Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

7.5

HIGH

CVE-2024-7017

Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)...

Affected Products : chrome
Published: Nov. 14, 2025

Modified: Nov. 14, 2025

Vuln Type: Misconfiguration
5.3

MEDIUM

CVE-2025-62483

Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access....

Affected Products : rooms meeting_software_development_kit virtual_desktop_infrastructure vdi_windows_meeting_clients meeting_sdk workplace_desktop rooms_controller workplace_virtual_desktop_infrastructure
Published: Nov. 13, 2025

Modified: Nov. 14, 2025

Vuln Type: Information Disclosure
5.4

MEDIUM

CVE-2025-13097

Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)...

Affected Products : chrome
Published: Nov. 14, 2025

Modified: Nov. 14, 2025

Vuln Type: Misconfiguration
4.0

MEDIUM

CVE-2025-64503

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can ca...

Affected Products :
Published: Nov. 12, 2025

Modified: Nov. 14, 2025

Vuln Type: Memory Corruption
7.0

HIGH

CVE-2025-62217

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 +8 more products
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
7.0

HIGH

CVE-2025-62218

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally....

Affected Products : windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
7.0

HIGH

CVE-2025-62219

Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally....

Affected Products : windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
8.8

HIGH

CVE-2025-62220

Heap-based buffer overflow in Windows Subsystem for Linux GUI allows an unauthorized attacker to execute code over a network....

Affected Products : windows_subsystem_for_linux windows_subsystem_for_linux_gui
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
8.8

HIGH

CVE-2025-62222

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network....

Affected Products : visual_studio_code_copilot_chat_extension github_copilot_chat
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
8.0

HIGH

CVE-2025-62452

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network....

Affected Products : windows_server_2008 windows_server_2012 windows_server_2016 windows_server_2019 windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 +8 more products
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
5.0

MEDIUM

CVE-2025-62453

Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally....

Affected Products : visual_studio_code
Published: Nov. 11, 2025

Modified: Nov. 14, 2025
6.5

MEDIUM

CVE-2025-43205

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in watchOS 11.4, tvOS 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4. An app may be able to bypass ASLR....

Affected Products : iphone_os tvos watchos ipados visionos
Published: Nov. 12, 2025

Modified: Nov. 14, 2025

Vuln Type: Memory Corruption
7.5

HIGH

CVE-2024-12125

A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information....

Affected Products :
Published: Nov. 06, 2025

Modified: Nov. 14, 2025

Vuln Type: Cross-Site Request Forgery
5.3

MEDIUM

CVE-2025-10259

Improper Validation of Specified Quantity in Input vulnerability in TCP Communication Function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote attacker to disconnect the connection by sending specially crafted TCP packets ...

Affected Products : melsec_iq-fx5u-32mt\/es_firmware melsec_iq-fx5u-32mt\/ds_firmware melsec_iq-fx5u-32mt\/ess_firmware melsec_iq-fx5u-32mt\/dss_firmware melsec_iq-fx5u-32mr\/es_firmware melsec_iq-fx5u-32mr\/ds_firmware melsec_iq-fx5u-64mt\/es_firmware melsec_iq-fx5u-64mt\/ds_firmware melsec_iq-fx5u-64mt\/ess_firmware melsec_iq-fx5u-64mt\/dss_firmware +11 more products
Published: Nov. 06, 2025

Modified: Nov. 14, 2025

Vuln Type: Denial of Service
7.0

HIGH

CVE-2025-62215

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally....

Affected Products : windows_server_2019 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_server_2022 windows_11_23h2 windows_server_2022_23h2 windows_server_23h2 windows_11_24h2 windows_server_2025 +1 more products
Actively Exploited

Published: Nov. 11, 2025

Modified: Nov. 14, 2025
9.1

CRITICAL

CVE-2025-12480

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete....

Affected Products : triofox
Actively Exploited

Published: Nov. 10, 2025

Modified: Nov. 14, 2025

Vuln Type: Authorization
6.0

MEDIUM

CVE-2025-12390

A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during l...

Affected Products :
Published: Oct. 28, 2025

Modified: Nov. 13, 2025

Vuln Type: Authentication
5.4

MEDIUM

CVE-2025-12110

A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where ...

Affected Products :
Published: Oct. 23, 2025

Modified: Nov. 13, 2025

Vuln Type: Authentication
3.7

LOW

CVE-2025-10939

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access t...

Affected Products :
Published: Oct. 28, 2025

Modified: Nov. 13, 2025

Vuln Type: Misconfiguration
7.3

HIGH

CVE-2025-64496

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute ...

Affected Products : open_webui
Published: Nov. 08, 2025

Modified: Nov. 13, 2025

Vuln Type: Injection

Showing 20 of 3808 Results

Browse by Apps

Latest CVE Feed

7.5

5.3

5.4

4.0

7.0

7.0

7.0

8.8

8.8

8.0

5.0

6.5

7.5

5.3

7.0

9.1

6.0

5.4

3.7

7.3

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable