# CVEs published 2025-06-17 173 CVEs were published on June 17, 2025: 23 critical, 78 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2025-49149](https://cve.now/CVE-2025-49149.md): Dify has XSS vulnerability (CVSS 5.3, langgenius dify) - [CVE-2025-49825](https://cve.now/CVE-2025-49825.md): Teleport allows remote authentication bypass (CVSS 9.8, gravitational teleport · github.com/gravitational/teleport) - [CVE-2025-49593](https://cve.now/CVE-2025-49593.md): Portainer HTTP Headers May Leak to Malicious Container Registries (CVSS 6.8, portainer) - [CVE-2025-49385](https://cve.now/CVE-2025-49385.md): Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local att (CVSS 7.8, Trend Micro Internet Security) - [CVE-2025-49384](https://cve.now/CVE-2025-49384.md): Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local att (CVSS 7.8, Trend Micro Internet Security) - [CVE-2025-49824](https://cve.now/CVE-2025-49824.md): conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack (CVSS 1.7, conda-forge conda-smithy) - [CVE-2025-49843](https://cve.now/CVE-2025-49843.md): conda-smithy Has Incorrect Default File Permissions (CVSS 2.7, conda-forge conda-smithy) - [CVE-2025-48443](https://cve.now/CVE-2025-48443.md): Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Local Privilege Escalation Vulnerabil (CVSS 6.7, Trend Micro Password Manager) - [CVE-2025-49218](https://cve.now/CVE-2025-49218.md): A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges o (CVSS 7.7, Trend Micro Endpoint Encryption Policy Server) - [CVE-2025-49217](https://cve.now/CVE-2025-49217.md): An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exe (CVSS 9.8, Trend Micro Endpoint Encryption Policy Server) - [CVE-2025-49216](https://cve.now/CVE-2025-49216.md): An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as (CVSS 9.8, Trend Micro Endpoint Encryption Policy Server) - [CVE-2025-49215](https://cve.now/CVE-2025-49215.md): A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges o (CVSS 8.8, Trend Micro Endpoint Encryption Policy Server) - [CVE-2025-49214](https://cve.now/CVE-2025-49214.md): An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code ex (CVSS 8.8, Trend Micro Endpoint Encryption Policy Server) - [CVE-2025-49213](https://cve.now/CVE-2025-49213.md): An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exe (CVSS 9.8, Trend Micro Endpoint Encryption Policy Server) - [CVE-2025-49212](https://cve.now/CVE-2025-49212.md): An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code exe (CVSS 9.8, Trend Micro Endpoint Encryption Policy Server) - [CVE-2025-41388](https://cve.now/CVE-2025-41388.md): Fuji Electric Smart Editor Stack-based Buffer Overflow (CVSS 8.4, Fuji Electric Smart Editor) - [CVE-2025-41413](https://cve.now/CVE-2025-41413.md): Fuji Electric Smart Editor Out-of-bounds Write (CVSS 8.4, Fuji Electric Smart Editor) - [CVE-2025-32412](https://cve.now/CVE-2025-32412.md): Fuji Electric Smart Editor Out-of-bounds Read (CVSS 8.4, Fuji Electric Smart Editor) - [CVE-2025-49211](https://cve.now/CVE-2025-49211.md): A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected (CVSS 7.7, Trend Micro Endpoint Encryption Policy Server) - [CVE-2025-30642](https://cve.now/CVE-2025-30642.md): A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to create a denial of service (DoS) sit (CVSS 5.5, Trend Micro Deep Security) - [CVE-2025-30641](https://cve.now/CVE-2025-30641.md): A link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allow a local attacker to (CVSS 7.8, Trend Micro Deep Security) - [CVE-2025-30640](https://cve.now/CVE-2025-30640.md): A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected inst (CVSS 7.8, Trend Micro Deep Security) - [CVE-2025-49847](https://cve.now/CVE-2025-49847.md): llama.cpp Vulnerable to Buffer Overflow via Malicious GGUF Model (CVSS 8.8, ggml-org llama.cpp) - [CVE-2025-30680](https://cve.now/CVE-2025-30680.md): A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain paramete (CVSS 7.5, Trend Micro Apex Central) - [CVE-2025-30679](https://cve.now/CVE-2025-30679.md): A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to man (CVSS 6.5, Trend Micro Apex Central) - [CVE-2025-30678](https://cve.now/CVE-2025-30678.md): A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to man (CVSS 6.5, Trend Micro Apex Central) - [CVE-2025-5141](https://cve.now/CVE-2025-5141.md): Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache (CVSS 5.5, Fortra Core Privileged Access Manager) - [CVE-2025-34511](https://cve.now/CVE-2025-34511.md): Sitecore PowerShell Extension RCE via Unrestricted Upload (CVSS 8.8, Sitecore Powershell Extension) - [CVE-2025-34510](https://cve.now/CVE-2025-34510.md): Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip (CVSS 8.8, Sitecore Experience Manager · Sitecore Experience Platfo… +1) - [CVE-2025-49487](https://cve.now/CVE-2025-49487.md): An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attac (CVSS 6.8, Trend Micro Worry-Free Business Security Services) - [CVE-2025-49158](https://cve.now/CVE-2025-49158.md): An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalation privileges o (CVSS 6.7, Trend Micro Apex One) - [CVE-2025-49157](https://cve.now/CVE-2025-49157.md): A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on af (CVSS 7.8, Trend Micro Apex One) - [CVE-2025-49156](https://cve.now/CVE-2025-49156.md): A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected ins (CVSS 7.0, Trend Micro Apex One) - [CVE-2025-49155](https://cve.now/CVE-2025-49155.md): An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject maliciou (CVSS 8.8, Trend Micro Apex One) - [CVE-2025-49154](https://cve.now/CVE-2025-49154.md): An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker t (CVSS 8.7, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…) - [CVE-2025-49850](https://cve.now/CVE-2025-49850.md): Out-of-bounds Read in Write in LS Electric GMWin 4 (CVSS 8.4, LS Electric GMWin) - [CVE-2025-49849](https://cve.now/CVE-2025-49849.md): Out-of-bounds Read in Write in LS Electric GMWin 4 (CVSS 8.4, LS Electric GMWin) - [CVE-2025-49848](https://cve.now/CVE-2025-49848.md): Out-of-bounds Write in LS Electric GMWin 4 (CVSS 8.4, LS Electric GMWin) - [CVE-2025-34509](https://cve.now/CVE-2025-34509.md): Sitecore XM and XP Hardcoded Credentials (CVSS 7.5, Sitecore Experience Manager · Sitecore Experience Platform) - [CVE-2025-49220](https://cve.now/CVE-2025-49220.md): An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code exec (CVSS 9.8, Trend Micro Apex Central) - [CVE-2025-49219](https://cve.now/CVE-2025-49219.md): An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code exe (CVSS 9.8, Trend Micro Apex Central) - [CVE-2025-47867](https://cve.now/CVE-2025-47867.md): A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbi (CVSS 7.5, Trend Micro Apex Central) - [CVE-2025-47866](https://cve.now/CVE-2025-47866.md): An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbi (CVSS 4.3, Trend Micro Apex Central) - [CVE-2025-47865](https://cve.now/CVE-2025-47865.md): A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code (CVSS 7.5, Trend Micro Apex Central) - [CVE-2025-33122](https://cve.now/CVE-2025-33122.md): IBM i privilege escalation (CVSS 7.5, IBM i) - [CVE-2025-48111](https://cve.now/CVE-2025-48111.md): WordPress YITH PayPal Express Checkout for WooCommerce plugin \<= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, YITHEMES YITH PayPal Express Checkout for WooCommerce) - [CVE-2025-48333](https://cve.now/CVE-2025-48333.md): WordPress eForm - WordPress Form Builder \< 4.19.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, WPQuark eForm - WordPress Form Builder) - [CVE-2025-49071](https://cve.now/CVE-2025-49071.md): WordPress Flozen \< 1.5.1 - Arbitrary File Upload Vulnerability (CVSS 10.0, NasaTheme Flozen) - [CVE-2025-49451](https://cve.now/CVE-2025-49451.md): WordPress Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery plugin \<= 1.0.13 - Directory Traversal Vulnerability (CVSS 7.5, yannisraft Aeroscroll Gallery – Infinite Scroll Image Galle…) - [CVE-2025-49452](https://cve.now/CVE-2025-49452.md): WordPress PostaPanduri plugin \<= 2.1.3 - SQL Injection Vulnerability (CVSS 9.3, Adrian Ladó PostaPanduri) - [CVE-2025-49508](https://cve.now/CVE-2025-49508.md): WordPress CozyStay theme \< 1.7.1 - Local File Inclusion vulnerability (CVSS 8.1, LoftOcean CozyStay) - [CVE-2025-24761](https://cve.now/CVE-2025-24761.md): WordPress DSK theme \< 2.4 - Local File Inclusion vulnerability (CVSS 8.1, snstheme DSK) - [CVE-2025-24773](https://cve.now/CVE-2025-24773.md): WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin \<= 3.2.0 - SQL Injection Vulnerability (CVSS 9.3, mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce) - [CVE-2025-28972](https://cve.now/CVE-2025-28972.md): WordPress WP Employee Attendance System plugin \<= 3.5 - SQL Injection Vulnerability (CVSS 7.6, Suhas Surse WP Employee Attendance System) - [CVE-2025-28991](https://cve.now/CVE-2025-28991.md): WordPress Evon theme \<= 3.4 - Local File Inclusion Vulnerability (CVSS 8.1, snstheme Evon) - [CVE-2025-29002](https://cve.now/CVE-2025-29002.md): WordPress Simen theme \<= 4.6 - Local File Inclusion Vulnerability (CVSS 8.1, snstheme Simen) - [CVE-2025-30562](https://cve.now/CVE-2025-30562.md): WordPress Navigation Tree Elementor plugin \<= 1.0.1 - SQL Injection Vulnerability (CVSS 8.5, wpdistillery Navigation Tree Elementor) - [CVE-2025-30618](https://cve.now/CVE-2025-30618.md): WordPress Rapyd Payment Extension for WooCommerce plugin \<= 1.2.0 - PHP Object Injection Vulnerability (CVSS 9.8, yuliaz Rapyd Payment Extension for WooCommerce) - [CVE-2025-30988](https://cve.now/CVE-2025-30988.md): WordPress Elite Video Player plugin \<= 10.0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, \_CreativeMedia\_ Elite Video Player) - [CVE-2025-31919](https://cve.now/CVE-2025-31919.md): WordPress Spare \<= 1.7 - PHP Object Injection Vulnerability (CVSS 9.8, themeton Spare) - [CVE-2025-32510](https://cve.now/CVE-2025-32510.md): WordPress Ovatheme Events Manager plugin \<= 1.8.4 - Arbitrary File Upload vulnerability (CVSS 10.0, Ovatheme Events Manager) - [CVE-2025-32549](https://cve.now/CVE-2025-32549.md): WordPress WPGYM \<= 65.0 - Local File Inclusion Vulnerability (CVSS 7.5, mojoomla WPGYM) - [CVE-2025-39479](https://cve.now/CVE-2025-39479.md): WordPress Smart Notification Plugin \<= 10.3 - SQL Injection vulnerability (CVSS 9.3, smartiolabs Smart Notification) - [CVE-2025-39486](https://cve.now/CVE-2025-39486.md): WordPress Rankie plugin \< 1.8.2 - SQL Injection vulnerability (CVSS 8.5, ValvePress Rankie) - [CVE-2025-39508](https://cve.now/CVE-2025-39508.md): WordPress Nasa Core Plugin \<= 6.