CVEs published June 19, 2025
54 CVEs were published on June 19, 2025: 5 critical, 8 high.
- Published
- 54
- Critical
- 5
- High
- 8
- Medium
- 40
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- IBM QRadar SIEM
- 3
- PHPGurukul COVID19 Testing Management System
- 3
- WebAssembly wabt
- 3
- Apache Software Foundation Apache Traffic Server
- 2
- Brilliance Golden Link Secondary System
- 2
- HDF5
- 2
- LabRedesCefetRJ WeGIA
- 2
- Upsonic
- 2
- urllib3
- 2
- alekv Pixel Manager for WooCommerce – Conversion Tracking,…
- 1
Critical 5
- CVE-2025-33117IBM QRadar SIEM command executionIBM QRadar SIEM
- CVE-2025-52464Meshtastic Repeated Public and Private Keypairsmeshtastic firmware
- CVE-2025-4738Authenticated SQLi in Yirmibes Software's MY ERPYirmibes Software MY ERP
- CVE-2025-50201WeGIA OS Command Injection in debug_info.php parameter 'branch'LabRedesCefetRJ WeGIA
- CVE-2025-52467pgai secrets exfiltration via `pull_request_target`timescale pgai
High 8
- CVE-2025-47771PowSyBl Core allows deserialization of untrusted SparseMatrix datapowsybl-core · com.powsybl:powsybl-math
- CVE-2025-6384Improper Control of Dynamically-Managed Code Resources in Crafter StudioCrafterCMS · org.craftercms:crafter-studio
- CVE-2025-33121IBM QRadar SIEM XML external entity injectionIBM QRadar SIEM
- CVE-2025-6019Libblockdev: lpe from allow_active to root in libblockdev via udiskslibblockdev · Red Hat Enterprise Linux
- CVE-2025-31698Apache Traffic Server: Client IP address from PROXY protocol is not used for ACLApache Software Foundation Apache Traffic Server
- CVE-2025-49763Apache Traffic Server: Remote DoS via memory exhaustion in ESI PluginApache Software Foundation Apache Traffic Server
- CVE-2025-5071AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCPtigroumeow AI Engine
- CVE-2025-52474WeGIA SQL Injection Vulnerability in id Parameter on control.php EndpointLabRedesCefetRJ WeGIA
Medium, low and unrated 41
- CVE-2025-6287PHPGurukul COVID19 Testing Management System Take Action test-details.php cross site scriptingPHPGurukul COVID19 Testing Management System
- CVE-2025-6286PHPGurukul COVID19 Testing Management System search-report-result.php redirectPHPGurukul COVID19 Testing Management System
- CVE-2025-6285PHPGurukul COVID19 Testing Management System search-report-result.php cross site scriptingPHPGurukul COVID19 Testing Management System
- CVE-2025-6284PHPGurukul Car Rental Portal cross-site request forgeryPHPGurukul Car Rental Portal
- CVE-2025-6283xataio Xata Agent route.ts GET path traversalxataio Xata Agent
- CVE-2025-6282xlang-ai OpenAgents file.py create_upload_file path traversalxlang-ai OpenAgents
- CVE-2025-47293PowSyBl Core XML Reader allows XXE and SSRFpowsybl-core · com.powsybl:powsybl-commons
- CVE-2025-6281OpenBMB XAgent community path traversalOpenBMB XAgent
- CVE-2025-6280TransformerOptimus SuperAGI EmailToolKit read_email.py download_attachment path traversalTransformerOptimus SuperAGI
- CVE-2025-6279Upsonic Pickle add_tool cloudpickle.loads deserializationUpsonic
- CVE-2025-6278Upsonic server.py os.path.join path traversalUpsonic
- CVE-2025-6277Brilliance Golden Link Secondary System custTakeInfoPage.htm sql injectionBrilliance Golden Link Secondary System
- CVE-2025-6276Brilliance Golden Link Secondary System rentTakeInfoPage.htm sql injectionBrilliance Golden Link Secondary System
- CVE-2025-6275WebAssembly wabt binary-reader-interp.cc GetFuncOffset use after freeWebAssembly wabt
- CVE-2025-6274WebAssembly wabt binary-reader-interp.cc OnDataCount resource consumptionWebAssembly wabt
- CVE-2025-6273WebAssembly wabt binary-reader-objdump.cc LogOpcode assertionWebAssembly wabt
- CVE-2025-6272wasm3 m3_compile.c MarkSlotAllocated out-of-bounds writewasm3 · pywasm3
- CVE-2025-6271swftools wav2swf wav.c wav_convert2mono out-of-boundsswftools
- CVE-2025-36050IBM QRadar SIEM information disclosureIBM QRadar SIEM
- CVE-2025-6270HDF5 H5FSsection.c H5FS__sect_find_node heap-based overflowHDF5
- CVE-2025-50200RabbitMQ Node can log Basic Auth header from an HTTP requestrabbitmq-server
- CVE-2025-6269HDF5 H5Cimage.c H5C__reconstruct_cache_entry heap-based overflowHDF5
- CVE-2025-49014jq heap use after free vulnerability in f_strflocaltimejqlang jq
- CVE-2025-6268Luna Imaging search cross site scriptingLuna Imaging
- CVE-2025-48886hydra-node dangerously assumes L1 event finality and does not consider failed transactionscardano-scaling hydra
- CVE-2025-6267zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 barcodeDetail sql injectionzhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用…
- CVE-2024-24916DLL-HiJackingcheckpoint Check Point SmartConsole
- CVE-2025-6266Teledyne FLIR AX8 upload.php unrestricted uploadTeledyne FLIR AX8
- CVE-2025-32896Apache SeaTunnel: Unauthenticated insecure accessApache Software Foundation Apache SeaTunnel · org.apache… +1
- CVE-2025-5234Gutenverse News <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via elementId Parameterjegstudio Gutenverse News – Advanced News Magazine Blog Gu…
- CVE-2025-4965WPBakery Page Builder <= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid BuilderWPBakery Page Builder
- CVE-2025-4571GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modificationstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2025-5490Football Pool <= 2.12.4 - Authenticated (Administrator+) Stored Cross-Site Scriptingantoineh Football Pool
- CVE-2025-5524OceanWP <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML TagOceanWP
- CVE-2025-4479ElementsKit Lite <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widgetroxnor ElementsKit Elementor Addons – Advanced Widgets & Te…
- CVE-2025-4367Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcodecodename065 Download Manager
- CVE-2025-4661Path transversal vulnerability potentially leading to sensitive information disclosureBrocade Fabric OS
- CVE-2025-50183OpenList (frontend) allows XSS Attacks in the built-in Markdown ViewerOpenListTeam OpenList · @openlist-frontend/openlist-frontend
- CVE-2025-6201Pixel Manager for WooCommerce (PRO) <= 1.49.0 - Authenticated (Contributor+) Cross-Site Scripting via Shortcodealekv Pixel Manager for WooCommerce – Conversion Tracking,…
- CVE-2025-50182urllib3 does not control redirects in browsers and Node.jsurllib3
- CVE-2025-50181urllib3 redirects are not disabled when retries are disabled on PoolManager instantiationurllib3