Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

8.8

HIGH

CVE-2025-11097

A vulnerability has been found in D-Link DIR-823X 250416. Impacted is an unknown function of the file /goform/set_device_name. The manipulation of the argument mac leads to command injection. The attack is possible to be carried out remotely. The exploit ...

Affected Products : dir-823x_firmware dir-823x
Published: Sep. 28, 2025

Modified: Oct. 02, 2025

Vuln Type: Injection
8.8

HIGH

CVE-2025-11098

A vulnerability was found in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_wifi_blacklists. The manipulation of the argument macList results in command injection. The attack may be performed from remote. The e...

Affected Products : dir-823x_firmware dir-823x
Published: Sep. 28, 2025

Modified: Oct. 02, 2025

Vuln Type: Injection
8.8

HIGH

CVE-2025-11099

A vulnerability was determined in D-Link DIR-823X 250416. The impacted element is the function uci_del of the file /goform/delete_prohibiting. This manipulation of the argument delvalue causes command injection. It is possible to initiate the attack remot...

Affected Products : dir-823x_firmware dir-823x
Published: Sep. 28, 2025

Modified: Oct. 02, 2025

Vuln Type: Injection
8.8

HIGH

CVE-2025-11100

A vulnerability was identified in D-Link DIR-823X 250416. This affects the function uci_set of the file /goform/set_wifi_blacklists. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly availa...

Affected Products : dir-823x_firmware dir-823x
Published: Sep. 28, 2025

Modified: Oct. 02, 2025

Vuln Type: Injection
8.4

HIGH

CVE-2025-59050

Greenshot is an open source Windows screenshot utility. Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM_COPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication, allowing a local pr...

Affected Products : greenshot greenshot
Published: Sep. 16, 2025

Modified: Oct. 02, 2025

Vuln Type: Memory Corruption
7.0

HIGH

CVE-2025-53802

Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally....

Affected Products : windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_22h2 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025
Published: Sep. 09, 2025

Modified: Oct. 02, 2025
7.8

HIGH

CVE-2025-53801

Untrusted pointer dereference in Windows DWM allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_22h2 windows_10_1507 windows_11_23h2 +2 more products
Published: Sep. 09, 2025

Modified: Oct. 02, 2025
7.8

HIGH

CVE-2025-53800

No cwe for this issue in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_22h2 windows_11_23h2 windows_server_2022_23h2 +3 more products
Published: Sep. 09, 2025

Modified: Oct. 02, 2025
9.8

CRITICAL

CVE-2025-10459

A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/all-appointment.php. The manipulation of the argument delid results in sql injection. The attack can be executed remote...

Affected Products : beauty_parlour_management_system beauty_parlor_management_system
Published: Sep. 15, 2025

Modified: Oct. 02, 2025

Vuln Type: Injection
5.5

MEDIUM

CVE-2025-53799

Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 office windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 +10 more products
Published: Sep. 09, 2025

Modified: Oct. 02, 2025
6.5

MEDIUM

CVE-2025-53798

Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_server_2022 windows_server_2022_23h2 windows_server_23h2 windows_server_2012_r2 windows_server_2008_r2 windows_server_2008_sp2 +1 more products
Published: Sep. 09, 2025

Modified: Oct. 02, 2025
6.3

MEDIUM

CVE-2025-49089

wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd....

Affected Products : moneyprinterturbo moneyprinterturbo
Published: Sep. 15, 2025

Modified: Oct. 02, 2025

Vuln Type: Path Traversal
5.3

MEDIUM

CVE-2025-59474

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names thr...

Affected Products : jenkins
Published: Sep. 17, 2025

Modified: Oct. 02, 2025

Vuln Type: Authorization
4.3

MEDIUM

CVE-2025-59475

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by li...

Affected Products : jenkins
Published: Sep. 17, 2025

Modified: Oct. 02, 2025

Vuln Type: Information Disclosure
6.5

MEDIUM

CVE-2025-53797

Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_server_2022 windows_server_2022_23h2 windows_server_23h2 windows_server_2012_r2 windows_server_2008_r2 windows_server_2008_sp2 +1 more products
Published: Sep. 09, 2025

Modified: Oct. 02, 2025
6.5

MEDIUM

CVE-2025-53796

Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_server_2022 windows_server_2022_23h2 windows_server_23h2 windows_server_2012_r2 windows_server_2008_r2 windows_server_2008_sp2 +1 more products
Published: Sep. 09, 2025

Modified: Oct. 02, 2025
7.0

HIGH

CVE-2025-49734

Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_22h2 powershell windows_11_23h2 +4 more products
Published: Sep. 09, 2025

Modified: Oct. 02, 2025
5.3

MEDIUM

CVE-2025-59476

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, fol...

Affected Products : jenkins
Published: Sep. 17, 2025

Modified: Oct. 02, 2025

Vuln Type: Information Disclosure
8.8

HIGH

CVE-2025-11113

A vulnerability was detected in CodeAstro Online Leave Application 1.0. Affected is an unknown function of the file /signup.php. Performing manipulation of the argument city results in sql injection. The attack may be initiated remotely. The exploit is no...

Affected Products : online_leave_application
Published: Sep. 28, 2025

Modified: Oct. 02, 2025

Vuln Type: Injection
9.8

CRITICAL

CVE-2025-11109

A vulnerability was identified in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/us_edit.php?action=edit. The manipulation of the argument ID leads to sql injection. It is possible to init...

Affected Products : computer_sales_and_inventory_system
Published: Sep. 28, 2025

Modified: Oct. 02, 2025

Vuln Type: Injection

Showing 20 of 4447 Results

Browse by Apps

Latest CVE Feed

8.8

8.8

8.8

8.8

8.4

7.0

7.8

7.8

9.8

5.5

6.5

6.3

5.3

4.3

6.5

6.5

7.0

5.3

8.8

9.8

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable