CVEs published in June 2025
3,618 vulnerabilities, 289 critical, 18 exploited.
- 70mai 1s70mai 1S Video Services improper authentication2.3 Low
- dgtlmoon changedetection.ioChangeDetection.io XSS in watch overview7.0 High
- convoypanel panelConvey Panel Directory Traversal in LocaleController leading to Remote Code Execution10.0 Critical
- langchain, langchain-ai langchain-ai/langchain +1 moreSSRF Vulnerability in RequestsToolkit in langchain-ai/langchain8.4 High
- notepad-plus-plusNotepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path7.3 High
pbkdf2npm,aws-cliopenSUSE,python-boto3openSUSE +9 more +11 moreOn Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys9.1 Critical- pyspur-dev pyspurPySpur-Dev pyspur Jinja2 Template single_llm_call.py SingleLLMCallNode special elements used in a template engine5.3 Medium
- quarkusio quarkusQuarkus potential data leak when duplicating a duplicated context6.4 Medium
pbkdf2npm,aws-cliopenSUSE,node-pbkdf2Debian +11 more +13 morepbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js9.1 Critical- dromara maxkeyDromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgery5.3 Medium
- visionatrixVisionatrix Vulnerable to Reflected XSS Leading to Exfiltration of Secrets8.8 High
- hdfgroup hdf5HDF5 H5Fint.c H5F_addr_decode_len heap-based overflow4.8 Medium
- netgear ex6150, ex6150 firmware +1 moreNetgear EX6150 sub_410090 stack-based overflow8.7 High
- netgear ex6100, ex6100 firmware +1 moreNetgear EX6100 sub_415EF8 stack-based overflow8.7 High
- kubernetesNodes can bypass dynamic resource allocation authorization checks2.7 Low
- seaswalker spring-analysisseaswalker spring-analysis SimpleController.java echo cross site scripting5.1 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible4.8 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper...4.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible4.8 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible5.4 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible5.4 Medium
- aviatrix controllerAviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input...6.6 Medium
- aviatrix controllerAviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting...7.8 High
- bizerba brain2Scripts within reports executable on BRAIN2 Server10.0 Critical
- bizerba brain2BRAIN2 Configuration file for database access not sufficiently secured9.3 Critical
distributionopenSUSESecurity update for distributionNo score- xiaomi mi connect serviceMi Connect Service APP protocol flaws lead to unauthorized access9.6 Critical
- oppo colorosOPPO Clone Phone uses weak WPA passphrase as only means of security7.4 High
- dragonflydb dragonflyInteger Overflow or Wraparound vulnerability in dragonflydb/dragonfly9.4 Critical
- dail8859 notepadnextPotential heap-buffer overflow vulnerability in NotepadNext9.4 Critical
- dail8859 notepadnextPotential heap-based buffer over-read vulnerability in NotepadNext5.1 Medium
- pointcloudlibrary pclVulnerability in PointCloudLibrary PCL2.0 Low
- yrutschle sslhImproper Link Resolution Before File Access vulnerability in yrutschle/sslh9.3 Critical
- wso2 api manager, enterprise integrator, identity server +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files4.3 Medium
- code-projects inventory management systemcode-projects Inventory Management System fetchSelectedCategories.php sql injection6.9 Medium
- code-projects inventory management systemcode-projects Inventory Management System changePassword.php sql injection6.9 Medium
- code-projects inventory management systemcode-projects Inventory Management System createCategories.php sql injection6.9 Medium
- code-projects inventory management systemcode-projects Inventory Management System editCategories.php sql injection6.9 Medium
- libuclvstakhov libucl ucl_parser.c ucl_parse_multiline_string heap-based overflow4.8 Medium
- htacg tidy, tidy-html5 +1 moreHTACG tidy-html5 alloc.c defaultAlloc memory leak4.8 Medium
- htacg tidy-html5HTACG tidy-html5 parser.c prvTidyParseNamespace assertion4.8 Medium
ndpiOSS-FuzzHeap-buffer-overflow in load_protocols_file_fdNo score- htacg tidy-html5HTACG tidy-html5 parser.c InsertNodeAsParent null pointer dereference4.8 Medium
dns-root-dataDebiandns-root-data - DNSSEC trust anchors updateNo score- freedesktop xdg-utilsxdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which...2.7 Low
- lfprojects mlflowMLFlow SSRF via gateway_proxy_handler5.8 Medium
- spytrap-org spytrap-adbspytrap-adb Omission of Security-relevant Information2.7 Low
- innocommerce innoshopInnoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated...7.4 High
- innocommerce innoshopIn Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in...9.9 Critical
- innocommerce innoshopInnoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within...6.4 Medium
- Show moreLoading…