Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 5.3

    MEDIUM
    CVE-2025-3305

    A vulnerability has been found in 1902756969/code-projects IKUN_Library 1.0 and classified as problematic. This vulnerability affects the function addInterceptors of the file MvcConfig.java of the component Borrow Handler. The manipulation leads to improp... Read more

    Affected Products : ikun_library
    • Published: Apr. 05, 2025
    • Modified: Apr. 08, 2025
    • Vuln Type: Authorization

  • 4.8

    MEDIUM
    CVE-2025-32366

    In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and memcpy(response+offset,*end,*rdlen) without a check for whether the sum of *end and *rdlen exceeds max. Consequentl... Read more

    Affected Products : connman
    • Published: Apr. 05, 2025
    • Modified: Apr. 11, 2025
    • Vuln Type: Memory Corruption

  • 8.8

    HIGH
    CVE-2025-3304

    A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /dental_not.php. The manipulation of the argument itr_no leads to sql injection. It is possible to... Read more

    • Published: Apr. 05, 2025
    • Modified: May. 28, 2025
    • Vuln Type: Injection

  • 4.0

    MEDIUM
    CVE-2025-32365

    Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.... Read more

    Affected Products : poppler
    • Published: Apr. 05, 2025
    • Modified: Apr. 07, 2025
    • Vuln Type: Memory Corruption

  • 4.0

    MEDIUM
    CVE-2025-32364

    A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.... Read more

    Affected Products : poppler
    • Published: Apr. 05, 2025
    • Modified: Apr. 07, 2025
    • Vuln Type: Denial of Service

  • 7.5

    HIGH
    CVE-2025-3303

    A vulnerability, which was classified as critical, has been found in code-projects Patient Record Management System 1.0. Affected by this issue is some unknown functionality of the file /birthing_record.php. The manipulation of the argument itr_no leads t... Read more

    • Published: Apr. 05, 2025
    • Modified: Apr. 08, 2025
    • Vuln Type: Injection

  • 8.1

    HIGH
    CVE-2025-32360

    In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared drafts for their customer tickets in the browser console, ... Read more

    Affected Products : zammad
    • Published: Apr. 05, 2025
    • Modified: Apr. 15, 2025
    • Vuln Type: Information Disclosure

  • 8.8

    HIGH
    CVE-2025-32359

    In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zamm... Read more

    Affected Products : zammad
    • Published: Apr. 05, 2025
    • Modified: Apr. 15, 2025
    • Vuln Type: Authentication

  • 4.1

    MEDIUM
    CVE-2025-32358

    In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain conditions are met. If a webhook endpoint returned a redirect response, Zammad would follow it automat... Read more

    Affected Products : zammad
    • Published: Apr. 05, 2025
    • Modified: Apr. 15, 2025
    • Vuln Type: Server-Side Request Forgery

  • 4.3

    MEDIUM
    CVE-2025-32357

    In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for.... Read more

    Affected Products : zammad
    • Published: Apr. 05, 2025
    • Modified: Apr. 15, 2025
    • Vuln Type: Authorization

  • 6.5

    MEDIUM
    CVE-2024-56370

    Net::Xero 0.044 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Net::Xero uses the Data::Random library which specifically states that it is ... Read more

    Affected Products :
    • Published: Apr. 05, 2025
    • Modified: Sep. 05, 2025
    • Vuln Type: Cryptography

  • 5.5

    MEDIUM
    CVE-2024-52322

    WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically WebService::Xero uses the Data::Random library which specifically state... Read more

    Affected Products : webservice\
    • Published: Apr. 05, 2025
    • Modified: Sep. 05, 2025
    • Vuln Type: Cryptography

  • 5.5

    MEDIUM
    CVE-2024-58036

    Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Net::Dropbox::API uses the Data::Random library which specifically stat... Read more

    Affected Products : net\
    • Published: Apr. 05, 2025
    • Modified: Sep. 05, 2025
    • Vuln Type: Cryptography

  • 5.5

    MEDIUM
    CVE-2024-57868

    Web::API 2.8 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Web::API uses the Data::Random library which specifically states that it is "Use... Read more

    Affected Products : web\
    • Published: Apr. 05, 2025
    • Modified: Sep. 05, 2025
    • Vuln Type: Cryptography

  • 5.5

    MEDIUM
    CVE-2024-57835

    Amon2::Auth::Site::LINE uses the String::Random module to generate nonce values.  String::Random defaults to Perl's built-in predictable random number generator, the rand() function, which is not cryptographically secure... Read more

    Affected Products : line_integration_for_amon2
    • Published: Apr. 05, 2025
    • Modified: Apr. 08, 2025
    • Vuln Type: Cryptography

  • 6.7

    MEDIUM
    CVE-2025-30401

    A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename extension. A maliciously crafted mismatch could have caused the ... Read more

    Affected Products : whatsapp
    • Published: Apr. 05, 2025
    • Modified: Apr. 09, 2025
    • Vuln Type: Authentication

  • 7.5

    HIGH
    CVE-2025-3299

    A vulnerability was found in PHPGurukul Men Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /appointment.php. The manipulation of the argument Name leads to sql injection. The attack... Read more

    Affected Products : men_salon_management_system
    • Published: Apr. 05, 2025
    • Modified: Apr. 08, 2025
    • Vuln Type: Injection

  • 5.3

    MEDIUM
    CVE-2025-3298

    A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=save_product of the component Registration Handler. T... Read more

    Affected Products : online_eyewear_shop
    • Published: Apr. 05, 2025
    • Modified: Apr. 08, 2025
    • Vuln Type: Authentication

  • 5.1

    MEDIUM
    CVE-2025-3297

    A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes/Master.php?f=save_product. The manipulation of the argument brand leads to cross site scripting... Read more

    Affected Products : online_eyewear_shop
    • Published: Apr. 05, 2025
    • Modified: Apr. 08, 2025
    • Vuln Type: Cross-Site Scripting

  • 6.5

    MEDIUM
    CVE-2025-3296

    A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=delete_customer. The manipulation of the argument ID leads to sql inje... Read more

    Affected Products : online_eyewear_shop
    • Published: Apr. 05, 2025
    • Modified: Apr. 08, 2025
    • Vuln Type: Injection
Showing 20 of 293351 Results