Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

6.3

MEDIUM

CVE-2025-60023

A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and delete arbitrary directories on ...

Affected Products : productivity_3000_p3-622_cpu productivity_2000_p2-550_cpu productivity_1000_p1-540_cpu productivity_3000_p3-530_cpu productivity_2000_p2-622_cpu productivity_1000_p1-550_cpu productivity_3000_p3-550e_cpu productivity_suite
Published: Oct. 23, 2025

Modified: Oct. 27, 2025

Vuln Type: Path Traversal
10.0

CRITICAL

CVE-2025-61934

A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read, write, or d...

Affected Products : productivity_3000_p3-622_cpu productivity_2000_p2-550_cpu productivity_1000_p1-540_cpu productivity_3000_p3-530_cpu productivity_2000_p2-622_cpu productivity_1000_p1-550_cpu productivity_3000_p3-550e_cpu productivity_suite
Published: Oct. 23, 2025

Modified: Oct. 27, 2025

Vuln Type: Misconfiguration
8.3

HIGH

CVE-2025-58429

A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and delete arbitrary files on the ta...

Affected Products : productivity_3000_p3-622_cpu productivity_2000_p2-550_cpu productivity_1000_p1-540_cpu productivity_3000_p3-530_cpu productivity_2000_p2-622_cpu productivity_1000_p1-550_cpu productivity_3000_p3-550e_cpu productivity_suite
Published: Oct. 23, 2025

Modified: Oct. 27, 2025

Vuln Type: Path Traversal
8.2

HIGH

CVE-2025-58456

A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read arbitrary files on the ...

Affected Products : productivity_3000_p3-622_cpu productivity_2000_p2-550_cpu productivity_1000_p1-540_cpu productivity_3000_p3-530_cpu productivity_2000_p2-622_cpu productivity_1000_p1-550_cpu productivity_3000_p3-550e_cpu productivity_suite
Published: Oct. 23, 2025

Modified: Oct. 27, 2025

Vuln Type: Path Traversal
8.8

HIGH

CVE-2025-62498

A relative path traversal (ZipSlip) vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an attacker who can tamper with a productivity project to execute arbitrary code on the machine where the project ...

Affected Products : productivity_3000_p3-622_cpu productivity_2000_p2-550_cpu productivity_1000_p1-540_cpu productivity_3000_p3-530_cpu productivity_2000_p2-622_cpu productivity_1000_p1-550_cpu productivity_3000_p3-550e_cpu productivity_suite
Published: Oct. 23, 2025

Modified: Oct. 27, 2025

Vuln Type: Path Traversal
7.3

HIGH

CVE-2025-61977

A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an attacker to decrypt an encrypted project by answering just one recovery question....

Affected Products : productivity_3000_p3-622_cpu productivity_2000_p2-550_cpu productivity_1000_p1-540_cpu productivity_3000_p3-530_cpu productivity_2000_p2-622_cpu productivity_1000_p1-550_cpu productivity_3000_p3-550e_cpu productivity_suite
Published: Oct. 23, 2025

Modified: Oct. 27, 2025

Vuln Type: Authentication
6.1

MEDIUM

CVE-2025-61413

A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary web scripts or HTML via creating a page and injecting a crafted payload into the Markdown blocks....

Affected Products :
Published: Oct. 23, 2025

Modified: Oct. 27, 2025

Vuln Type: Cross-Site Scripting
4.3

MEDIUM

CVE-2025-11257

The LLM Hubspot Blog Import plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_save_blogs' AJAX endpoint in all versions up to, and including, 1.0.1. This makes it possible for authent...

Affected Products :
Published: Oct. 24, 2025

Modified: Oct. 27, 2025

Vuln Type: Authorization
5.2

MEDIUM

CVE-2025-57848

A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execu...

Affected Products :
Published: Oct. 23, 2025

Modified: Oct. 27, 2025

Vuln Type: Misconfiguration
6.8

MEDIUM

CVE-2025-12136

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.2.4. This is due to insufficient validation on the user-supplied URL in the '/scanner/scan-wit...

