CVE-2025 records published in June 2025
Page four of four: records 3,001 to 3,210 of the 3,210 published in June 2025, newest first. The first page carries the figures for June 2025.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-46355 | Keiyo System PC Time Tracer incorrect default permissions | 7.0CNA v4.0 | 0.2% | 2025-06-03 | |
| CVE-2025-46154 | FoxCMS SQL injection | 8.4CISA ADP v3.1 | 0.2% | 2025-06-03 | |
| CVE-2025-45855 | Erupt unrestricted upload of file with dangerous type | 5.4CISA ADP v3.1 | 0.3% | 2025-06-03 | |
| CVE-2025-45854 | JEHC-BPM missing authorization | 10.0CNA v3.1 | 3.2% | 2025-06-03 | Nuclei |
| CVE-2025-44148 | MailEnable cross-site scripting | 9.8CISA ADP v3.1 | 54.7% | 2025-06-03 | NucleiExploit codeFix |
| CVE-2025-43925 | Unicomsi Focal Point inadequate encryption strength | 4.6CISA ADP v3.1 | 0.1% | 2025-06-03 | Fix |
| CVE-2025-43924 | Unicomsi Focal Point cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-06-03 | Fix |
| CVE-2025-43923 | Unicomsi Focal Point SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-06-03 | Fix |
| CVE-2025-41428 | Keiyo System TimeWorks path traversal | 6.9CNA v4.0 | 0.7% | 2025-06-03 | |
| CVE-2025-36564 | Dell Encryption Admin Utilities symlink following | 7.8CNA v3.1 | 0.1% | 2025-06-03 | Fix |
| CVE-2025-35036 | hibernate-validator insecure default Expression Language interpolation | 6.9CNA v4.0 | 0.7% | 2025-06-03 | Fix |
| CVE-2025-32106 | AudioCodes Mp-112 code injection | 9.8CISA ADP v3.1 | 1.0% | 2025-06-03 | |
| CVE-2025-32105 | Sangoma IMG2020 the Sangoma buffer overflow | 9.8CISA ADP v3.1 | 1.2% | 2025-06-03 | |
| CVE-2025-31712 | UNISOC chipsets cplog service out-of-bounds write | 5.1CNA v3.1 | 0.1% | 2025-06-03 | Fix |
| CVE-2025-31711 | UNISOC chipsets cplog service crash | 5.1CNA v3.1 | 0.1% | 2025-06-03 | Fix |
| CVE-2025-31710 | UNISOC chipsets engineermode service command injection | 5.9CNA v3.1 | 0.4% | 2025-06-03 | Exploit codeKCVFix |
| CVE-2025-31359 | Parallels Desktop PVMP package unpacking functionality path traversal | 8.8CNA v3.1 | 1.1% | 2025-06-03 | |
| CVE-2025-30360 | webpack-dev-server WebSocket origin validation vulnerability | 6.5CNA v3.1 | 0.3% | 2025-06-03 | Fix |
| CVE-2025-30359 | webpack-dev-server users' source code may be stolen when they access a malicious web site | 5.3CNA v3.1 | 0.6% | 2025-06-03 | Fix |
| CVE-2025-30167 | Jupyter Core on Windows has uncontrolled search path element local privilege escalation | 7.3CNA v3.1 | 0.2% | 2025-06-03 | Fix |
| CVE-2025-27038 | Qualcomm Multiple Chipsets use-after-free | 7.5CNA v3.1 | 1.0% | 2025-06-03 | KEVFix |
| CVE-2025-27031 | Qualcomm Snapdragon use-after-free in Bluetooth host | 7.8CNA v3.1 | 0.1% | 2025-06-03 | Fix |
| CVE-2025-27029 | Qualcomm Snapdragon buffer over-read in WLAN HAL | 7.5CNA v3.1 | 0.2% | 2025-06-03 | Fix |
| CVE-2025-25022 | IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure | 9.6CNA v3.1 | 0.3% | 2025-06-03 | Fix |
| CVE-2025-25021 | IBM QRadar Suite Software and IBM Cloud Pak for Security code injection | 7.2CNA v3.1 | 0.6% | 2025-06-03 | Fix |
| CVE-2025-25020 | IBM QRadar Suite Software and IBM Cloud Pak for Security improper input validation | 6.5CNA v3.1 | 0.4% | 2025-06-03 | Fix |
| CVE-2025-25019 | IBM QRadar Suite Software and IBM Cloud Pak for Security session fixation | 4.8CNA v3.1 | 0.3% | 2025-06-03 | Fix |
| CVE-2025-24015 | Deno's AES GCM authentication tags are not verified | 7.7CNA v4.0 | 0.3% | 2025-06-03 | Fix |
| CVE-2025-23107 | Samsung Exynos 1480 out-of-bounds write | 8.6CISA ADP v3.1 | 0.3% | 2025-06-03 | Fix |
| CVE-2025-23103 | Samsung Exynos 1480 out-of-bounds write | 8.6CISA ADP v3.1 | 0.3% | 2025-06-03 | Fix |
| CVE-2025-23102 | Samsung Exynos 980 double free | 8.8CISA ADP v3.1 | 0.4% | 2025-06-03 | Fix |
| CVE-2025-23100 | Samsung Exynos 1280 null pointer dereference | 7.5CISA ADP v3.1 | 0.4% | 2025-06-03 | Fix |
| CVE-2025-23098 | Samsung Exynos 980 use-after-free | 7.8CISA ADP v3.1 | 0.2% | 2025-06-03 | Fix |
| CVE-2025-23097 | Samsung Exynos 1380 out-of-bounds write | 9.1CISA ADP v3.1 | 0.4% | 2025-06-03 | Fix |
| CVE-2025-21486 | Qualcomm Snapdragon untrusted pointer dereference in DSP service | 7.8CNA v3.1 | 0.1% | 2025-06-03 | Fix |
| CVE-2025-21485 | Qualcomm Snapdragon time-of-check time-of-use (TOCTOU) race condition in DSP service | 7.8CNA v3.1 | 0.1% | 2025-06-03 | Fix |
| CVE-2025-21480 | Qualcomm Multiple Chipsets incorrect authorization | 8.6CNA v3.1 | 0.5% | 2025-06-03 | KEVFix |
| CVE-2025-21479 | Qualcomm Multiple Chipsets incorrect authorization | 8.6CNA v3.1 | 0.8% | 2025-06-03 | KEVExploit codeFix |
| CVE-2025-21463 | Qualcomm Snapdragon buffer over-read in WLAN Host Communication | 7.5CNA v3.1 | 0.2% | 2025-06-03 | Fix |
| CVE-2025-5544 | aaluoxiang oa_system UserpanelController.java image path traversal | 7.5v3.1 | 0.7% | 2025-06-03 | |
| CVE-2025-5543 | TOTOLINK X2000R Parent Controls page cross-site scripting | 4.8v3.1 | 0.3% | 2025-06-03 | |
| CVE-2025-5542 | TOTOLINK X2000R Virtual Server page formPortFw cross-site scripting | 4.8v3.1 | 0.3% | 2025-06-03 | |
| CVE-2025-5527 | Tenda RX3 SetStaticRouteCfg save_staticroute_data stack-based overflow | 8.7CNA v4.0 | 11.9% | 2025-06-03 | Emerging Threats |
| CVE-2025-5525 | Jrohy trojan linux.go LogChan os command injection | 8.1v3.1 | 2.8% | 2025-06-03 | |
| CVE-2025-5523 | enilu web-flash file upload upload fileService.upload cross-site scripting | 6.1v3.1 | 0.3% | 2025-06-03 | |
| CVE-2025-5522 | jack0240 魏 bskms 蓝天幼儿园管理系统 User Creation addUser improper authorization | 6.9CNA v4.0 | 0.4% | 2025-06-03 | |
| CVE-2025-5521 | WuKongOpenSource WukongCRM updataPassword cross-site request forgery | 8.8v3.1 | 0.3% | 2025-06-03 | |
| CVE-2025-5520 | Open5GS AMF/MME emm_state_authentication assertion | 6.9CNA v4.0 | 0.9% | 2025-06-03 | |
| CVE-2025-5516 | TOTOLINK X2000R URL Filtering page formFilter cross-site scripting | 4.8v3.1 | 0.4% | 2025-06-03 | |
| CVE-2025-5515 | TOTOLINK X2000R formMapDel command injection | 5.3CNA v4.0 | 3.2% | 2025-06-03 | |
| CVE-2025-5513 | quequnlong shiyi-blog add cross-site scripting | 5.4v3.1 | 0.3% | 2025-06-03 | |
| CVE-2025-5512 | quequnlong shiyi-blog Administrator Backend verifyPassword improper authentication | 9.8v3.1 | 0.8% | 2025-06-03 | |
| CVE-2025-5511 | quequnlong shiyi-blog photos improper authorization | 7.5v3.1 | 0.7% | 2025-06-03 | |
| CVE-2025-5510 | quequnlong shiyi-blog optimize server-side request forgery | 9.8v3.1 | 0.5% | 2025-06-03 | |
| CVE-2025-5509 | quequnlong shiyi-blog upload path traversal | 9.8v3.1 | 0.7% | 2025-06-03 | |
| CVE-2025-5508 | TOTOLINK A3002RU IP Port Filtering page cross-site scripting | 3.4NVD v3.1 | 0.4% | 2025-06-03 | |
| CVE-2025-5507 | TOTOLINK A3002RU MAC Filtering page cross-site scripting | 5.4v3.1 | 0.4% | 2025-06-03 | |
| CVE-2025-5506 | TOTOLINK A3002RU NAT Mapping page cross-site scripting | 5.4v3.1 | 0.4% | 2025-06-03 | |
| CVE-2025-5505 | TOTOLINK A3002RU Virtual Server page formPortFw cross-site scripting | 4.8CNA v4.0 | 0.4% | 2025-06-03 | |
| CVE-2025-5504 | TOTOLINK X2000R formWsc command injection | 5.3CNA v4.0 | 12.9% | 2025-06-03 | |
| CVE-2025-5503 | TOTOLINK X15 formMapReboot stack-based overflow | 8.7CNA v4.0 | 5.8% | 2025-06-03 | |
| CVE-2025-5502 | TOTOLINK X15 formMapReboot command injection | 9.8v3.1 | 8.7% | 2025-06-03 | |
| CVE-2025-5501 | Open5GS NGAP PathSwitchRequest handler reachable assertion | 6.9CNA v4.0 | 0.8% | 2025-06-03 | |
| CVE-2025-5499 | slackero Phpwcms image_resized.php getimagesize deserialization | 9.8v3.1 | 0.8% | 2025-06-03 | Fix |
| CVE-2025-5498 | slackero Phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization | 7.2v3.1 | 0.5% | 2025-06-03 | Fix |
| CVE-2025-5497 | slackero Phpwcms Feedimport processing.inc.php deserialization | 9.8v3.1 | 0.6% | 2025-06-03 | Fix |
| CVE-2025-5495 | Netgear WNR614 URL improper authentication | 9.8v3.1 | 0.9% | 2025-06-03 | |
| CVE-2025-5493 | Baison Channel Middleware Product ToJsonByControlName SQL injection | 9.8v3.1 | 0.5% | 2025-06-03 | |
| CVE-2025-5492 | D-Link DI-500WF-WT /usr/sbin/jhttpd msp_info.htm sub_456DE8 command injection | 8.8v3.1 | 2.5% | 2025-06-03 | |
| CVE-2025-5419 | Google Chromium V8 out-of-bounds read and Write | 8.8CISA ADP v3.1 | 7.8% | 2025-06-03 | KEVExploit codeFix |
| CVE-2025-5340 | Music Player for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-06-03 | Fix |
| CVE-2025-5116 | WP Plugin Info Card WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-06-03 | Fix |
| CVE-2025-5103 | Ultimate Gift Cards for WooCommerce WordPress plugin SQL injection | 4.9CNA v3.1 | 0.4% | 2025-06-03 | Fix |
| CVE-2025-5068 | Google Chrome Blink use-after-free | 8.8CISA ADP v3.1 | 3.5% | 2025-06-03 | Fix |
| CVE-2025-4797 | Golo WordPress theme authentication bypass to account takeover | 9.8CNA v3.1 | 0.5% | 2025-06-03 | Fix |
| CVE-2025-4671 | Profile Builder WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-06-03 | Fix |
| CVE-2025-4567 | Post Slider and Carousel with Widget WordPress plugin Admin+ stored XSS | 4.8CISA ADP v3.1 | 0.2% | 2025-06-03 | Fix |
| CVE-2025-4517 | Python CPython arbitrary writes via tarfile realpath overflow | 9.4CNA v3.1 | 1.4% | 2025-06-03 | Exploit codeFix |
| CVE-2025-4435 | Python CPython tarfile extracts filtered members when errorlevel=0 | 7.5CNA v3.1 | 0.6% | 2025-06-03 | Fix |
| CVE-2025-4420 | Vayu Blocks WordPress plugin missing authorization authenticated stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-06-03 | Fix |
| CVE-2025-4392 | Shared Files WordPress plugin unauthenticated stored cross-site scripting via sanitize_file function | 7.2CNA v3.1 | 0.4% | 2025-06-03 | Fix |
| CVE-2025-4330 | Python CPython extraction filter bypass for linking outside extraction directory | 7.5CNA v3.1 | 0.9% | 2025-06-03 | Fix |
| CVE-2025-4224 | wpForo + wpForo Advanced Attachments WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.2% | 2025-06-03 | Fix |
| CVE-2025-4205 | Popup Maker WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-06-03 | Fix |
| CVE-2025-4138 | Python CPython tarfile module path traversal | 7.5CNA v3.1 | 1.4% | 2025-06-03 | Exploit codeFix |
| CVE-2025-4047 | Broken Link Checker WordPress plugin unauthorized data access | 4.3CNA v3.1 | 0.3% | 2025-06-03 | Fix |
| CVE-2025-3662 | FancyBox for WordPress plugin unauthenticated stored XSS | 6.1CISA ADP v3.1 | 0.2% | 2025-06-03 | Fix |
| CVE-2025-3584 | Newsletter WordPress plugin Admin+ stored XSS via Subscription | 4.8CISA ADP v3.1 | 0.2% | 2025-06-03 | Fix |
| CVE-2025-2939 | Ninja Tables WordPress plugin PHP object injection | 5.6CNA v3.1 | 0.5% | 2025-06-03 | Fix |
| CVE-2025-1725 | Bit File Manager WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-06-03 | Fix |
| CVE-2025-1334 | IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure | 4.0CNA v3.1 | 0.2% | 2025-06-03 | Fix |
| CVE-2025-49113 | RoundCube Webmail deserialization of untrusted data | 8.8NVD v3.1 | 99.0% | 2025-06-02 | KEVNucleiMetasploitEmerging ThreatsExploit codeKCVFix |
| CVE-2025-49112 | Valkey integer underflow | 3.1CNA v3.1 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-49069 | Contact Forms by Cimatti WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-06-02 | Fix |
| CVE-2025-48996 | haxtheweb issues information disclosure | 5.3CNA v3.1 | 0.4% | 2025-06-02 | |
| CVE-2025-48995 | SignXML's signature verification with HMAC is vulnerable to a timing attack | 6.9CNA v4.0 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-48994 | SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack | 6.9CNA v4.0 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-48990 | NeKernel has heap overflow in `rt_copy_memory` | 8.6CNA v4.0 | 0.2% | 2025-06-02 | |
| CVE-2025-48958 | Froxlor has an HTML injection | 5.5CNA v3.1 | 0.3% | 2025-06-02 | Fix |
| CVE-2025-48957 | AstrBot has path traversal vulnerability in /API/chat/get_file | 7.5CNA v3.1 | 0.7% | 2025-06-02 | Fix |
| CVE-2025-48955 | Para Server logs sensitive information | 6.2CNA v3.1 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-48941 | MyBB may disclosure unviewable threads' titles in searches | 5.3CNA v3.1 | 0.3% | 2025-06-02 | Fix |
| CVE-2025-48940 | MyBB's upgrade component vulnerable to local file inclusion | 7.2CNA v3.1 | 0.5% | 2025-06-02 | Fix |
| CVE-2025-48866 | ModSecurity has possible DoS vulnerability in sanitiseArg action | 7.5CNA v3.1 | 0.8% | 2025-06-02 | Fix |
| CVE-2025-48495 | Gokapi has stored XSS vulnerability in friendly name for API keys | 4.8CNA v4.0 | 0.1% | 2025-06-02 | Fix |
