Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

6.3

MEDIUM

CVE-2025-64703

MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can get sensitive informations by Python code in tool module, although the process run in sandbox. Version 2.3.1 fixes the issue....

Affected Products : maxkb
Published: Nov. 13, 2025

Modified: Nov. 14, 2025

Vuln Type: Information Disclosure
9.0

CRITICAL

CVE-2025-36096

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access by an attacker using man in the middle techniques....

Affected Products : aix vios
Published: Nov. 13, 2025

Modified: Nov. 14, 2025

Vuln Type: Misconfiguration
6.1

MEDIUM

CVE-2025-59480

Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses...

Affected Products : mattermost_server
Published: Nov. 13, 2025

Modified: Nov. 14, 2025

Vuln Type: Authentication
5.1

MEDIUM

CVE-2025-60686

A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.614_B20230630, LR1200GB V9.1.0u.6619_B20230130, and NR1800X V9.1.0u.6681_B20230703). Both programs parse the contents...

Affected Products :
Published: Nov. 13, 2025

Modified: Nov. 14, 2025

Vuln Type: Memory Corruption
4.9

MEDIUM

CVE-2025-11981

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'SCodes' parameter in all versions up to, and including, 2.2.23 due to insufficient escaping on the user supplied parameter and lack of sufficient pre...

Affected Products : wpschoolpress
Published: Nov. 14, 2025

Modified: Nov. 14, 2025

Vuln Type: Injection
4.3

MEDIUM

CVE-2025-64739

External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access....

Affected Products : rooms meeting_software_development_kit virtual_desktop_infrastructure vdi_windows_meeting_clients meeting_sdk workplace_desktop rooms_controller workplace_virtual_desktop_infrastructure
Published: Nov. 13, 2025

Modified: Nov. 14, 2025

Vuln Type: Information Disclosure
7.0

HIGH

CVE-2025-62217

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 +8 more products
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
7.0

HIGH

CVE-2025-62218

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally....

Affected Products : windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
7.0

HIGH

CVE-2025-62219

Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally....

Affected Products : windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
8.8

HIGH

CVE-2025-62220

Heap-based buffer overflow in Windows Subsystem for Linux GUI allows an unauthorized attacker to execute code over a network....

Affected Products : windows_subsystem_for_linux windows_subsystem_for_linux_gui
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
8.8

HIGH

CVE-2025-62222

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network....

Affected Products : visual_studio_code_copilot_chat_extension github_copilot_chat
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
8.0

HIGH

CVE-2025-62452

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 +8 more products
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
5.0

MEDIUM

CVE-2025-62453

Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally....

Affected Products : visual_studio_code
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
6.5

MEDIUM

CVE-2025-43205

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in watchOS 11.4, tvOS 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4. An app may be able to bypass ASLR....

Affected Products : iphone_os tvos watchos ipados visionos
Published: Nov. 12, 2025

Modified: Nov. 14, 2025

Vuln Type: Memory Corruption
7.5

HIGH

CVE-2024-12125

A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information....

Affected Products :
Published: Nov. 06, 2025

Modified: Nov. 14, 2025

Vuln Type: Cross-Site Request Forgery
5.3

MEDIUM

CVE-2025-10259

Improper Validation of Specified Quantity in Input vulnerability in TCP Communication Function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote attacker to disconnect the connection by sending specially crafted TCP packets ...

Affected Products : melsec_iq-fx5u-32mt\/es_firmware melsec_iq-fx5u-32mt\/ds_firmware melsec_iq-fx5u-32mt\/ess_firmware melsec_iq-fx5u-32mt\/dss_firmware melsec_iq-fx5u-32mr\/es_firmware melsec_iq-fx5u-32mr\/ds_firmware melsec_iq-fx5u-64mt\/es_firmware melsec_iq-fx5u-64mt\/ds_firmware melsec_iq-fx5u-64mt\/ess_firmware melsec_iq-fx5u-64mt\/dss_firmware +11 more products
Published: Nov. 06, 2025

Modified: Nov. 14, 2025

Vuln Type: Denial of Service
9.1

CRITICAL

CVE-2025-12480

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete....

Affected Products : triofox
Actively Exploited

Published: Nov. 10, 2025

Modified: Nov. 14, 2025

Vuln Type: Authorization
7.0

HIGH

CVE-2025-62215

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 +1 more products
Actively Exploited

Published: Nov. 11, 2025

Modified: Nov. 14, 2025
6.0

MEDIUM

CVE-2025-12390

A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during l...

Affected Products :
Published: Oct. 28, 2025

Modified: Nov. 13, 2025

Vuln Type: Authentication
5.4

MEDIUM

CVE-2025-12110

A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where ...

Affected Products :
Published: Oct. 23, 2025

Modified: Nov. 13, 2025

Vuln Type: Authentication

Showing 20 of 3855 Results

Browse by Apps

Latest CVE Feed

6.3

9.0

6.1

5.1

4.9

4.3

7.0

7.0

7.0

8.8

8.8

8.0

5.0

6.5

7.5

5.3

9.1

7.0

6.0

5.4

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable