Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

6.8

MEDIUM

CVE-2025-64992

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior V25. Improper input validation, allowing authenticated attackers with Actioner privileges to inject a...

Affected Products :
Published: Dec. 11, 2025

Modified: Dec. 12, 2025

Vuln Type: Injection
6.8

MEDIUM

CVE-2025-8460

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Notification rules, Open tickets module) allows Stored XSS by users with elevated privileges.This issue affects Inf...

Affected Products :
Published: Dec. 22, 2025

Modified: Dec. 23, 2025

Vuln Type: Cross-Site Scripting
6.8

MEDIUM

CVE-2025-64990

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-LogoffUser instruction prior V21.1. Improper input validation, allowing authenticated attackers with Actioner privileges to...

Affected Products :
Published: Dec. 11, 2025

Modified: Dec. 12, 2025

Vuln Type: Injection
6.8

MEDIUM

CVE-2025-14311

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JMRI.This issue affects JMRI: before 5.13.3....

Affected Products :
Published: Dec. 09, 2025

Modified: Dec. 09, 2025

Vuln Type: Path Traversal
6.8

MEDIUM

CVE-2025-41697

An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692....

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Authentication
6.8

MEDIUM

CVE-2025-54838

An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests....

Affected Products : fortiportal
Published: Dec. 09, 2025

Modified: Dec. 09, 2025

Vuln Type: Authorization
6.8

MEDIUM

CVE-2025-59808

An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7....

Affected Products : fortisoar fortisoaron-premise fortisoarpaas
Published: Dec. 09, 2025

Modified: Dec. 09, 2025

Vuln Type: Authentication
6.8

MEDIUM

CVE-2025-59699

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to escalate privileges by booting from a USB device with a valid root filesystem. This occurs because of insecure default settings in ...

Affected Products : nshield_5c_firmware nshield_5c nshield_hsmi_firmware nshield_hsmi nshield_connect_xc_base_firmware nshield_connect_xc_base nshield_connect_xc_mid_firmware nshield_connect_xc_mid nshield_connect_xc_high_firmware nshield_connect_xc_high
Published: Dec. 02, 2025

Modified: Dec. 08, 2025

Vuln Type: Authentication
6.8

MEDIUM

CVE-2025-41692

A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm....

Affected Products : fl_nat_2208_firmware fl_nat_2304-2gc-2sfp_firmware fl_switch_2005_firmware fl_switch_2008_firmware fl_switch_2008f_firmware fl_switch_2016_firmware fl_switch_2105_firmware fl_switch_2108_firmware fl_switch_2116_firmware fl_switch_2204-2tc-2sfx_firmware +128 more products
Published: Dec. 09, 2025

Modified: Dec. 19, 2025

Vuln Type: Authentication
6.8

MEDIUM

CVE-2025-66302

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers with administrative privileges to read arbitrary files on the underlying server filesystem. This vu...

Affected Products : grav grav-plugin-admin
Published: Dec. 01, 2025

Modified: Dec. 03, 2025

Vuln Type: Path Traversal
6.8

MEDIUM

CVE-2025-54890

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hostgroup configuration page) allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring...

Affected Products :
Published: Dec. 22, 2025

Modified: Dec. 23, 2025

Vuln Type: Cross-Site Scripting
6.8

MEDIUM

CVE-2025-13407

The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted...

Affected Products :
Published: Dec. 24, 2025

Modified: Dec. 24, 2025

Vuln Type: Misconfiguration
6.8

MEDIUM

CVE-2025-59694

The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allows a physically proximate attacker to persistently modify firmware and influence the (insecurely configured) appliance boot process. To ...

Affected Products : nshield_5c_firmware nshield_5c nshield_hsmi_firmware nshield_hsmi nshield_connect_xc_base_firmware nshield_connect_xc_base nshield_connect_xc_mid_firmware nshield_connect_xc_mid nshield_connect_xc_high_firmware nshield_connect_xc_high
Published: Dec. 02, 2025

Modified: Dec. 15, 2025

Vuln Type: Misconfiguration
6.8

MEDIUM

CVE-2025-66308

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/config/site en...

Affected Products : grav grav-plugin-admin
Published: Dec. 01, 2025

Modified: Dec. 03, 2025

Vuln Type: Cross-Site Scripting
6.8

MEDIUM

CVE-2025-59705

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a Physically Proximate Attacker to Escalate Privileges by enabling the USB interface through chassis probe insertion during system boot, aka "Unauthorized Reactivatio...

Affected Products : nshield_5c_firmware nshield_5c nshield_hsmi_firmware nshield_hsmi nshield_connect_xc_base_firmware nshield_connect_xc_base nshield_connect_xc_mid_firmware nshield_connect_xc_mid nshield_connect_xc_high_firmware nshield_connect_xc_high
Published: Dec. 02, 2025

Modified: Dec. 08, 2025

Vuln Type: Misconfiguration
6.8

MEDIUM

CVE-2025-48618

In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction...

Affected Products : android
Published: Dec. 08, 2025

Modified: Dec. 08, 2025

Vuln Type: Race Condition
6.8

MEDIUM

CVE-2025-27232

An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss....

Affected Products : zabbix
Published: Dec. 01, 2025

Modified: Dec. 01, 2025

Vuln Type: Path Traversal
6.8

MEDIUM

CVE-2025-59698

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, might allow a physically proximate attacker to gain access to the EOL legacy bootloader....

Affected Products : nshield_5c_firmware nshield_5c nshield_hsmi_firmware nshield_hsmi nshield_connect_xc_base_firmware nshield_connect_xc_base nshield_connect_xc_mid_firmware nshield_connect_xc_mid nshield_connect_xc_high_firmware nshield_connect_xc_high
Published: Dec. 02, 2025

Modified: Dec. 08, 2025

Vuln Type: Authentication
6.8

MEDIUM

CVE-2018-25130

Beward Intercom 2.3.1 contains a credentials disclosure vulnerability that allows local attackers to access plain-text authentication credentials stored in an unencrypted database file. Attackers can read the BEWARD.INTERCOM.FDB file to extract usernames ...

Affected Products :
Published: Dec. 24, 2025

Modified: Dec. 24, 2025

Vuln Type: Information Disclosure
6.8

MEDIUM

CVE-2025-53897

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to log information from the system by tricking an administrator into browsing a specifically crafted ...

Affected Products : kiteworks kiteworks_managed_file_transfer
Published: Nov. 29, 2025

Modified: Dec. 03, 2025

Vuln Type: Information Disclosure

Showing 20 of 4948 Results

Browse by Apps

Latest CVE Feed

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

6.8

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable