Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 3.1

    LOW
    CVE-2025-15242

    A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function of the component Coupon Handler. Performing manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack is rather ... Read more

    Affected Products : phpems
    • Published: Dec. 30, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Race Condition

  • 8.8

    HIGH
    CVE-2025-15131

    A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed... Read more

    Affected Products : z4pro\+_firmware z4pro\+
    • Published: Dec. 28, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Injection

  • 8.8

    HIGH
    CVE-2025-15133

    A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2_api_CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. Such manipulation leads to command injection. It is possibl... Read more

    Affected Products : z4pro\+_firmware z4pro\+
    • Published: Dec. 28, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Injection

  • 3.1

    LOW
    CVE-2025-15119

    A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of the argument deptId results in improper authorization. The attack can be executed remotely. A hig... Read more

    Affected Products : jeecg_boot jeecgboot
    • Published: Dec. 28, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Authorization

  • 9.9

    CRITICAL
    CVE-2025-66209

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/servic... Read more

    Affected Products : coolify
    • Published: Dec. 23, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Injection

  • 7.8

    HIGH
    CVE-2025-14414

    Soda PDF Desktop Word File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulner... Read more

    Affected Products : soda_pdf_desktop
    • Published: Dec. 23, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Information Disclosure

  • 7.8

    HIGH
    CVE-2025-14413

    Soda PDF Desktop CBZ File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vul... Read more

    Affected Products : soda_pdf_desktop
    • Published: Dec. 23, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Path Traversal

  • 9.1

    CRITICAL
    CVE-2025-56332

    Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin resource via Insecure Default Configuration... Read more

    Affected Products : pangolin
    • Published: Dec. 30, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Authentication

  • 9.8

    CRITICAL
    CVE-2025-56333

    An issue in Fossorial fosrl/pangolin v.1.6.2 and before allows a remote attacker to escalate privileges via the 2FA component... Read more

    Affected Products : pangolin
    • Published: Dec. 29, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Authentication

  • 5.6

    MEDIUM
    CVE-2025-62329

    HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated. This could lead to unauthorized access under cer... Read more

    Affected Products : hcl_launch hcl_devops_deploy
    • Published: Dec. 16, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Race Condition

  • 7.5

    HIGH
    CVE-2025-65568

    A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a PFCP Session Establishment Request that includes a CreateFAR with an empty or truncated IPv4 address f... Read more

    Affected Products : upf
    • Published: Dec. 18, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Denial of Service

  • 7.5

    HIGH
    CVE-2025-65567

    A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a specially crafted PFCP Session Establishment Request with a CreatePDR that contains a malformed Flow-D... Read more

    Affected Products : upf
    • Published: Dec. 18, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Denial of Service

  • 7.5

    HIGH
    CVE-2025-65565

    A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association is established, a PFCP Session Establishment Request that is missing the mandatory F-SEID (CPF-SEID) Info... Read more

    Affected Products : upf
    • Published: Dec. 18, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Denial of Service

  • 5.9

    MEDIUM
    CVE-2025-62330

    HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS as intended. As a result, an attacker with network access could intercept or modify user credent... Read more

    Affected Products : hcl_devops_deploy
    • Published: Dec. 16, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Misconfiguration

  • 7.5

    HIGH
    CVE-2025-65564

    A denial-of-service vulnerability exists in the omec-upf (upf-epc-pfcpiface) in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Association Setup Request that is missing the mandatory Recovery Time Stamp Information Element, the associat... Read more

    Affected Products : upf
    • Published: Dec. 18, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Denial of Service

  • 7.5

    HIGH
    CVE-2025-65563

    A denial-of-service vulnerability exists in the omec-project UPF (component upf-epc/pfcpiface) up to at least version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Association Setup Request that is missing the mandatory NodeID Information Elem... Read more

    Affected Products : upf
    • Published: Dec. 18, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Denial of Service

  • 9.8

    CRITICAL
    CVE-2025-65834

    Meltytech Shotcut 25.10.31 is vulnerable to Buffer Overflow. A memory access violation occurs when processing MLT project files with manipulated width and height parameters. By setting these values to extremely large numbers, the application attempts to a... Read more

    Affected Products : shotcut
    • Published: Dec. 16, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Memory Corruption

  • 7.5

    HIGH
    CVE-2025-65562

    The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remote attacker can send a request with a very large SEID (e.g., 0xFFFFFFFFFFFFFFFF) that causes an integer conversion/un... Read more

    Affected Products : free5gc
    • Published: Dec. 18, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Denial of Service

  • 7.5

    HIGH
    CVE-2025-65561

    An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted header Local SEID to the PFCP Session Modification Request.... Read more

    Affected Products : free5gc
    • Published: Dec. 18, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Denial of Service

  • 5.3

    MEDIUM
    CVE-2025-65581

    An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.... Read more

    Affected Products : abp
    • Published: Dec. 16, 2025
    • Modified: Jan. 07, 2026
    • Vuln Type: Misconfiguration
Showing 20 of 4727 Results