CVE-2025 records published in June 2025
This page lists the 3,210 CVE-2025 records published in June 2025, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 18 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2025 list filters these records by severity or signal.
- Critical
- 51616.1% of these records
- Listed in CISA KEV
- 180.6% of these records
- Reported exploited
- 20.1% of these records
- Detection signal
- 832.6% of these records
- Exploit code
- 1133.5% of these records
- Actionable vendor fix
- 1,84857.6% of these records
Figures as of 2026-10-24 13:47 UTC. Records published in June 2025 have had from about 16 months to about 17 months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-53416 | File Parsing deserialization of untrusted data in DTN Soft | 7.8CNA v3.1 | 0.3% | 2025-06-30 | Fix |
| CVE-2025-53415 | File Parsing deserialization of untrusted data in DTM Soft | 7.8CNA v3.1 | 0.2% | 2025-06-30 | Fix |
| CVE-2025-53076 | Samsung Open Source rlottie improper input validation | 5.1CNA v4.0 | 0.4% | 2025-06-30 | |
| CVE-2025-53075 | Samsung Open Source rlottie improper input validation | 4.6CNA v4.0 | 0.3% | 2025-06-30 | Fix |
| CVE-2025-53074 | Samsung Open Source rlottie out-of-bounds read | 5.1CNA v4.0 | 0.4% | 2025-06-30 | Fix |
| CVE-2025-53004 | Dataease Redshift Data Source JDBC Connection Parameters Bypass vulnerability | 8.9CNA v4.0 | 0.6% | 2025-06-30 | Fix |
| CVE-2025-52997 | filebrowser File Browser Insecurely Handles Passwords | 5.9CNA v3.1 | 0.5% | 2025-06-30 | Fix |
| CVE-2025-52996 | filebrowser File Browser's Password Protection of Links vulnerable to Bypass | 3.1CNA v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-52995 | filebrowser file Browser vulnerable to command execution allowlist bypass | 8.1CNA v3.1 | 0.6% | 2025-06-30 | Fix |
| CVE-2025-52901 | filebrowser file Browser allows sensitive data to be transferred in URL | 4.5CNA v3.1 | 0.6% | 2025-06-30 | Fix |
| CVE-2025-52898 | Frappe account takeover via password reset token leakage | 8.7CNA v4.0 | 0.4% | 2025-06-30 | Fix |
| CVE-2025-52896 | Frappe authenticated XSS via data import | 8.6CNA v4.0 | 0.3% | 2025-06-30 | Fix |
| CVE-2025-52895 | Frappe possibility of SQL injection due to improper validations | 8.7CNA v4.0 | 0.4% | 2025-06-30 | Fix |
| CVE-2025-52491 | Akamai CloudTest server-side request forgery | 5.8CNA v3.1 | 0.3% | 2025-06-30 | Fix |
| CVE-2025-49521 | Red Hat Ansible Automation Platform event-driven-ansible: Template injection | 8.8CNA v3.1 | 0.6% | 2025-06-30 | Fix |
| CVE-2025-49520 | Red Hat Ansible Automation Platform event-driven Ansible Git URL handling argument injection | 8.8CNA v3.1 | 0.6% | 2025-06-30 | Fix |
| CVE-2025-49493 | Akamai CloudTest XML external entity injection | 5.8CNA v3.1 | 2.1% | 2025-06-30 | NucleiExploit codeFix |
| CVE-2025-47871 | Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API | 4.3CNA v3.1 | 0.2% | 2025-06-30 | Fix |
| CVE-2025-46702 | Mattermost Playbooks allows privilege escalation | 5.4CNA v3.1 | 0.2% | 2025-06-30 | Fix |
| CVE-2025-46014 | Honor PcManager incorrect default permissions | 8.8CISA ADP v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-45931 | D-Link DIR-816 command injection | 9.8CISA ADP v3.1 | 1.0% | 2025-06-30 | |
| CVE-2025-45143 | String-math's String-math.js vulnerability can cause Regex denial of service (ReDoS) | 7.0CISA ADP v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-41439 | RICOH Streamline NX cross-site scripting | 5.1CNA v4.0 | 0.2% | 2025-06-30 | |
| CVE-2025-40734 | Reflected cross-site scripting (XSS) vulnerability in Daily Expense Manager | 6.1v3.1 | 0.2% | 2025-06-30 | |
| CVE-2025-40733 | Reflected cross-site scripting (XSS) vulnerability in Daily Expense Manager | 6.1v3.1 | 0.2% | 2025-06-30 | |
| CVE-2025-40732 | User enumeration vulnerability in Daily Expense Manager | 7.5v3.1 | 0.3% | 2025-06-30 | |
| CVE-2025-40731 | SQL injection vulnerability in Daily Expense Manager | 9.8v3.1 | 0.3% | 2025-06-30 | |
| CVE-2025-40710 | Host header injection (HHI) in the Hotspot Shield VPN client | 2.3CNA v4.0 | 0.3% | 2025-06-30 | |
| CVE-2025-38090 | Linux kernel RapidIO channel manager vulnerability | 7.8CNA v3.1 | 0.2% | 2025-06-30 | Fix |
| CVE-2025-38089 | Linux kernel sunrpc server authentication null pointer dereference | 9.8CNA v3.1 | 0.5% | 2025-06-30 | Exploit codeFix |
| CVE-2025-38088 | Linux kernel PowerNV memtrace out-of-bounds read | 7.1v3.1 | 0.2% | 2025-06-30 | Fix |
| CVE-2025-38087 | Linux kernel net/sched use-after-free | 7.8CNA v3.1 | 0.2% | 2025-06-30 | Fix |
| CVE-2025-36593 | Dell OpenManage Network Integration authentication bypass by replay | 8.8CNA v3.1 | 0.3% | 2025-06-30 | Fix |
| CVE-2025-32463 | Sudo inclusion of functionality from untrusted control sphere | 7.8NVD v3.1 | 55.5% | 2025-06-30 | KEVExploit codeFix |
| CVE-2025-32462 | sudo incorrect authorization | 8.8NVD v3.1 | 4.5% | 2025-06-30 | Exploit codeFix |
| CVE-2025-26074 | Conductor vulnerable to OS command injection through unrestricted access to Java classes | 9.8CISA ADP v3.1 | 0.7% | 2025-06-30 | Fix |
| CVE-2025-6932 | D-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded password | 6.3CNA v4.0 | 1.3% | 2025-06-30 | |
| CVE-2025-6931 | D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropy | 7.4v3.1 | 2.2% | 2025-06-30 | |
| CVE-2025-6930 | PHPGurukul Zoo Management System manage-foreigners-ticket.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-6929 | PHPGurukul Zoo Management System view-normal-ticket.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-6925 | Dromara RuoYi-Vue-Plus Mail MailController.java path traversal | 9.1v3.1 | 1.1% | 2025-06-30 | |
| CVE-2025-6917 | code-projects Online Hotel Booking registration.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-30 | |
| CVE-2025-6916 | TOTOLINK T6 formLoginAuth.htm Form_Login missing authentication | 8.7CNA v4.0 | 0.9% | 2025-06-30 | Exploit code |
| CVE-2025-6915 | PHPGurukul Student Record System register.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-6914 | PHPGurukul Student Record System edit-student.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-6913 | PHPGurukul Student Record System admin-profile.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-6912 | PHPGurukul Student Record System manage-students.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-6911 | PHPGurukul Student Record System manage-subjects.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-6910 | PHPGurukul Student Record System session.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-6909 | PHPGurukul Old Age Home Management System add-scdetails.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-6908 | PHPGurukul Old Age Home Management System edit-services.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-6907 | code-projects Car Rental System book_car.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-30 | Exploit code |
| CVE-2025-6906 | code-projects Car Rental System login.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-30 | |
| CVE-2025-6905 | code-projects Car Rental System signup.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-30 | |
| CVE-2025-6904 | code-projects Car Rental System add_cars.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-30 | |
| CVE-2025-6903 | code-projects Car Rental System approve.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-30 | |
| CVE-2025-6902 | code-projects Inventory Management System editUser.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-30 | |
| CVE-2025-6901 | code-projects Inventory Management System removeUser.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-30 | |
| CVE-2025-6900 | code-projects Library System add-book.php unrestricted upload | 9.8v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-6899 | D-Link DI-7300G+/DI-8200G msp_info.htm os command injection | 8.8v3.1 | 4.7% | 2025-06-30 | Emerging Threats |
| CVE-2025-6898 | D-Link DI-7300G+ in proxy_client.asp os command injection | 8.8v3.1 | 16.5% | 2025-06-30 | |
| CVE-2025-6897 | D-Link DI-7300G+ httpd_debug.asp os command injection | 9.8v3.1 | 2.6% | 2025-06-30 | |
| CVE-2025-6896 | D-Link DI-7300G+ wget_test.asp os command injection | 8.8v3.1 | 4.2% | 2025-06-30 | |
| CVE-2025-6891 | code-projects Inventory Management System createUser.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-30 | |
| CVE-2025-6890 | code-projects Movie Ticketing System ticketConfirmation.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-6889 | code-projects Movie Ticketing System logIn.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-30 | |
| CVE-2025-6888 | PHPGurukul Teachers Record Management System changeimage.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-30 | |
| CVE-2025-6887 | Tenda AC5 SetSysTimeCfg stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-06-30 | |
| CVE-2025-6886 | Tenda AC5 openSchedWifi stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-06-30 | |
| CVE-2025-6885 | PHPGurukul Teachers Record Management System edit-teacher-detail.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-30 | |
| CVE-2025-6884 | code-projects Staff Audit System search_index.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-6883 | code-projects Staff Audit System update_index.php SQL injection | 5.3CNA v4.0 | 0.3% | 2025-06-30 | |
| CVE-2025-6882 | D-Link DIR-513 formSetWanPPTP buffer overflow | 8.7CNA v4.0 | 0.8% | 2025-06-30 | |
| CVE-2025-6881 | D-Link DI-8100 jhttpd pppoe_base.asp buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-06-30 | |
| CVE-2025-6880 | SourceCodester Best Salon Management System edit-tax.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-30 | |
| CVE-2025-6879 | SourceCodester Best Salon Management System add-tax.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-30 | |
| CVE-2025-6878 | SourceCodester Best Salon Management System search-appointment.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-30 | |
| CVE-2025-6877 | SourceCodester Best Salon Management System edit-category.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-30 | |
| CVE-2025-6554 | Google Chromium V8 type confusion | 8.1CISA ADP v3.1 | 14.1% | 2025-06-30 | KEVExploit codeFix |
| CVE-2025-5730 | Easy Contact Form Lite WordPress plugin Contributor+ stored XSS | 4.3CISA ADP v3.1 | 0.2% | 2025-06-30 | Fix |
| CVE-2025-4407 | ABB Lite Panel Pro application does not invalidate session after password reset | 6.8CNA v4.0 | 0.2% | 2025-06-30 | Fix |
| CVE-2025-3745 | WP Lightbox 2 WordPress plugin unauthenticated stored XSS | 6.3CISA ADP v3.1 | 0.3% | 2025-06-30 | Fix |
| CVE-2025-2895 | IBM Cloud Pak System HTML injection | 5.4CNA v3.1 | 0.3% | 2025-06-30 | Fix |
| CVE-2025-0634 | Samsung Open Source rlottie use-after-free | 5.1CNA v4.0 | 0.5% | 2025-06-30 | Fix |
| CVE-2025-24292 | Ubiquiti UniFi Network Application improper authentication | 6.8CNA v3.0 | 0.4% | 2025-06-29 | Fix |
| CVE-2025-24290 | Ubiquiti UISP Application SQL injection | 9.9CNA v3.0 | 0.3% | 2025-06-29 | Fix |
| CVE-2025-24289 | Ubiquiti UCRM Client Signup Plugin cross-site request forgery | 7.5CNA v3.0 | 0.2% | 2025-06-29 | Fix |
| CVE-2025-6876 | SourceCodester Best Salon Management System add-category.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6875 | SourceCodester Best Salon Management System edit-subscription.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6874 | SourceCodester Best Salon Management System add_subscribe.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6873 | SourceCodester Simple Company Website Users.php unrestricted upload | 7.2v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6872 | SourceCodester Simple Company Website SystemSettings.php unrestricted upload | 7.2v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6871 | SourceCodester Simple Company Website Login.php SQL injection | 9.8v3.1 | 0.6% | 2025-06-29 | |
| CVE-2025-6870 | SourceCodester Simple Company Website Content.php unrestricted upload | 5.1CNA v4.0 | 0.4% | 2025-06-29 | |
| CVE-2025-6869 | SourceCodester Simple Company Website manage.php SQL injection | 7.2v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6868 | SourceCodester Simple Company Website manage.php SQL injection | 7.2v3.1 | 0.4% | 2025-06-29 | |
| CVE-2025-6867 | SourceCodester Simple Company Website manage.php SQL injection | 7.2v3.1 | 0.4% | 2025-06-29 | |
| CVE-2025-6866 | code-projects Simple Forum forum_downloadfile.php path traversal | 5.3CNA v4.0 | 0.6% | 2025-06-29 | |
| CVE-2025-6865 | DaiCuo index cross-site request forgery | 5.3CNA v4.0 | 0.3% | 2025-06-29 | |
| CVE-2025-6864 | SeaCMS admin_type.php cross-site request forgery | 5.3CNA v4.0 | 0.3% | 2025-06-29 | |
| CVE-2025-6863 | PHPGurukul Local Services Search Engine Management System edit-category-detail.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6862 | SourceCodester Best Salon Management System edit_plan.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6861 | SourceCodester Best Salon Management System add_plan.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6860 | SourceCodester Best Salon Management System staff_commision.php SQL injection | 8.8NVD v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6859 | SourceCodester Best Salon Management System pro_sale.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6858 | HDF5 H5Centry.c H5C__flush_single_entry null pointer dereference | 5.5v3.1 | 0.2% | 2025-06-29 | Fix |
| CVE-2025-6857 | HDF5 H5Gnode.c H5G__node_cmp3 stack-based overflow | 7.8v3.1 | 0.3% | 2025-06-29 | Fix |
| CVE-2025-6856 | HDF5 H5FL.c H5FL__reg_gc_list use-after-free | 7.8v3.1 | 0.2% | 2025-06-29 | Fix |
| CVE-2025-6855 | chatchat-space Langchain-Chatchat file path traversal | 8.8v3.1 | 0.7% | 2025-06-29 | |
| CVE-2025-6854 | chatchat-space Langchain-Chatchat files path traversal | 4.3v3.1 | 0.6% | 2025-06-29 | |
| CVE-2025-6853 | chatchat-space Langchain-Chatchat Backend upload_temp_docs path traversal | 9.8v3.1 | 0.6% | 2025-06-29 | |
| CVE-2025-6850 | code-projects Simple Forum forum1.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-29 | |
| CVE-2025-6849 | code-projects Simple Forum forum_edit1.php cross-site scripting | 4.1v3.1 | 0.3% | 2025-06-29 | |
| CVE-2025-6848 | code-projects Simple Forum forum1.php unrestricted upload | 8.8v3.1 | 0.4% | 2025-06-29 | |
| CVE-2025-6847 | code-projects Simple Forum forum_edit.php SQL injection | 9.8v3.1 | 0.4% | 2025-06-29 | |
| CVE-2025-6846 | code-projects Simple Forum forum_viewfile.php SQL injection | 6.9CNA v4.0 | 0.4% | 2025-06-29 | |
| CVE-2025-6845 | code-projects Simple Forum register1.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6844 | code-projects Simple Forum signin.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6843 | code-projects Simple Photo Gallery upload-photo.php unrestricted upload | 9.8v3.1 | 0.6% | 2025-06-29 | |
| CVE-2025-6842 | code-projects Product Inventory System edit_user.php SQL injection | 7.2v3.1 | 0.4% | 2025-06-29 | |
| CVE-2025-6841 | code-projects Product Inventory System edit_product.php SQL injection | 7.2v3.1 | 0.4% | 2025-06-29 | |
| CVE-2025-6840 | code-projects Product Inventory System Login index.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6839 | Conjure Position Department Service Quality Evaluation System head.php eval backdoor | 5.3CNA v4.0 | 0.3% | 2025-06-29 | |
| CVE-2025-6837 | code-projects Library System profile.php unrestricted upload | 9.8v3.1 | 0.4% | 2025-06-29 | |
| CVE-2025-6836 | code-projects Library System profile.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6835 | code-projects Library System student-issue-book.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6834 | code-projects Inventory Management System editPayment.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-29 | |
| CVE-2025-6462 | EZ SQL Reports Shortcode Widget and DB Backup WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-29 | Fix |
| CVE-2025-5878 | ESAPI esapi-java-legacy SQL injection Defense Encoder.encodeForSQL special element | 6.9CNA v4.0 | 0.5% | 2025-06-29 | Exploit codeFix |
| CVE-2025-53393 | Akka akka-cluster-metrics uses Java serialization for cluster metrics | 6.0CNA v3.1 | 0.2% | 2025-06-28 | |
| CVE-2025-53392 | Netgate pfSense absolute path traversal | 6.5v3.1 | 1.8% | 2025-06-28 | Exploit code |
| CVE-2025-53391 | Debian zulucrypt incorrect authorization | 9.3CNA v3.1 | 0.2% | 2025-06-28 | Fix |
| CVE-2025-38086 | Linux kernel ch9200 uninitialized resource use | 5.5v3.1 | 0.2% | 2025-06-28 | Fix |
| CVE-2025-38085 | Linux kernel hugetlb page table unsharing race condition | 7.8CNA v3.1 | 0.1% | 2025-06-28 | Fix |
| CVE-2025-38084 | Linux kernel hugetlb page table unsharing race condition | 7.8CNA v3.1 | 0.2% | 2025-06-28 | Fix |
| CVE-2025-36027 | IBM Datacap clickjacking | 5.4CNA v3.1 | 0.2% | 2025-06-28 | Fix |
| CVE-2025-36026 | IBM Datacap information disclosure | 4.3CNA v3.1 | 0.2% | 2025-06-28 | Fix |
| CVE-2025-32897 | Apache Seata (incubating): Deserialization of untrusted data in Apache Seata Server | 9.8CISA ADP v3.1 | 1.8% | 2025-06-28 | Fix |
| CVE-2025-6829 | aaluoxiang oa_system External Address Book outAddress SQL injection | 8.8v3.1 | 0.4% | 2025-06-28 | |
| CVE-2025-6828 | code-projects Inventory Management System orders.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-28 | |
| CVE-2025-6827 | code-projects Inventory Management System editOrder.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-28 | |
| CVE-2025-6826 | code-projects Payroll Management System ajax.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-28 | |
| CVE-2025-6825 | TOTOLINK A702R HTTP POST request formWlSiteSurvey buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-06-28 | |
| CVE-2025-6824 | TOTOLINK X15 HTTP POST request formParentControl buffer overflow | 7.5v3.1 | 1.0% | 2025-06-28 | |
| CVE-2025-6823 | code-projects Inventory Management System editProduct.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-28 | |
| CVE-2025-6822 | code-projects Inventory Management System removeProduct.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-28 | |
| CVE-2025-6821 | code-projects Inventory Management System createOrder.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-28 | |
| CVE-2025-6820 | code-projects Inventory Management System createProduct.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-28 | |
| CVE-2025-6819 | code-projects Inventory Management System removeBrand.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-28 | |
| CVE-2025-6818 | HDF5 H5Ochunk.c H5O__chunk_protect heap-based overflow | 7.8v3.1 | 0.3% | 2025-06-28 | Fix |
| CVE-2025-6817 | HDF5 H5Centry.c H5C__load_entry resource consumption | 4.8CNA v4.0 | 0.2% | 2025-06-28 | Fix |
| CVE-2025-6816 | HDF5 H5Ofsinfo.c H5O__fsinfo_encode heap-based overflow | 4.8CNA v4.0 | 0.3% | 2025-06-28 | Fix |
| CVE-2025-6755 | Game Users Share Buttons WordPress plugin arbitrary file deletion | 8.8CNA v3.1 | 0.9% | 2025-06-28 | |
| CVE-2025-6381 | BeeTeam368 Extensions WordPress plugin directory traversal to arbitrary file deletion | 8.8CNA v3.1 | 0.7% | 2025-06-28 | Fix |
| CVE-2025-6379 | BeeTeam368 Extensions Pro WordPress plugin directory traversal to arbitrary file deletion | 8.8CNA v3.1 | 0.7% | 2025-06-28 | Fix |
| CVE-2025-6350 | WP VR 360 Panorama and Free Virtual Tour Builder For WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-28 | Fix |
| CVE-2025-6252 | Qi Addons For Elementor WordPress plugin authenticated (Contributor+) stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-28 | Fix |
| CVE-2025-5937 | MicroPayments WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-06-28 | Fix |
| CVE-2025-5304 | PT Project Notebooks - missing authorization to unauthenticated privilege escalation | 9.8CNA v3.1 | 0.7% | 2025-06-28 | Exploit codeFix |
| CVE-2025-1991 | IBM Informix Dynamic Server denial of service | 7.5CNA v3.1 | 0.4% | 2025-06-28 | Fix |
| CVE-2025-53339 | Devnex Addons For Elementor WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.6% | 2025-06-27 | |
| CVE-2025-53338 | re.place WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53336 | My Resume Builder WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53332 | Track Everything WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53331 | RSS Digest WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53329 | Społecznościowa 6 PL 2013 WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53327 | Aioseo Multibyte Descriptions WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53325 | Beauty Contact Popup Form WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53323 | Pre-Publish Post Checklist WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53322 | Accept Authorize.NET Payments Using Contact Form 7 WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-53321 | Raise The Money WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53320 | WP Enhanced Free Downloads EDD cross-site scripting | 6.5CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53318 | WP DB Booster WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-53317 | WPShapere Lite WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53315 | Relocate Upload WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53314 | WP Optimizer WordPress plugin cross-site request forgery (CSRF) | 9.6CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53313 | Twitch TV Embed Suite WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53312 | OnionBuzz WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53311 | Navayan Subscribe WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53310 | HidePost WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53309 | Accept Stripe Payments Using Contact Form 7 WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-53308 | Image Slider With Description WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53306 | WP Forum Server WordPress plugin SQL injection | 7.6CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-53305 | WP Forum Server WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53304 | Contact Form 7: Hide Success Message WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-53301 | Theme Junkie Team Content WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53300 | Podcast Feed Player Widget and Shortcode WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53298 | Plugin Inspector WordPress plugin arbitrary file download | 4.9CNA v3.1 | 0.5% | 2025-06-27 | |
| CVE-2025-53296 | EC Stars Rating WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53295 | iCount Payment Gateway WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-53294 | Smart Agenda WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-53293 | Dashboard Widget Sidebar WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-53292 | WP DataTable WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53290 | WP Visual Sitemap WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53288 | PlatiOnline Payments WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-53287 | Quick Favicon WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53285 | The Website Flip Add and Replace Affiliate Links for Amazon cross-site scripting | 5.9CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53284 | CMS Blocks WordPress plugin broken access control | 6.5CNA v3.1 | 0.4% | 2025-06-27 | |
| CVE-2025-53282 | Thumbnail Editor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53281 | WPB Category Slider for WooCommerce WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-06-27 | |
| CVE-2025-53280 | Football Pool WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-53279 | Popup addon for Ninja Forms WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-53278 | WP AdCenter WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-53277 | IS-theme-companion WordPress plugin cross-site request forgery (CSRF) | 8.8CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53276 | Omnipress WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-53275 | Leyka WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53274 | WP Permalink Translator WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53273 | Slickstream WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-27 | Fix |
| CVE-2025-53272 | Image Cleanup WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53271 | Additional Order Filters for WooCommerce WordPress plugin cross-site request forgery to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-06-27 | Fix |
| CVE-2025-53270 | CTA WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-27 | Fix |
| CVE-2025-53269 | My Wp Brand WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-27 | Fix |
| CVE-2025-53268 | Import external attachments WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53267 | Hide Admin Bar From Front End WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-53266 | Cron Logger WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-53265 | Virusdie WordPress plugin cross-site request forgery (CSRF) | 5.4CNA v3.1 | 0.1% | 2025-06-27 | Fix |
| CVE-2025-53264 | ONet Regenerate Thumbnails WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-53263 | Address Autocomplete via Google for Gravity Forms WordPress plugin cross-site request forgery (CSRF) | 5.4CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-53262 | Writesonic WordPress plugin cross-site request forgery (CSRF) | 5.4CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-53261 | WP YouTube Live WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-53260 | File Manager Plugin For Wordpress arbitrary file upload | 9.1CNA v3.1 | 0.4% | 2025-06-27 | |
| CVE-2025-53259 | Hotel Booking WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-06-27 | Fix |
| CVE-2025-53258 | Hover Effects WordPress plugin SQL injection | 7.6CNA v3.1 | 0.4% | 2025-06-27 | Fix |
| CVE-2025-53257 | Gmedia Photo Gallery WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-06-27 | Fix |
| CVE-2025-53256 | YaySMTP WordPress plugin SQL injection | 7.6CNA v3.1 | 0.4% | 2025-06-27 | Fix |
| CVE-2025-53255 | HurryTimer WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-53254 | Cyrlitera WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-53253 | WP Edit WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-53211 | Audio Editor and Recorder WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.4% | 2025-06-27 | Fix |
| CVE-2025-53206 | HT Mega Absolute Addons for WPBakery Page Builder WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-53203 | WooCommerce PDF Invoice Builder WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-53202 | Responsive Blocks WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-53200 | ChatBot WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-53199 | HT Slider For Elementor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-53197 | Cookiebot WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-27 | Fix |
| CVE-2025-53193 | Burst Statistics WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-27 | Fix |
| CVE-2025-53098 | RooCodeInc Roo-Code roo Code vulnerable to potential remote code execution | 8.1CNA v3.1 | 0.7% | 2025-06-27 | Fix |
| CVE-2025-53097 | RooCodeInc Roo-Code roo Code extension vulnerable to potential information leakage via JSON Schema | 5.9CNA v3.1 | 0.5% | 2025-06-27 | Fix |
| CVE-2025-53094 | ESPAsyncWebServer Vulnerable to CRLF injection in AsyncWebHeader.cpp | 8.7CNA v4.0 | 0.4% | 2025-06-27 | |
| CVE-2025-53093 | StarCitizenTools mediawiki-extensions-TabberNeue TabberNeue vulnerable to stored XSS | 8.6CNA v3.1 | 0.4% | 2025-06-27 | Fix |
| CVE-2025-53091 | WeGIA has Unauthenticated Time-based blind SQL injection in almox parameter | 10.0CNA v4.0 | 0.5% | 2025-06-27 | |
| CVE-2025-53018 | Lychee has server-side request forgery in Photo::fromUrl API | 3.0CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-52993 | NixOS Nix A race condition | 5.6CNA v3.1 | 0.1% | 2025-06-27 | Fix |
| CVE-2025-52992 | NixOS Nix incorrect permission assignment | 3.2CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-52991 | NixOS Nix incorrect default permissions | 3.2CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-52834 | Homey WordPress theme SQL injection | 9.3CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-52829 | DirectIQ Email Marketing WordPress plugin SQL injection | 9.3CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-52827 | Nuss WordPress theme PHP object injection | 8.8CNA v3.1 | 0.4% | 2025-06-27 | |
| CVE-2025-52826 | Sala WordPress theme PHP object injection | 8.8CNA v3.1 | 0.4% | 2025-06-27 | |
| CVE-2025-52824 | Mobile DJ Manager WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-52818 | Trusty Whistleblowing WordPress plugin broken access control | 8.2CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-52817 | Abandoned Contact Form 7 WordPress plugin broken access control | 8.2CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-52816 | Zita WordPress theme local file inclusion | 9.8v3.1 | 0.4% | 2025-06-27 | Fix |
| CVE-2025-52815 | CityGov WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-06-27 | |
| CVE-2025-52814 | BRW WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-06-27 | Fix |
| CVE-2025-52812 | Domnoo WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-06-27 | Fix |
| CVE-2025-52811 | Davenport - Versatile Blog and Magazine WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-06-27 | |
| CVE-2025-52810 | Katerio - Magazine WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-06-27 | |
| CVE-2025-52809 | National Weather Service Alerts WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-06-27 | |
| CVE-2025-52808 | RealtyElite WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-06-27 | |
| CVE-2025-52799 | LMS WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-52778 | xili-dictionary WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-52774 | Infility Global WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-52729 | Diza WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-06-27 | Fix |
| CVE-2025-52727 | CSS3 Vertical Web Pricing Tables WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-52726 | CouponXxL Custom Post Types WordPress plugin privilege escalation | 8.6CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-52725 | CouponXxL WordPress theme PHP object injection | 9.8CNA v3.1 | 0.5% | 2025-06-27 | Fix |
| CVE-2025-52724 | Amwerk WordPress theme PHP object injection | 9.8CNA v3.1 | 0.4% | 2025-06-27 | Fix |
| CVE-2025-52723 | Networker WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-06-27 | Fix |
| CVE-2025-52722 | Classiera WordPress theme SQL injection | 9.3CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-52717 | LifterLMS WordPress plugin SQL injection | 9.8v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-52553 | authentik has Insufficient Session verification for Remote Access Control endpoint access | 5.5CNA v4.0 | 0.5% | 2025-06-27 | Fix |
| CVE-2025-52207 | MikoPBX relative path traversal | 9.9CNA v3.1 | 1.6% | 2025-06-27 | Nuclei |
| CVE-2025-50528 | Tenda AC6 fromNatStaticSetting function buffer overflow | 7.3CISA ADP v3.1 | 0.4% | 2025-06-27 | |
| CVE-2025-50370 | Anujk305 Medical Card Generation System cross-site request forgery | 6.5CISA ADP v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-50369 | Anujk305 Medical Card Generation System Manage Card functionality cross-site request forgery | 6.5CISA ADP v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-50367 | Anujk305 Medical Card Generation System Contact page of the Phpgurukul cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-50052 | Flexo Counter WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-49886 | Zikzag Core WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-06-27 | Fix |
| CVE-2025-49885 | Drag and Drop Multiple File Upload (Pro) - WooCommerce WordPress plugin arbitrary file upload | 10.0CNA v3.1 | 0.4% | 2025-06-27 | Fix |
| CVE-2025-49883 | Greenmart WordPress theme local file inclusion | 8.1CNA v3.1 | 0.7% | 2025-06-27 | Fix |
| CVE-2025-49448 | FW Food Menu WordPress plugin arbitrary file deletion | 8.6CNA v3.1 | 0.5% | 2025-06-27 | |
| CVE-2025-49423 | Bulk YouTube Post Creator WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-49416 | FW Gallery WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.7% | 2025-06-27 | |
| CVE-2025-49321 | Eventin WordPress plugin cross-site scripting (XSS) | 6.1NVD v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-49290 | Off-Canvas Sidebars and Menus (Slidebars) WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-47824 | Flock Safety License Plate Reader cleartext storage of sensitive information | 2.4v3.1 | 0.1% | 2025-06-27 | Fix |
| CVE-2025-47823 | Flock Safety License Plate Reader hard-coded password | 4.6v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-47822 | Flock Safety License Plate Reader improper access control | 6.8v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-47821 | Flock Safety Gunshot Detection devices hard-coded password | 4.6v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-47820 | Flock Safety Gunshot Detection devices cleartext storage of sensitive information | 2.4v3.1 | 0.1% | 2025-06-27 | Fix |
| CVE-2025-47819 | Flock Safety Gunshot Detection devices improper access control | 6.8v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-47818 | Flock Safety Gunshot Detection devices hard-coded password | 4.6v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-47654 | FormLift for Infusionsoft Web Forms WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-47574 | School Management System WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-46708 | GPU Ddk Guest VM can delay the FW and GPU from processing workloads from other VMs | 4.3CISA ADP v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-46707 | GPU Ddk Guest VM can override its own FW VZ connection state after the FW has close it | 5.2CISA ADP v3.1 | 0.1% | 2025-06-27 | Fix |
| CVE-2025-46416 | NixOS Nix build sandbox isolation privilege escalation | 2.9CNA v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-46415 | NixOS Nix A race condition | 3.2CNA v3.1 | 0.1% | 2025-06-27 | Fix |
| CVE-2025-45851 | Hikvision DS-2CD1321-I ISAPI Security challenge endpoint denial of service | 7.5CISA ADP v3.1 | 0.6% | 2025-06-27 | |
| CVE-2025-45737 | NetEase Neacsafe64 improper privilege management | 6.5CISA ADP v3.1 | 0.3% | 2025-06-27 | Exploit code |
| CVE-2025-45729 | D-Link Dir-823 Pro improper permissions | 6.3CISA ADP v3.1 | 0.4% | 2025-06-27 | |
| CVE-2025-44559 | Realtek RTL8762E BLE SDK Bluetooth Low Energy stack resource exhaustion | 6.5CISA ADP v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-44557 | Cypress PSoC4 Bluetooth Low Energy stack authentication bypass | 8.1CISA ADP v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-44163 | raspap-webgui has a directory traversal | 6.3CISA ADP v3.1 | 0.6% | 2025-06-27 | Fix |
| CVE-2025-41418 | TB-eye XRN-410SN/TE multiple versions buffer overflow | 6.9CNA v4.0 | 0.4% | 2025-06-27 | |
| CVE-2025-40910 | Net::IP::LPM improper input validation | 6.5CISA ADP v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-39488 | MagOne WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-39478 | Smart Notification WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-39474 | Amely WordPress theme SQL injection | 9.8v3.1 | 0.4% | 2025-06-27 | Fix |
| CVE-2025-36595 | Dell Unisphere for PowerMax vApp static code injection | 7.2CNA v3.1 | 0.7% | 2025-06-27 | Fix |
| CVE-2025-36529 | TB-eye XRN-410SN/TE multiple versions OS command injection | 8.6CNA v4.0 | 1.2% | 2025-06-27 | |
| CVE-2025-32298 | CTUsers WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.6% | 2025-06-27 | |
| CVE-2025-32281 | DarkMySite WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-27 | Fix |
| CVE-2025-31428 | HYDRO WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-31067 | Seven Stars WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-30992 | Puca WordPress theme local file inclusion | 8.1CNA v3.1 | 0.7% | 2025-06-27 | Fix |
| CVE-2025-30972 | Woocommerce Line Notify WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-28998 | SERPed.net WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.7% | 2025-06-27 | Fix |
| CVE-2025-28993 | Content No Cache WordPress plugin arbitrary function Call vulnerability | 8.6CNA v3.1 | 0.4% | 2025-06-27 | Fix |
| CVE-2025-28990 | SNS Vicky WordPress theme local file inclusion | 8.1CNA v3.1 | 0.7% | 2025-06-27 | |
| CVE-2025-28988 | WP Front User Submit / Front Editor WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-28970 | WP Optimize By xTraffic WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.5% | 2025-06-27 | |
| CVE-2025-28960 | Evangelische Termine WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-28956 | Backwp WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-28947 | MBStore - Digital WooCommerce WordPress theme local file inclusion | 8.1CNA v3.1 | 0.7% | 2025-06-27 | |
| CVE-2025-28946 | PrintXtore WordPress theme local file inclusion | 8.1CNA v3.1 | 0.7% | 2025-06-27 | Fix |
| CVE-2025-27361 | Photo Express for Google WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-25173 | FastBook WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-25171 | WP SmartPay WordPress plugin account takeover | 8.8CNA v3.1 | 0.5% | 2025-06-27 | Fix |
| CVE-2025-24774 | WPCRM - CRM for Contact form CF7 and WooCommerce WordPress plugin reflected cross-site scripting | 7.1CNA v3.1 | 0.3% | 2025-06-27 | |
| CVE-2025-24769 | Zenny WordPress theme local file inclusion | 8.1CNA v3.1 | 0.7% | 2025-06-27 | |
| CVE-2025-24765 | Image Shadow WordPress plugin arbitrary file deletion | 7.7CNA v3.1 | 0.5% | 2025-06-27 | |
| CVE-2025-24760 | Sofass WordPress theme local file inclusion | 8.1CNA v3.1 | 0.7% | 2025-06-27 | |
| CVE-2025-23973 | SpecFit-Virtual Try On Woocommerce WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-23967 | GG Bought Together for WooCommerce WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-06-27 | |
| CVE-2025-6778 | code-projects Food Distributor Site save_settings.php cross-site scripting | 4.8v3.1 | 0.4% | 2025-06-27 | |
| CVE-2025-6777 | code-projects Food Distributor Site process_login.php SQL injection | 9.8v3.1 | 0.6% | 2025-06-27 | |
| CVE-2025-6776 | xiaoyunjie openvpn-cms-flask file upload controller.py upload path traversal | 9.8v3.1 | 0.7% | 2025-06-27 | Fix |
| CVE-2025-6775 | xiaoyunjie openvpn-cms-flask User Creation endpoint openvpn.py create_user command injection | 9.8v3.1 | 3.1% | 2025-06-27 | Fix |
| CVE-2025-6774 | gooaclok819 sublinkX template.go AddTemp path traversal | 5.3CNA v4.0 | 0.4% | 2025-06-27 | Fix |
| CVE-2025-6773 | HKUDS LightRAG file upload document_routes.py upload_to_input_dir path traversal | 4.8CNA v4.0 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-6772 | eosphoros-ai db-gpt import import_flow path traversal | 7.5v3.1 | 0.6% | 2025-06-27 | |
| CVE-2025-6768 | sfturing hosp_order HospitalServiceImpl.java findAllHosByCondition SQL injection | 5.3CNA v4.0 | 0.3% | 2025-06-27 | |
| CVE-2025-6767 | sfturing hosp_order DoctorServiceImpl.java findDoctorByCondition SQL injection | 5.3CNA v4.0 | 0.3% | 2025-06-27 | |
| CVE-2025-6766 | sfturing hosp_order OfficeServiceImpl.java getOfficeName SQL injection | 8.8v3.1 | 0.4% | 2025-06-27 | |
| CVE-2025-6765 | Intelbras InControl HTTP PUT request operador permission | 8.8v3.1 | 0.4% | 2025-06-27 | |
| CVE-2025-6763 | Comet System H3531 Web-based Management setupA.cfg missing authentication | 9.2CNA v4.0 | 1.4% | 2025-06-27 | |
| CVE-2025-6762 | diyhi bbs HTTP header login getUrl server-side request forgery | 7.2v3.1 | 0.4% | 2025-06-27 | |
| CVE-2025-6761 | Kingdee Cloud-Starry-Sky Enterprise Edition Freemarker engine server-side template injection | 6.9CNA v4.0 | 0.4% | 2025-06-27 | Fix |
| CVE-2025-6753 | huija bicycleSharingServer AdminController.java selectAdminByNameLike SQL injection | 5.3CNA v4.0 | 0.3% | 2025-06-27 | |
| CVE-2025-6752 | Linksys WRT1900ACS stack-based buffer overflow | 8.7CNA v4.0 | 1.2% | 2025-06-27 | |
| CVE-2025-6751 | Linksys E8450 HTTP POST request portal.cgi set_device_language buffer overflow | 8.7CNA v4.0 | 0.8% | 2025-06-27 | |
| CVE-2025-6750 | HDF5 H5Omtime.c H5O__mtime_new_encode heap-based overflow | 4.8CNA v4.0 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-6749 | huija bicycleSharingServer AdminController.java searchAdminMessageShow SQL injection | 5.3CNA v4.0 | 0.3% | 2025-06-27 | |
| CVE-2025-6748 | Bharti Airtel Thanks App files cleartext storage in a file or on disk | 2.4CNA v4.0 | 0.1% | 2025-06-27 | |
| CVE-2025-6738 | huija bicycleSharingServer UserServiceImpl.java userDao.selectUserByUserNameLike SQL injection | 5.3CNA v4.0 | 0.3% | 2025-06-27 | |
| CVE-2025-6736 | juzaweb CMS Add New Themes page install improper authorization | 8.8v3.1 | 0.5% | 2025-06-27 | |
| CVE-2025-6735 | juzaweb CMS Import page imports improper authorization | 8.8v3.1 | 0.5% | 2025-06-27 | |
| CVE-2025-6705 | Eclipse Open VSX Registry improper isolation | 7.6CNA v4.0 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-6689 | FL3R Accessibility Suite WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-6688 | Simple Payment - authentication bypass to Admin | 9.8CNA v3.1 | 0.5% | 2025-06-27 | Fix |
| CVE-2025-6550 | The Pack Elementor addon WordPress plugin authenticated (Contributor+) stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-6522 | TrendMakers Sight Bulb Pro command injection | 5.2CNA v4.0 | 0.2% | 2025-06-27 | |
| CVE-2025-6521 | TrendMakers Sight Bulb Pro use of a broken or risky cryptographic algorithm | 6.8CNA v4.0 | 0.1% | 2025-06-27 | |
| CVE-2025-6488 | isMobile WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-5940 | Osom Blocks WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-5936 | VR Calendar WordPress plugin cross-site request forgery to Calendar Sync | 4.3CNA v3.1 | 0.1% | 2025-06-27 | |
| CVE-2025-5526 | BuddyPress Docs WordPress plugin Subscriber+ arbitrary Document Read/Update | 4.3CISA ADP v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-5398 | Ninja Forms WordPress plugin authenticated (Contributor+) stored cross-site scripting via CSTI | 5.4v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-5310 | Dover Fueling Solutions ProGauge MagLink LX Consoles missing authentication for critical function | 9.3CNA v4.0 | 0.8% | 2025-06-27 | Fix |
| CVE-2025-5306 | Pandora FMS command injection in Netflow path | 7.0CNA v4.0 | 35.7% | 2025-06-27 | MetasploitExploit codeFix |
| CVE-2025-5194 | WP Map Block by aBlocks WordPress plugin Contributor+ stored XSS via Marker | 4.8CISA ADP v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-5093 | Responsive Lightbox and Gallery WordPress plugin Contributor+ stored XSS | 5.4CISA ADP v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-5035 | Firelight Lightbox WordPress plugin Contributor+ stored XSS | 5.4CISA ADP v3.1 | 0.2% | 2025-06-27 | Fix |
| CVE-2025-4587 | A/B Testing for WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-06-27 | |
| CVE-2025-2940 | Ninja Tables Easy Data Table Builder WordPress plugin unauthenticated server-side request forgery | 7.2CNA v3.1 | 0.3% | 2025-06-27 | Fix |
| CVE-2025-53122 | SQLi in OpenNMS Horizon and Meridian | 6.9CNA v4.0 | 0.2% | 2025-06-26 | |
| CVE-2025-53121 | Stored XSS in multiple.8files in opennms/opennms | 6.9CNA v4.0 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-53013 | Himmelblau offline auth permits authentication with invalid Hello PIN | 5.2CNA v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-53007 | arduino-esp32 vulnerable to CRLF injection in WebServer.cpp | 8.9CNA v4.0 | 0.5% | 2025-06-26 | Fix |
| CVE-2025-53002 | LLaMA-Factory remote code execution (RCE) | 8.3CNA v3.1 | 1.2% | 2025-06-26 | Fix |
| CVE-2025-52904 | filebrowser File Browser: Command execution not Limited to Scope | 8.0CNA v3.1 | 1.1% | 2025-06-26 | Fix |
| CVE-2025-52903 | filebrowser File Browser allows Execution of Shell commands that can Spawn other commands | 8.0CNA v3.1 | 1.2% | 2025-06-26 | Fix |
| CVE-2025-52902 | filebrowser file Browser has stored cross-site scripting | 7.6CNA v3.1 | 0.3% | 2025-06-26 | Fix |
| CVE-2025-52900 | filebrowser file Browser has insecure file permissions | 5.5CNA v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-52887 | cpp-httplib has unlimited number of HTTP header fields, which causes memory leak | 7.5CNA v3.1 | 0.5% | 2025-06-26 | |
| CVE-2025-52573 | Command injection in MCP Server ios-simulator-mcp | 6.0CNA v3.1 | 0.6% | 2025-06-26 | Fix |
| CVE-2025-52555 | CephFS permission escalation vulnerability in Ceph Fuse mounted FS | 6.5CNA v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-52477 | Octo-STS vulnerable to unauthenticated SSRF with HTTP Response Reflection in OIDC Flow | 8.6CNA v3.1 | 0.5% | 2025-06-26 | Fix |
| CVE-2025-51672 | PHPGurukul Dairy Farm Shop Management System SQL injection | 8.0CISA ADP v3.1 | 0.4% | 2025-06-26 | |
| CVE-2025-51671 | PHPGurukul Dairy Farm Shop Management System SQL injection | 5.4CISA ADP v3.1 | 0.3% | 2025-06-26 | |
| CVE-2025-50350 | PHPGurukul Pre-School Enrollment System path traversal | 5.4CISA ADP v3.1 | 0.5% | 2025-06-26 | |
| CVE-2025-49603 | Northern.tech Mender Server improper access control | 9.1CISA ADP v3.1 | 0.4% | 2025-06-26 | |
| CVE-2025-49592 | n8n Login Flow has open redirect | 4.6CNA v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-49003 | Dataease H2 JDBC Connection remote code execution | 8.9CNA v4.0 | 0.9% | 2025-06-26 | Fix |
| CVE-2025-48923 | Toc.js Moderately critical cross-site scripting SA-CONTRIB-2025-077 | 6.1CISA ADP v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-48922 | GLightbox Moderately critical cross-site scripting SA-CONTRIB-2025-078 | 6.1CISA ADP v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-48921 | Open Social Moderately critical cross-site request forgery SA-CONTRIB-2025-079 | 8.8CISA ADP v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-48497 | iroha Soft iroha Board cross-site request forgery | 5.1CNA v4.0 | 0.1% | 2025-06-26 | Fix |
| CVE-2025-44141 | Backdrop Cms node creation form cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-06-26 | |
| CVE-2025-41404 | iroha Soft iroha Board forced browsing | 5.3CNA v4.0 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-37101 | HPE OneView for VMware vCenter (OV4VC), local elevation of privilege | 8.7CNA v3.1 | 0.3% | 2025-06-26 | Fix |
| CVE-2025-36034 | IBM InfoSphere DataStage Flow Designer information disclosure | 5.3CNA v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-34049 | OptiLink ONT1GEW GPON remote code execution | 9.4CNA v4.0 | 2.4% | 2025-06-26 | Emerging ThreatsExploit code |
| CVE-2025-34048 | D-Link DSL-2730U/2750U/2750E path traversal arbitrary file read | 8.7CNA v4.0 | 0.7% | 2025-06-26 | Exploit code |
| CVE-2025-34047 | Leadsec VPN path traversal arbitrary file read | 8.7CNA v4.0 | 0.5% | 2025-06-26 | |
| CVE-2025-34046 | Fanwei E-Office Unauthenticated file upload | 10.0CNA v4.0 | 0.9% | 2025-06-26 | |
| CVE-2025-34045 | WeiPHP path traversal arbitrary file read | 7.5v3.1 | 4.2% | 2025-06-26 | Nuclei |
| CVE-2025-34044 | WIFISKY 7-Layer Flow Control Router remote command execution | 9.4CNA v4.0 | 3.9% | 2025-06-26 | |
| CVE-2025-34043 | Vacron NVR remote command execution | 10.0CNA v4.0 | 7.5% | 2025-06-26 | |
| CVE-2025-34042 | Beward N100 IP Camera remote command execution | 9.4CNA v4.0 | 1.7% | 2025-06-26 | |
| CVE-2025-30131 | Iroadau FX2 unrestricted file upload | 9.8CISA ADP v3.1 | 0.7% | 2025-06-26 | |
| CVE-2025-29331 | MHSanaei 3x-ui improper certificate validation | 9.8CISA ADP v3.1 | 0.5% | 2025-06-26 | |
| CVE-2025-6734 | UTT HiPER 840G API formP2PLimitConfig sub_484E40 buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-06-26 | |
| CVE-2025-6733 | UTT HiPER 840G API formConfigDnsFilterGlobal sub_416928 buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-06-26 | |
| CVE-2025-6732 | UTT HiPER 840G API setSysAdm strcpy buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-06-26 | |
| CVE-2025-6731 | yzcheng90 X-SpringBoot APK file apk uploadApk path traversal | 5.3CNA v4.0 | 0.4% | 2025-06-26 | |
| CVE-2025-6710 | MongoDB Server JSON parser denial of service | 7.5CNA v3.1 | 0.4% | 2025-06-26 | Fix |
| CVE-2025-6709 | Pre-authentication denial of service vulnerability in MongoDB Server's OIDC Authentication | 7.5CNA v3.1 | 0.5% | 2025-06-26 | Fix |
| CVE-2025-6707 | MongoDB Server race condition in privilege cache invalidation cycle | 4.2CNA v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-6706 | MongoDB Server aggregation framework SBE engine use-after-free | 5.0CNA v3.1 | 0.3% | 2025-06-26 | Fix |
| CVE-2025-6703 | Mozilla neqo transport/fc.rs: Panic attempting to send MAX_DATA with value larger max varint | 2.3CNA v4.0 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-6702 | linlinjava litemall post improper authorization | 5.3v3.1 | 0.4% | 2025-06-26 | |
| CVE-2025-6701 | Xuxueli xxl-sso XXL SSO is vulnerable to an open redirect | 6.1v3.1 | 0.3% | 2025-06-26 | |
| CVE-2025-6700 | Xuxueli xxl-sso login cross-site scripting | 6.1v3.1 | 0.5% | 2025-06-26 | |
| CVE-2025-6699 | LabRedesCefetRJ WeGIA Cadastro de Funcionário cadastro_funcionario.php cross-site scripting | 4.1v3.1 | 0.4% | 2025-06-26 | |
| CVE-2025-6698 | LabRedesCefetRJ WeGIA Adicionar tipo adicionar_tipoSaida.php cross-site scripting | 4.1v3.1 | 0.4% | 2025-06-26 | |
| CVE-2025-6697 | LabRedesCefetRJ WeGIA Adicionar tipo adicionar_tipoEntrada.php cross-site scripting | 4.1v3.1 | 0.4% | 2025-06-26 | |
| CVE-2025-6696 | LabRedesCefetRJ WeGIA Cadastro de Atendio Cadastro_Atendido.php cross-site scripting | 4.1v3.1 | 0.4% | 2025-06-26 | |
| CVE-2025-6695 | LabRedesCefetRJ WeGIA Additional Categoria adicionar_categoria.php cross-site scripting | 4.1v3.1 | 0.4% | 2025-06-26 | |
| CVE-2025-6694 | LabRedesCefetRJ WeGIA Adicionar Unidade adicionar_unidade.php cross-site scripting | 4.1v3.1 | 0.4% | 2025-06-26 | |
| CVE-2025-6693 | RT-Thread device.c sys_device_write memory corruption | 8.5CNA v4.0 | 0.3% | 2025-06-26 | |
| CVE-2025-6677 | Paragraphs table Moderately critical cross-site scripting SA-CONTRIB-2025-084 | 5.4CISA ADP v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-6676 | Simple XML sitemap Moderately critical cross-site scripting SA-CONTRIB-2025-083 | 5.4CISA ADP v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-6675 | Enterprise MFA TFA for Drupal Critical Access bypass SA-CONTRIB-2025-082 | 4.8CISA ADP v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-6674 | CKEditor5 Youtube Moderately critical cross-site scripting SA-CONTRIB-2025-081 | 6.1CISA ADP v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-6624 | Snyk CLI insertion of sensitive information into log file allowed in DEBUG or DEBUG/TRACE mode | 2.4CNA v4.0 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-6562 | Hunt Electronic Hybrid DVR OS command injection | 8.7CNA v4.0 | 0.9% | 2025-06-26 | Fix |
| CVE-2025-6561 | Hunt Electronic Hybrid DVR Exposure of Sensitive System Information | 9.8CNA v3.1 | 0.5% | 2025-06-26 | Fix |
| CVE-2025-6546 | Drive Folder Embedder WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-6540 | web-cam WordPress plugin authenticated (Contributor+) stored cross-site scripting via slug parameter | 6.4CNA v3.1 | 0.3% | 2025-06-26 | Fix |
| CVE-2025-6538 | Post Rating and Review WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-6537 | Namasha By Mdesign WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-6383 | WP-PhotoNav WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-6378 | Responsive Food and Drink Menu WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-6290 | Tournament Bracket Generator WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-6258 | WP SoundSystem WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-06-26 | |
| CVE-2025-6212 | Ultra Addons for Contact Form 7 - unauthenticated stored cross-site scripting via Database module | 6.1NVD v3.1 | 0.3% | 2025-06-26 | Fix |
| CVE-2025-5995 | Canon EOS Webcam Utility Pro privilege escalation | 4.6CNA v4.0 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-5966 | ManageEngine Exchange Reporter Plus stored XSS | 8.1CNA v3.1 | 1.3% | 2025-06-26 | Fix |
| CVE-2025-5932 | Homerunner WordPress plugin cross-site request forgery to settings update | 4.3CNA v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-5929 | The Countdown WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-5846 | Missing authorization in GitLab | 2.7CNA v3.1 | 0.3% | 2025-06-26 | Fix |
| CVE-2025-5842 | Modern Design Library WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-06-26 | Fix |
| CVE-2025-5813 | Amazon Products to WooCommerce WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2025-06-26 | |
| CVE-2025-5812 | VG WORT METIS WordPress plugin missing authorization authenticated limited settings update | 4.3CNA v3.1 | 0.3% | 2025-06-26 | Fix |
| CVE-2025-5731 | Infinispan: Credential leakage in Infinispan cli | 5.5CNA v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-5682 | Klaro Cookie and Consent Management Moderately critical cross-site scripting SA-CONTRIB-2025-080 | 4.3CISA ADP v3.1 | 0.3% | 2025-06-26 | Fix |
| CVE-2025-5590 | Owl carousel responsive WordPress plugin authenticated (Contributor+) SQL injection via id parameter | 8.8CNA v3.1 | 0.4% | 2025-06-26 | |
| CVE-2025-5588 | Image Editor by Pixo WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-06-26 | Fix |
| CVE-2025-5564 | GC Social wall WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-06-26 | |
| CVE-2025-5559 | TimeZoneCalculator WordPress plugin authenticated (Contributor+) stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-26 | |
| CVE-2025-5540 | Event RSVP and Simple Event Management WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-5535 | e.nigma buttons WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-06-26 | |
| CVE-2025-5488 | WP Masonry and Infinite Scroll WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-5459 | Perforce Puppet Enterprise OS command injection | 8.6CNA v4.0 | 1.1% | 2025-06-26 | |
| CVE-2025-5366 | ManageEngine Exchange Reporter Plus stored XSS | 8.1CNA v3.1 | 1.3% | 2025-06-26 | Fix |
| CVE-2025-5338 | Royal Elementor Addons WordPress plugin stored DOM-based cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-5315 | Missing authorization in GitLab | 4.3CNA v3.1 | 0.3% | 2025-06-26 | Fix |
| CVE-2025-5275 | Charitable WordPress plugin stored cross-site scripting | 4.0v3.1 | 0.2% | 2025-06-26 | Fix |
| CVE-2025-4334 | Simple User Registration WordPress plugin unauthenticated privilege escalation | 9.8CNA v3.1 | 2.6% | 2025-06-26 | NucleiExploit codeFix |
| CVE-2025-3863 | Post Carousel Slider for Elementor WordPress plugin missing authorization | 4.3CNA v3.1 | 0.3% | 2025-06-26 | Fix |
| CVE-2025-3773 | Trellix System Information Reporter information disclosure | 0.0CNA v4.0 | 0.1% | 2025-06-26 | |
| CVE-2025-3771 | Trellix System Information Reporter link following | 7.2CNA v4.0 | 0.2% | 2025-06-26 | |
| CVE-2025-3722 | Trellix System Information Reporter path traversal | 0.0CNA v4.0 | 0.2% | 2025-06-26 | |
| CVE-2025-3699 | Mitsubishi Electric G-50 missing authentication | 9.8CNA v3.1 | 1.1% | 2025-06-26 | Fix |
| CVE-2025-3279 | Allocation of resources without limits or throttling in GitLab | 6.5CNA v3.1 | 0.4% | 2025-06-26 | Fix |
| CVE-2025-2938 | Business Logic Errors in GitLab | 3.1CNA v3.1 | 0.3% | 2025-06-26 | Fix |
| CVE-2025-1754 | Missing authentication for critical function in GitLab | 5.3CNA v3.1 | 0.3% | 2025-06-26 | Fix |
| CVE-2025-52999 | jackson-core can throw a StackoverflowError when processing deeply nested data | 8.7CNA v4.0 | 0.8% | 2025-06-25 | Fix |
| CVE-2025-52894 | OpenBao vulnerable to Unauthenticated Rekey Operation Cancellation | 6.9CNA v4.0 | 0.4% | 2025-06-25 | Fix |
| CVE-2025-52893 | OpenBao may leak sensitive information in Logs when Processing Malformed Data | 4.5CNA v3.1 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-52890 | Incus vulnerable to antispoofing nftables firewall rule bypass on bridge networks with ACLs | 8.1CNA v3.1 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-52889 | Incus vulnerable to DoS | 3.4CNA v3.1 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-52576 | Kanboard vulnerable to Username Enumeration via Login Behavior and Bruteforce Protection Bypass | 5.3CNA v3.1 | 0.4% | 2025-06-25 | Fix |
| CVE-2025-52569 | GitHub.jl lacks validation for user-provided fields | 6.6CNA v4.0 | 0.5% | 2025-06-25 | Fix |
| CVE-2025-52483 | Registrator.jl vulnerable to argument injection and command injection | 8.1CNA v4.0 | 0.4% | 2025-06-25 | Fix |
| CVE-2025-52480 | Registrator.jl argument injection | 8.1CNA v4.0 | 0.7% | 2025-06-25 | Fix |
| CVE-2025-52479 | HTTP.jl vulnerable to CR/LF injection in URIs | 7.7CNA v4.0 | 0.4% | 2025-06-25 | Fix |
| CVE-2025-50179 | Tuleap missing CSRF protection on tracker reports manipulation | 4.6CNA v3.1 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-50178 | GitForge.jl lacks validation for user provided fields | 6.6CNA v4.0 | 0.5% | 2025-06-25 | Fix |
| CVE-2025-49845 | Discourse whisper post visibility information disclosure | 6.3CNA v4.0 | 0.4% | 2025-06-25 | Fix |
| CVE-2025-49797 | Brother Industries Multiple driver installers files accessible to external parties | 8.5CNA v4.0 | 0.2% | 2025-06-25 | |
| CVE-2025-49550 | Adobe Commerce incorrect authorization | 4.3CNA v3.1 | 0.4% | 2025-06-25 | Fix |
| CVE-2025-49549 | Adobe Commerce incorrect authorization | 2.7CNA v3.1 | 0.4% | 2025-06-25 | Fix |
| CVE-2025-49153 | Path traversal in Microsens NMP Web+ | 9.3CNA v4.0 | 0.7% | 2025-06-25 | Fix |
| CVE-2025-49152 | Insufficient session expiration in Microsens NMP Web+ | 8.7CNA v4.0 | 0.5% | 2025-06-25 | Fix |
| CVE-2025-49151 | Microsens NMP Web+ JWT authentication vulnerability | 9.3CNA v4.0 | 0.6% | 2025-06-25 | Fix |
| CVE-2025-49135 | Cvat missing validation for in-progress backup upload names | 5.3CNA v4.0 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-48991 | Tuleap missing CSRF protection on tracker canned responses administration | 4.6CNA v3.1 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-48954 | Discourse vulnerable to XSS via user-provided query parameter in oauth failure flow | 8.1CNA v3.1 | 0.7% | 2025-06-25 | NucleiFix |
| CVE-2025-45333 | Berkeley-abc Abc null pointer dereference | 7.5CISA ADP v3.1 | 0.4% | 2025-06-25 | |
| CVE-2025-45332 | Vkoskiv C-ray null pointer dereference | 7.5v3.1 | 0.3% | 2025-06-25 | |
| CVE-2025-44206 | Hexagon HxGN OnCall Dispatch Advantage Broadcast functionality cross-site scripting | 4.6CNA v3.1 | 0.3% | 2025-06-25 | |
| CVE-2025-43880 | GROWI regular expression denial of service | 5.3CNA v4.0 | 0.3% | 2025-06-25 | |
| CVE-2025-41647 | Lenze: Plaintext password Disclosure in PLC Designer V4 interface | 5.5CNA v3.1 | 0.1% | 2025-06-25 | Fix |
| CVE-2025-41256 | Cyberduck and Mountain Duck weak hash Algorithm for Certificate Fingerprint | 7.4CNA v3.1 | 0.1% | 2025-06-25 | |
| CVE-2025-41255 | Cyberduck and Mountain Duck Improper Certificate Store Handling | 8.0CNA v3.1 | 0.2% | 2025-06-25 | |
| CVE-2025-36038 | IBM WebSphere Application Server code execution | 9.0CNA v3.1 | 13.3% | 2025-06-25 | Fix |
| CVE-2025-36004 | IBM i privilege escalation | 8.8CNA v3.1 | 0.5% | 2025-06-25 | Fix |
| CVE-2025-25905 | 4pace Cadclick cross-site scripting | 7.1CISA ADP v3.1 | 0.5% | 2025-06-25 | |
| CVE-2025-25012 | Kibana open redirect | 4.3CNA v3.1 | 0.4% | 2025-06-25 | Fix |
| CVE-2025-20282 | Cisco ISE API unauthenticated remote code execution | 10.0CNA v3.1 | 38.7% | 2025-06-25 | NucleiExploit codeFix |
| CVE-2025-20281 | Cisco Identity Services Engine injection | 10.0CNA v3.1 | 97.6% | 2025-06-25 | KEVNucleiEmerging ThreatsExploit codeFix |
| CVE-2025-20264 | Cisco Identity Services Engine authorization bypass | 6.4CNA v3.1 | 0.4% | 2025-06-25 | Fix |
| CVE-2025-6678 | Autel MaxiCharger AC Wallbox Commercial PIN missing authentication information disclosure | 7.5CNA v3.0 | 0.5% | 2025-06-25 | |
| CVE-2025-6669 | gooaclok819 sublinkX jwt.go hard-coded key | 6.3CNA v4.0 | 0.4% | 2025-06-25 | Fix |
| CVE-2025-6668 | code-projects Inventory Management System fetchSelectedBrand.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-25 | |
| CVE-2025-6667 | code-projects Car Rental System add_cars.php unrestricted upload | 8.8v3.1 | 0.4% | 2025-06-25 | |
| CVE-2025-6665 | code-projects Inventory Management System editBrand.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-25 | |
| CVE-2025-6664 | CodeAstro Patient Record Management System cross-site request forgery | 5.3CNA v4.0 | 0.3% | 2025-06-25 | |
| CVE-2025-6662 | PDF-XChange Editor PRC File Parsing out-of-bounds read information disclosure | 3.3CNA v3.0 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-6661 | PDF-XChange Editor App object use-after-free remote code execution | 7.8CNA v3.0 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-6660 | PDF-XChange Editor GIF File Parsing heap-based buffer overflow remote code execution | 7.8CNA v3.0 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-6659 | PDF-XChange Editor PRC File Parsing out-of-bounds write remote code execution | 7.8CNA v3.0 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-6658 | PDF-XChange Editor PRC File Parsing out-of-bounds read information disclosure | 3.3CNA v3.0 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-6657 | PDF-XChange Editor PRC File Parsing out-of-bounds read information disclosure | 3.3CNA v3.0 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-6656 | PDF-XChange Editor PRC File Parsing out-of-bounds read information disclosure | 3.3CNA v3.0 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-6655 | PDF-XChange Editor PRC File Parsing out-of-bounds read information disclosure | 3.3CNA v3.0 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-6654 | PDF-XChange Editor PRC File Parsing out-of-bounds write remote code execution | 7.8CNA v3.0 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-6653 | PDF-XChange Editor PRC File Parsing out-of-bounds read information disclosure | 3.3CNA v3.0 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-6652 | PDF-XChange Editor PRC File Parsing out-of-bounds read information disclosure | 3.3CNA v3.0 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-6651 | PDF-XChange Editor JP2 File Parsing out-of-bounds write remote code execution | 7.8CNA v3.0 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-6650 | PDF-XChange Editor U3D File Parsing out-of-bounds read information disclosure | 3.3CNA v3.0 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-6649 | PDF-XChange Editor U3D File Parsing out-of-bounds read information disclosure | 3.3CNA v3.0 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-6648 | PDF-XChange Editor U3D File Parsing out-of-bounds read information disclosure | 3.3CNA v3.0 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-6647 | PDF-XChange Editor U3D File Parsing out-of-bounds write remote code execution | 7.8CNA v3.0 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-6646 | PDF-XChange Editor U3D File Parsing use-after-free information disclosure | 3.3CNA v3.0 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-6645 | PDF-XChange Editor U3D File Parsing use-after-free remote code execution | 7.8CNA v3.0 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-6644 | PDF-XChange Editor U3D File Parsing use-after-free remote code execution | 7.8CNA v3.0 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-6643 | PDF-XChange Editor U3D File Parsing out-of-bounds read information disclosure | 3.3CNA v3.0 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-6642 | PDF-XChange Editor U3D File Parsing out-of-bounds read remote code execution | 7.8CNA v3.0 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-6641 | PDF-XChange Editor U3D File Parsing out-of-bounds read information disclosure | 3.3CNA v3.0 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-6640 | PDF-XChange Editor U3D File Parsing use-after-free remote code execution | 7.8CNA v3.0 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-6627 | TOTOLINK A702R HTTP POST request formIpv6Setup buffer overflow | 8.7CNA v4.0 | 5.7% | 2025-06-25 | Emerging Threats |
| CVE-2025-6621 | TOTOLINK CA300-PoE ap.so QuickSetting os command injection | 9.8v3.1 | 2.5% | 2025-06-25 | |
| CVE-2025-6620 | TOTOLINK CA300-PoE upgrade.so setUpgradeUboot os command injection | 9.8v3.1 | 2.5% | 2025-06-25 | |
| CVE-2025-6619 | TOTOLINK CA300-PoE upgrade.so setUpgradeFW os command injection | 9.8v3.1 | 2.4% | 2025-06-25 | |
| CVE-2025-6618 | TOTOLINK CA300-PoE wps.so SetWLanApcliSettings os command injection | 9.8v3.1 | 2.4% | 2025-06-25 | |
| CVE-2025-6617 | D-Link DIR-619L formAdvanceSetup stack-based overflow | 8.7CNA v4.0 | 1.2% | 2025-06-25 | |
| CVE-2025-6616 | D-Link DIR-619L formSetWAN_Wizard51 stack-based overflow | 8.7CNA v4.0 | 1.3% | 2025-06-25 | |
| CVE-2025-6615 | D-Link DIR-619L formAutoDetecWAN_wizard4 stack-based overflow | 8.7CNA v4.0 | 1.2% | 2025-06-25 | |
| CVE-2025-6614 | D-Link DIR-619L formSetWANType_Wizard5 stack-based overflow | 8.7CNA v4.0 | 1.2% | 2025-06-25 | |
| CVE-2025-6613 | PHPGurukul Hospital Management System manage-patient.php cross-site scripting | 5.4v3.1 | 0.3% | 2025-06-25 | |
| CVE-2025-6612 | code-projects Inventory Management System removeCategories.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-25 | |
| CVE-2025-6611 | code-projects Inventory Management System createBrand.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-25 | |
| CVE-2025-6610 | itsourcecode Employee Management System editempprofile.php SQL injection | 7.2v3.1 | 0.4% | 2025-06-25 | |
| CVE-2025-6609 | SourceCodester Best Salon Management System bwdates-reports-details.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-25 | |
| CVE-2025-6608 | SourceCodester Best Salon Management System edit-services.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-25 | |
| CVE-2025-6607 | SourceCodester Best Salon Management System stock.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-25 | |
| CVE-2025-6606 | SourceCodester Best Salon Management System add-services.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-25 | |
| CVE-2025-6605 | SourceCodester Best Salon Management System edit-staff.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-25 | |
| CVE-2025-6604 | SourceCodester Best Salon Management System add-staff.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-25 | |
| CVE-2025-6603 | coldfunction qCUDA qcow.c qcow_make_empty integer overflow | 4.8CNA v4.0 | 0.2% | 2025-06-25 | |
| CVE-2025-6583 | SourceCodester Best Salon Management System view-appointment.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-25 | |
| CVE-2025-6582 | SourceCodester Best Salon Management System edit-customer-detailed.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-25 | |
| CVE-2025-6543 | Citrix NetScaler ADC and Gateway buffer overflow | 9.2CNA v4.0 | 10.6% | 2025-06-25 | KEVExploit codeFix |
| CVE-2025-6445 | ServiceStack FindType directory traversal remote code execution | 8.1v3.1 | 1.1% | 2025-06-25 | Fix |
| CVE-2025-6444 | ServiceStack GetErrorResponse improper input validation NTLM Relay | 5.9v3.1 | 0.4% | 2025-06-25 | |
| CVE-2025-6443 | MikroTik RouterOS VXLAN Source IP improper access control | 7.2CNA v3.0 | 0.6% | 2025-06-25 | |
| CVE-2025-6442 | Ruby WEBrick read_header HTTP request smuggling | 5.9v3.1 | 0.4% | 2025-06-25 | Fix |
| CVE-2025-5927 | Everest Forms (Pro) WordPress plugin unauthenticated path traversal to arbitrary file deletion | 7.5CNA v3.1 | 0.7% | 2025-06-25 | Fix |
| CVE-2025-5834 | Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware local privilege escalation | 7.8v3.1 | 0.2% | 2025-06-25 | |
| CVE-2025-5833 | Pioneer DMH-WT7600NEX Root Filesystem insufficient verification of data authenticity | 6.8v3.1 | 0.2% | 2025-06-25 | |
| CVE-2025-5832 | Pioneer DMH-WT7600NEX Software Update Signing insufficient verification of data authenticity | 6.8CNA v3.0 | 0.2% | 2025-06-25 | |
| CVE-2025-5830 | Autel MaxiCharger AC Wallbox Commercial DLB SlaveRegister message handling buffer overflow | 8.8CNA v3.0 | 0.4% | 2025-06-25 | |
| CVE-2025-5829 | Autel MaxiCharger AC Wallbox Commercial autocharge stack-based buffer overflow remote code execution | 6.8CNA v3.0 | 0.3% | 2025-06-25 | |
| CVE-2025-5828 | Autel MaxiCharger AC Wallbox Commercial wLength buffer overflow remote code execution | 6.8CNA v3.0 | 0.3% | 2025-06-25 | |
| CVE-2025-5827 | Autel MaxiCharger AC Wallbox Commercial stack-based buffer overflow | 8.8CNA v3.0 | 0.4% | 2025-06-25 | |
| CVE-2025-5826 | Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not r | 6.3CNA v3.0 | 0.3% | 2025-06-25 | |
| CVE-2025-5825 | Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade remote code execution | 7.5CNA v3.0 | 0.3% | 2025-06-25 | |
| CVE-2025-5824 | Autel MaxiCharger AC Wallbox Commercial origin validation error authentication bypass | 7.5v3.1 | 0.1% | 2025-06-25 | |
| CVE-2025-5823 | Autel MaxiCharger AC Wallbox Commercial Technician API information disclosure | 6.5v3.1 | 0.5% | 2025-06-25 | |
| CVE-2025-5822 | Autel MaxiCharger AC Wallbox Commercial Technician API incorrect authorization privilege escalation | 8.8v3.1 | 0.3% | 2025-06-25 | |
| CVE-2025-5585 | SiteOrigin Widgets Bundle WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-25 | Fix |
| CVE-2025-5015 | Parsons AccuWeather widget cross-site scripting | 8.8CNA v3.1 | 0.4% | 2025-06-25 | Fix |
| CVE-2025-4656 | Vault vulnerable to Recovery Key Cancellation denial of service | 3.1CNA v3.1 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-0966 | IBM InfoSphere Information Server SQL injection | 7.6CNA v3.1 | 0.3% | 2025-06-25 | Fix |
| CVE-2025-53073 | Sentry forced browsing | 4.2CNA v3.1 | 0.2% | 2025-06-24 | |
| CVE-2025-53021 | Moodle session fixation allows unauthenticated users to hijack sessions via sesskey parameter | 4.2CNA v3.1 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-52888 | allure-framework allure2 allure 2's xunit-xml-plugin vulnerable to improper XXE Restriction | 7.5CNA v3.1 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-52884 | risc0-ethereum Steel commitment validation vulnerability | 1.7CNA v4.0 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-52883 | Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted | 5.3CNA v3.1 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-52882 | anthropics claude-code claude Code IDE extensions allow websocket connections from arbitrary origins | 8.8CNA v4.0 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-52880 | Komga vulnerable to arbitrary code execution via Crafted EPUB file | 4.2CNA v3.1 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-52574 | bocaletto-luca SysmonElixir /read endpoint path traversal | 7.5CNA v3.1 | 0.5% | 2025-06-24 | Fix |
| CVE-2025-52572 | Hikka vulnerable to RCE through dangling web interface | 10.0CNA v3.1 | 0.7% | 2025-06-24 | |
| CVE-2025-52571 | Hikka vulnerable to RCE through edits in a channel | 9.7CNA v3.1 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-52570 | Letmein connection limiter allows an arbitrary amount of simultaneous connections | 1.7CNA v4.0 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-52568 | nekernel NeKernal multiple memory corruption vulnerabilities in mkfs.hefs | 8.8CNA v4.0 | 0.5% | 2025-06-24 | Fix |
| CVE-2025-52566 | llama.cpp tokenizer signed vs. unsigned heap overflow | 8.6CNA v3.1 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-52560 | Kanboard Password Reset Poisoning via host header injection | 8.1CNA v3.1 | 0.5% | 2025-06-24 | Fix |
| CVE-2025-52471 | espressif esp-idf ESP-NOW integer underflow vulnerability Advisory | 7.2CNA v4.0 | 0.9% | 2025-06-24 | Fix |
| CVE-2025-50699 | PHPGurukul Online DJ Booking Management System cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-06-24 | |
| CVE-2025-50695 | PHPGurukul Online DJ Booking Management System cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-06-24 | |
| CVE-2025-50693 | PHPGurukul Online DJ Booking Management System insecure direct object reference | 6.5CISA ADP v3.1 | 0.3% | 2025-06-24 | |
| CVE-2025-50213 | Apache Airflow Providers Snowflake package allows for special element injection | 9.8CISA ADP v3.1 | 0.7% | 2025-06-24 | Fix |
| CVE-2025-49853 | Improper neutralization of special elements used in an SQL command in ControlID iDSecure On-premises | 9.3CNA v4.0 | 0.5% | 2025-06-24 | Fix |
| CVE-2025-49852 | Server-side request forgery (SSRF) in ControlID iDSecure On-premises | 8.7CNA v4.0 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-49851 | Improper authentication in ControlID iDSecure On-premises | 9.8v3.1 | 0.6% | 2025-06-24 | Fix |
| CVE-2025-49147 | Umbraco-CMS Umbraco.Cms vulnerable to Disclosure of Configured Password Requirements | 5.3CNA v3.1 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-48890 | ELECOM WRH-733GBK OS command injection | 9.3CNA v4.0 | 2.2% | 2025-06-24 | |
| CVE-2025-48470 | Advantech Wireless Sensing and Equipment (WISE) stored cross-site scripting (XSS) | 4.1CNA v3.1 | 0.2% | 2025-06-24 | Fix |
| CVE-2025-48469 | Advantech WISE firmware update page missing authentication | 9.6CNA v3.1 | 0.5% | 2025-06-24 | Fix |
| CVE-2025-48468 | Advantech Wireless Sensing and Equipment (WISE) Open JTAG Debug Port | 6.4CNA v3.1 | 0.2% | 2025-06-24 | Fix |
| CVE-2025-48467 | Advantech Wireless Sensing and Equipment (WISE) denial of service via Malformed Modbus Packets | 6.5CNA v3.1 | 0.2% | 2025-06-24 | Fix |
| CVE-2025-48466 | Advantech Wireless Sensing and Equipment (WISE) modbus command injection without Authentication | 8.1CNA v3.1 | 0.6% | 2025-06-24 | Exploit codeFix |
| CVE-2025-48463 | Advantech Wireless Sensing and Equipment (WISE) unencrypted HTTP Communication | 3.1CNA v3.1 | 0.1% | 2025-06-24 | Fix |
| CVE-2025-48462 | Advantech Wireless Sensing and Equipment (WISE) Login Session Exhaustion | 4.2CNA v3.1 | 0.2% | 2025-06-24 | Fix |
| CVE-2025-48461 | Advantech Wireless Sensing and Equipment (WISE) Weak Session Cookie Entropy | 5.0CNA v3.1 | 0.5% | 2025-06-24 | Fix |
| CVE-2025-47943 | Gogs stored XSS in PDF renderer | 6.3CNA v3.1 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-44531 | Realtek Rtl8762ekf-evb denial of service | 7.5CISA ADP v3.1 | 0.5% | 2025-06-24 | |
| CVE-2025-43879 | ELECOM WRH-733GBK OS command injection | 9.3CNA v4.0 | 2.2% | 2025-06-24 | |
| CVE-2025-43877 | ELECOM WRC-1167GHBK2-S cross-site scripting | 4.8CNA v4.0 | 0.2% | 2025-06-24 | |
| CVE-2025-41427 | ELECOM WRC-X3000GS OS command injection | 8.7CNA v4.0 | 1.0% | 2025-06-24 | |
| CVE-2025-39205 | Hitachi Energy MicroSCADA X SYS600 improper certificate validation | 7.1CNA v4.0 | 0.2% | 2025-06-24 | Fix |
| CVE-2025-39204 | Hitachi Energy MicroSCADA X SYS600 information disclosure | 8.5CNA v4.0 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-39203 | Hitachi Energy MicroSCADA X SYS600 improper integrity check validation | 7.1CNA v4.0 | 0.2% | 2025-06-24 | Fix |
| CVE-2025-39202 | Hitachi Energy MicroSCADA X SYS600 improper privilege management | 8.3CNA v4.0 | 0.2% | 2025-06-24 | Fix |
| CVE-2025-39201 | Hitachi Energy MicroSCADA X SYS600 incorrect default permissions | 6.9CNA v4.0 | 0.1% | 2025-06-24 | Fix |
| CVE-2025-36537 | Incorrect permission assignment for critical resource in TeamViewer Remote Management | 7.0CNA v3.1 | 0.2% | 2025-06-24 | Fix |
| CVE-2025-36519 | ELECOM WRC-2533GST2 unrestricted file upload | 5.3CNA v4.0 | 0.3% | 2025-06-24 | |
| CVE-2025-34041 | Sangfor Endpoint Detection and Response OS command injection | 10.0CNA v4.0 | 7.1% | 2025-06-24 | Fix |
| CVE-2025-34040 | Seeyon Zhiyuan OA System path traversal file upload | 10.0CNA v4.0 | 15.4% | 2025-06-24 | NucleiExploit codeFix |
| CVE-2025-34039 | Yonyou NC BeanShell command injection | 10.0CNA v4.0 | 0.6% | 2025-06-24 | |
| CVE-2025-34038 | Weaver E-cology SQL injection | 7.5v3.1 | 2.1% | 2025-06-24 | Nuclei |
| CVE-2025-34037 | Linksys Routers E/WAG/WAP/WES/WET/WRT-Series | 10.0CNA v4.0 | 92.8% | 2025-06-24 | Reported exploitedMetasploitEmerging ThreatsExploit codeFix |
| CVE-2025-34036 | Shenzhen TVT CCTV-DVR command injection | 9.8v3.1 | 30.9% | 2025-06-24 | Emerging ThreatsExploit code |
| CVE-2025-34035 | EnGenius EnShare IoT Gigabit Cloud Service command injection | 9.8v3.1 | 22.8% | 2025-06-24 | NucleiEmerging ThreatsExploit code |
| CVE-2025-34034 | 5VTechnologies Blue Angel Software Suite hard-coded credentials | 8.8NVD v3.1 | 0.7% | 2025-06-24 | Exploit code |
| CVE-2025-34033 | 5VTechnologies Blue Angel Software Suite OS command injection | 8.8v3.1 | 11.2% | 2025-06-24 | NucleiExploit code |
| CVE-2025-34032 | Moodle LMS Jmol Plugin cross-site scripting (XSS) | 6.1v3.1 | 0.8% | 2025-06-24 | NucleiExploit code |
| CVE-2025-34031 | Moodle LMS Jmol Plugin path traversal | 7.5v3.1 | 3.1% | 2025-06-24 | NucleiExploit code |
| CVE-2025-32978 | Quest KACE Systems Management Appliance license renewal interface missing authentication | 7.5CISA ADP v3.1 | 0.9% | 2025-06-24 | |
| CVE-2025-32977 | Quest KACE Systems Management Appliance backup file upload improper signature verification | 9.6CISA ADP v3.1 | 0.4% | 2025-06-24 | |
| CVE-2025-32976 | Quest KACE Systems Management Appliance two-factor authentication authentication bypass | 8.8CISA ADP v3.1 | 0.8% | 2025-06-24 | |
| CVE-2025-32975 | Quest KACE Systems Management Appliance (SMA) improper authentication | 10.0CISA ADP v3.1 | 2.5% | 2025-06-24 | KEVFix |
| CVE-2025-27828 | Mitel MiContact Center Business legacy chat reflected cross-site scripting | 7.1CISA ADP v3.1 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-27827 | Mitel MiContact Center Business legacy chat information disclosure | 7.1CISA ADP v3.1 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-23265 | NVIDIA Megatron-LM code injection | 7.8CNA v3.1 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-23264 | NVIDIA Megatron-LM code injection | 7.8CNA v3.1 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-23260 | NVIDIA AIS Operator incorrect privilege assignment | 5.0CNA v3.1 | 0.2% | 2025-06-24 | Fix |
| CVE-2025-6581 | SourceCodester Best Salon Management System add-customer.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-24 | |
| CVE-2025-6580 | SourceCodester Best Salon Management System Login SQL injection | 9.8v3.1 | 0.5% | 2025-06-24 | |
| CVE-2025-6579 | code-projects Car Rental System message_admin.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-24 | |
| CVE-2025-6578 | code-projects Simple Online Hotel Reservation System delete_account.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-24 | |
| CVE-2025-6570 | PHPGurukul Hospital Management System search.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-24 | |
| CVE-2025-6569 | code-projects School Fees Payment System student.php cross-site scripting | 6.1v3.1 | 0.4% | 2025-06-24 | |
| CVE-2025-6568 | TOTOLINK EX1200T HTTP POST request formIpv6Setup buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-06-24 | |
| CVE-2025-6567 | Campcodes Online Recruitment Management System view_application.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-24 | |
| CVE-2025-6566 | oatpp Oat++ Deserializer.cpp deserializeArray stack-based overflow | 7.5v3.1 | 0.8% | 2025-06-24 | |
| CVE-2025-6565 | Netgear WNCE3001 HTTP POST request http_d stack-based overflow | 8.7CNA v4.0 | 0.9% | 2025-06-24 | |
| CVE-2025-6560 | Sapido Wireless Router exposure of sensitive information | 9.3CNA v4.0 | 0.6% | 2025-06-24 | |
| CVE-2025-6559 | Sapido Wireless Router OS command injection | 9.3CNA v4.0 | 1.7% | 2025-06-24 | |
| CVE-2025-6557 | Google Chrome DevTools improper input validation | 5.4CISA ADP v3.1 | 0.2% | 2025-06-24 | Fix |
| CVE-2025-6556 | Google Chrome Loader insufficient policy enforcement | 5.4CISA ADP v3.1 | 0.2% | 2025-06-24 | Fix |
| CVE-2025-6555 | Google Chrome Animation use-after-free | 5.4CISA ADP v3.1 | 0.2% | 2025-06-24 | Fix |
| CVE-2025-6552 | java-aodeng Hope-Boot Login WebController.java doLogin redirect | 5.3CNA v4.0 | 0.4% | 2025-06-24 | |
| CVE-2025-6551 | java-aodeng Hope-Boot WebController.java login cross-site scripting | 5.4v3.1 | 0.5% | 2025-06-24 | |
| CVE-2025-6536 | Tarantool datetime.c tm_to_datetime assertion | 4.8CNA v4.0 | 0.2% | 2025-06-24 | |
| CVE-2025-6535 | Xxyopen/201206030 Novel-Plus User Management Module UserMapper.xml list SQL injection | 8.8v3.1 | 0.5% | 2025-06-24 | |
| CVE-2025-6534 | Xxyopen/201206030 Novel-Plus File FileController.java remove resource injection | 6.8v3.1 | 0.5% | 2025-06-24 | |
| CVE-2025-6533 | Xxyopen/201206030 Novel-Plus CATCHA LoginController.java ajaxLogin authentication replay | 5.9v3.1 | 0.6% | 2025-06-24 | |
| CVE-2025-6532 | NOYAFA/Xiami LF9 Pro RTSP Live Video Stream endpoint access control | 5.3CNA v4.0 | 0.5% | 2025-06-24 | |
| CVE-2025-6531 | SIFUSM/MZZYG BD S1 RTSP Live Video Stream endpoint access control | 5.3CNA v4.0 | 0.3% | 2025-06-24 | |
| CVE-2025-6436 | Mozilla memory safety bugs fixed in Firefox 140 and Thunderbird 140 | 8.1CISA ADP v3.1 | 4.3% | 2025-06-24 | Fix |
| CVE-2025-6435 | Mozilla Firefox save as in Devtools could download files without sanitizing the extension | 8.1CISA ADP v3.1 | 0.5% | 2025-06-24 | Fix |
| CVE-2025-6434 | Mozilla Firefox HTTPS-Only exception screen lacked anti-clickjacking delay | 4.3CISA ADP v3.1 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-6433 | Mozilla Firefox and Thunderbird WebAuthn improper certificate validation | 9.8CISA ADP v3.1 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-6432 | Mozilla Firefox DNS requests leaked outside of a configured SOCKS proxy | 8.6CISA ADP v3.1 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-6431 | Mozilla Firefox improper authorization | 6.5CISA ADP v3.1 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-6430 | Mozilla Firefox Content-Disposition header ignored when a file is included in an embed or object tag | 6.1CISA ADP v3.1 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-6429 | Mozilla Firefox incorrect parsing of URLs could have allowed embedding of youtube.com | 6.5CISA ADP v3.1 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-6428 | Mozilla Firefox for Android opened URLs specified in a link querystring parameter | 4.3CISA ADP v3.1 | 0.2% | 2025-06-24 | Fix |
| CVE-2025-6427 | Mozilla Firefox connect-src Content Security Policy restriction could be bypassed | 9.1CISA ADP v3.1 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-6426 | Mozilla Firefox no warning when opening executable terminal files on macOS | 8.8CISA ADP v3.1 | 0.2% | 2025-06-24 | Fix |
| CVE-2025-6425 | Mozilla The WebCompat WebExtension shipped with Firefox exposed a persistent UUID | 4.3CISA ADP v3.1 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-6424 | Mozilla Firefox use-after-free in FontFaceSet | 9.8CISA ADP v3.1 | 4.4% | 2025-06-24 | Fix |
| CVE-2025-6206 | Aiomatic - AI Content Writer, Editor, ChatBot and AI Toolkit WordPress plugin arbitrary file upload | 7.5CNA v3.1 | 0.5% | 2025-06-24 | Fix |
| CVE-2025-6032 | Red Hat Enterprise Linux 10 podman: Podman missing TLS verification | 8.3CNA v3.1 | 0.5% | 2025-06-24 | Fix |
| CVE-2025-5318 | Libssh: Out-of-bounds read in sftp_handle | 8.1NVD v3.1 | 1.8% | 2025-06-24 | Fix |
| CVE-2025-5258 | Conference Scheduler WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-5087 | Cleartext transmission of sensitive information in Kaleris Navis N4 | 6.0CNA v4.0 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-4383 | Authentication bypass in Art-In Systems' Wi-Fi Cloud Hotspot | 9.3CNA v3.1 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-4378 | Hard-coded credentials in Ataturk University's ATA-AOF Mobile Application | 10.0CNA v3.1 | 0.3% | 2025-06-24 | Fix |
| CVE-2025-3092 | MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24 | 7.5CNA v3.1 | 0.5% | 2025-06-24 | Fix |
| CVE-2025-3091 | MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24 | 7.5CNA v3.1 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-3090 | MB connect line: Missing authentication in mbCONNECT24/mymbCONNECT24 | 8.2CNA v3.1 | 0.5% | 2025-06-24 | Fix |
| CVE-2025-2962 | zephyrproject-rtos Zephyr infinite loop in dns_copy_qname | 8.2CNA v3.1 | 0.6% | 2025-06-24 | |
| CVE-2025-2566 | Deserialization of untrusted data in Kaleris Navis N4 | 9.3CNA v4.0 | 0.6% | 2025-06-24 | Fix |
| CVE-2025-2403 | Hitachi Energy Relion 670/650 and SAM600-IO resource exhaustion | 8.7CNA v4.0 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-1718 | Hitachi Energy Relion 670/650 and SAM600-IO improper check for exceptional conditions | 7.1CNA v4.0 | 0.4% | 2025-06-24 | Fix |
| CVE-2025-52968 | Freedesktop xdg-utils unprotected alternate channel | 2.7CNA v3.1 | 0.2% | 2025-06-23 | |
| CVE-2025-52967 | MLFlow SSRF via gateway_proxy_handler | 5.8CNA v3.1 | 0.4% | 2025-06-23 | Fix |
| CVE-2025-52939 | Potential heap-buffer overflow vulnerability in NotepadNext | 9.4CNA v4.0 | 0.2% | 2025-06-23 | Fix |
| CVE-2025-52938 | Potential heap-based buffer over-read vulnerability in NotepadNext | 5.1CNA v4.0 | 0.2% | 2025-06-23 | |
| CVE-2025-52937 | Point Cloud Library openNURBS module vulnerability | 2.0CNA v4.0 | 0.1% | 2025-06-23 | |
| CVE-2025-52936 | Improper link resolution before file access vulnerability in yrutschle/sslh | 9.3CNA v4.0 | 0.2% | 2025-06-23 | Fix |
| CVE-2025-52935 | Integer overflow or wraparound vulnerability in dragonflydb/dragonfly | 9.4CNA v4.0 | 0.4% | 2025-06-23 | |
| CVE-2025-52926 | spytrap-adb Omission of Security-relevant Information | 2.7CNA v3.1 | 0.2% | 2025-06-23 | Fix |
| CVE-2025-52922 | InnoShop relative path traversal | 7.4CNA v3.1 | 0.5% | 2025-06-23 | |
| CVE-2025-52921 | InnoShop unprotected alternate channel | 9.9CNA v3.1 | 0.5% | 2025-06-23 | |
| CVE-2025-52920 | InnoShop forced browsing | 6.4CNA v3.1 | 0.3% | 2025-06-23 | |
| CVE-2025-52879 | JetBrains TeamCity cross-site scripting | 4.8CNA v3.1 | 1.2% | 2025-06-23 | Fix |
| CVE-2025-52878 | JetBrains TeamCity missing authorization | 4.3CNA v3.1 | 0.4% | 2025-06-23 | Fix |
| CVE-2025-52877 | JetBrains TeamCity cross-site scripting | 4.8CNA v3.1 | 36.7% | 2025-06-23 | Fix |
| CVE-2025-52876 | JetBrains TeamCity cross-site scripting | 5.4CNA v3.1 | 37.6% | 2025-06-23 | Fix |
| CVE-2025-52875 | JetBrains TeamCity cross-site scripting | 5.4CNA v3.1 | 1.0% | 2025-06-23 | Fix |
| CVE-2025-52562 | Convey Panel directory traversal in LocaleController leading to remote code execution | 10.0CNA v3.1 | 1.8% | 2025-06-23 | Fix |
| CVE-2025-52561 | HTMLSanitizer.jl Possible XSS | 6.9CNA v4.0 | 0.9% | 2025-06-23 | Fix |
| CVE-2025-52558 | ChangeDetection.io XSS in watch overview | 7.0CNA v4.0 | 0.6% | 2025-06-23 | Fix |
| CVE-2025-50349 | PHPGurukul Pre-School Enrollment System path traversal | 7.5CISA ADP v3.1 | 0.8% | 2025-06-23 | |
| CVE-2025-50348 | PHPGurukul Pre-School Enrollment System path traversal | 7.5CISA ADP v3.1 | 0.8% | 2025-06-23 | |
| CVE-2025-49574 | Quarkus potential data leak when duplicating a duplicated context | 6.4CNA v3.1 | 0.3% | 2025-06-23 | Fix |
| CVE-2025-49144 | notepad-plus-plus Notepad++ privilege escalation in Installer | 7.3CNA v3.1 | 0.7% | 2025-06-23 | Exploit codeFix |
| CVE-2025-49126 | Visionatrix vulnerable to reflected XSS leading to Exfiltration of Secrets | 8.8CNA v3.1 | 0.3% | 2025-06-23 | Fix |
| CVE-2025-48700 | Synacor Zimbra Collaboration Suite (ZCS) cross-site scripting | 6.1CISA ADP v3.1 | 1.7% | 2025-06-23 | KEVFix |
| CVE-2025-48026 | Mitel OpenScape Xpressions WebApl path traversal | 7.5CISA ADP v3.1 | 0.6% | 2025-06-23 | Fix |
| CVE-2025-46101 | Beakon Learning Management System Sharable Content Object Reference Model SQL injection | 9.8CISA ADP v3.1 | 0.7% | 2025-06-23 | |
| CVE-2025-44528 | An issue in Texas Instruments LP-CC2652RB SimpleLink CC13XX CC26XX SDK 7.41.00.17 allows attackers to cause a Denial of Service (DoS) via sending a crafted LL_Pause_Enc_Req packet during the authentication and connection phase, causing a Denial of Service (DoS). | 7.5CISA ADP v3.1 | 0.4% | 2025-06-23 | |
| CVE-2025-27387 | OPPO Clone Phone uses weak WPA passphrase as only means of security | 7.4CNA v3.1 | 0.3% | 2025-06-23 | |
| CVE-2025-23092 | Mitel OpenScape Accounting Management path traversal | 7.2CISA ADP v3.1 | 0.9% | 2025-06-23 | Fix |
| CVE-2025-23049 | Materialise OrthoView OS command injection | 8.4CNA v4.0 | 1.9% | 2025-06-23 | |
| CVE-2025-6547 | On Node.js, pbkdf2 silently disregards Uint8Array input, returning static keys | 9.1CNA v4.0 | 0.5% | 2025-06-23 | Fix |
| CVE-2025-6545 | pbkdf2 improper input validation | 9.1CNA v4.0 | 0.4% | 2025-06-23 | Fix |
| CVE-2025-6530 | 70mai M300 Telnet service demo.sh denial of service | 4.8v3.1 | 0.7% | 2025-06-23 | |
| CVE-2025-6529 | 70mai M300 Telnet service default credentials | 8.8v3.1 | 0.9% | 2025-06-23 | |
| CVE-2025-6528 | 70mai M300 RTSP Live Video Stream endpoint 12 improper authentication | 4.3v3.1 | 0.7% | 2025-06-23 | |
| CVE-2025-6527 | 70mai M300 Web Server access control | 3.1v3.1 | 0.6% | 2025-06-23 | |
| CVE-2025-6526 | 70mai M300 HTTP server insufficiently protected credentials | 5.3v3.1 | 0.6% | 2025-06-23 | |
| CVE-2025-6525 | 70mai 1S Configuration Config.cgi improper authorization | 5.3CNA v4.0 | 0.3% | 2025-06-23 | |
| CVE-2025-6524 | 70mai 1S Video services improper authentication | 2.3CNA v4.0 | 0.4% | 2025-06-23 | |
| CVE-2025-6518 | pyspur incomplete filtering of special elements allowed by SingleLLMCallNode function | 5.3CNA v4.0 | 0.4% | 2025-06-23 | |
| CVE-2025-6517 | Dromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgery | 9.8v3.1 | 0.5% | 2025-06-23 | |
| CVE-2025-6516 | HDF5 H5Fint.c H5F_addr_decode_len heap-based overflow | 7.8v3.1 | 0.4% | 2025-06-23 | Fix |
| CVE-2025-6513 | BRAIN2 Configuration file for database access not sufficiently secured | 9.3CNA v3.1 | 0.2% | 2025-06-23 | Fix |
| CVE-2025-6512 | Scripts within reports executable on BRAIN2 Server | 10.0CNA v3.1 | 0.5% | 2025-06-23 | Fix |
| CVE-2025-6511 | Netgear EX6150 sub_410090 stack-based overflow | 8.7CNA v4.0 | 1.2% | 2025-06-23 | |
| CVE-2025-6510 | Netgear EX6100 sub_415EF8 stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-06-23 | |
| CVE-2025-6509 | seaswalker spring-analysis SimpleController.java echo cross-site scripting | 5.1CNA v4.0 | 0.3% | 2025-06-23 | |
| CVE-2025-6503 | code-projects Inventory Management System fetchSelectedCategories.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-23 | |
| CVE-2025-6502 | code-projects Inventory Management System changePassword.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-23 | |
| CVE-2025-6501 | code-projects Inventory Management System createCategories.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-23 | |
| CVE-2025-6500 | code-projects Inventory Management System editCategories.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-23 | |
| CVE-2025-6499 | vstakhov libucl ucl_parser.c ucl_parse_multiline_string heap-based overflow | 5.5v3.1 | 0.3% | 2025-06-23 | |
| CVE-2025-6498 | HTACG tidy-html5 alloc.c defaultAlloc memory leak | 5.5v3.1 | 0.2% | 2025-06-23 | |
| CVE-2025-6497 | HTACG tidy-html5 parser.c prvTidyParseNamespace assertion | 4.8CNA v4.0 | 0.2% | 2025-06-23 | |
| CVE-2025-6496 | HTACG tidy-html5 parser.c InsertNodeAsParent null pointer dereference | 4.8CNA v4.0 | 0.2% | 2025-06-23 | |
| CVE-2025-4563 | Kubernetes nodes can bypass dynamic resource allocation authorization checks | 2.7CNA v3.1 | 0.7% | 2025-06-23 | Fix |
| CVE-2025-2828 | SSRF vulnerability in RequestsToolkit in langchain-ai/langchain | 10.0v3.1 | 21.0% | 2025-06-23 | Fix |
| CVE-2025-2172 | Aviatrix Controller OS command injection | 6.6CNA v4.0 | 12.2% | 2025-06-23 | |
| CVE-2025-2171 | Aviatrix Controller missing brute-force protection | 7.8CNA v4.0 | 0.5% | 2025-06-23 | |
| CVE-2025-52923 | Sangfor aTrust incorrect permission assignment | 4.3CNA v3.1 | 0.2% | 2025-06-22 | |
| CVE-2025-6494 | sparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflow | 4.8CNA v4.0 | 0.2% | 2025-06-22 | |
| CVE-2025-6493 | CodeMirror Markdown Mode markdown.js redos | 6.9CNA v4.0 | 0.5% | 2025-06-22 | |
| CVE-2025-6492 | MarkText index.js getRecommendTitleFromMarkdownString redos | 6.9CNA v4.0 | 0.5% | 2025-06-22 | |
| CVE-2025-6490 | sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow | 4.8CNA v4.0 | 0.2% | 2025-06-22 | |
| CVE-2025-6489 | itsourcecode Agri-Trading Online Shopping System transactionsave.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6487 | TOTOLINK A3002R formRoute stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-06-22 | |
| CVE-2025-6486 | TOTOLINK A3002R formWlanMultipleAP stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-06-22 | |
| CVE-2025-6485 | TOTOLINK A3002R formWlSiteSurvey os command injection | 5.3CNA v4.0 | 9.1% | 2025-06-22 | |
| CVE-2025-6484 | code-projects Online Shopping Store action.php SQL injection | 7.2v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6483 | code-projects Simple Pizza Ordering System edituser.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6482 | code-projects Simple Pizza Ordering System edituser-exec.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6481 | code-projects Simple Pizza Ordering System update.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6480 | code-projects Simple Pizza Ordering System addcatexec.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6479 | code-projects Simple Pizza Ordering System salesreport.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6478 | CodeAstro Expense Management System cross-site request forgery | 5.3CNA v4.0 | 0.2% | 2025-06-22 | |
| CVE-2025-6477 | SourceCodester Student Result Management System System settings page system cross-site scripting | 4.8v3.1 | 0.3% | 2025-06-22 | |
| CVE-2025-6476 | SourceCodester Gym Management System cross-site request forgery | 5.3CNA v4.0 | 0.3% | 2025-06-22 | |
| CVE-2025-6475 | SourceCodester Student Result Management System manage_students module cross-site scripting | 4.8v3.1 | 0.3% | 2025-06-22 | |
| CVE-2025-6474 | code-projects Inventory Management System changeUsername.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6473 | code-projects School Fees Payment System fees.php cross-site scripting | 6.1v3.1 | 0.4% | 2025-06-22 | |
| CVE-2025-6472 | code-projects Online Bidding System showprod.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6471 | code-projects Online Bidding System administrator SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6470 | code-projects Online Bidding System bidlog.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6469 | code-projects Online Bidding System details.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6468 | code-projects Online Bidding System bidnow.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6467 | code-projects Online Bidding System login.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6466 | ageerle ruoyi-ai SseServiceImpl.java upload unrestricted upload | 9.8v3.1 | 0.4% | 2025-06-22 | Fix |
| CVE-2025-6458 | code-projects Online Hotel Reservation System execedituser.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6457 | code-projects Online Hotel Reservation System demo.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6456 | code-projects Online Hotel Reservation System order.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6455 | code-projects Online Hotel Reservation System messageexec.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6453 | diyhi bbs API ForumManageAction.java add path traversal | 4.3v3.1 | 0.4% | 2025-06-22 | |
| CVE-2025-6452 | CodeAstro Patient Record Management System Generate New Report page cross-site scripting | 4.8v3.1 | 0.4% | 2025-06-22 | |
| CVE-2025-6451 | code-projects Simple Online Hotel Reservation System delete_pending.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6450 | code-projects Simple Online Hotel Reservation System confirm_reserve.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6449 | code-projects Simple Online Hotel Reservation System checkout_query.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6448 | code-projects Simple Online Hotel Reservation System delete_room.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-6447 | code-projects Simple Online Hotel Reservation System index.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-22 | |
| CVE-2025-52919 | Yealink RPS improper certificate validation | 4.3CNA v3.1 | 0.2% | 2025-06-21 | Fix |
| CVE-2025-52918 | Yealink RPS incorrect authorization | 5.0CNA v3.1 | 0.3% | 2025-06-21 | Fix |
| CVE-2025-52917 | Yealink RPS resource exhaustion | 4.3CNA v3.1 | 0.3% | 2025-06-21 | Fix |
| CVE-2025-52916 | Yealink RPS missing brute-force protection | 2.2CNA v3.1 | 0.3% | 2025-06-21 | Fix |
| CVE-2025-52557 | Mail-0 Zero session hijacking via Email | 8.6CNA v4.0 | 0.4% | 2025-06-21 | |
| CVE-2025-52556 | rfc3161-client has insufficient verification for timestamp response signatures | 9.3CNA v4.0 | 0.2% | 2025-06-21 | Fix |
| CVE-2025-52552 | FastGPT LastRoute parameter on Login page vulnerable to open redirect and DOM-based XSS | 5.5CNA v4.0 | 0.3% | 2025-06-21 | Fix |
| CVE-2025-52488 | Dnn.Platform leaks NTLM hash via SMB Share Interaction with malicious user input | 8.6CNA v3.1 | 35.8% | 2025-06-21 | NucleiExploit codeFix |
| CVE-2025-52487 | Dnn.Platform possibly allows bypass of IP Filters | 8.8CNA v4.0 | 0.3% | 2025-06-21 | Fix |
| CVE-2025-52486 | Dnn.Platform Allows reflected cross-site scripting in some TokenReplace situations with SkinObjects | 6.1CNA v4.0 | 0.2% | 2025-06-21 | Fix |
| CVE-2025-52485 | Dnn.Platform allows stored cross-site scripting (XSS) in Activity Feed | 5.1CNA v4.0 | 0.2% | 2025-06-21 | Fix |
| CVE-2025-36016 | IBM Process Mining HTTP open redirect | 6.8CNA v3.1 | 0.2% | 2025-06-21 | Fix |
| CVE-2025-6446 | code-projects Client Details System index.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6422 | Campcodes Online Recruitment Management System About Content page ajax.php unrestricted upload | 8.8v3.1 | 0.4% | 2025-06-21 | |
| CVE-2025-6421 | code-projects Simple Online Hotel Reservation System add_account.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6420 | code-projects Simple Online Hotel Reservation System add_room.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6419 | code-projects Simple Online Hotel Reservation System edit_room.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6418 | code-projects Simple Online Hotel Reservation System edit_query_account.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6417 | PHPGurukul Art Gallery Management System add-artist.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6416 | PHPGurukul Art Gallery Management System changeimage4.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6415 | PHPGurukul Art Gallery Management System changeimage3.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6414 | PHPGurukul Art Gallery Management System changeimage2.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6413 | PHPGurukul Art Gallery Management System changeimage1.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6412 | PHPGurukul Art Gallery Management System changeimage.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6411 | PHPGurukul Art Gallery Management System changepropic.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6410 | PHPGurukul Art Gallery Management System edit-art-medium-detail.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6409 | PHPGurukul Art Gallery Management System forgot-password.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6408 | Campcodes Online Hospital Management System search.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6407 | Campcodes Online Hospital Management System user-login.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6406 | Campcodes Online Hospital Management System forgot-password.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6405 | Campcodes Online Teacher Record Management System edit-teacher-detail.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6404 | Campcodes Online Teacher Record Management System search.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6403 | code-projects School Fees Payment System student.php SQL injection | 9.8v3.1 | 2.0% | 2025-06-21 | Nuclei |
| CVE-2025-6402 | TOTOLINK X15 HTTP POST request formIpv6Setup buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-06-21 | |
| CVE-2025-6401 | TOTOLINK N300RH HTTP POST message formFilter denial of service | 5.1CNA v4.0 | 0.5% | 2025-06-21 | |
| CVE-2025-6400 | TOTOLINK N300RH HTTP POST message formPortFw buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-06-21 | |
| CVE-2025-6399 | TOTOLINK X15 HTTP POST request formIPv6Addr buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-06-21 | |
| CVE-2025-6394 | code-projects Simple Online Hotel Reservation System add_reserve.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-21 | |
| CVE-2025-6393 | TOTOLINK A702R/A3002R/A3002RU/EX1200T HTTP POST request formIPv6Addr buffer overflow | 7.5v3.1 | 1.0% | 2025-06-21 | |
| CVE-2025-6375 | poco MultipartReader.cpp MultipartInputStream null pointer dereference | 5.5v3.1 | 0.3% | 2025-06-21 | Fix |
| CVE-2025-6374 | D-Link DIR-619L formSetACLFilter stack-based overflow | 8.7CNA v4.0 | 1.2% | 2025-06-21 | |
| CVE-2025-6373 | D-Link DIR-619L formWlSiteSurvey formSetWizard1 stack-based overflow | 8.7CNA v4.0 | 0.9% | 2025-06-21 | |
| CVE-2025-6218 | RARLAB WinRAR path traversal | 7.8CNA v3.0 | 90.5% | 2025-06-21 | KEVEmerging ThreatsExploit codeKCVFix |
| CVE-2025-6217 | PEAK-System Driver PCANFD_ADD_FILTERS time-of-check time-of-use information disclosure | 2.5v3.1 | 0.1% | 2025-06-21 | |
| CVE-2025-6216 | Allegra calculateTokenExpDate Password Recovery authentication bypass | 9.8CNA v3.0 | 47.8% | 2025-06-21 | NucleiFix |
| CVE-2025-5820 | Sony XAV-AX8500 Bluetooth ERTM Channel authentication bypass | 8.8v3.1 | 0.3% | 2025-06-21 | Fix |
| CVE-2025-5479 | Sony XAV-AX8500 Bluetooth AVCTP protocol heap-based buffer overflow remote code execution | 7.5CNA v3.0 | 0.4% | 2025-06-21 | Fix |
| CVE-2025-5478 | Sony XAV-AX8500 Bluetooth SDP protocol integer overflow remote code execution | 8.8CNA v3.0 | 0.4% | 2025-06-21 | Fix |
| CVE-2025-5477 | Sony XAV-AX8500 Bluetooth L2CAP protocol heap-based buffer overflow remote code execution | 7.5v3.1 | 0.3% | 2025-06-21 | Fix |
| CVE-2025-5476 | Sony XAV-AX8500 Bluetooth improper isolation authentication bypass | 8.8v3.1 | 0.3% | 2025-06-21 | Fix |
| CVE-2025-5475 | Sony XAV-AX8500 Bluetooth Packet Handling integer overflow remote code execution | 7.5v3.1 | 0.3% | 2025-06-21 | Fix |
| CVE-2025-5289 | 3D FlipBook - Lite Edition WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-21 | Fix |
| CVE-2025-5143 | TableOn WordPress Posts Table Filterable plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-06-21 | Fix |
| CVE-2025-5034 | WP File Download WordPress plugin reflected XSS | 7.1CISA ADP v3.1 | 0.3% | 2025-06-21 | Fix |
| CVE-2025-3629 | IBM InfoSphere Information Server file manipulation | 4.3CNA v3.1 | 0.2% | 2025-06-21 | Fix |
| CVE-2025-3221 | IBM InfoSphere Information Server denial of service | 7.5CNA v3.1 | 0.4% | 2025-06-21 | Fix |
| CVE-2025-1987 | Stored XSS in Psono-client via Malicious Vault Entry URLs | 6.1NVD v3.1 | 0.6% | 2025-06-21 | Fix |
| CVE-2025-52825 | Real Estate Manager WordPress plugin cross-site request forgery (CSRF) | 8.8CNA v3.1 | 0.2% | 2025-06-20 | |
| CVE-2025-52822 | WP Roadmap WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-52821 | Video List Manager WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-52802 | Import YouTube videos as WP Posts WordPress plugin broken access control | 7.5CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-52795 | WP Front User Submit / Front Editor WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.2% | 2025-06-20 | |
| CVE-2025-52794 | Creative Contact Form WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-52793 | Esselink.nu Settings WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-20 | Fix |
| CVE-2025-52792 | WP User Stylesheet Switcher WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-52791 | Knowledge Base Knowledge Base Maker WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-52790 | WP-DownloadCounter WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-52789 | Lewe ChordPress WordPress plugin cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-52784 | Bluff Post WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-52783 | Change Cart button Colors WooCommerce WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-52782 | Scroll UP WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-06-20 | |
| CVE-2025-52781 | TinyNav WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-52780 | Logo Manager For Samandehi WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-52772 | Virtual Moderator WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-52733 | ANON::form embedded secure form WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-52719 | ProfileGrid WordPress plugin full path disclosure (FPD) | 4.3CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-52715 | Classified Listing WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.6% | 2025-06-20 | Fix |
| CVE-2025-52713 | Post and Page Builder by BoldGrid WordPress plugin server-side request forgery | 6.4CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-52711 | Post and Page Builder by BoldGrid WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.1% | 2025-06-20 | Fix |
| CVE-2025-52710 | File Manager Pro WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-52708 | HUSKY WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-06-20 | Fix |
| CVE-2025-52707 | Firelight Lightbox WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-52484 | risc0 RISC Zero zkVM Underconstrained vulnerability | 2.7CNA v4.0 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-50054 | OpenVPN ovpn-dco-win buffer overflow | 5.5CISA ADP v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-50051 | WP-Members WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-50050 | Jobs for WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-50049 | Modern Footnotes WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-50048 | Automatically Hierarchic Categories in Menu WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-50047 | Sitekit WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-50046 | WPComplete WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-50045 | Related Products Manager for WooCommerce WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-50044 | Real Estate Manager WordPress plugin cross-site request forgery (CSRF) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | |
| CVE-2025-50043 | Code Engine WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-50042 | WP Register Profile With Shortcode WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | |
| CVE-2025-50041 | Gutenberg Blocks ACF Blocks Suite WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | |
| CVE-2025-50038 | Anant Addons for Elementor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | |
| CVE-2025-50037 | Buying Buddy IDX CRM WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-50036 | Mailing Group Listserv WordPress plugin cross-site request forgery (CSRF) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | |
| CVE-2025-50035 | Fyrebox Quizzes WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | |
| CVE-2025-50034 | Enhanced Blocks Page Builder Blocks for Gutenberg WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-50033 | Fitness Park WordPress theme cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | |
| CVE-2025-50030 | Spark Multipurpose WordPress theme cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-06-20 | |
| CVE-2025-50027 | Login/Signup Popup WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-50026 | Spoki WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-50025 | CP Polls WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-50024 | ATP Call Now WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-50023 | CodePen Embed Block WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-50022 | WP-FB-AutoConnect WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-50021 | Better Random Redirect WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-50020 | RDFa Breadcrumb WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-50019 | Simple Sticky Footer WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-50018 | Tealium WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-50017 | WP Voting Contest WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-50016 | IP Based Login WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-50015 | Hand Talk WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-50014 | PDPA Consent for Thailand WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-50013 | CSV Importer Improved WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-50012 | Inventory Presser WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-50011 | WordPress plugin Recipes manager - WPH cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-50010 | Zapier for WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-50009 | Kata Plus WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-50008 | WooCommerce Manager WordPress plugin cscode missing authorization | 5.4CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-49998 | WooCommerce Fortnox Integration WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-49997 | Giveaways and Contests by RafflePress WordPress plugin broken access control + CSRF | 5.3CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-49996 | WP Visitor Statistics (Real Time Traffic) WordPress plugin broken access control | 5.3CNA v3.1 | 0.4% | 2025-06-20 | Fix |
| CVE-2025-49995 | Download Attachments WordPress plugin insecure direct object references (IDOR) | 5.3CNA v3.1 | 0.4% | 2025-06-20 | Fix |
| CVE-2025-49993 | Cookie-Script.com WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-49991 | WP-Recall WordPress plugin broken access control | 5.3CNA v3.1 | 0.4% | 2025-06-20 | |
| CVE-2025-49990 | ContentStudio WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-49989 | App Builder WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-49988 | Contact Form 7 AWeber Extension WordPress plugin broken access control | 5.3CNA v3.1 | 0.4% | 2025-06-20 | Fix |
| CVE-2025-49987 | CRM ERP Business Solution WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-49986 | Video List Manager WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-49985 | Auto Upload Images WordPress plugin server side request forgery (SSRF) | 4.9CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-49984 | PowerPress Podcasting WordPress plugin server side request forgery (SSRF) | 4.9CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-49983 | WPThumb WordPress plugin server side request forgery (SSRF) | 4.9CNA v3.1 | 0.2% | 2025-06-20 | |
| CVE-2025-49982 | WP Customer Area WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-49981 | User Roles and Capabilities WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-49980 | WP User Profile Avatar WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-49979 | Media Hygiene WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-49978 | JobSearch WordPress plugin insecure direct object references (IDOR) | 4.3CNA v3.1 | 0.4% | 2025-06-20 | Fix |
| CVE-2025-49977 | WP Inventory Manager WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-20 | Fix |
| CVE-2025-49976 | WANotifier WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-49975 | JobWP WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-20 | Fix |
| CVE-2025-49974 | UpStream: a Project Management Plugin for WordPress broken access control | 4.3CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-49973 | Image Sizes Controller WordPress plugin GrandPlugins missing authorization | 4.3CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-49972 | TM Replace Howdy WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-49971 | eDS Responsive Menu WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-49970 | Hello FSE Blog WordPress theme broken access control | 4.3CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-49969 | Zara 4 Image Compression WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-06-20 | |
| CVE-2025-49968 | XML Travel Portal Widget WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-49967 | Live Sports Streamthunder WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-49966 | Oganro Travel Portal Search Widget for HotelBeds APITUDE API cross-site request forgery | 4.3CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-49965 | PixelBeds Channel Manager and Hotel Booking Engine WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-49964 | ClipLink WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-20 | |
| CVE-2025-49873 | Elessi WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-06-20 | Fix |
| CVE-2025-49715 | Microsoft Dynamics 365 FastTrack Implementation Assets information disclosure | 7.5CNA v3.1 | 0.8% | 2025-06-20 | Fix |
| CVE-2025-49132 | Pterodactyl Panel allows Unauthenticated arbitrary remote code execution | 10.0CNA v3.1 | 54.5% | 2025-06-20 | NucleiMetasploitExploit codeFix |
| CVE-2025-48945 | aio-libs aiodns pycares has a use-after-free | 8.2CNA v4.0 | 0.5% | 2025-06-20 | Fix |
| CVE-2025-48706 | Yftech Coros Pace 3 out-of-bounds read | 9.1CISA ADP v3.1 | 0.6% | 2025-06-20 | |
| CVE-2025-48705 | Yftech Coros Pace 3 null pointer dereference | 7.5CISA ADP v3.1 | 0.5% | 2025-06-20 | |
| CVE-2025-48059 | PowSyBl Core Contains a Polynomial ReDoS in RegexCriterion | 2.7CNA v4.0 | 0.6% | 2025-06-20 | Fix |
| CVE-2025-48058 | PowSyBl Core contains Polynomial REDoS’es | 6.3CNA v4.0 | 0.4% | 2025-06-20 | Fix |
| CVE-2025-47771 | PowSyBl Core allows deserialization of untrusted SparseMatrix data | 8.1CNA v4.0 | 0.5% | 2025-06-20 | Fix |
| CVE-2025-46179 | Vishalmathur CloudClassroom-PHP-Project SQL injection | 9.8CISA ADP v3.1 | 0.6% | 2025-06-20 | |
| CVE-2025-46158 | Redox-os Redox divide by zero | 6.2CISA ADP v3.1 | 0.2% | 2025-06-20 | |
| CVE-2025-45890 | xxyopen Novel-Plus path traversal | 9.8CISA ADP v3.1 | 1.6% | 2025-06-20 | |
| CVE-2025-45331 | Ricko Brplot null pointer dereference | 7.5CISA ADP v3.1 | 0.5% | 2025-06-20 | |
| CVE-2025-44635 | There are multiple unauthorized remote command execution vulnerabilities in the H3C ER2200G2, ERG2-450W, ERG2-1200W, ERG2-1350W, NR1200W series routers before ERG2AW-MNW100-R1117; H3C ER3100G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2, ER6300G2, ER8300G2, ER8300G2-X series routers before ERHMG2-MNW100 | 9.8CISA ADP v3.1 | 1.1% | 2025-06-20 | |
| CVE-2025-44203 | digitaldruid HotelDruid information disclosure through error messages | 7.5CISA ADP v3.1 | 0.6% | 2025-06-20 | Exploit codeFix |
| CVE-2025-38083 | Linux kernel prio race condition | 7.8CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-34030 | sar2html OS command injection | 10.0CNA v4.0 | 52.5% | 2025-06-20 | NucleiExploit code |
| CVE-2025-34029 | Edimax EW-7438RPn Mini OS command injection via syscmd.asp | 8.8NVD v3.1 | 3.4% | 2025-06-20 | Exploit code |
| CVE-2025-34024 | Edimax EW-7438RPn Mini OS command injection via mp.asp | 8.8NVD v3.1 | 3.8% | 2025-06-20 | Exploit code |
| CVE-2025-34023 | Karel IP Phone IP1211 path traversal | 8.5CNA v4.0 | 1.6% | 2025-06-20 | NucleiExploit code |
| CVE-2025-34022 | Selea Targa IP OCR-ANPR Camera path traversal | 9.3CNA v4.0 | 0.8% | 2025-06-20 | Exploit code |
| CVE-2025-34021 | Selea Targa IP OCR-ANPR Camera server-side request forgery | 7.8CNA v4.0 | 0.6% | 2025-06-20 | Exploit code |
| CVE-2025-32880 | Yftech Coros Pace 3 cleartext transmission of sensitive information | 9.8CISA ADP v3.1 | 0.5% | 2025-06-20 | Fix |
| CVE-2025-32879 | Yftech Coros Pace 3 improper authentication | 8.8CISA ADP v3.1 | 0.5% | 2025-06-20 | Fix |
| CVE-2025-32878 | Yftech Coros Pace 3 improper certificate validation | 9.8CISA ADP v3.1 | 0.4% | 2025-06-20 | Fix |
| CVE-2025-32877 | Yftech Coros Pace 3 improper authentication | 9.8CISA ADP v3.1 | 0.7% | 2025-06-20 | Fix |
| CVE-2025-32876 | Yftech Coros Pace 3 missing authentication | 6.8CISA ADP v3.1 | 0.4% | 2025-06-20 | Fix |
| CVE-2025-32875 | COROS application Bluetooth pairing missing encryption | 5.7CISA ADP v3.1 | 0.2% | 2025-06-20 | |
| CVE-2025-32753 | Dell PowerScale OneFS SQL injection | 5.3CNA v3.1 | 0.2% | 2025-06-20 | Fix |
| CVE-2025-25038 | MiniDVBLinux Root command injection | 9.8v3.1 | 5.6% | 2025-06-20 | Exploit code |
| CVE-2025-25037 | Aquatronica Controller System Complete information disclosure | 9.3CNA v4.0 | 1.6% | 2025-06-20 | NucleiExploit code |
| CVE-2025-25034 | SugarCRM PHP deserialization RCE | 9.3CNA v4.0 | 5.0% | 2025-06-20 | NucleiExploit codeFix |
| CVE-2025-6372 | D-Link DIR-619L formSetWizard1 stack-based overflow | 8.7CNA v4.0 | 1.2% | 2025-06-20 | |
| CVE-2025-6371 | D-Link DIR-619L formSetEnableWizard stack-based overflow | 8.7CNA v4.0 | 1.2% | 2025-06-20 | |
| CVE-2025-6370 | D-Link DIR-619L formWlanGuestSetup stack-based overflow | 8.7CNA v4.0 | 1.2% | 2025-06-20 | |
| CVE-2025-6369 | D-Link DIR-619L formdumpeasysetup stack-based overflow | 8.7CNA v4.0 | 1.2% | 2025-06-20 | |
| CVE-2025-6368 | D-Link DIR-619L formSetEmail stack-based overflow | 8.7CNA v4.0 | 1.2% | 2025-06-20 | |
| CVE-2025-6367 | D-Link DIR-619L formSetDomainFilter stack-based overflow | 8.7CNA v4.0 | 1.2% | 2025-06-20 | |
| CVE-2025-6365 | HobbesOSR Kitten pgtable.h set_pte_at resource consumption | 7.5v3.1 | 0.8% | 2025-06-20 | |
| CVE-2025-6364 | code-projects Simple Pizza Ordering System adduser-exec.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-20 | |
| CVE-2025-6363 | code-projects Simple Pizza Ordering System adding-exec.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-20 | |
| CVE-2025-6362 | code-projects Simple Pizza Ordering System editpro.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-20 | |
| CVE-2025-6361 | code-projects Simple Pizza Ordering System adds.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-20 |