Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 9.8

    CRITICAL
    CVE-2025-4180

    A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component TRACE Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The e... Read more

    Affected Products : pcman_ftp_server ftp_server
    • Published: May. 01, 2025
    • Modified: May. 13, 2025
    • Vuln Type: Memory Corruption

  • 5.5

    MEDIUM
    CVE-2025-4178

    A vulnerability was found in xiaowei1118 java_server up to 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a on Windows and classified as critical. This issue affects some unknown processing of the file /src/main/java/com/changyu/foryou/controller/FoodController.j... Read more

    Affected Products : windows java_server
    • Published: May. 01, 2025
    • Modified: Jun. 17, 2025
    • Vuln Type: Path Traversal

  • 9.8

    CRITICAL
    CVE-2025-4176

    A vulnerability has been found in PHPGurukul Blood Bank & Donor Management System 2.4 and classified as critical. This vulnerability affects unknown code of the file /admin/request-received-bydonar.php. The manipulation of the argument searchdata leads to... Read more

    • Published: May. 01, 2025
    • Modified: May. 09, 2025
    • Vuln Type: Injection

  • 8.5

    HIGH
    CVE-2025-43595

    An insecure file system permissions vulnerability in MSP360 Backup 4.3.1.115 allows a low privileged user to execute commands with root privileges in the 'Online Backup' folder. Upgrade to MSP360 Backup 4.4 (released on 2025-04-22).... Read more

    Affected Products :
    • Published: May. 01, 2025
    • Modified: May. 22, 2025
    • Vuln Type: Misconfiguration

  • 6.5

    MEDIUM
    CVE-2025-27365

    IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10  Client connecting to a MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel p... Read more

    Affected Products : mq_operator
    • Published: May. 01, 2025
    • Modified: May. 02, 2025
    • Vuln Type: Denial of Service

  • 6.5

    MEDIUM
    CVE-2025-1333

    IBM MQ Container when used with the IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10 and configured with Cloud Pak for Integration Keyc... Read more

    Affected Products : mq_operator
    • Published: May. 01, 2025
    • Modified: May. 02, 2025
    • Vuln Type: Information Disclosure

  • 6.5

    MEDIUM
    CVE-2025-4175

    A vulnerability, which was classified as critical, was found in AlanBinu007 Spring-Boot-Advanced-Projects up to 3.1.3. This affects the function uploadUserProfileImage of the file /Spring-Boot-Advanced-Projects-main/Project-4.SpringBoot-AWS-S3/backend/src... Read more

    Affected Products :
    • Published: May. 01, 2025
    • Modified: May. 10, 2025
    • Vuln Type: Path Traversal

  • 7.5

    HIGH
    CVE-2024-48907

    Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API.... Read more

    Affected Products : replyone
    • Published: May. 01, 2025
    • Modified: Jun. 04, 2025
    • Vuln Type: Server-Side Request Forgery

  • 6.1

    MEDIUM
    CVE-2024-48906

    Sematell ReplyOne 7.4.3.0 allows XSS via a ReplyDesk e-mail attachment name.... Read more

    Affected Products : replyone
    • Published: May. 01, 2025
    • Modified: Jun. 04, 2025
    • Vuln Type: Cross-Site Scripting

  • 9.1

    CRITICAL
    CVE-2024-48905

    Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint.... Read more

    Affected Products : replyone
    • Published: May. 01, 2025
    • Modified: Jun. 04, 2025
    • Vuln Type: Misconfiguration

  • 7.1

    HIGH
    CVE-2025-46635

    An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the router allows an attacker (who is authenticated to the guest Wi-Fi) to access resources on the rou... Read more

    Affected Products : rx2_pro_firmware rx2_pro
    • Published: May. 01, 2025
    • Modified: May. 27, 2025
    • Vuln Type: Misconfiguration

  • 8.2

    HIGH
    CVE-2025-46634

    Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenticate to the web management portal by collecting credentials from observed/collected traffic. It ... Read more

    Affected Products : rx2_pro_firmware rx2_pro
    • Published: May. 01, 2025
    • Modified: May. 27, 2025
    • Vuln Type: Authentication

  • 8.2

    HIGH
    CVE-2025-46633

    Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the client and server by collecting the symmetric AES key from collected and/or observed traffic. T... Read more

    Affected Products : rx2_pro_firmware rx2_pro
    • Published: May. 01, 2025
    • Modified: May. 27, 2025
    • Vuln Type: Cryptography

  • 6.5

    MEDIUM
    CVE-2025-46632

    Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information about or more easily decrypt encrypted messages between client and server.... Read more

    Affected Products : rx2_pro_firmware rx2_pro
    • Published: May. 01, 2025
    • Modified: May. 27, 2025
    • Vuln Type: Cryptography

  • 6.5

    MEDIUM
    CVE-2025-46631

    Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to the router's OS by sending a /goform/telnet web request.... Read more

    Affected Products : rx2_pro_firmware rx2_pro
    • Published: May. 01, 2025
    • Modified: May. 27, 2025
    • Vuln Type: Misconfiguration

  • 6.5

    MEDIUM
    CVE-2025-46630

    Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable 'ate' (a remote system management binary) by sending a /goform/ate web request.... Read more

    Affected Products : rx2_pro_firmware rx2_pro
    • Published: May. 01, 2025
    • Modified: May. 27, 2025
    • Vuln Type: Authorization

  • 6.5

    MEDIUM
    CVE-2025-46629

    Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where 'ate' has been enabled by sending a crafted UDP packet... Read more

    Affected Products : rx2_pro_firmware rx2_pro
    • Published: May. 01, 2025
    • Modified: May. 27, 2025
    • Vuln Type: Authentication

  • 7.3

    HIGH
    CVE-2025-46628

    Lack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shell access to the device by sending a crafted UDP packet to the 'ate' service when it is enabled. ... Read more

    Affected Products : rx2_pro_firmware rx2_pro
    • Published: May. 01, 2025
    • Modified: May. 27, 2025
    • Vuln Type: Authentication

  • 8.2

    HIGH
    CVE-2025-46627

    Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the telnet service by calculating the root password based on easily-obtained device information. The password is based on the last two digits/oc... Read more

    Affected Products : rx2_pro_firmware rx2_pro
    • Published: May. 01, 2025
    • Modified: May. 27, 2025
    • Vuln Type: Authentication

  • 7.3

    HIGH
    CVE-2025-46626

    Reuse of a static AES key and initialization vector for encrypted traffic to the 'ate' management service of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt, replay, and/or forge traffic to the service.... Read more

    Affected Products : rx2_pro_firmware rx2_pro
    • Published: May. 01, 2025
    • Modified: May. 27, 2025
    • Vuln Type: Cryptography
Showing 20 of 293673 Results