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NasaTheme Nasa Core) - [CVE-2025-47452](https://cve.now/CVE-2025-47452.md): WordPress WP VR plugin \<= 8.5.26 - Arbitrary File Upload Vulnerability (CVSS 9.9, RexTheme WP VR) - [CVE-2025-47559](https://cve.now/CVE-2025-47559.md): WordPress MapSVG plugin \< 8.7.4 - Arbitrary File Upload vulnerability (CVSS 9.9, RomanCode MapSVG) - [CVE-2025-47572](https://cve.now/CVE-2025-47572.md): WordPress School Management \<= 93.0.0 - Local File Inclusion Vulnerability (CVSS 7.5, mojoomla School Management) - [CVE-2025-47573](https://cve.now/CVE-2025-47573.md): WordPress School Management System Plugin \<= 92.0.0 - SQL Injection vulnerability (CVSS 9.3, mojoomla School Management) - [CVE-2025-48118](https://cve.now/CVE-2025-48118.md): WordPress Woocommerce Partial Shipment plugin \<= 3.2 - SQL Injection Vulnerability (CVSS 8.5, WpExperts Hub Woocommerce Partial Shipment) - [CVE-2025-48145](https://cve.now/CVE-2025-48145.md): WordPress Track, Analyze & Optimize by WP Tao plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Michal Jaworski Track, Analyze & Optimize by WP Tao) - [CVE-2025-48274](https://cve.now/CVE-2025-48274.md): WordPress WP Job Portal plugin \<= 2.3.2 - SQL Injection Vulnerability (CVSS 9.3, wpjobportal WP Job Portal) - [CVE-2025-49234](https://cve.now/CVE-2025-49234.md): WordPress WP Dummy Content Generator plugin \<= 3.4.6 - Arbitrary User Deletion vulnerability (CVSS 6.5, Deepak anand WP Dummy Content Generator) - [CVE-2025-49251](https://cve.now/CVE-2025-49251.md): WordPress Fana theme \<= 1.1.28 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Fana) - [CVE-2025-49252](https://cve.now/CVE-2025-49252.md): WordPress Besa theme \<= 2.3.8 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Besa) - [CVE-2025-49253](https://cve.now/CVE-2025-49253.md): WordPress Lasa theme \<= 1.1 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Lasa) - [CVE-2025-49254](https://cve.now/CVE-2025-49254.md): WordPress Nika theme \<= 1.2.8 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Nika) - [CVE-2025-49255](https://cve.now/CVE-2025-49255.md): WordPress Ruza theme \<= 1.0.7 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Ruza) - [CVE-2025-49256](https://cve.now/CVE-2025-49256.md): WordPress Sapa theme \<= 1.1.14 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Sapa) - [CVE-2025-49257](https://cve.now/CVE-2025-49257.md): WordPress Zota theme \<= 1.3.8 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Zota) - [CVE-2025-49258](https://cve.now/CVE-2025-49258.md): WordPress Maia theme \<= 1.1.15 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Maia) - [CVE-2025-49259](https://cve.now/CVE-2025-49259.md): WordPress Hara theme \<= 1.2.10 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Hara) - [CVE-2025-49260](https://cve.now/CVE-2025-49260.md): WordPress Aora theme \<= 1.3.9 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Aora) - [CVE-2025-49261](https://cve.now/CVE-2025-49261.md): WordPress Diza theme \<= 1.3.8 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Diza) - [CVE-2025-49266](https://cve.now/CVE-2025-49266.md): WordPress Ultimate Reviews plugin \<= 3.2.14 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rustaurius Ultimate Reviews) - [CVE-2025-49312](https://cve.now/CVE-2025-49312.md): WordPress Echo RSS Feed Post Generator Plugin for WordPress plugin \<= 5.4.8.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CodeRevolution Echo RSS Feed Post Generator Plugin for Word…) - [CVE-2025-49316](https://cve.now/CVE-2025-49316.md): WordPress WP2LEADS plugin \<= 3.5.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Saleswonder Team: Tobias WP2LEADS) - [CVE-2025-49330](https://cve.now/CVE-2025-49330.md): WordPress Integration for Contact Form 7 and Zoho CRM, Bigin plugin \<= 1.3.0 - PHP Object Injection Vulnerability (CVSS 9.8, CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin) - [CVE-2025-49331](https://cve.now/CVE-2025-49331.md): WordPress eCommerce Product Catalog plugin \<= 3.4.3 - PHP Object Injection Vulnerability (CVSS 7.2, impleCode eCommerce Product Catalog) - [CVE-2025-49854](https://cve.now/CVE-2025-49854.md): WordPress Slim SEO plugin \<= 4.5.4 - SQL Injection Vulnerability (CVSS 7.6, Anh Tran Slim SEO) - [CVE-2025-49855](https://cve.now/CVE-2025-49855.md): WordPress Meks Flexible Shortcodes plugin \<= 1.3.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Meks Flexible Shortcodes) - [CVE-2025-49856](https://cve.now/CVE-2025-49856.md): WordPress Responsive Plus plugin \<= 3.2.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, CyberChimps Responsive Plus) - [CVE-2025-49857](https://cve.now/CVE-2025-49857.md): WordPress myCred plugin \<= 2.9.4.2 - Broken Access Control Vulnerability (CVSS 4.3, Saad Iqbal myCred) - [CVE-2025-49858](https://cve.now/CVE-2025-49858.md): WordPress Arconix Shortcodes plugin \<= 2.1.17 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, tychesoftwares Arconix Shortcodes) - [CVE-2025-49859](https://cve.now/CVE-2025-49859.md): WordPress WP Views Counter plugin \<= 2.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, etruel WP Views Counter) - [CVE-2025-49861](https://cve.now/CVE-2025-49861.md): WordPress Kama Click Counter plugin \<= 4.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Timur Kamaev Kama Click Counter) - [CVE-2025-49862](https://cve.now/CVE-2025-49862.md): WordPress Ebook Store plugin \<= 5.8008 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, motov.net Ebook Store) - [CVE-2025-49863](https://cve.now/CVE-2025-49863.md): WordPress Advanced Sermons plugin \<= 3.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WP CodeUs Advanced Sermons) - [CVE-2025-49864](https://cve.now/CVE-2025-49864.md): WordPress AFS Analytics plugin \<= 4.21 - Broken Access Control Vulnerability (CVSS 5.3, AFS Analytics) - [CVE-2025-49865](https://cve.now/CVE-2025-49865.md): WordPress Advanced Settings plugin \<= 3.0.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Helmut Wandl Advanced Settings) - [CVE-2025-49868](https://cve.now/CVE-2025-49868.md): WordPress Automation By Autonami plugin \<= 3.6.0 - Open Redirection Vulnerability (CVSS 4.7, Aman FunnelKit Automations) - [CVE-2025-49871](https://cve.now/CVE-2025-49871.md): WordPress Noptin plugin \<= 3.8.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Noptin Newsletter Team Noptin) - [CVE-2025-49872](https://cve.now/CVE-2025-49872.md): WordPress myCred plugin \<= 2.9.4.2 - Broken Access Control Vulnerability (CVSS 5.3, Saad Iqbal myCred) - [CVE-2025-49874](https://cve.now/CVE-2025-49874.md): WordPress Arconix FAQ plugin \<= 1.9.6 - Broken Access Control Vulnerability (CVSS 4.3, tychesoftwares Arconix FAQ) - [CVE-2025-49875](https://cve.now/CVE-2025-49875.md): WordPress If-So Dynamic Content Personalization plugin \<= 1.9.3.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, If-So Dynamic Content Personalization) - [CVE-2025-49877](https://cve.now/CVE-2025-49877.md): WordPress ProfileGrid plugin \<= 5.9.5.2 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.9, Metagauss ProfileGrid) - [CVE-2025-49878](https://cve.now/CVE-2025-49878.md): WordPress WPAdverts plugin \<= 2.2.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Greg Winiarski WPAdverts) - [CVE-2025-49879](https://cve.now/CVE-2025-49879.md): WordPress Litho theme \<= 3.0 - Arbitrary File Deletion Vulnerability (CVSS 8.6, themezaa Litho) - [CVE-2025-49880](https://cve.now/CVE-2025-49880.md): WordPress CubeWP Forms plugin \<= 1.1.5 - Broken Access Control Vulnerability (CVSS 4.3, Imran Tauqeer CubeWP Forms) - [CVE-2025-49881](https://cve.now/CVE-2025-49881.md): WordPress Responsive Blocks plugin \<= 2.0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, CyberChimps Responsive Blocks) - [CVE-2025-49882](https://cve.now/CVE-2025-49882.md): WordPress CubeWP Framework plugin \<= 1.1.23 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Imran Tauqeer CubeWP) - [CVE-2025-49415](https://cve.now/CVE-2025-49415.md): WordPress FW Gallery plugin \<= 8.0.0 - Arbitrary File Deletion Vulnerability (CVSS 8.6, Fastw3b FW Gallery) - [CVE-2025-49444](https://cve.now/CVE-2025-49444.md): WordPress Reformer for Elementor plugin \<= 1.0.5 - Arbitrary File Upload Vulnerability (CVSS 10.0, merkulove Reformer for Elementor) - [CVE-2025-49447](https://cve.now/CVE-2025-49447.md): WordPress FW Food Menu \<= 6.0.0 - Arbitrary File Upload Vulnerability (CVSS 10.0, Fastw3b FW Food Menu) - [CVE-2025-49180](https://cve.now/CVE-2025-49180.md): Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x resize, rotate and reflect (randr) extension (CVSS 7.8, X.Org xwayland · Red Hat Enterprise Linux) - [CVE-2025-49179](https://cve.now/CVE-2025-49179.md): Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x record extension (CVSS 7.3, X.Org xwayland · Red Hat Enterprise Linux) - [CVE-2025-49178](https://cve.now/CVE-2025-49178.md): Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore (CVSS 5.5, X.Org xwayland · Red Hat Enterprise Linux) - [CVE-2025-49177](https://cve.now/CVE-2025-49177.md): Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode (CVSS 6.1, X.Org xwayland · Red Hat Enterprise Linux) - [CVE-2025-49176](https://cve.now/CVE-2025-49176.md): Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in big requests extension (CVSS 7.3, X.Org xwayland · Red Hat Enterprise Linux) - [CVE-2025-49175](https://cve.now/CVE-2025-49175.md): Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: out-of-bounds read in x rendering extension animated cursors (CVSS 6.1, X.Org xwayland · Red Hat Enterprise Linux) - [CVE-2025-4754](https://cve.now/CVE-2025-4754.md): Missing Session Revocation on Logout in ash\_authentication\_phoenix (CVSS 2.3, team-alembic ash\_authentication\_phoenix) - [CVE-2025-6199](https://cve.now/CVE-2025-6199.md): Gdk-pixbuf: uninitialized memory disclosure in gdkpixbuf gif lzw decoder (CVSS 3.3, gdk-pixbuf · Red Hat Enterprise Linux) - [CVE-2025-6196](https://cve.now/CVE-2025-6196.md): Libgepub: integer overflow in libgepub's epub archive handling (CVSS 5.5, libgepub · Red Hat Enterprise Linux) - [CVE-2025-34508](https://cve.now/CVE-2025-34508.md): ZendTo \< 6.15-8 Path Traversal (CVSS 6.3, ZendTo) - [CVE-2025-49842](https://cve.now/CVE-2025-49842.md): conda-forge-webservices Privilege Escalation Risk via Default Docker Root User (CVSS 1.0, conda-forge-webservices) - [CVE-2025-6069](https://cve.now/CVE-2025-6069.md): HTMLParser quadratic complexity when processing malformed inputs (CVSS 4.3, Python Software Foundation CPython) - [CVE-2025-4404](https://cve.now/CVE-2025-4404.md): Freeipa: idm: privilege escalation from host to domain admin in freeipa (CVSS 9.1, freeipa · Red Hat Enterprise Linux) - [CVE-2025-0320](https://cve.now/CVE-2025-0320.md): Citrix Secure Access - Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (CVSS 8.6, Citrix Secure Access Client for Windows) - [CVE-2025-4879](https://cve.now/CVE-2025-4879.md): Citrix Workspace App for Windows - Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (CVSS 7.3, Citrix Workspace App for Windows) - [CVE-2025-6020](https://cve.now/CVE-2025-6020.md): Linux-pam: linux-pam directory traversal (CVSS 7.8, linux-pam · Red Hat Enterprise Linux +10) - [CVE-2025-4365](https://cve.now/CVE-2025-4365.md): NetScaler Console and NetScaler SDX (SVM) - Arbitrary file read (CVSS 6.9, NetScaler Console · NetScaler SDX) - [CVE-2025-5349](https://cve.now/CVE-2025-5349.md): NetScaler ADC and NetScaler Gateway - Improper access control on the NetScaler Management Interface (CVSS 8.7, NetScaler ADC) - [CVE-2025-5777](https://cve.now/CVE-2025-5777.md): NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread (CVSS 9.3, KEV, NetScaler ADC · NetScaler Gateway) - [CVE-2025-5291](https://cve.now/CVE-2025-5291.md): Master Slider \<= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via masterslider\_pb and ms\_slide Shortcodes (CVSS 6.4, averta Master Slider – Responsive Touch Slider) - [CVE-2025-3880](https://cve.now/CVE-2025-3880.md): Poll, Survey & Quiz Maker Plugin by Opinion Stage \<= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update (CVSS 4.3, assafp Quiz, Poll & Survey Maker by Opinion Stage) - [CVE-2025-5700](https://cve.now/CVE-2025-5700.md): Simple Logo Carousel \<= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, tvledesign Simple Logo Carousel) - [CVE-2025-6050](https://cve.now/CVE-2025-6050.md): Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface (CVSS 4.8, jupo mezzanine · mezzanine) - [CVE-2025-3515](https://cve.now/CVE-2025-3515.md): Drag and Drop Multiple File Upload for Contact Form 7 \<= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks (CVSS 8.1, glenwpcoder Drag and Drop Multiple File Upload for Contact…) - [CVE-2025-40674](https://cve.now/CVE-2025-40674.md): Reflected Cross-Site Scripting (XSS) in osCommerce (CVSS 5.1, osCommerce) - [CVE-2025-6173](https://cve.now/CVE-2025-6173.md): Webkul QloApps ajax\_products\_list.php sql injection (CVSS 5.1, Webkul QloApps) - [CVE-2025-6167](https://cve.now/CVE-2025-6167.md): themanojdesai python-a2a api.py create\_workflow path traversal (CVSS 5.1, themanojdesai python-a2a · python-a2a) - [CVE-2025-6166](https://cve.now/CVE-2025-6166.md): frdel Agent-Zero image\_get.py image\_get path traversal (CVSS 5.1, frdel Agent-Zero) - [CVE-2025-6165](https://cve.now/CVE-2025-6165.md): TOTOLINK X15 HTTP POST Request formTmultiAP buffer overflow (CVSS 8.7, TOTOLINK X15) - [CVE-2025-5209](https://cve.now/CVE-2025-5209.md): Ivory Search \< 5.5.10 - Admin+ Stored XSS (CVSS 4.8, Ivory Search) - [CVE-2025-6164](https://cve.now/CVE-2025-6164.md): TOTOLINK A3002R HTTP POST Request formMultiAP buffer overflow (CVSS 8.7, TOTOLINK A3002R) - [CVE-2025-6163](https://cve.now/CVE-2025-6163.md): TOTOLINK A3002RU HTTP POST Request formMultiAP buffer overflow (CVSS 8.7, TOTOLINK A3002RU) - [CVE-2025-6162](https://cve.now/CVE-2025-6162.md): TOTOLINK EX1200T HTTP POST Request formMultiAP buffer overflow (CVSS 8.7, TOTOLINK EX1200T) - [CVE-2025-6161](https://cve.now/CVE-2025-6161.md): SourceCodester Simple Food Ordering System editproduct.php unrestricted upload (CVSS 6.9, SourceCodester Simple Food Ordering System) - [CVE-2025-6160](https://cve.now/CVE-2025-6160.md): SourceCodester Client Database Management System user\_customer\_create\_order.php sql injection (CVSS 6.9, SourceCodester Client Database Management System) - [CVE-2025-6159](https://cve.now/CVE-2025-6159.md): code-projects Hostel Management System allocate\_room.php sql injection (CVSS 6.9, code-projects Hostel Management System) - [CVE-2025-6158](https://cve.now/CVE-2025-6158.md): D-Link DIR-665 HTTP POST Request sub\_AC78 stack-based overflow (CVSS 8.7, D-Link DIR-665) - [CVE-2025-6157](https://cve.now/CVE-2025-6157.md): PHPGurukul Nipah Virus Testing Management System registered-user-testing.php sql injection (CVSS 6.9, PHPGurukul Nipah Virus Testing Management System) - [CVE-2025-6156](https://cve.now/CVE-2025-6156.md): PHPGurukul Nipah Virus Testing Management System bwdates-report-ds.php sql injection (CVSS 5.3, PHPGurukul Nipah Virus Testing Management System) - [CVE-2025-6155](https://cve.now/CVE-2025-6155.md): PHPGurukul Hostel Management System login-hm.inc.php sql injection (CVSS 6.9, PHPGurukul Hostel Management System) - [CVE-2025-6154](https://cve.now/CVE-2025-6154.md): PHPGurukul Hostel Management System login.inc.php sql injection (CVSS 6.9, PHPGurukul Hostel Management System) - [CVE-2025-49823](https://cve.now/CVE-2025-49823.md): Conda Constructor Command Injection via Unsanitized User Input (Low) (CVSS 0.0, conda constructor) - [CVE-2025-6153](https://cve.now/CVE-2025-6153.md): PHPGurukul Hostel Management System students.php sql injection (CVSS 6.9, PHPGurukul Hostel Management System) - [CVE-2025-5673](https://cve.now/CVE-2025-5673.md): Blog2Social \<= 8.4.4 - Authenticated (Subscriber+) SQL Injection via \`prgSortPostType\` Parameter (CVSS 6.5, pr-gateway Blog2Social: Social Media Auto Post & Scheduler) - [CVE-2025-4775](https://cve.now/CVE-2025-4775.md): WordPress Infinite Scroll – Ajax Load More \<= 7.4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting (CVSS 6.4, dcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…) - [CVE-2025-3774](https://cve.now/CVE-2025-3774.md): Wise Chat \<= 3.3.4 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header (CVSS 7.2, marcinlawrowski Wise Chat) - [CVE-2025-6152](https://cve.now/CVE-2025-6152.md): Steel Browser files.routes.ts handleFileUpload path traversal (CVSS 5.3, Steel Browser) - [CVE-2025-6151](https://cve.now/CVE-2025-6151.md): TP-Link TL-WR940N, TL-WR841N WanSlaacCfgRpm.htm buffer overflow (CVSS 8.2, TP-Link Systems TL-WR940N · TP-Link Systems TL-WR841N) - [CVE-2025-48993](https://cve.now/CVE-2025-48993.md): Group-Office vulnerable to reflected XSS via Look and Feel Formatting input (CVSS 5.3, Intermesh groupoffice) - [CVE-2025-6150](https://cve.now/CVE-2025-6150.md): TOTOLINK X15 HTTP POST Request formMultiAP buffer overflow (CVSS 8.7, TOTOLINK X15) - [CVE-2025-6149](https://cve.now/CVE-2025-6149.md): TOTOLINK A3002R HTTP POST Request formSysLog buffer overflow (CVSS 8.7, TOTOLINK A3002R) - [CVE-2025-6148](https://cve.now/CVE-2025-6148.md): TOTOLINK A3002RU HTTP POST Request formSysLog buffer overflow (CVSS 8.7, TOTOLINK A3002RU) - [CVE-2025-6147](https://cve.now/CVE-2025-6147.md): TOTOLINK A702R HTTP POST Request formSysLog buffer overflow (CVSS 8.7, TOTOLINK A702R) - [CVE-2024-40570](https://cve.now/CVE-2024-40570.md): SQL Injection vulnerability in SeaCMS v.12.9 allows a remote attacker to obtain sensitive information via the admin\_datarelate.php component (CVSS 6.5) - [CVE-2025-45525](https://cve.now/CVE-2025-45525.md): A NULL pointer dereference vulnerability has been identified in the JavaScript library microlight version 0.0.7, a lightweight syntax highli (CVSS 2.9, asvd microlight) - [CVE-2025-45526](https://cve.now/CVE-2025-45526.md): A denial of service (DoS) vulnerability has been identified in the JavaScript library microlight version 0.0.7. (CVSS 2.9, asvd microlight) - [CVE-2025-45878](https://cve.now/CVE-2025-45878.md): A cross-site scripting (XSS) vulnerability in the report manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary (CVSS 6.1) - [CVE-2025-45879](https://cve.now/CVE-2025-45879.md): A cross-site scripting (XSS) vulnerability in the e-mail manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary (CVSS 6.1) - [CVE-2025-45880](https://cve.now/CVE-2025-45880.md): A cross-site scripting (XSS) vulnerability in the data resource management function of Miliaris Amigdala v2.2.6 allows attackers to execute (CVSS 6.1) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-06-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.