CVEs published in June 2025
3,618 vulnerabilities, 289 critical, 18 exploited.
- marcdk game review blockGame Review Block <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter6.4 Medium
- salt project saltCVE-2024-38822 Salt Advisory2.7 Low
- palo alto networks globalprotect app, paloaltonetworks globalprotect +1 moreGlobalProtect App: Interception in Endpoint Traffic Policy Enforcement1.0 Low
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Traffic Information Disclosure Vulnerability6.0 Medium
- wptravelengine wp travel engine – tour booking plugin – tour operator software, wp travel engine +1 moreWP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion7.5 High
- dmitriamartin traffic monitorTraffic Monitor <= 3.2.2 - Missing Authorization to Unauthenticated Settings Update5.3 Medium
- acer controlcenterAcer ControlCenter - Remote Code Execution8.7 High
- fay-1 wp sliding login/dashboard panelWP Sliding Login/Dashboard Panel <= 2.1.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- amir-mousavi telegram for wpTelegram for WP <= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- themebon digital marketing and agency templates addons for elementorDigital Marketing and Agency Templates Addons for Elementor <= 1.1.1 - Cross-Site Request Forgery to Import5.3 Medium
- a3rev contact us page – contact people, contact us page - contact people +1 moreContact Us Page – Contact People <= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via style Parameter6.4 Medium
- thatdevgirl color paletteColor Palette <= 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via hex Parameter6.4 Medium
- irmau irm newsroomIRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmcalendarview' Shortcode6.4 Medium
- digitalacornjp wp2htmlWP2HTML <= 1.0.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- jconti link shieldLink Shield <= 0.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- andremacola acf onyx pollACF Onyx Poll <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter6.4 Medium
- janboddez indieblocksIndieBlocks <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via kind Parameter6.4 Medium
- weboccults rest api | custom api generator for cross platform and import export in wpREST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation via process_handler Function9.8 Critical
- irmau irm newsroomIRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmeventlist' Shortcode6.4 Medium
- irmau irm newsroomIRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmflat' Shortcode6.4 Medium
- microsoft visual studio 2022 version 17.10, visual studio 2022 version 17.12, visual studio 2022 version 17.14 +2 more +4 moreVisual Studio Remote Code Execution Vulnerability7.1 High
- noear solonSolon Vulnerable to Directory Traversal6.1 Medium
- totolink n600r firmwareBuffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker...9.8 Critical
- b-link bl-ac1900 firmware, bl-ac2100 az3 firmware, bl-f1200 at1 firmware +6 more +8 moreBlink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL...9.8 Critical
- b-link bl-ac2100 az3 firmware, bl-f1200 at1 firmware, bl-lte300 firmware +4 more +6 moreBlink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL...9.8 Critical
- b-link bl-ac2100 az3 firmware, bl-f1200 at1 firmware, bl-lte300 firmware +5 more +7 moreBlink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL...9.8 Critical
- b-link bl-ac2100 az3 firmware, bl-f1200 at1 firmware, bl-lte300 firmware +5 more +7 moreBlink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL...9.8 Critical
- b-link bl-ac1900 firmware, bl-ac2100 az3 firmware, bl-f1200 at1 firmware +6 more +8 moreBlink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL...9.8 Critical
- openc3 cosmosWeak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a...9.8 Critical
- openc3 cosmosOpenC3 COSMOS v6.0.0 was discovered to contain hardcoded credentials for the Service Account.9.8 Critical
- openc3 cosmosA remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS...9.8 Critical
- openc3 cosmosOpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint9.1 Critical
- openc3 cosmosOpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint7.5 High
- openc3 cosmosA credential leak in OpenC3 COSMOS v6.0.0 allows attackers to access service credentials as...7.5 High
- openc3 cosmosA cross-site scripting (XSS) vulnerability in OpenC3 COSMOS v6.0.0 allows attackers to execute...6.1 Medium
- palo alto networks cortex xdr broker vmCortex XDR Broker VM: Privilege Escalation (PE) Vulnerability4.6 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Authenticated Admin Command Injection Vulnerability Through CLI8.4 High
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Authenticated Admin Command Injection Vulnerability in the Management Web Interface8.6 High
- paloaltonetworks globalprotect, palo alto networks globalprotect app +1 moreGlobalProtect: Authenticated Code Injection Through Wildcard on macOS8.5 High
- palo alto networks prisma access browserPrisma Access Browser: Inappropriate implementation in Cache5.1 Medium
- vmware avi load balancerDescription: VMware AVI Load Balancer contains an authenticated blind SQL Injection...6.8 Medium
- vmware spring frameworkRFD Attack via “Content-Disposition” Header Sourced from Request6.5 Medium
- pcsx2PCSX2 Contains a Stack-based Buffer Overflow in IOP Console Logging6.1 Medium
- dell idrac toolsDell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control...7.8 High
- sinotrack iot pc platformSinoTrack GPS Receiver Weak Authentication8.8 High
- sinotrack iot pc platformSinoTrack GPS Receiver Weak Authentication7.6 High
- aveva pi data archive, pi server +1 moreAVEVA PI Data Archive Uncaught Exception7.1 High
- aveva pi data archive, pi server +1 moreAVEVA PI Data Archive Uncaught Exception7.1 High
- aveva pi web apiAVEVA PI Web API Cross-site Scripting4.5 Medium
- aveva pi connector for cygnetAVEVA PI Connector for CygNet Improper Validation of Integrity Check Value6.7 Medium
- Show moreLoading…