Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

9.1

CRITICAL

CVE-2025-69990

phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted....

Affected Products : news_portal
Published: Jan. 13, 2026

Modified: Jan. 16, 2026

Vuln Type: Path Traversal
9.8

CRITICAL

CVE-2025-69991

phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php....

Affected Products : news_portal
Published: Jan. 13, 2026

Modified: Jan. 16, 2026

Vuln Type: Injection
9.8

CRITICAL

CVE-2025-69992

phpgurukul News Portal Project V4.1 has File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identity authentication....

Affected Products : news_portal
Published: Jan. 13, 2026

Modified: Jan. 16, 2026

Vuln Type: Authentication
7.0

HIGH

CVE-2026-21221

Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally....

Affected Products : windows_11_24h2 windows_server_2025 windows_11_25h2
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
7.5

HIGH

CVE-2026-20965

Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally....

Affected Products : windows_admin_center
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
7.8

HIGH

CVE-2026-20949

Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally....

Affected Products : 365_apps office_long_term_servicing_channel office_macos_2024 office_macos_2021 office_2024 office_2021
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
7.8

HIGH

CVE-2026-20948

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally....

Affected Products : office word sharepoint_server 365_apps office_long_term_servicing_channel office_macos_2024 office_macos_2021 sharepoint_server_2016 word_2016 sharepoint_server_2019 +3 more products
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
8.8

HIGH

CVE-2026-20947

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network....

Affected Products : sharepoint_server sharepoint_server_2016 sharepoint_server_2019
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
7.8

HIGH

CVE-2026-20946

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally....

Affected Products : office 365_apps excel office_long_term_servicing_channel office_macos_2024 office_macos_2021 excel_2016 office_2024 office_2021 office_2019
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
8.4

HIGH

CVE-2026-20944

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally....

Affected Products : 365_apps office_long_term_servicing_channel office_macos_2024 office_macos_2021
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
7.0

HIGH

CVE-2026-20943

Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally....

Affected Products : office sharepoint_server sharepoint_server_2016 office_2016 sharepoint_server_2019 office_deployment_tool
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
7.8

HIGH

CVE-2026-20941

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally....

Affected Products : windows_11_24h2 windows_server_2025 windows_11_25h2
Published: Jan. 13, 2026

Modified: Jan. 16, 2026
5.7

MEDIUM

CVE-2025-13454

A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sensitive device information....

Affected Products :
Published: Jan. 14, 2026

Modified: Jan. 16, 2026

Vuln Type: Information Disclosure
6.8

MEDIUM

CVE-2025-13154

An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges....

Affected Products : vantage
Published: Jan. 14, 2026

Modified: Jan. 16, 2026

Vuln Type: Path Traversal
7.0

HIGH

CVE-2026-0421

A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when configured as “On” in the BIOS setup menu. This issue only affects systems whe...

Affected Products : thinkpad_l14_gen_6_bios thinkpad_l16_gen_2_bios thinkpad_l13_gen_6_2_in_1_bios thinkpad_l13_gen_6_bios
Published: Jan. 14, 2026

Modified: Jan. 16, 2026

Vuln Type: Misconfiguration
3.2

LOW

CVE-2025-14058

A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Control Center settings if the device is locked when the "Allow Control Center access when locked" op...

Affected Products : tab_m9_tb310fu tab_extreme_tb570zu_tb570fu tab_k11_tb330xu lenovo_tab_with_folio_case_tb311xu tab_p11_2nd_gen_tb350fu idea_tab_pro_tb373fu tab_m8_4th_gen_tb300fu tab_plus_tb351fu lenovo_tab_with_clear_case_tb311fu tab_k11_tb330fup +21 more products
Published: Jan. 14, 2026

Modified: Jan. 16, 2026

Vuln Type: Authentication
5.1

MEDIUM

CVE-2026-0601

A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction....

Affected Products : nexus_repository_manager
Published: Jan. 14, 2026

Modified: Jan. 16, 2026

Vuln Type: Cross-Site Scripting
7.8

HIGH

CVE-2025-13455

A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authentication and enroll an untrusted fingerprint....

Affected Products :
Published: Jan. 14, 2026

Modified: Jan. 16, 2026

Vuln Type: Authentication
7.5

HIGH

CVE-2025-12166

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection via the `order` and `append_where_sql` parameters in all versions up to, and including, 1.6.9.9 due to insufficient es...

Affected Products : simply_schedule_appointments
Published: Jan. 14, 2026

Modified: Jan. 16, 2026

Vuln Type: Injection
3.7

LOW

CVE-2026-0989

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas ca...

Affected Products :
Published: Jan. 15, 2026

Modified: Jan. 16, 2026

Vuln Type: Denial of Service

Showing 20 of 5094 Results

Browse by Apps

Latest CVE Feed

9.1

9.8

9.8

7.0

7.5

7.8

7.8

8.8

7.8

8.4

7.0

7.8

5.7

6.8

7.0

3.2

5.1

7.8

7.5

3.7

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable