CVEs published in June 2025
3,618 vulnerabilities, 289 critical, 18 exploited.
- samba, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreSamba: smbd doesn't pick up group membership changes when re-authenticating an expired smb session4.9 Medium
- google chrome, chromium v8, microsoft edge chromium +2 moreOut of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote...8.8 High
- google chromeUse after free in Blink in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to...8.8 High
- webtoffee comments import & exportWordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.3.8 - Broken Access Control vulnerability6.5 Medium
- haxtheweb issuesUnauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint5.3 Medium
- mafintosh tar-fstar-fs has issue where extract can write outside the specified dir with a specific tarball8.7 High
- sonos era 300, era 300 firmware +1 moreSonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability8.8 High
- cimatti contact forms by cimattiWordPress Contact Forms by Cimatti plugin <= 1.9.8 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- 3ds delmia aprisoDeserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 20259.0 Critical
- splunk universal forwarder, splunk/universalforwarder for windows +1 moreIncorrect permission assignment on Universal Forwarder for Windows during new installation or upgrade8.0 High
- splunk, splunk cloud platform, enterprise +2 moreReflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation component4.3 Medium
- autodesk revitRFA File Parsing Use-After-Free Vulnerability7.8 High
- wso2 api manager, identity server, identity server as key manager +3 more +5 moreOpen Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint5.4 Medium
- wso2 api manager, enterprise integrator, identity server +7 more +9 moreReflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation5.2 Medium
- wso2 api manager, enterprise integrator, identity server +4 more +6 moreStored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor4.3 Medium
- wso2 api manager, carbon synapse artifact uploader be, enterprise integrator +4 more +6 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution6.8 Medium
- wso2 identity server, identity server as key manager, open banking iam +2 more +4 moreUnauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services6.5 Medium
- xml-security signxmlSignXML's signature verification with HMAC is vulnerable to a timing attack6.9 Medium
- xml-security signxmlSignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack6.9 Medium
- mybbMyBB may disclosure unviewable threads' titles in searches5.3 Medium
- mybbMyBB's upgrade component vulnerable to local file inclusion7.2 High
- owasp modsecurityModSecurity has possible DoS vulnerability in sanitiseArg action7.5 High
- wagner xls2csvA memory corruption vulnerability exists in the Shared String Table Record Parser implementation...8.4 High
- catdoc, debian linux +1 moreAn integer overflow vulnerability exists in the OLE Document File Allocation Table Parser...8.4 High
- catdoc, debian linux +1 moreAn integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of...8.4 High
- high-logic fontcreatorAn out-of-bounds read vulnerability exists in High-Logic FontCreator 15.0.0.3015. A specially...6.5 Medium
- hewlett packard enterprise (hpe) hpe storeonce software, hpe storeonce system +1 moreA command injection remote code execution vulnerability exists in HPE StoreOnce Software.7.5 High
- hewlett packard enterprise (hpe) hpe storeonce software, hpe storeonce system +1 moreA directory traversal information disclosure vulnerability exists in HPE StoreOnce Software.5.9 Medium
- hewlett packard enterprise (hpe) hpe storeonce software, hpe storeonce system +1 moreA directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software.5.5 Medium
- hewlett packard enterprise (hpe) hpe storeonce software, hpe storeonce system +1 moreAn authentication bypass vulnerability exists in HPE StoreOnce Software.9.8 Critical
- hewlett packard enterprise (hpe) hpe storeonce software, hpe storeonce system +1 moreA command injection remote code execution vulnerability exists in HPE StoreOnce Software.7.5 High
- hewlett packard enterprise (hpe) hpe storeonce software, hpe storeonce system +1 moreA command injection remote code execution vulnerability exists in HPE StoreOnce Software.7.2 High
- linksys re6250, re6300, re6350 +9 more +11 moreLinksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 ssid1MACFilter os command injection5.3 Medium
- hewlett packard enterprise (hpe) hpe storeonce software, hpe storeonce system +1 moreA server-side request forgery vulnerability exists in HPE StoreOnce Software.6.9 Medium
- hewlett packard enterprise (hpe) hpe storeonce software, hpe storeonce system +1 moreA command injection remote code execution vulnerability exists in HPE StoreOnce Software.7.5 High
- solarwinds dameware mini remote control serviceSolarWinds Dameware Mini Remote Control Service Incorrect Permissions Local Privilege Escalation Vulnerability7.8 High
- linksys re6250, re6300, re6350 +9 more +11 moreLinksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_checkCredentialsByBBS os command injection5.3 Medium
- yandex telemostDLL Hijacking in Yandex Telemost8.4 High
- linksys re6250, re6300, re6350 +9 more +11 moreLinksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_checkFWByBBS os command injection5.3 Medium
- linksys re6250, re6300, re6350 +9 more +11 moreLinksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_UpgradeFWByBBS os command injection5.3 Medium
pam-bindingscrates.io`PamHandle::get_user` can cause an authentication bypassNo score- linksys re6250, re6300, re6350 +9 more +11 moreLinksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 wirelessAdvancedHidden os command injection5.3 Medium
- nekernel-org nekernelNeKernel has Heap Overflow in `rt_copy_memory`8.6 High
- astrbotAstrBot Has Path Traversal Vulnerability in /api/chat/get_file7.5 High
- forceu gokapiGokapi has stored XSS vulnerability in friendly name for API keys4.8 Medium
- arm 5th gen gpu architecture userspace driver, bifrost gpu userspace driver, valhall gpu userspace driver +2 moreMali GPU Userspace Driver allows an Out-of-Bounds access7.8 High
- forceu gokapiGokapi vulnerable to stored XSS via uploading file with malicious file name4.8 Medium
- phoenixcart ce phoenix cart, ce-phoenixcart phoenixcart +1 moreStored XSS in CE Phoenix Cart Testimonials Allows Account Takeover if Missing HttpOnly Flag6.3 Medium
- linksys re6250, re6300, re6350 +9 more +11 moreLinksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_pingGatewayByBBS os command injection5.3 Medium
- Show moreLoading…