Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

7.0

HIGH

CVE-2025-60716

Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 windows_11_25h2
Published: Nov. 11, 2025

Modified: Nov. 12, 2025
7.0

HIGH

CVE-2025-62219

Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally....

Affected Products : windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2
Published: Nov. 11, 2025

Modified: Nov. 12, 2025
7.0

HIGH

CVE-2025-59515

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 windows_11_25h2
Published: Nov. 11, 2025

Modified: Nov. 12, 2025
7.0

HIGH

CVE-2025-62258

CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless A...

Affected Products : liferay_portal digital_experience_platform dxp
Published: Oct. 27, 2025

Modified: Nov. 10, 2025

Vuln Type: Cross-Site Request Forgery
7.0

HIGH

CVE-2025-62217

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_23h2 +6 more products
Published: Nov. 11, 2025

Modified: Nov. 12, 2025
7.0

HIGH

CVE-2025-34133

Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery (CSRF) vulnerability in its API. The API accepts any authenticated request that contains a JSON field named 'csrf_token' without validating the field’s value; only the presence ...

Affected Products :
Published: Oct. 27, 2025

Modified: Oct. 30, 2025

Vuln Type: Cross-Site Request Forgery
7.0

HIGH

CVE-2025-60717

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 windows_11_25h2
Published: Nov. 11, 2025

Modified: Nov. 12, 2025
7.0

HIGH

CVE-2025-60719

Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_23h2 +6 more products
Published: Nov. 11, 2025

Modified: Nov. 12, 2025
7.0

HIGH

CVE-2025-59508

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_23h2 windows_11_24h2 +2 more products
Published: Nov. 11, 2025

Modified: Nov. 12, 2025
7.0

HIGH

CVE-2025-59506

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_23h2 +4 more products
Published: Nov. 11, 2025

Modified: Nov. 12, 2025
7.0

HIGH

CVE-2025-59507

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_23h2 windows_11_24h2 +2 more products
Published: Nov. 11, 2025

Modified: Nov. 12, 2025
7.0

HIGH

CVE-2025-37735

Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM. In some cases, this could result in local privilege escalation....

Affected Products : kibana
Published: Nov. 06, 2025

Modified: Nov. 06, 2025

Vuln Type: Misconfiguration
7.0

HIGH

CVE-2025-34500

Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the u...

Affected Products :
Published: Oct. 24, 2025

Modified: Oct. 27, 2025

Vuln Type: Cryptography
7.0

HIGH

CVE-2025-34502

Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem a...

Affected Products :
Published: Oct. 24, 2025

Modified: Oct. 27, 2025

Vuln Type: Misconfiguration
7.0

HIGH

CVE-2025-34501

Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often throu...

Affected Products :
Published: Nov. 03, 2025

Modified: Nov. 04, 2025

Vuln Type: Authentication
7.0

HIGH

CVE-2025-62215

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 +1 more products
Actively Exploited

Published: Nov. 11, 2025

Modified: Nov. 14, 2025
6.9

MEDIUM

CVE-2025-58474

When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests. Note: Software version...

Affected Products : big-ip_access_policy_manager big-ip_application_security_manager big-ip_advanced_web_application_firewall
Published: Oct. 15, 2025

Modified: Oct. 22, 2025

Vuln Type: Denial of Service
6.9

MEDIUM

CVE-2025-62250

Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote att...

Affected Products : liferay_portal dxp
Published: Oct. 21, 2025

Modified: Oct. 21, 2025

Vuln Type: Authentication
6.9

MEDIUM

CVE-2025-62701

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikistories allows Stored XSS.This issue affects Mediawiki - Wikistories: from master before 1.44....

Affected Products :
Published: Oct. 21, 2025

Modified: Oct. 21, 2025
6.9

MEDIUM

CVE-2025-11915

Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action....

Affected Products :
Published: Oct. 22, 2025

Modified: Oct. 22, 2025

Vuln Type: Misconfiguration

Showing 20 of 3919 Results

Browse by Apps

Latest CVE Feed

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

7.0

6.9

6.9

6.9

6.9

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable