CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 02:14 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-12119 | MO MongoDB MongoDB | 3.3 | Nov 18 | Bulk write with options may read invalid memory |
| CVE-2025-12761 | DR Drupal Drupal | 3.5 | Nov 18 | Simple multi step form - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-116 |
| CVE-2025-13083 | DR Drupal Drupal | 3.7 | Nov 18 | Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008 |
| CVE-2025-55074 | MA Mattermost Mattermost | 3.5 | Nov 18 | Channel member objects leak read status |
| CVE-2025-64734 | TR T21 Reader Gallagher | 2.4 | Nov 18 | Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-service attack… |
| CVE-2025-12792 | CA Canva Canva | 3.2 | Nov 18 | The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime |
| CVE-2025-63292 | M4 Mini 4k Firmware Freebox | 3.5 | Nov 17 | Freebox v5 HD (firmware = 1.7.20), Freebox v5 Crystal (firmware = 1.7.20), Freebox v6 Révolution r1–r3 (firmware = 4.7.x), Freebox Mini 4K (firmware = 4.7.x), and Freebox One… |
| CVE-2025-65083 | GD GoSign Desktop Tinexta Infocert | 3.2 | Nov 17 | GoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server |
| CVE-2025-13232 | PR projectsend Projectsend | 3.5 | Nov 16 | projectsend File Editor/Custom Download Aliases cross site scripting |
| CVE-2025-6945 | GI GitLab GitLab | 3.5 | Nov 15 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab |
| CVE-2025-11990 | GI GitLab GitLab | 3.5 | Nov 15 | Improper Handling of URL Encoding (Hex Encoding) in GitLab |
| CVE-2025-4617 | PB Prisma Browser Palo Alto Networks | 1.1 | Nov 14 | Prisma Browser: Insufficient Policy Enforcement Vulnerability in Prisma Browser |
| CVE-2025-4616 | PB Prisma Browser Palo Alto Networks | 1.1 | Nov 14 | Prisma Browser: Insufficient Validation of Untrusted Input Vulnerability in Prisma Browser |
| CVE-2025-54560 | PA Pingalert Application Server Desktopalert | 3.8 | Nov 14 | A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Probing of internal… |
| CVE-2025-54559 | PA Pingalert Application Server Desktopalert | 3.7 | Nov 14 | An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote Path Traversal for loading arbitrary external content |
| CVE-2025-54342 | PA Pingalert Application Server Desktopalert | 3.3 | Nov 14 | A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 |
| CVE-2025-64754 | JI jitsi-meet jitsi | 2.7 | Nov 13 | Jitsi Meet has DOM Redirect on Microsoft OAuth Flow |
| CVE-2025-64744 | OP openobserve openobserve | 3.5 | Nov 13 | OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails |
| CVE-2025-12817 | PO PostgreSQL PostgreSQL | 3.1 | Nov 13 | PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege |
| CVE-2025-64503 | CU cups-filters OpenPrinting | 3.3 | Nov 12 | [BIGSLEEP-434615384] cups-filters 1.x: out of bounds write in pdftoraster |
| CVE-2025-64345 | WA wasmtime bytecodealliance | 1.8 | Nov 12 | Wasmtime provides unsound API access to a WebAssembly shared linear memory |
| CVE-2025-64170 | SU sudo-rs trifectatechfoundation | 3.8 | Nov 12 | sudo-rs: Partial password reveal is possible after timeout |
| CVE-2025-57812 | LI libcupsfilters OpenPrinting | 3.7 | Nov 12 | [BIGSLEEP-434612419] CUPS-Filters has heap-buffer-overflow write in `cfImageLut()` |
| CVE-2025-20379 | SC Splunk Cloud Platform Splunk | 3.5 | Nov 12 | Risky command safeguards bypass using the “/services/streams/search“ REST endpoint through “q“ parameter in Splunk Enterprise |
| CVE-2025-63396 | PY Pytorch Linuxfoundation | 3.3 | Nov 12 | An issue was discovered in PyTorch v2.5 and v2.7.1 |
