected Products :
    • Published: Jan. 20, 2025
    • Modified: Jan. 20, 2025
    • Vuln Type: Misconfiguration

  • 6.1

    MEDIUM
    CVE-2025-22131

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file into a HTML representation and displays it in the response.... Read more

    Affected Products : phpexcel phpspreadsheet
    • Published: Jan. 20, 2025
    • Modified: Jan. 20, 2025
    • Vuln Type: Cross-Site Scripting

  • 7.7

    HIGH
    CVE-2024-51738

    Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pai... Read more

    Affected Products : sunshine
    • Published: Jan. 20, 2025
    • Modified: Jan. 20, 2025
    • Vuln Type: Authentication

  • 9.8

    CRITICAL
    CVE-2024-45647

    IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prior knowledge of that password.... Read more

    • Published: Jan. 20, 2025
    • Modified: Jan. 29, 2025
    • Vuln Type: Authentication

  • 8.4

    HIGH
    CVE-2025-24337

    WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.... Read more

    Affected Products :
    • Published: Jan. 20, 2025
    • Modified: Jan. 20, 2025
    • Vuln Type: Information Disclosure

  • 0.0

    NA
    CVE-2025-21655

    In the Linux kernel, the following vulnerability has been resolved: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period io_eventfd_do_signal() is invoked from an RCU callback, but when dropping the reference to the io_ev_fd, it calls ... Read more

    Affected Products : linux_kernel
    • Published: Jan. 20, 2025
    • Modified: Feb. 23, 2025
    • Vuln Type: Race Condition

  • 4.1

    MEDIUM
    CVE-2024-13176

    Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an at... Read more

    Affected Products : openssl
    • Published: Jan. 20, 2025
    • Modified: May. 26, 2025
    • Vuln Type: Cryptography

  • 8.6

    HIGH
    CVE-2025-0479

    This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vulnerability by intercepting data transmissions during an HTTP session on the vulnerable system. ... Read more

    Affected Products :
    • Published: Jan. 20, 2025
    • Modified: Jan. 20, 2025
    • Vuln Type: Information Disclosure

  • 0.0

    NA
    CVE-2023-52923

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction API to replace the old and buggy gc API and the busy mark approach. No set elements are removed... Read more

    Affected Products : linux_kernel
    • Published: Jan. 20, 2025
    • Modified: Jan. 20, 2025

  • 7.5

    HIGH
    CVE-2025-0590

    Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk.... Read more

    Affected Products : carlcare carlcare
    • Published: Jan. 20, 2025
    • Modified: Mar. 24, 2025
    • Vuln Type: Information Disclosure

  • 7.2

    HIGH
    CVE-2025-0586

    The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privileges and regular system privileges to perform arbitrary code execution.... Read more

    Affected Products :
    • Published: Jan. 20, 2025
    • Modified: Jan. 20, 2025
    • Vuln Type: Misconfiguration

  • 9.8

    CRITICAL
    CVE-2025-0585

    The a+HRD from aEnrich Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.... Read more

    Affected Products :
    • Published: Jan. 20, 2025
    • Modified: Jan. 20, 2025
    • Vuln Type: Injection

  • 5.3

    MEDIUM
    CVE-2025-0584

    The a+HRD from aEnrich Technology has a Server-side Request Forgery, allowing unauthenticated remote attackers to exploit this vulnerability to probe internal network.... Read more

    Affected Products :
    • Published: Jan. 20, 2025
    • Modified: Jan. 20, 2025
    • Vuln Type: Server-Side Request Forgery

  • 7.2

    HIGH
    CVE-2025-0582

    A vulnerability classified as critical was found in itsourcecode Farm Management System up to 1.0. This vulnerability affects unknown code of the file /add-pig.php. The manipulation of the argument pigphoto leads to unrestricted upload. The attack can be ... Read more

    • Published: Jan. 20, 2025
    • Modified: Feb. 07, 2025
    • Vuln Type: Misconfiguration

  • 5.4

    MEDIUM
    CVE-2025-0581

    A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. This affects an unknown part of the file /chat/group/send of the component Chat History. The manipulation of the argument message leads to cross site scr... Read more

    Affected Products : school_management_software
    • Published: Jan. 20, 2025
    • Modified: Jan. 20, 2025
    • Vuln Type: Cross-Site Scripting

  • 6.3

    MEDIUM
    CVE-2025-0580

    A vulnerability was found in Shiprocket Module 3 on OpenCart. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?route=extension/module/rest_api&action=getOrders of the component REST API Module. The... Read more

    Affected Products :
    • Published: Jan. 20, 2025
    • Modified: Jan. 20, 2025
    • Vuln Type: Authorization

  • 7.5

    HIGH
    CVE-2025-0579

    A vulnerability was found in Shiprocket Module 3/4 on OpenCart. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php?route=extension/shiprocket/module/restapi of the component REST API Module.... Read more

    Affected Products :
    • Published: Jan. 20, 2025
    • Modified: Jan. 20, 2025
    • Vuln Type: Injection

  • 4.5

    MEDIUM
    CVE-2024-13524

    A vulnerability has been found in obsproject OBS Studio up to 30.0.2 on Windows and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to untrusted search path. The attack needs to be approached l... Read more

    Affected Products :
    • Published: Jan. 20, 2025
    • Modified: Jan. 20, 2025
    • Vuln Type: Misconfiguration

  • 6.1

    MEDIUM
    CVE-2025-0583

    The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.... Read more

    Affected Products :
    • Published: Jan. 20, 2025
    • Modified: Jan. 20, 2025
    • Vuln Type: Cross-Site Scripting
Showing 20 of 291219 Results