CVEs published June 13, 2025
83 CVEs were published on June 13, 2025: 17 critical, 27 high.
- Published
- 83
- Critical
- 17
- High
- 27
- Medium
- 33
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 44
Most affected products
- VMware SALT · salt
- 9
- Broadcom BCM5820X · Dell ControlVault3
- 5
- openc3
- 5
- irmau IRM Newsroom
- 3
- Ricoh Company RICOH Streamline NX V3 PC Client
- 3
- Drupal COOKiES Consent Management · drupal/cookies
- 2
- Drupal Simple Klaro · drupal/simple_klaro
- 2
- openc3 · openc3-cosmos-tool-iframe
- 2
- Tenable Agent
- 2
- VMware SALT
- 2
Critical 17
- CVE-2025-49596MCP Inspector proxy server lacks authentication between the Inspector client and proxymodelcontextprotocol inspector · @modelcontextprotocol/insp…
- CVE-2025-6030Autoeastern Smart Keyless Entry System Replay AttackAutoeastern Cyclone Matrix TRF
- CVE-2025-6029KIA-branded Aftermarket Generic Smart Keyless Entry System Replay AttackKIA Aftermarket Generic Smart Keyless Entry System
- CVE-2025-29902Remote code execution that allows unauthorized users to execute arbitrary code on the server machine.Telex Remote Dispatch Console Server · RTS VLink Virtual Ma…
- CVE-2025-46783Path traversal vulnerability exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0.Ricoh Company RICOH Streamline NX V3 PC Client
- CVE-2024-38824CVE-2024-38824 salt advisoryVMware SALT · salt
- CVE-2025-5288REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation via process_handler Functionweboccults REST API | Custom API Generator For Cross Platfo…
- CVE-2025-28384An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.openc3 · openc3-cosmos-tool-iframe
- CVE-2025-28386A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitraryopenc3
- CVE-2025-28388OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.openc3
- CVE-2025-28389Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.openc3
- CVE-2025-45984Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200_AT1 V1.0.0, BL-X26_AC8
- CVE-2025-45985Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450
- CVE-2025-45986Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450
- CVE-2025-45987Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450
- CVE-2025-45988Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450
- CVE-2025-46060Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FIL
High 27
- CVE-2025-24919Dell ControlVault3/ControlVault3 Plus deserialization of untrusted input vulnerabilityBroadcom BCM5820X · Dell ControlVault3
- CVE-2025-25215Dell ControlVault3/ControlVault3 Plus cv_close arbitrary free vulnerabilityBroadcom BCM5820X · Dell ControlVault3
- CVE-2025-25050Dell ControlVault3/ControlVault3 Plus cv_upgrade_sensor_firmware out-of-bounds write vulnerabilityBroadcom BCM5820X · Dell ControlVault3
- CVE-2025-24922Dell ControlVault3/ControlVault3 Plus securebio_identify stack-based buffer overflow vulnerabilityBroadcom BCM5820X · Dell ControlVault3
- CVE-2025-24311Dell ControlVault3/ControlVault3 Plus cv_send_blockdata out-of-bounds read vulnerabilityBroadcom BCM5820X · Dell ControlVault3
- CVE-2025-49586XWiki allows remote code execution through preview of XClass changes in AWM editorxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2025-49585XWiki does not require right warnings for XClass definitionsxwiki-platform · org.xwiki.platform:xwiki-platform-security…
- CVE-2025-49584XWiki makes title of inaccessible pages available through the class property values REST APIxwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…
- CVE-2025-49582XWiki's required right warnings for macros are incompletexwiki-platform · org.xwiki.platform:xwiki-platform-rende… +3
- CVE-2025-49581XWiki allows remote code execution through default value of wiki macro wiki-type parametersxwiki-platform · org.xwiki.platform:xwiki-platform-renderin…
- CVE-2025-49580XWiki allows privilege escalation through link refactoringxwiki-platform · org.xwiki.platform:xwiki-platform-refactor…
- CVE-2025-48915COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-076Drupal COOKiES Consent Management · drupal/cookies
- CVE-2025-48914COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075Drupal COOKiES Consent Management · drupal/cookies
- CVE-2025-48920etracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074Drupal etracker · drupal/etracker
- CVE-2025-48918Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071Drupal Simple Klaro · drupal/simple_klaro
- CVE-2025-36631Local Privilege EscalationTenable Agent
- CVE-2025-36633Local Privilege EscalationTenable Agent
- CVE-2025-49468Joomla Extension - nobossextensions.com - SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomlanobossextensions.com No Boss Calendar component for Joomla
- CVE-2025-39240Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation.Hikvision DS-3WAP622G-SI · Hikvision DS-3WAP623E-SI +4
- CVE-2025-22239CVE-2025-22239 salt advisoryVMware SALT · salt
- CVE-2025-22236CVE-2025-22236 salt advisoryVMware SALT · salt
- CVE-2025-5282WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletionwptravelengine WP Travel Engine – Tour Booking Plugin – Tou…
- CVE-2025-5491Acer ControlCenter - Remote Code ExecutionAcer ControlCenter
- CVE-2025-47959Visual Studio Remote Code Execution VulnerabilityMicrosoft Visual Studio
- CVE-2025-30399.NET and Visual Studio Remote Code Execution VulnerabilityMicrosoft .NET · Microsoft Visual Studio +13
- CVE-2025-28381A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all contaopenc3
- CVE-2025-28382An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.openc3 · openc3-cosmos-tool-iframe
Medium, low and unrated 39
- CVE-2025-6083ExtremeCloud Universal ZTNA Improper AuthorizationExtreme Networks ExtremeCloud Universal ZTNA
- CVE-2025-49598conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsingconda-forge-ci-setup-feedstock
- CVE-2025-49597handcraftedinthealps goodby-csv Potential Gadget Chain allowing Remote Code Executionhandcraftedinthealps goodby-csv · handcraftedinthealps/good…
- CVE-2025-49587XWiki does not require right warnings for notification displayer objectsxwiki-platform · org.xwiki.platform:xwiki-platform-notifica…
- CVE-2025-49583XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin rightxwiki-platform · org.xwiki.platform:xwiki-platform-notifica…
- CVE-2025-6052Glib: integer overflow in g_string_maybe_expand() leading to potential buffer overflow in glib gstringRed Hat Enterprise Linux
- CVE-2025-48919Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-073Drupal Simple Klaro · drupal/simple_klaro
- CVE-2025-48917EU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072Drupal EU Cookie Compliance · drupal/eu_cookie_compliance
- CVE-2025-48916Bookable Calendar - Less critical - Access bypass - SA-CONTRIB-2025-070Drupal Bookable Calendar · drupal/bookable_calendar
- CVE-2025-6035Gimp: gimp integer overflowgimp · Red Hat Enterprise Linux
- CVE-2025-48825RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 contains an issue with use of less trusted source, which may allow an attacker who Ricoh Company RICOH Streamline NX V3 PC Client
- CVE-2025-36506External control of file name or path issue exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0.Ricoh Company RICOH Streamline NX V3 PC Client
- CVE-2025-6012Auto Attachments <= 1.8.5 - Authenticated (Administrator+) Stored Cross-Site Scriptingkaisercrazy Auto Attachments
- CVE-2025-22242CVE-2025-22242 salt advisoryVMware SALT · salt
- CVE-2025-22241CVE-2025-22241 salt advisoryVMware SALT · salt
- CVE-2025-22240CVE-2025-22240 salt advisoryVMware SALT · salt
- CVE-2025-22238CVE-2025-22238 salt advisoryVMware SALT · salt
- CVE-2025-22237CVE-2025-22237 salt advisoryVMware SALT · salt
- CVE-2024-38825CVE-2024-38825 Salt AdvisoryVMware SALT · salt
- CVE-2024-38823CVE-2024-38823 Salt AdvisoryVMware SALT
- CVE-2025-5923Game Review Block <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parametermarcdk Game Review Block
- CVE-2024-38822CVE-2024-38822 Salt AdvisoryVMware SALT
- CVE-2025-4227GlobalProtect App: Interception in Endpoint Traffic Policy EnforcementPalo Alto Networks GlobalProtect App
- CVE-2025-4229PAN-OS: Traffic Information Disclosure VulnerabilityPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-5815Traffic Monitor <= 3.2.2 - Missing Authorization to Unauthenticated Settings Updatedmitriamartin Traffic Monitor
- CVE-2025-5928WP Sliding Login/Dashboard Panel <= 2.1.1 - Cross-Site Request Forgery to Settings Updatefay-1 WP Sliding Login/Dashboard Panel
- CVE-2025-5938Digital Marketing and Agency Templates Addons for Elementor <= 1.1.1 - Cross-Site Request Forgery to Importthemebon Digital Marketing and Agency Templates Addons for…
- CVE-2025-5123Contact Us Page – Contact People <= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via style Parametera3rev Contact Us Page – Contact People
- CVE-2025-5939Telegram for WP <= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scriptingamir-mousavi Telegram for WP
- CVE-2025-4586IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmcalendarview' Shortcodeirmau IRM Newsroom
- CVE-2025-5233Color Palette <= 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via hex Parameterthatdevgirl Color Palette
- CVE-2025-5930WP2HTML <= 1.0.2 - Cross-Site Request Forgery to Settings Updatedigitalacornjp WP2HTML
- CVE-2025-5841ACF Onyx Poll <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameterandremacola ACF Onyx Poll
- CVE-2025-5926Link Shield <= 0.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scriptingjconti Link Shield
- CVE-2025-5950IndieBlocks <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via kind Parameterjanboddez IndieBlocks
- CVE-2025-4584IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmeventlist' Shortcodeirmau IRM Newsroom
- CVE-2025-4585IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmflat' Shortcodeirmau IRM Newsroom
- CVE-2025-28380A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injeopenc3
- CVE-2025-46096Directory Traversal vulnerability in solon v.3.1.2 allows a remote attacker to conduct XSS attacks via the solon-faas-luffy componentorg.noear:solon-faas-luffy