| CVE-2025-48494 | Gokapi vulnerable to stored XSS via uploading file with malicious file name | 4.8CNA v4.0 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-48387 | tar-fs has issue where extract can write outside the specified dir with a specific tarball | 8.7CNA v4.0 | 0.6% | 2025-06-02 | Fix |
| CVE-2025-47585 | Booking and Rental Manager WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-06-02 | Fix |
| CVE-2025-47289 | Stored XSS in CE Phoenix Cart Testimonials allows account takeover if Missing HttpOnly Flag | 6.3CNA v3.1 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-47272 | PhoenixCart vulnerable to Account Deletion without Password Confirmation | 5.5CNA v3.1 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-46807 | https://github.com/yrutschle/sslh/releases/tag/v2.2.4 sslh resource exhaustion | 8.7CNA v4.0 | 0.4% | 2025-06-02 | Fix |
| CVE-2025-46806 | https://github.com/yrutschle/sslh/releases/tag/v2.2.4 sslh out-of-range pointer offset | 6.9CNA v4.0 | 0.5% | 2025-06-02 | Fix |
| CVE-2025-45542 | Vishalmathur CloudClassroom-PHP-Project registrationform endpoint SQL injection | 7.3CISA ADP v3.1 | 1.1% | 2025-06-02 | Exploit code |
| CVE-2025-45387 | osTicket cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2025-06-02 | |
| CVE-2025-44172 | Tenda AC6 stack-based buffer overflow | 6.5CISA ADP v3.1 | 0.3% | 2025-06-02 | |
| CVE-2025-44115 | Cotonti Siena cross-site scripting | 5.4CISA ADP v3.1 | 0.3% | 2025-06-02 | |
| CVE-2025-37096 | HPE StoreOnce Software command injection | 7.5CNA v4.0 | 1.2% | 2025-06-02 | Fix |
| CVE-2025-37095 | HPE StoreOnce Software path traversal | 5.9CNA v4.0 | 1.2% | 2025-06-02 | Fix |
| CVE-2025-37094 | HPE StoreOnce Software path traversal | 5.5CNA v3.1 | 0.9% | 2025-06-02 | Fix |
| CVE-2025-37093 | HPE StoreOnce Software An authentication bypass | 9.8CNA v3.1 | 1.1% | 2025-06-02 | Fix |
| CVE-2025-37092 | HPE StoreOnce Software command injection | 7.5CNA v4.0 | 1.2% | 2025-06-02 | Fix |
| CVE-2025-37091 | HPE StoreOnce Software command injection | 7.2CNA v3.1 | 1.2% | 2025-06-02 | Fix |
| CVE-2025-37090 | HPE StoreOnce Software server-side request forgery | 6.9CNA v4.0 | 0.6% | 2025-06-02 | Fix |
| CVE-2025-37089 | HPE StoreOnce Software command injection | 7.5CNA v4.0 | 1.2% | 2025-06-02 | Fix |
| CVE-2025-29785 | quic-go has panic in Path Probe Loss Recovery Handling | 7.5CNA v3.1 | 0.5% | 2025-06-02 | Fix |
| CVE-2025-27956 | Pixeon Weblaudos path traversal | 7.5CISA ADP v3.1 | 1.1% | 2025-06-02 | |
| CVE-2025-27955 | Philips Clinical Collaboration Platform information disclosure | 6.5CISA ADP v3.1 | 0.3% | 2025-06-02 | |
| CVE-2025-27954 | Philips Clinical Collaboration Platform command injection | 6.5CISA ADP v3.1 | 0.4% | 2025-06-02 | |
| CVE-2025-27953 | Philips Clinical Collaboration Platform command injection | 6.5CISA ADP v3.1 | 0.4% | 2025-06-02 | |
| CVE-2025-26396 | SolarWinds Dameware Mini Remote Control Service incorrect permissions local privilege escalation | 7.8CNA v3.1 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-25179 | Imagination Technologies Graphics DDK GPU virtual address freelist vulnerability | 7.8CISA ADP v3.1 | 0.1% | 2025-06-02 | Fix |
| CVE-2025-23105 | Samsung Exynos 2200 incorrect default permissions | 7.8CISA ADP v3.1 | 0.1% | 2025-06-02 | Fix |
