Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 9.0

    HIGH
    CVE-2025-15136

    A security vulnerability has been detected in TRENDnet TEW-800MB 1.0.1.0. Affected is the function do_setWizard_asp of the file /goform/wizardset of the component Management Interface. The manipulation of the argument WizardConfigured leads to command inj... Read more

    Affected Products : tew-800mb_firmware
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Injection

  • 6.5

    MEDIUM
    CVE-2025-15135

    A weakness has been identified in joey-zhou xiaozhi-esp32-server-java up to 3.0.0. This impacts the function tryAuthenticateWithCookies of the file AuthenticationInterceptor.java of the component Cookie Handler. Executing manipulation can lead to improper... Read more

    Affected Products :
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authentication

  • 5.1

    MEDIUM
    CVE-2025-15134

    A security flaw has been discovered in yourmaileyes MOOC up to 1.17. This affects the function subreview of the file mooc/controller/MainController.java of the component Submission Handler. Performing manipulation of the argument review results in cross s... Read more

    Affected Products :
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Cross-Site Scripting

  • 6.5

    MEDIUM
    CVE-2025-15133

    A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2_api_CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. Such manipulation leads to command injection. It is possibl... Read more

    Affected Products :
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Injection

  • 6.5

    MEDIUM
    CVE-2025-15132

    A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2_api_open of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation causes command injection. It is possible to ini... Read more

    Affected Products :
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Injection

  • 6.5

    MEDIUM
    CVE-2025-15131

    A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed... Read more

    Affected Products :
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Injection

  • 5.8

    MEDIUM
    CVE-2025-15130

    A vulnerability has been found in shanyu SyCms up to a242ef2d194e8bb249dc175e7c49f2c1673ec921. This issue affects the function addPost of the file Application/Admin/Controller/FileManageController.class.php of the component Administrative Panel. The manip... Read more

    Affected Products :
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Injection

  • 6.5

    MEDIUM
    CVE-2025-15129

    A flaw has been found in ChenJinchuang Lin-CMS-TP5 up to 0.3.3. This vulnerability affects the function Upload of the file application/lib/file/LocalUploader.php of the component File Upload Handler. Executing manipulation of the argument File can lead to... Read more

    Affected Products :
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Injection

  • 5.5

    MEDIUM
    CVE-2025-15128

    A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint. Performing manipulation of the argument backup_encryption_password_decrypt/export_encryption_pa... Read more

    Affected Products : biotime
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Misconfiguration

  • 7.5

    HIGH
    CVE-2025-15127

    A security vulnerability has been detected in FantasticLBP Hotels_Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. Affected by this issue is some unknown functionality of the file /controller/api/Room.php. Such manipulation of the argument hotelId l... Read more

    Affected Products :
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Injection

  • 3.1

    LOW
    CVE-2025-15126

    A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositionUserList. This manipulation of the argument positionId causes improper authorization. The atta... Read more

    Affected Products : jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authorization

  • 3.1

    LOW
    CVE-2025-15125

    A security flaw has been discovered in JeecgBoot up to 3.9.0. Affected is the function queryDepartPermission of the file /sys/permission/queryDepartPermission. The manipulation of the argument departId results in improper authorization. The attack can be ... Read more

    Affected Products : jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authorization

  • 3.1

    LOW
    CVE-2025-15124

    A vulnerability was identified in JeecgBoot up to 3.9.0. This impacts the function getParameterMap of the file /sys/sysDepartPermission/list. The manipulation of the argument departId leads to improper authorization. The attack can be initiated remotely. ... Read more

    Affected Products : jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authorization

  • 3.1

    LOW
    CVE-2025-15123

    A vulnerability was determined in JeecgBoot up to 3.9.0. This affects an unknown function of the file /sys/sysDepartPermission/datarule/. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The attack r... Read more

    Affected Products : jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authorization

  • 3.1

    LOW
    CVE-2025-15122

    A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing manipulation of the argument departId/roleId results in improper authorization. It is possible to in... Read more

    Affected Products : jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authorization

  • 4.8

    MEDIUM
    CVE-2025-15121

    A vulnerability has been found in JeecgBoot up to 3.9.0. The affected element is the function getDeptRoleByUserId of the file /sys/sysDepartRole/getDeptRoleByUserId. Such manipulation of the argument departId leads to information disclosure. The vendor wa... Read more

    Affected Products : jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Information Disclosure

  • 3.1

    LOW
    CVE-2025-15120

    A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of the argument departId causes improper authorization. The attack is possible to be carried out rem... Read more

    Affected Products : jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authorization

  • 3.1

    LOW
    CVE-2025-15119

    A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of the argument deptId results in improper authorization. The attack can be executed remotely. A hig... Read more

    Affected Products : jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authorization

  • 5.3

    MEDIUM
    CVE-2025-15118

    A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the component Member Endpoint. The manipulation leads to improper authorization. Remote exploitation ... Read more

    Affected Products : mall
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authorization

  • 3.1

    LOW
    CVE-2025-15117

    A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Executing manipulation can lead to deserialization. The attack may be launched remotely. This attack ... Read more

    Affected Products : sa-token
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Injection
Showing 20 of 4781 Results