Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 5.8

    MEDIUM
    CVE-2025-15415

    A vulnerability has been found in xnx3 wangmarket up to 6.4. The impacted element is the function uploadImage of the file /sits/uploadImage.do of the component XML File Handler. The manipulation of the argument image leads to unrestricted upload. Remote e... Read more

    Affected Products : wangmarket
    • Published: Jan. 01, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Misconfiguration

  • 8.8

    HIGH
    CVE-2026-21683

    iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `icStatusCMM::CI... Read more

    Affected Products : iccdev
    • Published: Jan. 07, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Memory Corruption

  • 6.9

    MEDIUM
    CVE-2026-22188

    Panda3D versions up to and including 1.10.16 deploy-stub contains a denial of service vulnerability due to unbounded stack allocation. The deploy-stub executable allocates argv_copy and argv_copy2 using alloca() based directly on the attacker-controlled a... Read more

    Affected Products : panda3d
    • Published: Jan. 07, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Denial of Service

  • 9.8

    CRITICAL
    CVE-2026-22189

    Panda3D versions up to and including 1.10.16 egg-mkfont contains a stack-based buffer overflow vulnerability due to use of an unbounded sprintf() call with attacker-controlled input. When constructing glyph filenames, egg-mkfont formats a user-supplied gl... Read more

    Affected Products : panda3d
    • Published: Jan. 07, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Memory Corruption

  • 8.1

    HIGH
    CVE-2025-15382

    A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted SCP path input containing '/./' sequences, resulting in a heap over read by 1 byte.... Read more

    Affected Products : wolfssh
    • Published: Jan. 06, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Memory Corruption

  • 7.5

    HIGH
    CVE-2026-22190

    Panda3D versions up to and including 1.10.16 egg-mkfont contains an uncontrolled format string vulnerability. The -gp (glyph pattern) command-line option is used directly as the format string for sprintf() with only a single argument supplied. If an attac... Read more

    Affected Products : panda3d
    • Published: Jan. 07, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Information Disclosure

  • 9.8

    CRITICAL
    CVE-2025-14942

    wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the client into skipping user authentication. This affects client applications with wolfSSH version 1.... Read more

    Affected Products : wolfssh
    • Published: Jan. 06, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Authentication

  • 7.8

    HIGH
    CVE-2025-13709

    Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent TFace. User interaction is required to exploi... Read more

    Affected Products : tface
    • Published: Dec. 23, 2025
    • Modified: Jan. 12, 2026
    • Vuln Type: Injection

  • 7.8

    HIGH
    CVE-2025-13711

    Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent TFace. User interaction is required to exploit this vulnera... Read more

    Affected Products : tface
    • Published: Dec. 23, 2025
    • Modified: Jan. 12, 2026
    • Vuln Type: Information Disclosure

  • 5.0

    MEDIUM
    CVE-2025-66407

    Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prior to ... Read more

    Affected Products : weblate
    • Published: Dec. 16, 2025
    • Modified: Jan. 12, 2026
    • Vuln Type: Server-Side Request Forgery

  • 7.2

    HIGH
    CVE-2026-0699

    A vulnerability was found in code-projects Intern Membership Management System 1.0. This impacts an unknown function of the file /intern/admin/edit_activity.php. Performing a manipulation of the argument activity_id results in sql injection. Remote exploi... Read more

    • Published: Jan. 08, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Injection

  • 9.8

    CRITICAL
    CVE-2026-0700

    A vulnerability was determined in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /intern/admin/check_admin.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can... Read more

    • Published: Jan. 08, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Injection

  • 8.7

    HIGH
    CVE-2025-14847

    Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, Mon... Read more

    Affected Products : mongodb
    • Actively Exploited
    • Published: Dec. 19, 2025
    • Modified: Jan. 12, 2026
    • Vuln Type: Memory Corruption

  • 7.5

    HIGH
    CVE-2025-62004

    BullWall Server Intrusion Protection services are initialized after login services. An authenticated attacker with administrative permissions can log in after boot and bypass MFA. SIP service does not retroactively enforce the challenge or disconnect unau... Read more

    Affected Products : server_intrusion_protection
    • Published: Dec. 18, 2025
    • Modified: Jan. 12, 2026
    • Vuln Type: Authentication

  • 7.5

    HIGH
    CVE-2025-62003

    BullWall Server Intrusion Protection has a noticeable delay before the MFA check when connecting via RDP. A remote authenticated attacker with administrative privileges can potentially bypass detection during this window. Versions 4.6.0.0, 4.6.0.6, 4.6.0.... Read more

    Affected Products : server_intrusion_protection
    • Published: Dec. 18, 2025
    • Modified: Jan. 12, 2026
    • Vuln Type: Authentication

  • 7.5

    HIGH
    CVE-2025-56424

    An issue in Insiders Technologies GmbH e-invoice pro before release 1 Service Pack 2 allows a remote attacker to cause a denial of service via a crafted script... Read more

    Affected Products : e-invoice_pro
    • Published: Jan. 08, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Denial of Service

  • 8.1

    HIGH
    CVE-2025-62002

    BullWall Ransomware Containment relies on the number of file modifications to trigger detection. An authenticated attacker could encrypt a single large file without triggering a detection alert. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 were confirm... Read more

    Affected Products : ransomware_containment
    • Published: Dec. 18, 2025
    • Modified: Jan. 12, 2026
    • Vuln Type: Denial of Service

  • 8.8

    HIGH
    CVE-2025-62001

    BullWall Ransomware Containment contains excluded file paths, such as '$recycle.bin' that are not monitored. An attacker with file write permissions could bypass detection by renaming a directory. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 were confi... Read more

    Affected Products : ransomware_containment
    • Published: Dec. 18, 2025
    • Modified: Jan. 12, 2026
    • Vuln Type: Misconfiguration

  • 9.8

    CRITICAL
    CVE-2026-21891

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks the validity of the username but appears to skip, misinterpret, or incorrectly validate the passwo... Read more

    Affected Products : zimaos
    • Published: Jan. 08, 2026
    • Modified: Jan. 12, 2026
    • Vuln Type: Authentication

  • 7.1

    HIGH
    CVE-2025-62000

    BullWall Ransomware Containment does not entirely inspect a file to determine if it is ransomware. An authenticated attacker could bypass detection by encrypting a file and leaving the first four bytes unaltered. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.... Read more

    Affected Products : ransomware_containment
    • Published: Dec. 18, 2025
    • Modified: Jan. 12, 2026
    • Vuln Type: Misconfiguration
Showing 20 of 4340 Results