Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

7.2

HIGH

CVE-2025-59702

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with elevated privileges to falsify tamper events by accessing internal components....

Affected Products : nshield_5c_firmware nshield_5c nshield_hsmi_firmware nshield_hsmi nshield_connect_xc_base_firmware nshield_connect_xc_base nshield_connect_xc_mid_firmware nshield_connect_xc_mid nshield_connect_xc_high_firmware nshield_connect_xc_high
Published: Dec. 02, 2025

Modified: Dec. 08, 2025

Vuln Type: Misconfiguration
6.8

MEDIUM

CVE-2025-59705

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a Physically Proximate Attacker to Escalate Privileges by enabling the USB interface through chassis probe insertion during system boot, aka "Unauthorized Reactivatio...

Affected Products : nshield_5c_firmware nshield_5c nshield_hsmi_firmware nshield_hsmi nshield_connect_xc_base_firmware nshield_connect_xc_base nshield_connect_xc_mid_firmware nshield_connect_xc_mid nshield_connect_xc_high_firmware nshield_connect_xc_high
Published: Dec. 02, 2025

Modified: Dec. 08, 2025

Vuln Type: Misconfiguration
9.1

CRITICAL

CVE-2025-59703

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a Physically Proximate Attacker to access the internal components of the appliance, without leaving tamper evidence. To exploit this, the attacker needs to remove the...

Affected Products : nshield_5c_firmware nshield_5c nshield_hsmi_firmware nshield_hsmi nshield_connect_xc_base_firmware nshield_connect_xc_base nshield_connect_xc_mid_firmware nshield_connect_xc_mid nshield_connect_xc_high_firmware nshield_connect_xc_high
Published: Dec. 02, 2025

Modified: Dec. 08, 2025

Vuln Type: Authentication
4.6

MEDIUM

CVE-2025-59704

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow an attacker to gain access the the BIOS menu because is has no password....

Affected Products : nshield_5c_firmware nshield_5c nshield_hsmi_firmware nshield_hsmi nshield_connect_xc_base_firmware nshield_connect_xc_base nshield_connect_xc_mid_firmware nshield_connect_xc_mid nshield_connect_xc_high_firmware nshield_connect_xc_high
Published: Dec. 02, 2025

Modified: Dec. 08, 2025

Vuln Type: Misconfiguration
9.8

CRITICAL

CVE-2025-66208

Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versions prior to 25.04.702, Collabora Online has a Configuration-Dependent RCE (OS Command Injection)...

Affected Products : online
Published: Dec. 03, 2025

Modified: Dec. 08, 2025

Vuln Type: Injection
8.3

HIGH

CVE-2025-58098

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended ...

Affected Products : http_server
Published: Dec. 05, 2025

Modified: Dec. 08, 2025

Vuln Type: Injection
5.5

MEDIUM

CVE-2025-66334

Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability....

Affected Products : harmonyos
Published: Dec. 08, 2025

Modified: Dec. 08, 2025

Vuln Type: Denial of Service
7.2

HIGH

CVE-2025-59697

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to escalate privileges by editing the Legacy GRUB bootloader configuration to start a root shell upon boot of the host OS. This is cal...

Affected Products : nshield_5c_firmware nshield_5c nshield_hsmi_firmware nshield_hsmi nshield_connect_xc_base_firmware nshield_connect_xc_base nshield_connect_xc_mid_firmware nshield_connect_xc_mid nshield_connect_xc_high_firmware nshield_connect_xc_high
Published: Dec. 02, 2025

Modified: Dec. 08, 2025

Vuln Type: Authentication
3.2

LOW

CVE-2025-59696

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to modify or erase tamper events via the Chassis management board....

Affected Products : nshield_5c_firmware nshield_5c nshield_hsmi_firmware nshield_hsmi nshield_connect_xc_base_firmware nshield_connect_xc_base nshield_connect_xc_mid_firmware nshield_connect_xc_mid nshield_connect_xc_high_firmware nshield_connect_xc_high
Published: Dec. 02, 2025

Modified: Dec. 08, 2025

Vuln Type: Misconfiguration
7.5

HIGH

CVE-2025-54848

A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted series of network requests can lead to a denial of service. An attacker can send a sequence of unaut...

Affected Products : diris_digiware_m-70_firmware diris_digiware_m-70
Published: Dec. 01, 2025

Modified: Dec. 08, 2025

Vuln Type: Denial of Service
7.5

HIGH

CVE-2025-54849

A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted series of network requests can lead to a denial of service. An attacker can send a sequence of unaut...

Affected Products : diris_digiware_m-70_firmware diris_digiware_m-70
Published: Dec. 01, 2025

Modified: Dec. 08, 2025

Vuln Type: Denial of Service
8.7

HIGH

CVE-2025-53704

The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account....

Affected Products :
Published: Dec. 04, 2025

Modified: Dec. 08, 2025

Vuln Type: Authentication
8.7

HIGH

CVE-2024-58275

Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the ser...

Affected Products :
Published: Dec. 04, 2025

Modified: Dec. 08, 2025

Vuln Type: Injection
8.8

HIGH

CVE-2025-13066

The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization wh...

Affected Products : demo_importer_plus
Published: Dec. 05, 2025

Modified: Dec. 08, 2025

Vuln Type: Misconfiguration
4.4

MEDIUM

CVE-2025-12124

The FitVids for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

Affected Products :
Published: Dec. 05, 2025

Modified: Dec. 08, 2025

Vuln Type: Cross-Site Scripting
4.3

MEDIUM

CVE-2025-10055

The Time Sheets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on several endpoints. This makes it possible for unauthenticated attackers t...

Affected Products :
Published: Dec. 05, 2025

Modified: Dec. 08, 2025

Vuln Type: Cross-Site Request Forgery
5.3

MEDIUM

CVE-2023-53735

WEBIGniter 28.7.23 contains a cross-site scripting vulnerability in the user creation process that allows unauthenticated attackers to execute malicious JavaScript code, enabling potential XSS attacks....

Affected Products :
Published: Dec. 04, 2025

Modified: Dec. 08, 2025

Vuln Type: Cross-Site Scripting
4.3

MEDIUM

CVE-2025-12128

The Hide Categories Or Products On Shop Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7. This is due to missing or incorrect nonce validation on the save_data_hcps() function. This makes it...

Affected Products :
Published: Dec. 05, 2025

Modified: Dec. 08, 2025

Vuln Type: Cross-Site Request Forgery
4.3

MEDIUM

CVE-2025-12190

The Image Optimizer by wps.sk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the imagopby_ajax_optimize_gallery() function. This makes i...

Affected Products :
Published: Dec. 05, 2025

Modified: Dec. 08, 2025

Vuln Type: Cross-Site Request Forgery
8.8

HIGH

CVE-2025-12181

The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cstu_update_post() function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Aut...

Affected Products : contentstudio
Published: Dec. 05, 2025

Modified: Dec. 08, 2025

Vuln Type: Misconfiguration

Showing 20 of 4869 Results

Browse by Apps

Latest CVE Feed

7.2

6.8

9.1

4.6

9.8

8.3

5.5

7.2

3.2

7.5

7.5

8.7

8.7

8.8

4.4

4.3

5.3

4.3

4.3

8.8

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable