CVEs published June 11, 2025
57 CVEs were published on June 11, 2025: 9 critical, 23 high.
- Published
- 57
- Critical
- 9
- High
- 23
- Medium
- 21
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 36
Most affected products
- IBM Cognos Analytics
- 3
- Drupal Quick Node Block · drupal/quick_node_block
- 2
- gamerz WP-DownloadManager
- 2
- Google Chrome
- 2
- Mattermost · github.com/mattermost/mattermost-server +3
- 2
- MIK CryptX
- 2
- Mozilla Firefox
- 2
- VirtueMart
- 2
- Weidmueller IE-SR-2TX-WL · Weidmueller IE-SR-2TX-WL-4G-EU +1
- 2
- Autodesk USD for Maya · Autodesk USD for 3ds Max +1
- 1
Critical 9
- CVE-2025-30085Extension - rsjoomla.com - Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for Joomlarsjoomla.com RSform!Pro component for Joomla
- CVE-2025-40912CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicodeMIK CryptX
- CVE-2025-40914Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflowMIK CryptX
- CVE-2025-32711M365 Copilot Information Disclosure VulnerabilityMicrosoft 365 Copilot
- CVE-2025-49710Integer overflow in OrderedHashTableMozilla Firefox
- CVE-2025-49709Memory corruption in canvas surfacesMozilla Firefox
- CVE-2025-41663Weidmueller: Security routers IE-SR-2TX are affected by Command InjectionWeidmueller IE-SR-2TX-WL · Weidmueller IE-SR-2TX-WL-4G-EU +1
- CVE-2024-1244Remote code execution and local privilege escalation due to UNC access and NetNTLMv2 hash theftOSSEC-HIDS Agent
- CVE-2024-1243Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theftWazuh Agent
High 23
- CVE-2025-32465Extension - rsjoomla.com - Stored XSS vulnerability in RSTickets! component 1.9.12 - 3.3.0 for Joomlarsjoomla.com RSTickets! component for Joomla
- CVE-2025-25032IBM Cognos Analytics denial of serviceIBM Cognos Analytics
- CVE-2025-40915Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokensGRYPHON Mojolicious::Plugin::CSRF
- CVE-2025-22874Usage of ExtKeyUsageAny disables policy validation in crypto/x509Go standard library crypto/x509 · stdlib
- CVE-2025-6002VirtueMart - Unrestricted File UploadVirtueMart
- CVE-2025-6001VirtueMart - Cross Site Request Forgery (CSRF)VirtueMart
- CVE-2025-49148ClipShare Server Allows Local Privilege Escalation via DLL Hijackingthevindu-w clip_share_server
- CVE-2025-48447Lightgallery - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-069Drupal Lightgallery · drupal/lightgallery
- CVE-2025-48446Commerce Alphabank Redirect - Moderately critical - Access bypass - SA-CONTRIB-2025-067Drupal Commerce Alphabank Redirect · drupal/commerce_alphab…
- CVE-2025-49146pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configurationpgjdbc · org.postgresql:postgresql
- CVE-2025-48445Commerce Eurobank (Redirect) - Moderately critical - Access bypass - SA-CONTRIB-2025-066Drupal Commerce Eurobank · drupal/commerce_eurobank_redirect
- CVE-2025-4922Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A JobHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2025-5687Local privilege escalation vulnerability in Mozilla VPN clients for macOS v2.27.0 and below.Mozilla VPN
- CVE-2025-3302Xagio SEO <= 7.1.0.16 - Unauthenticated Stored Cross-Site Scripting via 'HTTP_REFERER'Xagio SEO – AI Powered SEO
- CVE-2025-4315CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalationcubewp1211 CubeWP Framework
- CVE-2025-41661Weidmueller: Security routers IE-SR-2TX are affected by CSRFWeidmueller IE-SR-2TX-WL · Weidmueller IE-SR-2TX-WL-4G-EU +1
- CVE-2025-29756MQTT implementation in Sungrow iSolarCloud allowed users to subscribe to all data of all connected invertersSunGrow iSolarCloud
- CVE-2025-5395WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File UploadValvePress WordPress Automatic Plugin
- CVE-2025-4799WP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Deletiongamerz WP-DownloadManager
- CVE-2025-5959Type Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a craGoogle Chrome
- CVE-2025-5958Use after free in Media in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2025-4275SecureFlashDxe: Incorrect UEFI variable attributes check allows usage of invalid certificateInsyde Software InsydeH2O
- CVE-2025-49091KDE Konsole before 25.04.2 allows remote code execution in a certain scenario.KDE Konsole
Medium, low and unrated 25
- CVE-2025-32466Extension - rsjoomla.com - SQL injection vulnerability in RSMediaGallery! component 1.7.4 - 2.1.7 for Joomlarsjoomla.com RSMediaGallery component for Joomla
- CVE-2025-49150Cursor Agent Potentially Leaks Information using JSON schemagetcursor cursor
- CVE-2025-0923IBM Cognos Analytics information disclosureIBM Cognos Analytics
- CVE-2025-0917IBM Cognos Analytics cross-site scriptingIBM Cognos Analytics
- CVE-2025-0913Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscallGo standard library syscall · Go standard library os +1
- CVE-2025-4673Sensitive headers not cleared on cross-origin redirect in net/httpGo standard library net/http · stdlib
- CVE-2025-1699An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauthorized access.Motorola g34 · Motorola g34t +1
- CVE-2025-1698Null pointer exception vulnerabilities were reported in the fingerprint sensor service that could allow a local attacker to cause a denial oMotorola Razr 40 Ultra · Motorola Razr +2
- CVE-2025-26383The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the WindowsJohnson Controls iSTAR Configuration Utility
- CVE-2025-48448Admin Audit Trail - Less critical - Denial of Service - SA-CONTRIB-2025-068Drupal Admin Audit Trail · drupal/admin_audit_trail
- CVE-2025-3473IBM Security Guardium privilege escalationIBM Security Guardium
- CVE-2025-0163IBM Security Verify Access information disclosureIBM Security Verify Access
- CVE-2025-48013Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-065Drupal Quick Node Block · drupal/quick_node_block
- CVE-2025-48444Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064Drupal Quick Node Block · drupal/quick_node_block
- CVE-2025-4605USD File Parsing Memory Allocation VulnerabilityAutodesk USD for Maya · Autodesk USD for 3ds Max +1
- CVE-2025-35941mySCADA PRO Manager Password DisclosuremySCADA myPRO
- CVE-2025-5144The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingstellarwp The Events Calendar
- CVE-2025-5986Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// LinksMozilla Thunderbird
- CVE-2025-4128Mattermost Guest User Information Disclosure VulnerabilityMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-4573LDAP Injection in Mattermost Enterprise Edition When Using Active DirectoryMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-26412Undocumented Root Shell Access in SIMCom SIM7600G ModemSIMCom SIM7600G Modem
- CVE-2025-5991Use after free in QHttp2ProtocolHandlerQt
- CVE-2024-35295A vulnerability has been identified in Perfect Harmony GH180 (All versions >= V8.0 < V8.3.3 with NXGPro+ controller manufactured between AprInnomotics Perfect Harmony GH180
- CVE-2025-4798WP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Readgamerz WP-DownloadManager
- CVE-2025-4666ZotPress <= 7.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'nickname'kseaborn Zotpress