Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

7.1

HIGH

CVE-2025-34410

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings panel (/settings/panel). The endpoint does not implement CSRF protections such as anti-CSRF tokens ...

Affected Products : 1panel
Published: Dec. 10, 2025

Modified: Dec. 23, 2025

Vuln Type: Cross-Site Request Forgery
7.1

HIGH

CVE-2025-13072

The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin....

Affected Products :
Published: Dec. 10, 2025

Modified: Dec. 12, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-34429

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality. The port-change endpoint lacks CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can cra...

Affected Products : 1panel
Published: Dec. 10, 2025

Modified: Dec. 23, 2025

Vuln Type: Cross-Site Request Forgery
7.1

HIGH

CVE-2025-62570

Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally....

Affected Products : windows_11_24h2 windows_server_2025 windows_11_25h2
Published: Dec. 09, 2025

Modified: Dec. 10, 2025
7.1

HIGH

CVE-2024-30547

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shazdeh Header Image Slider header-image-slider allows DOM-Based XSS.This issue affects Header Image Slider: from n/a through 0.3....

Affected Products :
Published: Jan. 06, 2026

Modified: Jan. 06, 2026

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-66402

Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. Version 2025.12...

Affected Products : misskey
Published: Dec. 16, 2025

Modified: Jan. 06, 2026

Vuln Type: Authorization
7.1

HIGH

CVE-2025-41746

An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulner...

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-42876

Due to a Missing Authorization Check vulnerability in SAP S/4 HANA Private Cloud (Financials General Ledger), an authenticated attacker with authorization limited to a single company code could read sensitive data and post or modify documents across all c...

Affected Products :
Published: Dec. 09, 2025

Modified: Dec. 09, 2025

Vuln Type: Authorization
7.1

HIGH

CVE-2025-67648

Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the...

Affected Products : shopware
Published: Dec. 11, 2025

Modified: Dec. 12, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-41747

An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulne...

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-64784

DNG SDK versions 1.7.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure or application denial of service. An attacker could leverage this vulnerability to disclose sensitive memory information. Expl...

Affected Products : macos windows dng_software_development_kit
Published: Dec. 09, 2025

Modified: Dec. 10, 2025

Vuln Type: Memory Corruption
7.1

HIGH

CVE-2025-49341

Cross-Site Request Forgery (CSRF) vulnerability in Alex Furr PDF Creator Lite pdf-creator-lite allows Stored XSS.This issue affects PDF Creator Lite: from n/a through <= 1.2....

Affected Products :
Published: Dec. 09, 2025

Modified: Dec. 11, 2025

Vuln Type: Cross-Site Request Forgery
7.1

HIGH

CVE-2025-49347

Cross-Site Request Forgery (CSRF) vulnerability in Jupitercow WP sIFR wp-sifr allows Stored XSS.This issue affects WP sIFR: from n/a through <= 0.6.8.1....

Affected Products :
Published: Dec. 09, 2025

Modified: Dec. 11, 2025

Vuln Type: Cross-Site Request Forgery
7.1

HIGH

CVE-2025-30631

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Sales Funnel Builder, AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows Reflected XSS.This ...

Affected Products :
Published: Jan. 06, 2026

Modified: Jan. 06, 2026

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-40831

A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application lacks input validation of date parameter in report generation functionality. This could allow an authenticated, lowly privileged attacker to c...

Affected Products : sinec_security_monitor
Published: Dec. 09, 2025

Modified: Dec. 10, 2025

Vuln Type: Denial of Service
7.1

HIGH

CVE-2025-41745

An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnera...

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-41695

An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerabilit...

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-41748

An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerabili...

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-41749

An XSS vulnerability in port_util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability ...

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Cross-Site Scripting
7.1

HIGH

CVE-2025-31642

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHURCH allows Reflected XSS.This issue affects WPCHURCH: from n/a through 2.7.0....

Affected Products :
Published: Jan. 07, 2026

Modified: Jan. 07, 2026

Vuln Type: Cross-Site Scripting

Showing 20 of 5135 Results

Browse by Apps

Latest CVE Feed

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

7.1

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable