# CVEs published 2025-06-13

83 CVEs were published on June 13, 2025: 17 critical, 27 high. Days are UTC.

- [CVE-2025-24919](https://cve.now/CVE-2025-24919.md): Dell ControlVault3/ControlVault3 Plus deserialization of untrusted input vulnerability (CVSS 8.1, Broadcom BCM5820X · Dell ControlVault3)
- [CVE-2025-25215](https://cve.now/CVE-2025-25215.md): Dell ControlVault3/ControlVault3 Plus cv\_close arbitrary free vulnerability (CVSS 8.8, Broadcom BCM5820X · Dell ControlVault3)
- [CVE-2025-6083](https://cve.now/CVE-2025-6083.md): ExtremeCloud Universal ZTNA Improper Authorization (CVSS 5.2, Extreme Networks ExtremeCloud Universal ZTNA)
- [CVE-2025-25050](https://cve.now/CVE-2025-25050.md): Dell ControlVault3/ControlVault3 Plus cv\_upgrade\_sensor\_firmware out-of-bounds write vulnerability (CVSS 8.8, Broadcom BCM5820X · Dell ControlVault3)
- [CVE-2025-24922](https://cve.now/CVE-2025-24922.md): Dell ControlVault3/ControlVault3 Plus securebio\_identify stack-based buffer overflow vulnerability (CVSS 8.8, Broadcom BCM5820X · Dell ControlVault3)
- [CVE-2025-24311](https://cve.now/CVE-2025-24311.md): Dell ControlVault3/ControlVault3 Plus cv\_send\_blockdata out-of-bounds read vulnerability (CVSS 8.4, Broadcom BCM5820X · Dell ControlVault3)
- [CVE-2025-49598](https://cve.now/CVE-2025-49598.md): conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing (CVSS 4.4, conda-forge-ci-setup-feedstock)
- [CVE-2025-49596](https://cve.now/CVE-2025-49596.md): MCP Inspector proxy server lacks authentication between the Inspector client and proxy (CVSS 9.4, modelcontextprotocol inspector · @modelcontextprotocol/insp…)
- [CVE-2025-49597](https://cve.now/CVE-2025-49597.md): handcraftedinthealps goodby-csv Potential Gadget Chain allowing Remote Code Execution (CVSS 3.9, handcraftedinthealps goodby-csv · handcraftedinthealps/good…)
- [CVE-2025-49587](https://cve.now/CVE-2025-49587.md): XWiki does not require right warnings for notification displayer objects (CVSS 6.4, xwiki-platform · org.xwiki.platform:xwiki-platform-notifica…)
- [CVE-2025-49586](https://cve.now/CVE-2025-49586.md): XWiki allows remote code execution through preview of XClass changes in AWM editor (CVSS 8.7, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2025-49585](https://cve.now/CVE-2025-49585.md): XWiki does not require right warnings for XClass definitions (CVSS 8.6, xwiki-platform · org.xwiki.platform:xwiki-platform-security…)
- [CVE-2025-49584](https://cve.now/CVE-2025-49584.md): XWiki makes title of inaccessible pages available through the class property values REST API (CVSS 8.7, xwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…)
- [CVE-2025-49583](https://cve.now/CVE-2025-49583.md): XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right (CVSS 5.1, xwiki-platform · org.xwiki.platform:xwiki-platform-notifica…)
- [CVE-2025-49582](https://cve.now/CVE-2025-49582.md): XWiki's required right warnings for macros are incomplete (CVSS 8.6, xwiki-platform · org.xwiki.platform:xwiki-platform-rende… +3)
- [CVE-2025-49581](https://cve.now/CVE-2025-49581.md): XWiki allows remote code execution through default value of wiki macro wiki-type parameters (CVSS 8.7, xwiki-platform · org.xwiki.platform:xwiki-platform-renderin…)
- [CVE-2025-49580](https://cve.now/CVE-2025-49580.md): XWiki allows privilege escalation through link refactoring (CVSS 8.5, xwiki-platform · org.xwiki.platform:xwiki-platform-refactor…)
- [CVE-2025-48915](https://cve.now/CVE-2025-48915.md): COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-076 (CVSS 8.6, Drupal COOKiES Consent Management · drupal/cookies)
- [CVE-2025-48914](https://cve.now/CVE-2025-48914.md): COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075 (CVSS 8.6, Drupal COOKiES Consent Management · drupal/cookies)
- [CVE-2025-6052](https://cve.now/CVE-2025-6052.md): Glib: integer overflow in g\_string\_maybe\_expand() leading to potential buffer overflow in glib gstring (CVSS 3.7, Red Hat Enterprise Linux)
- [CVE-2025-48920](https://cve.now/CVE-2025-48920.md): etracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074 (CVSS 7.3, Drupal etracker · drupal/etracker)
- [CVE-2025-48919](https://cve.now/CVE-2025-48919.md): Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-073 (CVSS 5.0, Drupal Simple Klaro · drupal/simple\_klaro)
- [CVE-2025-48917](https://cve.now/CVE-2025-48917.md): EU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072 (CVSS 5.0, Drupal EU Cookie Compliance · drupal/eu\_cookie\_compliance)
- [CVE-2025-48918](https://cve.now/CVE-2025-48918.md): Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071 (CVSS 8.8, Drupal Simple Klaro · drupal/simple\_klaro)
- [CVE-2025-48916](https://cve.now/CVE-2025-48916.md): Bookable Calendar - Less critical - Access bypass - SA-CONTRIB-2025-070 (CVSS 6.5, Drupal Bookable Calendar · drupal/bookable\_calendar)
- [CVE-2025-6035](https://cve.now/CVE-2025-6035.md): Gimp: gimp integer overflow (CVSS 6.1, gimp · Red Hat Enterprise Linux)
- [CVE-2025-6030](https://cve.now/CVE-2025-6030.md): Autoeastern Smart Keyless Entry System Replay Attack (CVSS 9.4, Autoeastern Cyclone Matrix TRF)
- [CVE-2025-36631](https://cve.now/CVE-2025-36631.md): Local Privilege Escalation (CVSS 8.4, Tenable Agent)
- [CVE-2025-6029](https://cve.now/CVE-2025-6029.md): KIA-branded Aftermarket Generic Smart Keyless Entry System Replay Attack (CVSS 9.4, KIA Aftermarket Generic Smart Keyless Entry System)
- [CVE-2025-36633](https://cve.now/CVE-2025-36633.md): Local Privilege Escalation (CVSS 8.8, Tenable Agent)
- [CVE-2025-49468](https://cve.now/CVE-2025-49468.md): Joomla Extension - nobossextensions.com - SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla (CVSS 8.6, nobossextensions.com No Boss Calendar component for Joomla)
- [CVE-2025-29902](https://cve.now/CVE-2025-29902.md): Remote code execution that allows unauthorized users to execute arbitrary code on the server machine. (CVSS 10.0, Telex Remote Dispatch Console Server · RTS VLink Virtual Ma…)
- [CVE-2025-48825](https://cve.now/CVE-2025-48825.md): RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 contains an issue with use of less trusted source, which may allow an attacker who (CVSS 2.5, Ricoh Company RICOH Streamline NX V3 PC Client)
- [CVE-2025-46783](https://cve.now/CVE-2025-46783.md): Path traversal vulnerability exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. (CVSS 9.8, Ricoh Company RICOH Streamline NX V3 PC Client)
- [CVE-2025-36506](https://cve.now/CVE-2025-36506.md): External control of file name or path issue exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. (CVSS 6.5, Ricoh Company RICOH Streamline NX V3 PC Client)
- [CVE-2025-6012](https://cve.now/CVE-2025-6012.md): Auto Attachments \<= 1.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, kaisercrazy Auto Attachments)
- [CVE-2025-39240](https://cve.now/CVE-2025-39240.md): Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation. (CVSS 7.2, Hikvision DS-3WAP622G-SI · Hikvision DS-3WAP623E-SI +4)
- [CVE-2024-38824](https://cve.now/CVE-2024-38824.md): CVE-2024-38824 salt advisory (CVSS 9.6, VMware SALT · salt)
- [CVE-2025-22242](https://cve.now/CVE-2025-22242.md): CVE-2025-22242 salt advisory (CVSS 5.6, VMware SALT · salt)
- [CVE-2025-22241](https://cve.now/CVE-2025-22241.md): CVE-2025-22241 salt advisory (CVSS 5.6, VMware SALT · salt)
- [CVE-2025-22240](https://cve.now/CVE-2025-22240.md): CVE-2025-22240 salt advisory (CVSS 6.3, VMware SALT · salt)
- [CVE-2025-22239](https://cve.now/CVE-2025-22239.md): CVE-2025-22239 salt advisory (CVSS 8.1, VMware SALT · salt)
- [CVE-2025-22238](https://cve.now/CVE-2025-22238.md): CVE-2025-22238 salt advisory (CVSS 4.2, VMware SALT · salt)
- [CVE-2025-22237](https://cve.now/CVE-2025-22237.md): CVE-2025-22237 salt advisory (CVSS 6.7, VMware SALT · salt)
- [CVE-2025-22236](https://cve.now/CVE-2025-22236.md): CVE-2025-22236 salt advisory (CVSS 8.1, VMware SALT · salt)
- [CVE-2024-38825](https://cve.now/CVE-2024-38825.md): CVE-2024-38825 Salt Advisory (CVSS 6.4, VMware SALT · salt)
- [CVE-2024-38823](https://cve.now/CVE-2024-38823.md): CVE-2024-38823 Salt Advisory (CVSS 2.7, VMware SALT)
- [CVE-2025-5923](https://cve.now/CVE-2025-5923.md): Game Review Block \<= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter (CVSS 6.4, marcdk Game Review Block)
- [CVE-2024-38822](https://cve.now/CVE-2024-38822.md): CVE-2024-38822 Salt Advisory (CVSS 2.7, VMware SALT)
- [CVE-2025-4227](https://cve.now/CVE-2025-4227.md): GlobalProtect App: Interception in Endpoint Traffic Policy Enforcement (CVSS 1.0, Palo Alto Networks GlobalProtect App)
- [CVE-2025-4229](https://cve.now/CVE-2025-4229.md): PAN-OS: Traffic Information Disclosure Vulnerability (CVSS 6.0, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-5282](https://cve.now/CVE-2025-5282.md): WP Travel Engine \<= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (CVSS 7.5, wptravelengine WP Travel Engine – Tour Booking Plugin – Tou…)
- [CVE-2025-5815](https://cve.now/CVE-2025-5815.md): Traffic Monitor \<= 3.2.2 - Missing Authorization to Unauthenticated Settings Update (CVSS 5.3, dmitriamartin Traffic Monitor)
- [CVE-2025-5491](https://cve.now/CVE-2025-5491.md): Acer ControlCenter - Remote Code Execution (CVSS 8.8, Acer ControlCenter)
- [CVE-2025-5928](https://cve.now/CVE-2025-5928.md): WP Sliding Login/Dashboard Panel \<= 2.1.1 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, fay-1 WP Sliding Login/Dashboard Panel)
- [CVE-2025-5938](https://cve.now/CVE-2025-5938.md): Digital Marketing and Agency Templates Addons for Elementor \<= 1.1.1 - Cross-Site Request Forgery to Import (CVSS 5.3, themebon Digital Marketing and Agency Templates Addons for…)
- [CVE-2025-5123](https://cve.now/CVE-2025-5123.md): Contact Us Page – Contact People \<= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via style Parameter (CVSS 6.4, a3rev Contact Us Page – Contact People)
- [CVE-2025-5939](https://cve.now/CVE-2025-5939.md): Telegram for WP \<= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, amir-mousavi Telegram for WP)
- [CVE-2025-4586](https://cve.now/CVE-2025-4586.md): IRM Newsroom \<= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmcalendarview' Shortcode (CVSS 6.4, irmau IRM Newsroom)
- [CVE-2025-5233](https://cve.now/CVE-2025-5233.md): Color Palette \<= 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via hex Parameter (CVSS 6.4, thatdevgirl Color Palette)
- [CVE-2025-5930](https://cve.now/CVE-2025-5930.md): WP2HTML \<= 1.0.2 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, digitalacornjp WP2HTML)
- [CVE-2025-5841](https://cve.now/CVE-2025-5841.md): ACF Onyx Poll \<= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter (CVSS 6.4, andremacola ACF Onyx Poll)
- [CVE-2025-5926](https://cve.now/CVE-2025-5926.md): Link Shield \<= 0.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, jconti Link Shield)
- [CVE-2025-5950](https://cve.now/CVE-2025-5950.md): IndieBlocks \<= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via kind Parameter (CVSS 6.4, janboddez IndieBlocks)
- [CVE-2025-4584](https://cve.now/CVE-2025-4584.md): IRM Newsroom \<= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmeventlist' Shortcode (CVSS 6.4, irmau IRM Newsroom)
- [CVE-2025-5288](https://cve.now/CVE-2025-5288.md): REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation via process\_handler Function (CVSS 9.8, weboccults REST API | Custom API Generator For Cross Platfo…)
- [CVE-2025-4585](https://cve.now/CVE-2025-4585.md): IRM Newsroom \<= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmflat' Shortcode (CVSS 6.4, irmau IRM Newsroom)
- [CVE-2025-47959](https://cve.now/CVE-2025-47959.md): Visual Studio Remote Code Execution Vulnerability (CVSS 7.1, Microsoft Visual Studio)
- [CVE-2025-30399](https://cve.now/CVE-2025-30399.md): .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 7.5, Microsoft .NET · Microsoft Visual Studio +13)
- [CVE-2025-28380](https://cve.now/CVE-2025-28380.md): A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via inje (CVSS 6.1, openc3)
- [CVE-2025-28381](https://cve.now/CVE-2025-28381.md): A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all conta (CVSS 7.5, openc3)
- [CVE-2025-28382](https://cve.now/CVE-2025-28382.md): An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal. (CVSS 7.5, openc3 · openc3-cosmos-tool-iframe)
- [CVE-2025-28384](https://cve.now/CVE-2025-28384.md): An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal. (CVSS 9.1, openc3 · openc3-cosmos-tool-iframe)
- [CVE-2025-28386](https://cve.now/CVE-2025-28386.md): A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary (CVSS 9.8, openc3)
- [CVE-2025-28388](https://cve.now/CVE-2025-28388.md): OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account. (CVSS 9.8, openc3)
- [CVE-2025-28389](https://cve.now/CVE-2025-28389.md): Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack. (CVSS 9.8, openc3)
- [CVE-2025-45984](https://cve.now/CVE-2025-45984.md): Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100\_AZ3 V1.0.4, BL-X10\_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200\_AT1 V1.0.0, BL-X26\_AC8 (CVSS 9.8)
- [CVE-2025-45985](https://cve.now/CVE-2025-45985.md): Blink routers BL-WR9000 V2.4.9 , BL-AC2100\_AZ3 V1.0.4, BL-X10\_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200\_AT1 v1.0.0, BL-X26\_AC8 v1.2.8, BLAC450 (CVSS 9.8)
- [CVE-2025-45986](https://cve.now/CVE-2025-45986.md): Blink routers BL-WR9000 V2.4.9 , BL-AC2100\_AZ3 V1.0.4, BL-X10\_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200\_AT1 v1.0.0, BL-X26\_AC8 v1.2.8, BLAC450 (CVSS 9.8)
- [CVE-2025-45987](https://cve.now/CVE-2025-45987.md): Blink routers BL-WR9000 V2.4.9 , BL-AC2100\_AZ3 V1.0.4, BL-X10\_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200\_AT1 v1.0.0, BL-X26\_AC8 v1.2.8, BLAC450 (CVSS 9.8)
- [CVE-2025-45988](https://cve.now/CVE-2025-45988.md): Blink routers BL-WR9000 V2.4.9 , BL-AC2100\_AZ3 V1.0.4, BL-X10\_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200\_AT1 v1.0.0, BL-X26\_AC8 v1.2.8, BLAC450 (CVSS 9.8)
- [CVE-2025-46060](https://cve.now/CVE-2025-46060.md): Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866\_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD\_FIL (CVSS 9.8)
- [CVE-2025-46096](https://cve.now/CVE-2025-46096.md): Directory Traversal vulnerability in solon v.3.1.2 allows a remote attacker to conduct XSS attacks via the solon-faas-luffy component (CVSS 6.1, org.noear:solon-faas-luffy)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.