| CVE-2025-23104 | Samsung Exynos 2200 use-after-free | 6.5CISA ADP v3.1 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-23099 | Samsung Exynos 1480 out-of-bounds write | 9.1CISA ADP v3.1 | 0.4% | 2025-06-02 | Fix |
| CVE-2025-20678 | MediaTek chipsets uncontrolled recursion in ims service | 6.5CISA ADP v3.1 | 0.4% | 2025-06-02 | Fix |
| CVE-2025-20677 | MediaTek chipsets null pointer dereference in Bluetooth | 5.5CISA ADP v3.1 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-20676 | MediaTek chipsets null pointer dereference in wlan | 5.5CISA ADP v3.1 | 0.1% | 2025-06-02 | Fix |
| CVE-2025-20675 | MediaTek chipsets null pointer dereference in wlan | 5.5CISA ADP v3.1 | 0.1% | 2025-06-02 | Fix |
| CVE-2025-20674 | MediaTek chipsets incorrect authorization in wlan | 9.8CISA ADP v3.1 | 0.8% | 2025-06-02 | Fix |
| CVE-2025-20673 | MediaTek chipsets null pointer dereference in wlan | 5.5CISA ADP v3.1 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-20672 | MediaTek chipsets heap overflow in Bluetooth | 9.8CISA ADP v3.1 | 0.6% | 2025-06-02 | Fix |
| CVE-2025-20298 | Splunk Universal Forwarder Windows installation directory incorrect permission assignment | 8.0CNA v3.1 | 0.3% | 2025-06-02 | Fix |
| CVE-2025-20297 | Reflected cross-site scripting (XSS) on Splunk Enterprise through dashboard PDF generation component | 4.3CNA v3.1 | 28.7% | 2025-06-02 | Fix |
| CVE-2025-20001 | High-Logic FontCreator out-of-bounds read | 6.5CNA v3.1 | 0.5% | 2025-06-02 | |
| CVE-2025-5455 | Qt possible denial of service when passing malformed data in a URL to qDecodeDataUrl | 8.4CNA v4.0 | 0.4% | 2025-06-02 | Fix |
| CVE-2025-5447 | Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 ssid1MACFilter os command injection | 9.8v3.1 | 30.7% | 2025-06-02 | Emerging Threats |
| CVE-2025-5446 | Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_checkCredentialsByBBS os command injection | 9.8v3.1 | 13.8% | 2025-06-02 | |
| CVE-2025-5445 | Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_checkFWByBBS os command injection | 9.8v3.1 | 13.6% | 2025-06-02 | |
| CVE-2025-5444 | Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_UpgradeFWByBBS os command injection | 9.8v3.1 | 13.6% | 2025-06-02 | |
| CVE-2025-5443 | Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 wirelessAdvancedHidden os command injection | 9.8v3.1 | 13.6% | 2025-06-02 | |
| CVE-2025-5442 | Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_pingGatewayByBBS os command injection | 9.8v3.1 | 13.8% | 2025-06-02 | |
| CVE-2025-5441 | Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 setDeviceURL os command injection | 9.8v3.1 | 13.8% | 2025-06-02 | |
| CVE-2025-5440 | Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 NTP os command injection | 8.8v3.1 | 5.5% | 2025-06-02 | |
| CVE-2025-5439 | Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 verifyFacebookLike os command injection | 8.8v3.1 | 5.5% | 2025-06-02 | |
| CVE-2025-5438 | Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 WPS command injection | 8.8v3.1 | 25.7% | 2025-06-02 | Emerging Threats |
| CVE-2025-5437 | Multilaser Sirius RE016 Password Change cstecgi.cgi improper authentication | 6.9CNA v4.0 | 0.5% | 2025-06-02 | |
| CVE-2025-5436 | Multilaser Sirius RE016 cstecgi.cgi information disclosure | 6.9CNA v4.0 | 0.5% | 2025-06-02 | |
| CVE-2025-5435 | Marwal Infotech CMS page.php SQL injection | 6.9CNA v4.0 | 0.4% | 2025-06-02 | |
| CVE-2025-5434 | Aem Solutions CMS page.php SQL injection | 6.9CNA v4.0 | 0.4% | 2025-06-02 | |
| CVE-2025-5433 | Fengoffice Feng Office index.php SQL injection | 5.3CNA v4.0 | 0.3% | 2025-06-02 | |
| CVE-2025-5432 | AssamLook CMS view_tender.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-02 | |
| CVE-2025-5431 | AssamLook CMS department-profile.php SQL injection | 8.8v3.1 | 0.4% | 2025-06-02 | |
| CVE-2025-5430 | AssamLook CMS product.php SQL injection | 9.8v3.1 | 0.5% | 2025-06-02 | |
| CVE-2025-5429 | juzaweb CMS plugins page install access control | 5.3CNA v4.0 | 0.4% | 2025-06-02 | |
| CVE-2025-5428 | juzaweb CMS Error Logs page log-viewer access control | 6.3v3.1 | 0.4% | 2025-06-02 | |
| CVE-2025-5427 | juzaweb CMS Permalinks page permalinks access control | 5.3CNA v4.0 | 0.4% | 2025-06-02 | |
| CVE-2025-5426 | juzaweb CMS menu page menus access control | 5.3CNA v4.0 | 0.4% | 2025-06-02 | |
| CVE-2025-5425 | juzaweb CMS Theme Editor page default access control | 5.3CNA v4.0 | 0.4% | 2025-06-02 | |
| CVE-2025-5424 | juzaweb CMS Media page media access control | 5.3CNA v4.0 | 0.5% | 2025-06-02 | |
| CVE-2025-5423 | juzaweb CMS General setting page general access control | 5.3CNA v4.0 | 0.4% | 2025-06-02 | |
| CVE-2025-5422 | juzaweb CMS Email Logs page email access control | 5.3CNA v4.0 | 0.5% | 2025-06-02 | |
| CVE-2025-5421 | juzaweb CMS Plugin Editor page editor access control | 5.3CNA v4.0 | 0.4% | 2025-06-02 | |
| CVE-2025-5420 | juzaweb CMS Profile page upload cross-site scripting | 5.4v3.1 | 0.3% | 2025-06-02 | |
| CVE-2025-5412 | Mist Community Edition Authentication endpoint views.py login cross-site scripting | 5.4v3.1 | 0.4% | 2025-06-02 | Fix |
| CVE-2025-5113 | Authenticated remote command injection in Diviotec NBR IP Cameras | 8.6CNA v4.0 | 8.2% | 2025-06-02 | |
| CVE-2025-5086 | Dassault Systèmes DELMIA Apriso deserialization of untrusted data | 9.0CNA v3.1 | 96.9% | 2025-06-02 | KEVNuclei |
| CVE-2025-5036 | Autodesk Revit RFA File Parsing use-after-free | 7.8CNA v3.1 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-4010 | Arbitrary command injection in Netcom NTC-6200 and NWL-222 | 8.6CNA v4.0 | 0.5% | 2025-06-02 | Fix |
| CVE-2025-3951 | WP-Optimize WordPress plugin Admin+ SQLi | 4.1CISA ADP v3.1 | 0.3% | 2025-06-02 | Fix |
| CVE-2025-3919 | WordPress Comments Import and Export WordPress plugin unauthorized access | 6.4CNA v3.1 | 0.3% | 2025-06-02 | Fix |
| CVE-2025-3454 | Grafana's datasource proxy API allows authorization checks to be bypassed | 5.0CNA v3.1 | 0.5% | 2025-06-02 | Fix |
| CVE-2025-3260 | Grafana vulnerable to authenticated users bypassing dashboard, folder permissions | 8.3CNA v3.1 | 0.6% | 2025-06-02 | Fix |
| CVE-2025-1750 | SQL injection in run-llama/llama_index | 9.8CNA v3.0 | 0.8% | 2025-06-02 | Fix |
