Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 9.8

    CRITICAL
    CVE-2025-58053

    Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating any existing account with a self forged POST request, one can gain higher privileges. Version 1.2.0 fixes the issue.... Read more

    Affected Products : galette
    • Published: Dec. 19, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Authorization

  • 9.8

    CRITICAL
    CVE-2025-63665

    An issue in GT Edge AI Community Edition Versions before v2.0.12 allows attackers to execute arbitrary code via injecting a crafted JSON payload into the Prompt window.... Read more

    Affected Products : gt_edge_ai
    • Published: Dec. 19, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Injection

  • 7.5

    HIGH
    CVE-2025-14591

    In Delphix Continuous Compliance version 2025.3.0 and later, following a recent bug fix to correctly handle CR+LF (Windows and DOS) End-of-Record (EOR) characters in delimited files, an issue was identified: using an incorrect EOR configuration can cause ... Read more

    Affected Products : delphix_continuous_compliance
    • Published: Dec. 20, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Misconfiguration

  • 6.1

    MEDIUM
    CVE-2025-65270

    Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute JavaScript code in the context of the victim's browser.... Read more

    Affected Products : captivate_electronic_data_capture
    • Published: Dec. 22, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Cross-Site Scripting

  • 4.3

    MEDIUM
    CVE-2024-35321

    MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter.... Read more

    Affected Products : mynet
    • Published: Dec. 22, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Cross-Site Scripting

  • 4.7

    MEDIUM
    CVE-2025-26787

    An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to configure Certificate access to the initial startup of the container sets a property of "allowany" to allow any user ... Read more

    Affected Products : signserver
    • Published: Dec. 22, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Authentication

  • 7.5

    HIGH
    CVE-2025-63662

    Insecure permissions in the /api/v1/agents API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access sensitive information.... Read more

    Affected Products : gt_edge_ai
    • Published: Dec. 22, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Information Disclosure

  • 7.5

    HIGH
    CVE-2025-63663

    Incorrect access control in the /api/v1/conversations/*/files API of GT Edge AI Platform before v2.0.10 allows unauthorized attackers to access other users' uploaded files.... Read more

    Affected Products : gt_edge_ai
    • Published: Dec. 22, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Authorization

  • 7.5

    HIGH
    CVE-2025-63664

    Incorrect access control in the /api/v1/conversations/*/messages API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access other users' message history with AI agents.... Read more

    Affected Products : gt_edge_ai
    • Published: Dec. 22, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Authorization

  • 9.9

    CRITICAL
    CVE-2025-68668

    n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this v... Read more

    Affected Products : n8n
    • Published: Dec. 26, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Injection

  • 9.8

    CRITICAL
    CVE-2025-15359

    DVP-12SE11T - Out-of-bound memory write Vulnerability... Read more

    Affected Products : dvp-12se11t_firmware dvp-12se11t
    • Published: Dec. 30, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Memory Corruption

  • 6.1

    MEDIUM
    CVE-2025-65790

    A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. FuguHub does not sanitize or restrict script execution inside SVG content. When a victim opens a crafted SVG contain... Read more

    Affected Products : fuguhub
    • Published: Dec. 22, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Cross-Site Scripting

  • 5.4

    MEDIUM
    CVE-2025-65837

    PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.... Read more

    Affected Products : publiccms
    • Published: Dec. 22, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Cross-Site Scripting

  • 9.8

    CRITICAL
    CVE-2025-68926

    RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both... Read more

    Affected Products : rustfs
    • Published: Dec. 30, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Authentication

  • 8.1

    HIGH
    CVE-2025-58937

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Tacticool tacticool allows PHP Local File Inclusion.This issue affects Tacticool: from n/a through <= 1.0.13.... Read more

    Affected Products : tacticool
    • Published: Dec. 18, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Injection

  • 8.2

    HIGH
    CVE-2025-58929

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Pantry pantry allows PHP Local File Inclusion.This issue affects Pantry: from n/a through <= 1.4.... Read more

    Affected Products : pantry
    • Published: Dec. 18, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Path Traversal

  • 8.2

    HIGH
    CVE-2025-58894

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Good Mood good-mood allows PHP Local File Inclusion.This issue affects Good Mood: from n/a through <= 1.16.... Read more

    Affected Products : good_mood
    • Published: Dec. 18, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Path Traversal

  • 7.8

    HIGH
    CVE-2024-46060

    Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This allows a local l... Read more

    Affected Products : macos anaconda3
    • Published: Dec. 17, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Misconfiguration

  • 7.8

    HIGH
    CVE-2024-46062

    Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This flaw allows a l... Read more

    Affected Products : macos miniconda3
    • Published: Dec. 17, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Misconfiguration

  • 8.2

    HIGH
    CVE-2025-58893

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Alright alright allows PHP Local File Inclusion.This issue affects Alright: from n/a through <= 1.6.1.... Read more

    Affected Products : alright
    • Published: Dec. 18, 2025
    • Modified: Jan. 05, 2026
    • Vuln Type: Path Traversal
Showing 20 of 4540 Results