| CVE-2025-41116 | GR Grafana Grafana | 2.1 | Nov 11 | Incorrect oauth passthrough in Grafana Databricks Datasource |
| CVE-2025-3717 | GR Grafana Grafana | 2.1 | Nov 11 | Incorrect oauth passthrough in Grafana Snowflake Datasource |
| CVE-2025-32088 | IQ Intel(R) QAT Windows software | 3.3 | Nov 11 | Improper conditions check for some Intel(R) QAT Windows software before version 2.6.0 |
| CVE-2025-32037 | IP Intel(R) PresentMon | 2.0 | Nov 11 | Improper access control for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow a denial of service |
| CVE-2025-31948 | IO Intel(R) oneAPI Math Kernel Library | 3.3 | Nov 11 | Improper input validation for some Intel(R) oneAPI Math Kernel Library before version 2025.2 within Ring 3: User Applications may allow a denial of service |
| CVE-2025-30509 | IQ Intel QuickAssist Technology software | 3.3 | Nov 11 | Improper input validation for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege |
| CVE-2025-25216 | IG Intel(R) Graphics Drivers and Intel LTS kernels | 3.3 | Nov 11 | Improper input validation in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may allow a denial of service |
| CVE-2025-24862 | IC Intel(R) CIP software | 2.0 | Nov 11 | Unrestricted upload of file with dangerous type for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of… |
| CVE-2025-24307 | IC Intel(R) CIP software | 2.0 | Nov 11 | Improper privilege management for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege |
| CVE-2025-20622 | IN Intel(R) NPU Drivers for Windows | 3.8 | Nov 11 | Sensitive information uncleared in resource before release for reuse for some Intel(R) NPU Drivers for Windows before version 32.0.100.4023 within Ring 3: User Applications may… |
| CVE-2025-13015 | FI Firefox Mozilla | 3.4 | Nov 11 | Spoofing issue in Firefox |
| CVE-2025-64773 | YO YouTrack JetBrains | 3.7 | Nov 11 | In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit |
| CVE-2025-8998 | AO AXIS OS Axis Communications AB | 3.1 | Nov 11 | It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability |
| CVE-2025-42883 | SN SAP NetWeaver Application Server for ABAP (Migration Workbench) SAP_SE | 2.7 | Nov 11 | Insecure File Operations vulnerability in SAP NetWeaver Application Server for ABAP (Migration Workbench) |
| CVE-2025-64682 | HU Hub JetBrains | 3.7 | Nov 10 | In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit |
| CVE-2025-64681 | HU Hub JetBrains | 3.7 | Nov 10 | In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations |
| CVE-2025-12919 | EV EverShop Evershop | 3.7 | Nov 9 | EverShop Order Order.resolvers.js resource injection |
| CVE-2025-64481 | DA datasette simonw | 2.7 | Nov 7 | Open redirect endpoint in Datasette |
| CVE-2025-12854 | NE newbee-mall-plus | 3.7 | Nov 7 | newbee-mall-plus seckillExecution executeSeckill authorization |
| CVE-2025-11219 | CH Chrome Google | 3.1 | Nov 6 | Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page |
| CVE-2025-64326 | WE weblate WeblateOrg | 3.5 | Nov 6 | Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log |
| CVE-2025-21077 | SE Samsung Email Samsung Mobile | 3.3 | Nov 5 | Improper input validation in Samsung Email prior to version 6.2.06.0 allows local attackers to launch arbitrary activity with Samsung Email privilege |
| CVE-2025-43365 | IO iOS Apple | 2.8 | Nov 4 | A denial-of-service issue was addressed with improved input validation |
| CVE-2025-43309 | IO iOS Apple | 2.4 | Nov 4 | A logic issue was addressed with improved checks |
| CVE-2025-43423 | MA macOS Apple | 2.0 | Nov 4 | A logging issue was addressed with improved data redaction |