Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 8.8

    HIGH
    CVE-2025-10629

    A vulnerability was determined in D-Link DIR-852 1.00CN B09. This issue affects the function ssdpcgi_main of the file htodcs/cgibin of the component Simple Service Discovery Protocol Service. Executing manipulation of the argument ST can lead to command i... Read more

    Affected Products : dir-852_firmware dir-852
    • Published: Sep. 18, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Injection

  • 9.8

    CRITICAL
    CVE-2025-9083

    The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.... Read more

    Affected Products : ninja_forms
    • Published: Sep. 18, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Injection

  • 9.1

    CRITICAL
    CVE-2025-8942

    The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value (e.g., sending negative or out-of-range values) by intercepting and modifying requests.... Read more

    Affected Products : wp_hotel_booking
    • Published: Sep. 18, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Injection

  • 9.8

    CRITICAL
    CVE-2025-5305

    The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers.... Read more

    Affected Products :
    • Published: Sep. 18, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Cryptography

  • 9.1

    CRITICAL
    CVE-2025-54236

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidential... Read more

    Affected Products : magento commerce magento commerce_b2b
    • Published: Sep. 09, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Authorization

  • 5.3

    MEDIUM
    CVE-2025-10675

    A security flaw has been discovered in fuyang_lipengjun platform 1.0. This impacts the function AttributeController of the file /attribute/queryAll. Performing manipulation results in improper authorization. Remote exploitation of the attack is possible. ... Read more

    Affected Products :
    • Published: Sep. 18, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Authorization

  • 8.4

    HIGH
    CVE-2025-10536

    This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.... Read more

    Affected Products : firefox firefox_esr thunderbird
    • Published: Sep. 16, 2025
    • Modified: Sep. 22, 2025

  • 6.5

    MEDIUM
    CVE-2025-53809

    Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.... Read more

    Affected Products : windows_11_24h2 windows_server_2025
    • Published: Sep. 09, 2025
    • Modified: Sep. 22, 2025

  • 4.2

    MEDIUM
    CVE-2025-59455

    In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition... Read more

    Affected Products : teamcity
    • Published: Sep. 17, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Race Condition

  • 5.5

    MEDIUM
    CVE-2025-59456

    In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload... Read more

    Affected Products : teamcity
    • Published: Sep. 17, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Path Traversal

  • 7.7

    HIGH
    CVE-2025-59457

    In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows... Read more

    Affected Products : teamcity
    • Published: Sep. 17, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Information Disclosure

  • 8.8

    HIGH
    CVE-2025-10483

    A flaw has been found in SourceCodester Online Student File Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/save_user.php. This manipulation of the argument firstname causes sql injection. The attack is... Read more

    • Published: Sep. 15, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Injection

  • 9.8

    CRITICAL
    CVE-2025-10482

    A vulnerability was detected in SourceCodester Online Student File Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely... Read more

    • Published: Sep. 15, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Injection

  • 8.8

    HIGH
    CVE-2025-10481

    A security vulnerability has been detected in SourceCodester Online Student File Management System 1.0. This impacts an unknown function of the file /remove_file.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the a... Read more

    • Published: Sep. 15, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Injection

  • 9.8

    CRITICAL
    CVE-2025-10480

    A weakness has been identified in SourceCodester Online Student File Management System 1.0. This affects an unknown function of the file /save_file.php. Executing manipulation can lead to unrestricted upload. The attack may be launched remotely. The explo... Read more

    • Published: Sep. 15, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Misconfiguration

  • 6.5

    MEDIUM
    CVE-2025-10059

    An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. This affects MongoDB Server v6.0 versions prior to 6.0.x, Mo... Read more

    Affected Products : mongodb
    • Published: Sep. 05, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Denial of Service

  • 8.8

    HIGH
    CVE-2025-10201

    Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: High)... Read more

    • Published: Sep. 10, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Misconfiguration

  • 8.8

    HIGH
    CVE-2025-10200

    Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)... Read more

    • Published: Sep. 10, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Memory Corruption

  • 8.8

    HIGH
    CVE-2025-10602

    A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/delete_s1.php. Performing manipulation of the argument ID results in sql injection. The attack can b... Read more

    • Published: Sep. 17, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Injection

  • 9.8

    CRITICAL
    CVE-2025-10563

    A vulnerability has been found in Campcodes Grocery Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=save_category. Such manipulation of the argument ID leads to sql injection. The attack can be executed remote... Read more

    • Published: Sep. 16, 2025
    • Modified: Sep. 22, 2025
    • Vuln Type: Injection
Showing 20 of 4204 Results