Affected Products : wordpress_real_cookie_banner
Published: Oct. 24, 2025

Modified: Oct. 27, 2025

Vuln Type: Server-Side Request Forgery
5.9

MEDIUM

CVE-2025-62517

Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with unt...

Affected Products : rollbar
Published: Oct. 23, 2025

Modified: Oct. 27, 2025

Vuln Type: Misconfiguration
7.1

HIGH

CVE-2025-55067

The TLS4B ATG system is vulnerable to improper handling of Unix time values that exceed the 2038 epoch rollover. When the system clock reaches January 19, 2038, it resets to December 13, 1901, causing authentication failures and disrupting core system fun...

Affected Products : tls4b_automatic_tank_gauge_system
Published: Oct. 23, 2025

Modified: Oct. 27, 2025

Vuln Type: Denial of Service
4.3

MEDIUM

CVE-2025-5605

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in p...

Affected Products : wso2_open_banking_am wso2_identity_server org.wso2.carbon_org.wso2.carbon.ui wso2_api_control_plane wso2_open_banking_iam wso2_enterprise_integrator wso2_api_manager wso2_universal_gateway wso2_identity_server_as_key_manager wso2_traffic_manager
Published: Oct. 24, 2025

Modified: Oct. 27, 2025

Vuln Type: Authentication
7.5

HIGH

CVE-2025-12277

A flaw has been found in Abdullah-Hasan-Sajjad Online-School up to f09dda77b4c29aa083ff57f4b1eb991b98b68883. This affects an unknown part of the file /studentLogin.php. This manipulation of the argument Email causes sql injection. The attack is possible t...

Affected Products :
Published: Oct. 27, 2025

Modified: Oct. 27, 2025

Vuln Type: Injection
7.3

HIGH

CVE-2025-12247

A weakness has been identified in Hasleo Backup Suite up to 5.2. Impacted is an unknown function of the component HasleoImageMountService/HasleoBackupSuiteService. This manipulation causes unquoted search path. The attack is restricted to local execution....

Affected Products :
Published: Oct. 27, 2025

Modified: Oct. 27, 2025

Vuln Type: Misconfiguration
4.3

MEDIUM

CVE-2025-58918

Cross-Site Request Forgery (CSRF) vulnerability in Waituk Entrada theme allows Cross Site Request Forgery.This issue affects Entrada: from n/a through 5.7.7....

Affected Products : entrada
Published: Oct. 27, 2025

Modified: Oct. 27, 2025

Vuln Type: Cross-Site Request Forgery
7.1

HIGH

CVE-2025-11682

Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to execute arbitrary JavaScript code in a victim's browser. The vulnerability is due to improper sanit...

Affected Products :
Published: Oct. 27, 2025

Modified: Oct. 27, 2025

Vuln Type: Cross-Site Scripting
6.5

MEDIUM

CVE-2025-12222

A security vulnerability has been detected in Bdtask Flight Booking Software up to 3.1. Affected by this issue is some unknown functionality of the file /admin/transaction/deposit of the component Deposit Handler. The manipulation leads to unrestricted up...

Affected Products :
Published: Oct. 27, 2025

Modified: Oct. 27, 2025

Vuln Type: Misconfiguration
5.8

MEDIUM

CVE-2025-12250

A flaw has been found in OpenWGA 7.11.12 Build 737. This affects an unknown function of the file WGA.File of the component TMLScript API. Executing manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been...

Affected Products :
Published: Oct. 27, 2025

Modified: Oct. 27, 2025

Vuln Type: Path Traversal
5.1

MEDIUM

CVE-2025-12251

A vulnerability has been found in OpenWGA 7.11.12 Build 737. This impacts an unknown function of the component Admin UI. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and...

Affected Products :
Published: Oct. 27, 2025

Modified: Oct. 27, 2025

Vuln Type: Cross-Site Scripting

Showing 20 of 3779 Results

Browse by Apps

Latest CVE Feed

6.3

10.0

8.3

8.2

8.8

7.3

6.1

4.3

5.2

6.8

5.9

7.1

4.3

7.5

7.3

4.3

7.1

6.5

5.8

5.1

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable