CVEs published June 16, 2025
95 CVEs were published on June 16, 2025: 10 critical, 37 high. 1 is now in CISA KEV.
- Published
- 95
- Critical
- 10
- High
- 37
- Medium
- 43
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 31
Most affected products
- TOTOLINK EX1200T
- 6
- conda-build
- 4
- Projectworlds Life Insurance Management System
- 4
- code-projects Restaurant Order System
- 3
- Das Parking Management System 停车场管理系统
- 3
- Liferay Portal · Liferay DXP +1
- 3
- TOTOLINK T10
- 3
- Wifi-soft UniBox Controller
- 3
- Apache Software Foundation Apache Tomcat · org.apache.to… +1
- 2
- Customer Support System
- 2
Critical 10
- CVE-2025-6179ChromeOS Extension Disablement and Developer Mode Bypass via ExtHang3r and ExtPrint3r ExploitsGoogle ChromeOS
- CVE-2025-49794Libxml: heap use after free (uaf) leads to denial of service (dos)libxml2 · Red Hat Enterprise Linux +10
- CVE-2025-49796Libxml: type confusion leads to denial of service (dos)libxml2 · Red Hat Enterprise Linux +10
- CVE-2025-6121D-Link DIR-632 HTTP POST Request get_pure_content stack-based overflowD-Link DIR-632
- CVE-2025-40916Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha textGRYPHON Mojolicious::Plugin::CaptchaPNG
- CVE-2025-47869Apache NuttX RTOS: examples/xmlrpc: Fix calls buffers size.Apache Software Foundation Apache NuttX RTOS
- CVE-2025-47868Apache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition.Apache Software Foundation Apache NuttX RTOS: tools/bdf-con…
- CVE-2025-6172Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation.TECNO com.afmobi.boomplayer
- CVE-2025-6169HAMASTAR Technology WIMP website co-construction management platform - SQL InjectionHAMASTAR Technology WIMP
- CVE-2025-6098UTT 进取 750W API setSysAdm strcpy buffer overflowUTT 进取
High 37
- CVE-2025-6146TOTOLINK X15 HTTP POST Request formSysLog buffer overflowTOTOLINK X15
- CVE-2025-6145TOTOLINK EX1200T HTTP POST Request formSysLog buffer overflowTOTOLINK EX1200T
- CVE-2025-6144TOTOLINK EX1200T HTTP POST Request formSysCmd buffer overflowTOTOLINK EX1200T
- CVE-2025-6143TOTOLINK EX1200T HTTP POST Request formNtp buffer overflowTOTOLINK EX1200T
- CVE-2025-32800Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPIconda-build
- CVE-2025-6138TOTOLINK T10 HTTP POST Request cstecgi.cgi setWizardCfg buffer overflowTOTOLINK T10
- CVE-2025-32798Conda-build Allows Arbitrary Code Execution via Malicious Recipe Selectorsconda-build
- CVE-2025-6137TOTOLINK T10 HTTP POST Request cstecgi.cgi setWiFiScheduleCfg buffer overflowTOTOLINK T10
- CVE-2025-6087SSRF vulnerability in opennextjs-cloudflare via /_next/image endpointopennextjs-cloudflare · @opennextjs/cloudflare
- CVE-2025-6177ChromeOS MiniOS Root Code Execution Bypass While Dev Mode BlockedGoogle ChromeOS
- CVE-2025-6130TOTOLINK EX1200T HTTP POST Request formStats buffer overflowTOTOLINK EX1200T
- CVE-2025-5309Remote Support & Privileged Remote Access server side template injectionBeyondTrust Remote support & Privileged Remote Access · Bey…
- CVE-2025-6129TOTOLINK EX1200T HTTP POST Request formSaveConfig buffer overflowTOTOLINK EX1200T
- CVE-2025-6128TOTOLINK EX1200T HTTP POST Request formWirelessTbl buffer overflowTOTOLINK EX1200T
- CVE-2025-49795Libxml: null pointer dereference leads to denial of service (dos)GNOME libxml2 · Red Hat Enterprise Linux +2
- CVE-2025-48976Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headersApache Software Foundation Apache Commons FileUpload · c… +1
- CVE-2025-4565Unbounded recursion in Python Protobufprotocolbuffers Python-Protobuf · protobuf
- CVE-2025-49124Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for WindowsApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2025-3526SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsuppoLiferay Portal · Liferay DXP +1
- CVE-2025-49125Apache Tomcat: Security constraint bypass for pre/post-resourcesApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2025-3594Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GLiferay Portal · Liferay DXP +1
- CVE-2025-48988Apache Tomcat: FileUpload large number of parts with headers DoSApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2025-36632Local Privilege EscalationTenable Agent
- CVE-2025-3602Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and Liferay Portal · Liferay DXP +1
- CVE-2025-5689Improper Permission Management in SSH Session HandlingCanonical authd · github.com/ubuntu/authd
- CVE-2025-3464A race condition vulnerability exists in Armoury Crate.ASUS Armoury Crate
- CVE-2025-6115D-Link DIR-619L form_macfilter stack-based overflowD-Link DIR-619L
- CVE-2025-6114D-Link DIR-619L form_portforwarding stack-based overflowD-Link DIR-619L
- CVE-2025-40728SQL injection vulnerability in Customer Support SystemCustomer Support System
- CVE-2025-6113Tenda FH1203 AdvSetLanip fromadvsetlanip buffer overflowTenda FH1203
- CVE-2025-6112Tenda FH1205 AdvSetLanip fromadvsetlanip buffer overflowTenda FH1205
- CVE-2025-4987Stored Cross-site Scripting (XSS) vulnerability affecting Opportunity Management in Project Portfolio Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025xDassault Systèmes Project Portfolio Manager
- CVE-2025-6111Tenda FH1205 VirtualSer fromVirtualSer stack-based overflowTenda FH1205
- CVE-2025-6110Tenda FH1201 SafeMacFilter stack-based overflowTenda FH1201
- CVE-2025-6104Wifi-soft UniBox Controller pms_check.php os command injectionWifi-soft UniBox Controller
- CVE-2025-6103Wifi-soft UniBox Controller test_accesscodelogin.php os command injectionWifi-soft UniBox Controller
- CVE-2025-6102Wifi-soft UniBox Controller logout.php os command injectionWifi-soft UniBox Controller
Medium, low and unrated 48
- CVE-2025-48992Group-Office vulnerable to blind XSSIntermesh groupoffice
- CVE-2025-6142Intera InHire server-side request forgeryIntera InHire
- CVE-2025-6141GNU ncurses parse_entry.c postprocess_termcap stack-based overflowGNU ncurses
- CVE-2025-43200This issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-6140spdlog pattern_formatter-inl.h scoped_padder resource consumptionspdlog
- CVE-2025-49134Weblate exposes personal IP address via e-mailWeblateOrg weblate · weblate
- CVE-2025-6139TOTOLINK T10 shadow.sample hard-coded passwordTOTOLINK T10
- CVE-2025-47951Weblate lacks rate limiting when verifying second factorWeblateOrg weblate · weblate
- CVE-2025-32799Conda-build Vulnerable to Path Traversal via Malicious Tar Fileconda-build
- CVE-2025-6136Projectworlds Life Insurance Management System insertPayment.php sql injectionProjectworlds Life Insurance Management System
- CVE-2025-6135Projectworlds Life Insurance Management System insertNominee.php sql injectionProjectworlds Life Insurance Management System
- CVE-2025-32797Conda-build Insecure Build Script Permissions Enabling Arbitrary Code Executionconda-build
- CVE-2025-6134Projectworlds Life Insurance Management System insertClient.php sql injectionProjectworlds Life Insurance Management System
- CVE-2025-6133Projectworlds Life Insurance Management System insertagent.php sql injectionProjectworlds Life Insurance Management System
- CVE-2025-6132Chanjet CRM departmentsetting.php sql injectionChanjet CRM
- CVE-2025-6131CodeAstro Food Ordering System POST Request Parameter edit cross site scriptingCodeAstro Food Ordering System
- CVE-2025-2327FlashArray KEK Logging VulnerabilityPure Storage FlashArray
- CVE-2025-6170Libxml2: stack buffer overflow in xmllint interactive shell command handlinglibxml2 · Red Hat Enterprise Linux +9
- CVE-2025-6127PHPGurukul Nipah Virus Testing Management System search-report.php cross site scriptingPHPGurukul Nipah Virus Testing Management System
- CVE-2025-6126PHPGurukul Rail Pass Management System contact.php cross site scriptingPHPGurukul Rail Pass Management System
- CVE-2025-6125PHPGurukul Rail Pass Management System aboutus.php cross site scriptingPHPGurukul Rail Pass Management System
- CVE-2025-6124code-projects Restaurant Order System tablelow.php sql injectioncode-projects Restaurant Order System
- CVE-2025-6123code-projects Restaurant Order System payment.php sql injectioncode-projects Restaurant Order System
- CVE-2025-6122code-projects Restaurant Order System table.php sql injectioncode-projects Restaurant Order System
- CVE-2025-6120Open Asset Import Library Assimp HL1MDLLoader.cpp read_meshes heap-based overflowOpen Asset Import Library Assimp
- CVE-2025-24388Unsafe handling of AJAX callsOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2025-46710Possible kernel exceptions caused by reading and writing kernel heap data after free.Imagination Technologies Graphics DDK
- CVE-2025-4748Absolute path traversal in zip:unzip/1,2Erlang OTP
- CVE-2025-6119Open Asset Import Library Assimp BVHLoader.cpp ReadNodeChannels use after freeOpen Asset Import Library Assimp
- CVE-2025-6118Das Parking Management System 停车场管理系统 API search sql injectionDas Parking Management System 停车场管理系统
- CVE-2025-6117Das Parking Management System 停车场管理系统 API Search sql injectionDas Parking Management System 停车场管理系统
- CVE-2025-25265Unauthenticated File Read via Web InterfaceWAGO CC100 0751-9x01 · WAGO PFC100 G1 0750-810x/xxxx-xx… +10
- CVE-2025-25264Overly Permissive CORS Policy in WAGO Device ManagerWAGO CC100 0751-9x01 · WAGO PFC100 G1 0750-810x/xxxx-xx… +10
- CVE-2025-6116Das Parking Management System 停车场管理系统 API Search sql injectionDas Parking Management System 停车场管理系统
- CVE-2025-40729Reflected Cross-Site Scripting (XSS) vulnerability in Customer Support SystemCustomer Support System
- CVE-2025-2091Open redirection in M-Files MobileM-Files Mobile
- CVE-2025-40726Cross-Site Scripting (XSS) reflected in NostoNosto
- CVE-2025-40727Reflected Cross-Site Scripting (XSS) in Phoenix CMSPhoenix BV Phoenix CMS
- CVE-2025-6109javahongxi whatsmars InitializrController.java initialize path traversaljavahongxi whatsmars
- CVE-2025-6108hansonwang99 Spring-Boot-In-Action File Upload ImageUploadService.java watermarkTest path traversalhansonwang99 Spring-Boot-In-Action
- CVE-2025-6107comfyanonymous comfyui utils.py set_attr dynamically-determined object attributescomfyanonymous comfyui
- CVE-2025-6106WuKongOpenSource WukongCRM AdminRoleController.java cross-site request forgeryWuKongOpenSource WukongCRM
- CVE-2025-6105jflyfox jfinal_cms HOME.java cross-site request forgeryjflyfox jfinal_cms
- CVE-2025-6101letta-ai letta interface.py function_message eval injectionletta-ai letta
- CVE-2025-6100realguoshuai open-video-cms list sql injectionrealguoshuai open-video-cms
- CVE-2025-6099szluyu99 gin-vue-blog PATCH Request manager.go improper authorizationszluyu99 gin-vue-blog
- CVE-2025-6097UTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password changeUTT 进取
- CVE-2025-27587OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of r