Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 3.1

    LOW
    CVE-2025-15126

    A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositionUserList. This manipulation of the argument positionId causes improper authorization. The atta... Read more

    Affected Products : jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authorization

  • 3.1

    LOW
    CVE-2025-68940

    In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.... Read more

    Affected Products : gitea
    • Published: Dec. 26, 2025
    • Modified: Dec. 26, 2025
    • Vuln Type: Authorization

  • 3.1

    LOW
    CVE-2025-43531

    A race condition was addressed with improved state handling. This issue is fixed in watchOS 26.2, Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, tvOS 26.2. Processing maliciously crafted web content m... Read more

    • Published: Dec. 17, 2025
    • Modified: Dec. 18, 2025
    • Vuln Type: Race Condition

  • 3.1

    LOW
    CVE-2025-15119

    A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of the argument deptId results in improper authorization. The attack can be executed remotely. A hig... Read more

    Affected Products : jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authorization

  • 3.1

    LOW
    CVE-2025-15125

    A security flaw has been discovered in JeecgBoot up to 3.9.0. Affected is the function queryDepartPermission of the file /sys/permission/queryDepartPermission. The manipulation of the argument departId results in improper authorization. The attack can be ... Read more

    Affected Products : jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authorization

  • 3.1

    LOW
    CVE-2025-15141

    A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler. Executing manipulation can lead to information disclosure. The attack may be performed from remo... Read more

    Affected Products :
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Information Disclosure

  • 3.1

    LOW
    CVE-2025-15122

    A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing manipulation of the argument departId/roleId results in improper authorization. It is possible to in... Read more

    Affected Products : jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authorization

  • 3.1

    LOW
    CVE-2025-15117

    A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Executing manipulation can lead to deserialization. The attack may be launched remotely. This attack ... Read more

    Affected Products : sa-token
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Injection

  • 3.1

    LOW
    CVE-2025-67737

    AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast installations. A u... Read more

    Affected Products : azuracast
    • Published: Dec. 12, 2025
    • Modified: Dec. 12, 2025
    • Vuln Type: Misconfiguration

  • 3.1

    LOW
    CVE-2025-12997

    Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive user information.... Read more

    Affected Products : carelink_network
    • Published: Dec. 04, 2025
    • Modified: Dec. 22, 2025
    • Vuln Type: Authorization

  • 3.1

    LOW
    CVE-2025-36229

    IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers.... Read more

    Affected Products : aspera_faspex_5
    • Published: Dec. 26, 2025
    • Modified: Dec. 26, 2025
    • Vuln Type: Information Disclosure

  • 3.1

    LOW
    CVE-2025-15123

    A vulnerability was determined in JeecgBoot up to 3.9.0. This affects an unknown function of the file /sys/sysDepartPermission/datarule/. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The attack r... Read more

    Affected Products : jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authorization

  • 3.1

    LOW
    CVE-2025-15120

    A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of the argument departId causes improper authorization. The attack is possible to be carried out rem... Read more

    Affected Products : jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Dec. 28, 2025
    • Vuln Type: Authorization

  • 3.0

    LOW
    CVE-2025-13352

    Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub o... Read more

    Affected Products : mattermost_server
    • Published: Dec. 17, 2025
    • Modified: Dec. 18, 2025
    • Vuln Type: Authentication

  • 2.9

    LOW
    CVE-2025-67899

    uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.... Read more

    Affected Products : uriparser
    • Published: Dec. 14, 2025
    • Modified: Dec. 15, 2025
    • Vuln Type: Denial of Service

  • 2.9

    LOW
    CVE-2025-68932

    FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows atta... Read more

    Affected Products : freshrss
    • Published: Dec. 27, 2025
    • Modified: Dec. 27, 2025
    • Vuln Type: Cryptography

  • 2.8

    LOW
    CVE-2025-43532

    A memory corruption issue was addressed with improved bounds checking. This issue is fixed in watchOS 26.2, macOS Sonoma 14.8.3, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, macOS Sequoia 15.7.3, visionOS 26.2, tvOS 26.2. Proc... Read more

    Affected Products : macos iphone_os tvos watchos ipados visionos
    • Published: Dec. 12, 2025
    • Modified: Dec. 17, 2025
    • Vuln Type: Memory Corruption

  • 2.8

    LOW
    CVE-2025-65185

    There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and new password then reviewing application responses.... Read more

    Affected Products :
    • Published: Dec. 17, 2025
    • Modified: Dec. 18, 2025
    • Vuln Type: Authentication

  • 2.7

    LOW
    CVE-2025-57823

    A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with a... Read more

    Affected Products : fortiauthenticator
    • Published: Dec. 09, 2025
    • Modified: Dec. 09, 2025
    • Vuln Type: Authorization

  • 2.7

    LOW
    CVE-2025-68164

    In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test... Read more

    Affected Products : teamcity
    • Published: Dec. 16, 2025
    • Modified: Dec. 18, 2025
    • Vuln Type: Information Disclosure
Showing 20 of 4782 Results