| CVE-2025-1485 | Real Cookie Banner WordPress plugin Admin+ stored XSS | 4.8CISA ADP v3.1 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-1246 | Mali GPU Userspace Driver allows an out-of-bounds access | 7.8CISA ADP v3.1 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-1235 | WAGO: Switches affected by year 2k38 problem | 4.3CNA v3.1 | 0.3% | 2025-06-02 | |
| CVE-2025-1051 | Sonos Era 300 heap-based buffer overflow remote code execution | 8.8CNA v3.0 | 0.4% | 2025-06-02 | |
| CVE-2025-0819 | Mali GPU Kernel Driver allows access to already freed memory | 7.8CISA ADP v3.1 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-0358 | Axis Communications AXIS OS improper privilege management | 8.8CNA v3.1 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-0325 | Axis Communications AXIS OS improper type validation | 4.3CNA v3.1 | 0.4% | 2025-06-02 | Fix |
| CVE-2025-0324 | Axis Communications AXIS OS incomplete filtering | 9.4CNA v3.1 | 0.4% | 2025-06-02 | Fix |
| CVE-2025-0073 | Mali GPU Kernel Driver allows improper GPU memory processing operations | 7.8CISA ADP v3.1 | 0.2% | 2025-06-02 | Fix |
| CVE-2025-40908 | TINITA YAML::LibYAML YAML-LibYAML for Perl uses 2-args open, allowing existing files to be modified | 9.1CISA ADP v3.1 | 0.5% | 2025-06-01 | Fix |
| CVE-2025-33005 | IBM Planning Analytics Local session fixation | 6.3CNA v3.1 | 0.2% | 2025-06-01 | Fix |
| CVE-2025-33004 | IBM Planning Analytics Local path traversal | 6.5CNA v3.1 | 0.5% | 2025-06-01 | Fix |
| CVE-2025-25044 | IBM Planning Analytics Local cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-06-01 | Fix |
| CVE-2025-5411 | Mist Community Edition views.py tag_resources cross-site scripting | 5.4v3.1 | 0.3% | 2025-06-01 | Fix |
| CVE-2025-5410 | Mist Community Edition middleware.py session_start_response cross-site request forgery | 4.3v3.1 | 0.3% | 2025-06-01 | Fix |
| CVE-2025-5409 | Mist Community Edition API Token views.py create_token access control | 9.8v3.1 | 0.6% | 2025-06-01 | Fix |
| CVE-2025-5408 | WAVLINK WL-WN576K1 HTTP POST request login.cgi sys_login buffer overflow | 9.3CNA v4.0 | 0.8% | 2025-06-01 | |
| CVE-2025-5407 | chaitak-gorai Blogbook register_script.php cross-site scripting | 5.4v3.1 | 0.3% | 2025-06-01 | |
| CVE-2025-5406 | chaitak-gorai Blogbook posts.php unrestricted upload | 8.8v3.1 | 0.5% | 2025-06-01 | |
| CVE-2025-5405 | chaitak-gorai Blogbook post.php cross-site scripting | 5.4v3.1 | 0.3% | 2025-06-01 | |
| CVE-2025-5404 | chaitak-gorai Blogbook GET parameter search.php denial of service | 7.5v3.1 | 0.8% | 2025-06-01 | |
| CVE-2025-5403 | chaitak-gorai Blogbook GET parameter view_all_posts.php SQL injection | 8.8v3.1 | 0.5% | 2025-06-01 | |
| CVE-2025-5402 | chaitak-gorai Blogbook GET parameter edit_post.php SQL injection | 9.8v3.1 | 0.6% | 2025-06-01 | |
| CVE-2025-5401 | chaitak-gorai Blogbook GET parameter post.php SQL injection | 9.8v3.1 | 0.6% | 2025-06-01 | |
| CVE-2025-5400 | chaitak-gorai Blogbook GET parameter user.php SQL injection | 9.8v3.1 | 0.6% | 2025-06-01 | |
| CVE-2025-2896 | IBM Planning Analytics Local cross-site scripting | 4.8CNA v3.1 | 0.2% | 2025-06-01 | Fix |
| CVE-2025-1499 | IBM InfoSphere Information Server information disclosure | 6.5CNA v3.1 | 0.2% | 2025-06-01 | Fix |