CVEs published in June 2025
3,618 vulnerabilities, 289 critical, 18 exploited.
tzdataTuxCare,tzdata-javaTuxCare +1 moreUpdate of tzdataNo score- linlinjava litemalllinlinjava litemall post improper authorization5.3 Medium
- xuxueli xxl-ssoXuxueli xxl-sso doLogin redirect5.1 Medium
- optilink ont1gew gponOptiLink ONT1GEW GPON Remote Code Execution9.4 Critical
- d-link dsl-2730u, dsl-2750e, dsl-2750u +2 moreD-Link DSL-2730U/2750U/2750E Path Traversal Arbitrary File Read8.7 High
- shanghai fanwei network technology e-officeFanwei E-Office Unauthenticated File Upload10.0 Critical
- shenzhen yuanmengyun technology co., ltd. weiphpWeiPHP Path Traversal Arbitrary File Read8.7 High
- shenzhen lingkong technology wifisky 7-layer flow control routerWIFISKY 7-Layer Flow Control Router Remote Command Execution9.4 Critical
- vacron network video recorder (nvr)Vacron NVR Remote Command Execution10.0 Critical
- beward n100 ip cameraBeward N100 IP Camera Remote Command Execution9.4 Critical
- xuxueli xxl-ssoXuxueli xxl-sso login cross site scripting5.3 Medium
- labredescefetrj wegiaLabRedesCefetRJ WeGIA Cadastro de Funcionário cadastro_funcionario.php cross site scripting5.1 Medium
- ibm infosphere information serverIBM InfoSphere DataStage Flow Designer information disclosure5.3 Medium
- labredescefetrj wegiaLabRedesCefetRJ WeGIA Adicionar tipo adicionar_tipoSaida.php cross site scripting5.1 Medium
- labredescefetrj wegiaLabRedesCefetRJ WeGIA Adicionar tipo adicionar_tipoEntrada.php cross site scripting5.1 Medium
- espressif arduino-esp32arduino-esp32 vulnerable to CRLF injection in WebServer.cpp8.9 High
- hiyouga llama-factoryLLaMA-Factory Remote Code Execution (RCE) Vulnerability8.3 High
- filebrowserFile Browser has Stored Cross-Site Scripting vulnerability7.6 High
- filebrowserFile Browser has Insecure File Permissions5.5 Medium
- yhirose cpp-httplibcpp-httplib has unlimited number of http header fields, which causes memory leak7.5 High
- labredescefetrj wegiaLabRedesCefetRJ WeGIA Cadastro de Atendio Cadastro_Atendido.php cross site scripting5.1 Medium
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 morePre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB7.5 High
- joshuayoes ios-simulator-mcpCommand Injection in MCP Server ios-simulator-mcp6.0 Medium
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 morePre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication7.5 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreRace condition in privilege cache invalidation cycle4.2 Medium
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreRunning certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server5.0 Medium
- dataeaseDataease H2 JDBC Connection Remote Code Execution8.9 High
- labredescefetrj wegiaLabRedesCefetRJ WeGIA Additional Categoria adicionar_categoria.php cross site scripting5.1 Medium
- labredescefetrj wegiaLabRedesCefetRJ WeGIA Adicionar Unidade adicionar_unidade.php cross site scripting5.1 Medium
- rt-threadRT-Thread device.c sys_device_write memory corruption8.5 High
- manageengine exchange reporter plus, zohocorp manageengine exchange reporter plus +1 moreStored XSS8.1 High
- manageengine exchange reporter plus, zohocorp manageengine exchange reporter plus +1 moreStored XSS8.1 High
- hunt electronic hybrid dvrHunt Electronic Hybrid DVR - OS Command Injection8.7 High
- hunt electronic hbf-09kd, hbf-16nk +1 moreHunt Electronic Hybrid DVR - Exposure of Sensitive System Information9.8 Critical
- trellix system information reporterA sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and...0.0 None
- trellix system information reporterA path traversal vulnerability in System Information Reporter (SIR) 1.0.3 and prior allowed an...0.0 None
- trellix system information reporterA path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an...7.2 High
- mozilla neqotransport/fc.rs: panic attempting to send MAX_DATA with value larger max varint2.3 Low
tzdataTuxCare,tzdata-javaTuxCare +1 moreUpdate of tzdataNo score- canonical cloud-initcloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with...5.9 Medium
- themefic ultra addons for contact form 7, ultimate addons for contact form 7 +1 moreUltra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module7.2 High
- butterflymedia modern design libraryModern Design Library <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter6.4 Medium
- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets6.4 Medium
- canonical cloud-initWhen a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a...8.8 High
- perforce puppet enterprise, puppet enterprise +1 moreOS Command Injection8.6 High
- iroha soft co., ltd. board, irohasoft iroha board +1 moreCross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If...5.1 Medium
- iroha soft co., ltd. board, irohasoft iroha board +1 moreDirect request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier. If...5.3 Medium
- gitlabMissing Authentication for Critical Function in GitLab5.3 Medium
- gitlabBusiness Logic Errors in GitLab3.1 Low
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- Show moreLoading…