# CVEs published 2025-06-16

95 CVEs were published on June 16, 2025: 10 critical, 37 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-6146](https://cve.now/CVE-2025-6146.md): TOTOLINK X15 HTTP POST Request formSysLog buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-6145](https://cve.now/CVE-2025-6145.md): TOTOLINK EX1200T HTTP POST Request formSysLog buffer overflow (CVSS 8.7, TOTOLINK EX1200T)
- [CVE-2025-6144](https://cve.now/CVE-2025-6144.md): TOTOLINK EX1200T HTTP POST Request formSysCmd buffer overflow (CVSS 8.7, TOTOLINK EX1200T)
- [CVE-2025-6143](https://cve.now/CVE-2025-6143.md): TOTOLINK EX1200T HTTP POST Request formNtp buffer overflow (CVSS 8.7, TOTOLINK EX1200T)
- [CVE-2025-48992](https://cve.now/CVE-2025-48992.md): Group-Office vulnerable to blind XSS (CVSS 5.2, Intermesh groupoffice)
- [CVE-2025-6142](https://cve.now/CVE-2025-6142.md): Intera InHire server-side request forgery (CVSS 5.3, Intera InHire)
- [CVE-2025-6141](https://cve.now/CVE-2025-6141.md): GNU ncurses parse\_entry.c postprocess\_termcap stack-based overflow (CVSS 4.8, GNU ncurses)
- [CVE-2025-43200](https://cve.now/CVE-2025-43200.md): This issue was addressed with improved checks. (CVSS 4.2, KEV, Apple iOS and iPadOS · Apple iPadOS +3)
- [CVE-2025-6140](https://cve.now/CVE-2025-6140.md): spdlog pattern\_formatter-inl.h scoped\_padder resource consumption (CVSS 4.8, spdlog)
- [CVE-2025-49134](https://cve.now/CVE-2025-49134.md): Weblate exposes personal IP address via e-mail (CVSS 2.1, WeblateOrg weblate · weblate)
- [CVE-2025-6139](https://cve.now/CVE-2025-6139.md): TOTOLINK T10 shadow.sample hard-coded password (CVSS 2.0, TOTOLINK T10)
- [CVE-2025-47951](https://cve.now/CVE-2025-47951.md): Weblate lacks rate limiting when verifying second factor (CVSS 4.9, WeblateOrg weblate · weblate)
- [CVE-2025-32800](https://cve.now/CVE-2025-32800.md): Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI (CVSS 7.2, conda-build)
- [CVE-2025-6138](https://cve.now/CVE-2025-6138.md): TOTOLINK T10 HTTP POST Request cstecgi.cgi setWizardCfg buffer overflow (CVSS 8.7, TOTOLINK T10)
- [CVE-2025-32799](https://cve.now/CVE-2025-32799.md): Conda-build Vulnerable to Path Traversal via Malicious Tar File (CVSS 5.6, conda-build)
- [CVE-2025-32798](https://cve.now/CVE-2025-32798.md): Conda-build Allows Arbitrary Code Execution via Malicious Recipe Selectors (CVSS 8.2, conda-build)
- [CVE-2025-6137](https://cve.now/CVE-2025-6137.md): TOTOLINK T10 HTTP POST Request cstecgi.cgi setWiFiScheduleCfg buffer overflow (CVSS 8.7, TOTOLINK T10)
- [CVE-2025-6136](https://cve.now/CVE-2025-6136.md): Projectworlds Life Insurance Management System insertPayment.php sql injection (CVSS 5.3, Projectworlds Life Insurance Management System)
- [CVE-2025-6135](https://cve.now/CVE-2025-6135.md): Projectworlds Life Insurance Management System insertNominee.php sql injection (CVSS 5.3, Projectworlds Life Insurance Management System)
- [CVE-2025-32797](https://cve.now/CVE-2025-32797.md): Conda-build Insecure Build Script Permissions Enabling Arbitrary Code Execution (CVSS 6.0, conda-build)
- [CVE-2025-6134](https://cve.now/CVE-2025-6134.md): Projectworlds Life Insurance Management System insertClient.php sql injection (CVSS 5.3, Projectworlds Life Insurance Management System)
- [CVE-2025-6087](https://cve.now/CVE-2025-6087.md): SSRF vulnerability in opennextjs-cloudflare via /\_next/image endpoint (CVSS 7.8, opennextjs-cloudflare · @opennextjs/cloudflare)
- [CVE-2025-6133](https://cve.now/CVE-2025-6133.md): Projectworlds Life Insurance Management System insertagent.php sql injection (CVSS 5.3, Projectworlds Life Insurance Management System)
- [CVE-2025-6132](https://cve.now/CVE-2025-6132.md): Chanjet CRM departmentsetting.php sql injection (CVSS 6.9, Chanjet CRM)
- [CVE-2025-6131](https://cve.now/CVE-2025-6131.md): CodeAstro Food Ordering System POST Request Parameter edit cross site scripting (CVSS 4.8, CodeAstro Food Ordering System)
- [CVE-2025-6179](https://cve.now/CVE-2025-6179.md): ChromeOS Extension Disablement and Developer Mode Bypass via ExtHang3r and ExtPrint3r Exploits (CVSS 9.8, Google ChromeOS)
- [CVE-2025-6177](https://cve.now/CVE-2025-6177.md): ChromeOS MiniOS Root Code Execution Bypass While Dev Mode Blocked (CVSS 7.4, Google ChromeOS)
- [CVE-2025-6130](https://cve.now/CVE-2025-6130.md): TOTOLINK EX1200T HTTP POST Request formStats buffer overflow (CVSS 8.7, TOTOLINK EX1200T)
- [CVE-2025-2327](https://cve.now/CVE-2025-2327.md): FlashArray KEK Logging Vulnerability (CVSS 5.1, Pure Storage FlashArray)
- [CVE-2025-5309](https://cve.now/CVE-2025-5309.md): Remote Support & Privileged Remote Access server side template injection (CVSS 8.6, BeyondTrust Remote support & Privileged Remote Access · Bey…)
- [CVE-2025-6129](https://cve.now/CVE-2025-6129.md): TOTOLINK EX1200T HTTP POST Request formSaveConfig buffer overflow (CVSS 8.7, TOTOLINK EX1200T)
- [CVE-2025-6128](https://cve.now/CVE-2025-6128.md): TOTOLINK EX1200T HTTP POST Request formWirelessTbl buffer overflow (CVSS 8.7, TOTOLINK EX1200T)
- [CVE-2025-49794](https://cve.now/CVE-2025-49794.md): Libxml: heap use after free (uaf) leads to denial of service (dos) (CVSS 9.1, libxml2 · Red Hat Enterprise Linux +10)
- [CVE-2025-6170](https://cve.now/CVE-2025-6170.md): Libxml2: stack buffer overflow in xmllint interactive shell command handling (CVSS 2.5, libxml2 · Red Hat Enterprise Linux +9)
- [CVE-2025-49795](https://cve.now/CVE-2025-49795.md): Libxml: null pointer dereference leads to denial of service (dos) (CVSS 7.5, GNOME libxml2 · Red Hat Enterprise Linux +2)
- [CVE-2025-49796](https://cve.now/CVE-2025-49796.md): Libxml: type confusion leads to denial of service (dos) (CVSS 9.1, libxml2 · Red Hat Enterprise Linux +10)
- [CVE-2025-48976](https://cve.now/CVE-2025-48976.md): Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers (CVSS 7.5, Apache Software Foundation Apache Commons FileUpload · c… +1)
- [CVE-2025-6127](https://cve.now/CVE-2025-6127.md): PHPGurukul Nipah Virus Testing Management System search-report.php cross site scripting (CVSS 5.1, PHPGurukul Nipah Virus Testing Management System)
- [CVE-2025-4565](https://cve.now/CVE-2025-4565.md): Unbounded recursion in Python Protobuf (CVSS 8.2, protocolbuffers Python-Protobuf · protobuf)
- [CVE-2025-6126](https://cve.now/CVE-2025-6126.md): PHPGurukul Rail Pass Management System contact.php cross site scripting (CVSS 5.3, PHPGurukul Rail Pass Management System)
- [CVE-2025-49124](https://cve.now/CVE-2025-49124.md): Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows (CVSS 8.4, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2025-3526](https://cve.now/CVE-2025-3526.md): SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsuppo (CVSS 8.7, Liferay Portal · Liferay DXP +1)
- [CVE-2025-49125](https://cve.now/CVE-2025-49125.md): Apache Tomcat: Security constraint bypass for pre/post-resources (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2025-3594](https://cve.now/CVE-2025-3594.md): Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 G (CVSS 8.6, Liferay Portal · Liferay DXP +1)
- [CVE-2025-48988](https://cve.now/CVE-2025-48988.md): Apache Tomcat: FileUpload large number of parts with headers DoS (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2025-6125](https://cve.now/CVE-2025-6125.md): PHPGurukul Rail Pass Management System aboutus.php cross site scripting (CVSS 4.8, PHPGurukul Rail Pass Management System)
- [CVE-2025-36632](https://cve.now/CVE-2025-36632.md): Local Privilege Escalation (CVSS 7.8, Tenable Agent)
- [CVE-2025-3602](https://cve.now/CVE-2025-3602.md): Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and (CVSS 8.7, Liferay Portal · Liferay DXP +1)
- [CVE-2025-6124](https://cve.now/CVE-2025-6124.md): code-projects Restaurant Order System tablelow.php sql injection (CVSS 6.9, code-projects Restaurant Order System)
- [CVE-2025-6123](https://cve.now/CVE-2025-6123.md): code-projects Restaurant Order System payment.php sql injection (CVSS 6.9, code-projects Restaurant Order System)
- [CVE-2025-6122](https://cve.now/CVE-2025-6122.md): code-projects Restaurant Order System table.php sql injection (CVSS 5.3, code-projects Restaurant Order System)
- [CVE-2025-6121](https://cve.now/CVE-2025-6121.md): D-Link DIR-632 HTTP POST Request get\_pure\_content stack-based overflow (CVSS 9.3, D-Link DIR-632)
- [CVE-2025-5689](https://cve.now/CVE-2025-5689.md): Improper Permission Management in SSH Session Handling (CVSS 8.5, Canonical authd · github.com/ubuntu/authd)
- [CVE-2025-6120](https://cve.now/CVE-2025-6120.md): Open Asset Import Library Assimp HL1MDLLoader.cpp read\_meshes heap-based overflow (CVSS 4.8, Open Asset Import Library Assimp)
- [CVE-2025-24388](https://cve.now/CVE-2025-24388.md): Unsafe handling of AJAX calls (CVSS 3.8, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2025-46710](https://cve.now/CVE-2025-46710.md): Possible kernel exceptions caused by reading and writing kernel heap data after free. (CVSS 5.7, Imagination Technologies Graphics DDK)
- [CVE-2025-40916](https://cve.now/CVE-2025-40916.md): Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha text (CVSS 9.1, GRYPHON Mojolicious::Plugin::CaptchaPNG)
- [CVE-2025-4748](https://cve.now/CVE-2025-4748.md): Absolute path traversal in zip:unzip/1,2 (CVSS 4.8, Erlang OTP)
- [CVE-2025-47869](https://cve.now/CVE-2025-47869.md): Apache NuttX RTOS: examples/xmlrpc: Fix calls buffers size. (CVSS 9.8, Apache Software Foundation Apache NuttX RTOS)
- [CVE-2025-6119](https://cve.now/CVE-2025-6119.md): Open Asset Import Library Assimp BVHLoader.cpp ReadNodeChannels use after free (CVSS 4.8, Open Asset Import Library Assimp)
- [CVE-2025-47868](https://cve.now/CVE-2025-47868.md): Apache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition. (CVSS 9.8, Apache Software Foundation Apache NuttX RTOS: tools/bdf-con…)
- [CVE-2025-6118](https://cve.now/CVE-2025-6118.md): Das Parking Management System 停车场管理系统 API search sql injection (CVSS 6.9, Das Parking Management System 停车场管理系统)
- [CVE-2025-6117](https://cve.now/CVE-2025-6117.md): Das Parking Management System 停车场管理系统 API Search sql injection (CVSS 6.9, Das Parking Management System 停车场管理系统)
- [CVE-2025-25265](https://cve.now/CVE-2025-25265.md): Unauthenticated File Read via Web Interface (CVSS 4.9, WAGO CC100 0751-9x01 · WAGO PFC100 G1 0750-810x/xxxx-xx… +10)
- [CVE-2025-25264](https://cve.now/CVE-2025-25264.md): Overly Permissive CORS Policy in WAGO Device Manager (CVSS 6.5, WAGO CC100 0751-9x01 · WAGO PFC100 G1 0750-810x/xxxx-xx… +10)
- [CVE-2025-6116](https://cve.now/CVE-2025-6116.md): Das Parking Management System 停车场管理系统 API Search sql injection (CVSS 6.9, Das Parking Management System 停车场管理系统)
- [CVE-2025-3464](https://cve.now/CVE-2025-3464.md): A race condition vulnerability exists in Armoury Crate. (CVSS 8.4, ASUS Armoury Crate)
- [CVE-2025-6115](https://cve.now/CVE-2025-6115.md): D-Link DIR-619L form\_macfilter stack-based overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-6172](https://cve.now/CVE-2025-6172.md): Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation. (CVSS 9.8, TECNO com.afmobi.boomplayer)
- [CVE-2025-6114](https://cve.now/CVE-2025-6114.md): D-Link DIR-619L form\_portforwarding stack-based overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-40729](https://cve.now/CVE-2025-40729.md): Reflected Cross-Site Scripting (XSS) vulnerability in Customer Support System (CVSS 4.8, Customer Support System)
- [CVE-2025-40728](https://cve.now/CVE-2025-40728.md): SQL injection vulnerability in Customer Support System (CVSS 8.7, Customer Support System)
- [CVE-2025-2091](https://cve.now/CVE-2025-2091.md): Open redirection in M-Files Mobile (CVSS 4.8, M-Files Mobile)
- [CVE-2025-40726](https://cve.now/CVE-2025-40726.md): Cross-Site Scripting (XSS) reflected in Nosto (CVSS 5.1, Nosto)
- [CVE-2025-40727](https://cve.now/CVE-2025-40727.md): Reflected Cross-Site Scripting (XSS) in Phoenix CMS (CVSS 5.1, Phoenix BV Phoenix CMS)
- [CVE-2025-6113](https://cve.now/CVE-2025-6113.md): Tenda FH1203 AdvSetLanip fromadvsetlanip buffer overflow (CVSS 8.7, Tenda FH1203)
- [CVE-2025-6112](https://cve.now/CVE-2025-6112.md): Tenda FH1205 AdvSetLanip fromadvsetlanip buffer overflow (CVSS 8.7, Tenda FH1205)
- [CVE-2025-4987](https://cve.now/CVE-2025-4987.md): Stored Cross-site Scripting (XSS) vulnerability affecting Opportunity Management in Project Portfolio Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x (CVSS 8.7, Dassault Systèmes Project Portfolio Manager)
- [CVE-2025-6111](https://cve.now/CVE-2025-6111.md): Tenda FH1205 VirtualSer fromVirtualSer stack-based overflow (CVSS 8.7, Tenda FH1205)
- [CVE-2025-6110](https://cve.now/CVE-2025-6110.md): Tenda FH1201 SafeMacFilter stack-based overflow (CVSS 8.7, Tenda FH1201)
- [CVE-2025-6169](https://cve.now/CVE-2025-6169.md): HAMASTAR Technology WIMP website co-construction management platform - SQL Injection (CVSS 9.8, HAMASTAR Technology WIMP)
- [CVE-2025-6109](https://cve.now/CVE-2025-6109.md): javahongxi whatsmars InitializrController.java initialize path traversal (CVSS 5.3, javahongxi whatsmars)
- [CVE-2025-6108](https://cve.now/CVE-2025-6108.md): hansonwang99 Spring-Boot-In-Action File Upload ImageUploadService.java watermarkTest path traversal (CVSS 5.3, hansonwang99 Spring-Boot-In-Action)
- [CVE-2025-6107](https://cve.now/CVE-2025-6107.md): comfyanonymous comfyui utils.py set\_attr dynamically-determined object attributes (CVSS 2.3, comfyanonymous comfyui)
- [CVE-2025-6106](https://cve.now/CVE-2025-6106.md): WuKongOpenSource WukongCRM AdminRoleController.java cross-site request forgery (CVSS 5.3, WuKongOpenSource WukongCRM)
- [CVE-2025-6105](https://cve.now/CVE-2025-6105.md): jflyfox jfinal\_cms HOME.java cross-site request forgery (CVSS 5.3, jflyfox jfinal\_cms)
- [CVE-2025-6104](https://cve.now/CVE-2025-6104.md): Wifi-soft UniBox Controller pms\_check.php os command injection (CVSS 8.7, Wifi-soft UniBox Controller)
- [CVE-2025-6103](https://cve.now/CVE-2025-6103.md): Wifi-soft UniBox Controller test\_accesscodelogin.php os command injection (CVSS 8.7, Wifi-soft UniBox Controller)
- [CVE-2025-6102](https://cve.now/CVE-2025-6102.md): Wifi-soft UniBox Controller logout.php os command injection (CVSS 8.7, Wifi-soft UniBox Controller)
- [CVE-2025-6101](https://cve.now/CVE-2025-6101.md): letta-ai letta interface.py function\_message eval injection (CVSS 5.1, letta-ai letta)
- [CVE-2025-6100](https://cve.now/CVE-2025-6100.md): realguoshuai open-video-cms list sql injection (CVSS 5.3, realguoshuai open-video-cms)
- [CVE-2025-6099](https://cve.now/CVE-2025-6099.md): szluyu99 gin-vue-blog PATCH Request manager.go improper authorization (CVSS 6.9, szluyu99 gin-vue-blog)
- [CVE-2025-6098](https://cve.now/CVE-2025-6098.md): UTT 进取 750W API setSysAdm strcpy buffer overflow (CVSS 9.3, UTT 进取)
- [CVE-2025-6097](https://cve.now/CVE-2025-6097.md): UTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password change (CVSS 6.9, UTT 进取)
- [CVE-2025-27587](https://cve.now/CVE-2025-27587.md): OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of r (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.