Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
  • 1.7

    LOW
    CVE-2025-43863

    vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password ... Read more

    Affected Products : vantage6
    • Published: Jun. 12, 2025
    • Modified: Jun. 16, 2025
    • Vuln Type: Authentication
  • 7.5

    HIGH
    CVE-2025-5982

    An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.... Read more

    Affected Products : gitlab
    • Published: Jun. 12, 2025
    • Modified: Aug. 12, 2025
    • Vuln Type: Authorization
  • 8.7

    HIGH
    CVE-2025-49080

    There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Denial of Service by sending a specially crafted sequence of packets to the server. The attack compl... Read more

    Affected Products : secure_access
    • Published: Jun. 12, 2025
    • Modified: Jun. 23, 2025
    • Vuln Type: Denial of Service
  • 7.5

    HIGH
    CVE-2024-55567

    Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62.01, and 5.7 before 05.71.01. The SMM module has an SMM call out vulnerability which can be used to write arbitrary... Read more

    Affected Products : insydeh2o
    • Published: Jun. 12, 2025
    • Modified: Aug. 20, 2025
    • Vuln Type: Memory Corruption
  • 5.4

    MEDIUM
    CVE-2023-45256

    Multiple SQL injection vulnerabilities in the EuroInformation MoneticoPaiement module before 1.1.1 for PrestaShop allow remote attackers to execute arbitrary SQL commands via the TPE, societe, MAC, reference, or aliascb parameter to transaction.php, valid... Read more

    Affected Products :
    • Published: Jun. 12, 2025
    • Modified: Jun. 17, 2025
    • Vuln Type: Injection
  • 9.3

    CRITICAL
    CVE-2025-49467

    A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges.... Read more

    Affected Products :
    • Published: Jun. 12, 2025
    • Modified: Jun. 16, 2025
    • Vuln Type: Injection
  • 7.5

    HIGH
    CVE-2025-46035

    Buffer Overflow vulnerability in Tenda AC6 v.15.03.05.16 allows a remote attacker to cause a denial of service via the oversized schedStartTime and schedEndTime parameters in an unauthenticated HTTP GET request to the /goform/openSchedWifi endpoint... Read more

    Affected Products : ac6_firmware ac6
    • Published: Jun. 12, 2025
    • Modified: Jun. 17, 2025
  • 7.1

    HIGH
    CVE-2025-36573

    Dell Smart Dock Firmware, versions prior to 01.00.08.01, contain an Insertion of Sensitive Information into Log File vulnerability. A user with local access could potentially exploit this vulnerability, leading to Information disclosure.... Read more

    Affected Products :
    • Published: Jun. 12, 2025
    • Modified: Jun. 16, 2025
    • Vuln Type: Information Disclosure
  • 5.4

    MEDIUM
    CVE-2025-29744

    pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.... Read more

    Affected Products : pg-promise
    • Published: Jun. 12, 2025
    • Modified: Jul. 02, 2025
    • Vuln Type: Injection
  • 7.3

    HIGH
    CVE-2024-7562

    A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. All supported versions (InstallShield 2023 R2, InstallShield 2022 R2 and InstallShield 2021 R2) ... Read more

    Affected Products : installshield
    • Published: Jun. 12, 2025
    • Modified: Jun. 16, 2025
    • Vuln Type: Authentication
  • 6.5

    MEDIUM
    CVE-2024-44906

    uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15.... Read more

    Affected Products : pgdriver
    • Published: Jun. 12, 2025
    • Modified: Aug. 13, 2025
    • Vuln Type: Injection
  • 6.5

    MEDIUM
    CVE-2024-44905

    go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.... Read more

    Affected Products : pg
    • Published: Jun. 12, 2025
    • Modified: Jul. 09, 2025
    • Vuln Type: Injection
  • 6.5

    MEDIUM
    CVE-2025-49200

    The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup files.... Read more

    Affected Products :
    • Published: Jun. 12, 2025
    • Modified: Jun. 12, 2025
    • Vuln Type: Information Disclosure
  • 8.8

    HIGH
    CVE-2025-49199

    The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it. This allows the attacker to disrupt the application by configuring the services in a way that they a... Read more

    Affected Products :
    • Published: Jun. 12, 2025
    • Modified: Jun. 12, 2025
    • Vuln Type: Misconfiguration
  • 3.1

    LOW
    CVE-2025-49198

    The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible tokens.... Read more

    Affected Products :
    • Published: Jun. 12, 2025
    • Modified: Jun. 12, 2025
  • 6.5

    MEDIUM
    CVE-2025-49197

    The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user account.... Read more

    Affected Products :
    • Published: Jun. 12, 2025
    • Modified: Jun. 12, 2025
    • Vuln Type: Authentication
  • 6.5

    MEDIUM
    CVE-2025-49196

    A service supports the use of a deprecated and unsafe TLS version. This could be exploited to expose sensitive information, modify data in unexpected ways or spoof identities of other users or devices, affecting the confidentiality and integrity of the de... Read more

    Affected Products :
    • Published: Jun. 12, 2025
    • Modified: Jun. 12, 2025
    • Vuln Type: Misconfiguration
  • 5.3

    MEDIUM
    CVE-2025-49195

    The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server.... Read more

    Affected Products :
    • Published: Jun. 12, 2025
    • Modified: Jun. 12, 2025
    • Vuln Type: Authentication
  • 7.5

    HIGH
    CVE-2025-49194

    The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to intercept traffic between a client and this server, the credentials would be exposed.... Read more

    Affected Products :
    • Published: Jun. 12, 2025
    • Modified: Jun. 12, 2025
    • Vuln Type: Authentication
  • 4.2

    MEDIUM
    CVE-2025-49193

    The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected ma... Read more

    Affected Products :
    • Published: Jun. 12, 2025
    • Modified: Jun. 12, 2025
    • Vuln Type: Misconfiguration
Showing 20 of 291562 Results