CVEs published in June 2025
3,618 vulnerabilities, 289 critical, 18 exploited.
- linux, linux kernel +1 moreiio: adc: ad7606: check for NULL before calling sw_mode_config()5.5 Medium
- debian linux, linux kernel +1 moreRDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug7.8 High
- debian linux, linux kernel +1 morenfs: handle failure of nfs_get_lock_context in unlock path5.5 Medium
- linux, linux kernel +1 moreRDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem7.8 High
- linux, linux kernel +1 moredrm/amd/display: Fix null check of pipe_ctx->plane_state for update_dchubp_dpp5.5 Medium
- debian linux, linux kernel +1 morenet/mlx5e: Disable MACsec offload for uplink representor profile5.5 Medium
- linux, linux kernel +1 moremlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices7.8 High
- debian linux, linux kernel +1 morenet/tls: fix kernel panic when alloc_page failed7.5 High
- linux, linux kernel +1 morefs/eventpoll: fix endless busy loop after timeout has expired5.5 Medium
- linux, linux kernel +1 moreHID: bpf: abort dispatch if device destroyed8.8 High
- debian linux, linux kernel +1 moredmaengine: idxd: fix memory leak in error handling path of idxd_alloc5.5 Medium
- linux, linux kernel +1 moredmaengine: idxd: Refactor remove call with idxd_cleanup() helper5.5 Medium
- linux, linux kernel +1 morewifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request7.8 High
- linux, linux kernel +1 moresched_ext: bpf_iter_scx_dsq_new() should always initialize iterator7.8 High
- linux, linux kernel +1 moredrm/amdgpu: csa unmap use uninterruptible lock5.5 Medium
- linux, linux kernel +1 morephy: tegra: xusb: Use a bitmask for UTMI pad power state tracking5.5 Medium
- debian linux, linux kernel +1 morewifi: mt76: disable napi on driver removal5.5 Medium
- linux, linux kernel +1 moremm/page_alloc: fix race condition in unaccepted memory handling4.7 Medium
- debian linux, linux kernel +1 moreHID: uclogic: Add NULL check in uclogic_input_configured()5.5 Medium
- linux, linux kernel +1 morenet: mctp: Don't access ifa_index when missing5.5 Medium
- debian linux, linux kernel +1 moredmaengine: ti: k3-udma: Add missing locking7.8 High
- cloudways breezeWordPress Breeze plugin <= 2.2.13 - Broken Access Control vulnerability4.3 Medium
- scottyla csv meCSV Me <= 2.0 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
- nebojsadabic target video easy publishTarget Video Easy Publish <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter6.4 Medium
- google osv-scalibrArbitrary File write in OSV-SCALIBR5.7 Medium
- amans2k funnelkit automations – email marketing automation and crm for wordpress & woocommerce, funnelkit automations +1 moreRecover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation9.8 Critical
- amauri tarteaucitron.iotarteaucitron.io < 1.9.5 - Contributor+ Stored XSS4.7 Medium
- kaon kcm3100An authentication bypass vulnerability exists in KCM3100 Ver1.4.2 and earlier. If this...9.3 Critical
- lycheeorg lycheeLychee Path Traversal Vulnerability7.5 High
- byrev pixabay imagesPixabay Images <= 3.4 - Authenticated (Author+) Arbitrary File Upload8.8 High
- nvidia nvdebug, nvdebug tool +1 moreThe NVIDIA NVDebug tool contains a vulnerability that may allow an actor to gain access to...4.5 Medium
- google chromeUse after free in Metrics in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to...8.8 High
- google chromeInteger overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to...8.8 High
- couchbase .net sdkCouchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates4.9 Medium
- efrotech timetraxAn issue in EfroTech Time Trax v.1.0 allows a remote attacker to execute arbitrary code via the...9.9 Critical
- pbootcmsSQL Injection vulnerability in pbootCMS v.3.2.5 and v.3.2.10 allows a remote attacker to obtain...8.8 High
- updategadh real estate managementReal Estate Management 1.0 is vulnerable to Cross Site Scripting (XSS) in /store/index.php.8.1 High
- dlink dph-400s firmware, dph-400se firmware +1 moreD-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including...9.8 Critical
- heavenspell minitcgA cross-site scripting (XSS) vulnerability in miniTCG v1.3.1 beta allows attackers to execute...5.9 Medium
- open5gsA missing length check in `ogs_pfcp_subnet_add` function from PFCP library, used by both smf and...7.8 High
- open5gsA missing length check in `ogs_pfcp_dev_add` function from PFCP library, used by both smf and upf...7.1 High
- open5gsAn issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of...7.1 High
- vishalmathur cloudclassroom-php projectAn issue in CloudClassroom PHP Project v.1.0 allows a remote attacker to execute arbitrary code...9.8 Critical
- vishalmathur cloudclassroom-php projectCloudClassroom-PHP-Project v.1.0 is vulnerable to SQL Injection in loginlinkadmin.php, allowing...9.8 Critical
- langgenius difyDify has XSS vulnerability5.3 Medium
- portainerPortainer HTTP Headers May Leak to Malicious Container Registries6.8 Medium
- trend micro, inc. micro internet security (consumer), trendmicro maximum security 2022 +1 moreTrend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation...7.8 High
- trend micro, inc. micro internet security (consumer), trendmicro maximum security 2022 +1 moreTrend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation...7.8 High
- conda-forge conda-smithyconda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack1.7 Low
- conda-forge conda-smithyconda-smithy Has Incorrect Default File Permissions2.7 Low
- Show moreLoading…