# CVEs published 2025-06-20

221 CVEs were published on June 20, 2025: 17 critical, 48 high. Days are UTC.

- [CVE-2025-6373](https://cve.now/CVE-2025-6373.md): D-Link DIR-619L formWlSiteSurvey formSetWizard1 stack-based overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-6372](https://cve.now/CVE-2025-6372.md): D-Link DIR-619L formSetWizard1 stack-based overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-6371](https://cve.now/CVE-2025-6371.md): D-Link DIR-619L formSetEnableWizard stack-based overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-6370](https://cve.now/CVE-2025-6370.md): D-Link DIR-619L formWlanGuestSetup stack-based overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-6369](https://cve.now/CVE-2025-6369.md): D-Link DIR-619L formdumpeasysetup stack-based overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-6368](https://cve.now/CVE-2025-6368.md): D-Link DIR-619L formSetEmail stack-based overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-6367](https://cve.now/CVE-2025-6367.md): D-Link DIR-619L formSetDomainFilter stack-based overflow (CVSS 8.7, D-Link DIR-619L)
- [CVE-2025-6365](https://cve.now/CVE-2025-6365.md): HobbesOSR Kitten pgtable.h set\_pte\_at resource consumption (CVSS 6.9, HobbesOSR Kitten)
- [CVE-2025-6364](https://cve.now/CVE-2025-6364.md): code-projects Simple Pizza Ordering System adduser-exec.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System)
- [CVE-2025-6363](https://cve.now/CVE-2025-6363.md): code-projects Simple Pizza Ordering System adding-exec.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System)
- [CVE-2023-5600](https://cve.now/CVE-2023-5600.md): Missing Authorization in GitLab (CVSS 3.1, GitLab)
- [CVE-2025-6362](https://cve.now/CVE-2025-6362.md): code-projects Simple Pizza Ordering System editpro.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System)
- [CVE-2025-6361](https://cve.now/CVE-2025-6361.md): code-projects Simple Pizza Ordering System adds.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System)
- [CVE-2025-48945](https://cve.now/CVE-2025-48945.md): pycares has a Use-After-Free Vulnerability (CVSS 8.2, aio-libs aiodns · pycares)
- [CVE-2025-6360](https://cve.now/CVE-2025-6360.md): code-projects Simple Pizza Ordering System portal.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System)
- [CVE-2025-34030](https://cve.now/CVE-2025-34030.md): sar2html OS Command Injection (CVSS 10.0, sar2html)
- [CVE-2025-34029](https://cve.now/CVE-2025-34029.md): Edimax EW-7438RPn Mini OS Command Injection via syscmd.asp (CVSS 9.4, Edimax EW-7438RPn Mini)
- [CVE-2025-34024](https://cve.now/CVE-2025-34024.md): Edimax EW-7438RPn Mini OS Command Injection via mp.asp (CVSS 9.4, Edimax EW-7438RPn Mini)
- [CVE-2025-34023](https://cve.now/CVE-2025-34023.md): Karel IP Phone IP1211 Path Traversal (CVSS 8.5, Karel IP Phone IP1211)
- [CVE-2025-34022](https://cve.now/CVE-2025-34022.md): Selea Targa IP OCR-ANPR Camera Path Traversal (CVSS 9.3, Selea Targa IP OCR-ANPR Camera)
- [CVE-2025-34021](https://cve.now/CVE-2025-34021.md): Selea Targa IP OCR-ANPR Camera Server-Side Request Forgery (CVSS 7.8, Selea Targa IP OCR-ANPR Camera)
- [CVE-2025-25038](https://cve.now/CVE-2025-25038.md): MiniDVBLinux Root Command Injection (CVSS 9.3, MiniDVBLinux)
- [CVE-2025-25037](https://cve.now/CVE-2025-25037.md): Aquatronica Controller System Complete Information Disclosure (CVSS 9.3, Aquatronica Controller System)
- [CVE-2025-25034](https://cve.now/CVE-2025-25034.md): SugarCRM PHP Deserialization RCE (CVSS 9.3, SugarCRM)
- [CVE-2025-6359](https://cve.now/CVE-2025-6359.md): code-projects Simple Pizza Ordering System cashconfirm.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System)
- [CVE-2024-4994](https://cve.now/CVE-2024-4994.md): Cross-Site Request Forgery (CSRF) in GitLab (CVSS 8.1, GitLab)
- [CVE-2024-4025](https://cve.now/CVE-2024-4025.md): Inefficient Regular Expression Complexity in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-6358](https://cve.now/CVE-2025-6358.md): code-projects Simple Pizza Ordering System saveorder.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System)
- [CVE-2025-6357](https://cve.now/CVE-2025-6357.md): code-projects Simple Pizza Ordering System paymentportal.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System)
- [CVE-2025-6356](https://cve.now/CVE-2025-6356.md): code-projects Simple Pizza Ordering System addmem.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System)
- [CVE-2025-52484](https://cve.now/CVE-2025-52484.md): RISC Zero zkVM Underconstrained Vulnerability (CVSS 2.7, risc0 · risc0-zkvm +1)
- [CVE-2025-2443](https://cve.now/CVE-2025-2443.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-5121](https://cve.now/CVE-2025-5121.md): Missing Authorization in GitLab (CVSS 8.5, GitLab)
- [CVE-2025-6355](https://cve.now/CVE-2025-6355.md): SourceCodester Online Hotel Reservation System execeditroom.php sql injection (CVSS 6.9, SourceCodester Online Hotel Reservation System)
- [CVE-2025-49132](https://cve.now/CVE-2025-49132.md): Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution (CVSS 10.0, pterodactyl panel · pterodactyl/panel)
- [CVE-2025-48059](https://cve.now/CVE-2025-48059.md): PowSyBl Core Contains a Polynomial ReDoS in RegexCriterion (CVSS 2.7, powsybl-core · com.powsybl:powsybl-iidm-criteria +1)
- [CVE-2025-6354](https://cve.now/CVE-2025-6354.md): code-projects Online Shoe Store customer\_signup.php sql injection (CVSS 6.9, code-projects Online Shoe Store)
- [CVE-2025-6353](https://cve.now/CVE-2025-6353.md): code-projects Responsive Blog search.php cross site scripting (CVSS 5.1, code-projects Responsive Blog)
- [CVE-2025-5416](https://cve.now/CVE-2025-5416.md): Keycloak-core: keycloak environment information (CVSS 2.7, Red Hat Build of Keycloak)
- [CVE-2025-6352](https://cve.now/CVE-2025-6352.md): code-projects Automated Voting System Backend vote.php direct request (CVSS 6.9, code-projects Automated Voting System)
- [CVE-2025-6351](https://cve.now/CVE-2025-6351.md): itsourcecode Employee Record Management System editprofile.php sql injection (CVSS 5.3, itsourcecode Employee Record Management System)
- [CVE-2025-6193](https://cve.now/CVE-2025-6193.md): Trustyai-explainability: command injection via lmevaljob cr (CVSS 5.9, trustyAI · Red Hat OpenShift AI)
- [CVE-2025-6347](https://cve.now/CVE-2025-6347.md): code-projects Responsive Blog pageViewMembers.php cross site scripting (CVSS 4.8, code-projects Responsive Blog)
- [CVE-2025-49873](https://cve.now/CVE-2025-49873.md): WordPress Elessi theme \<= 6.3.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, NasaTheme Elessi)
- [CVE-2025-49964](https://cve.now/CVE-2025-49964.md): WordPress ClipLink plugin \<= 1.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, indgeek ClipLink)
- [CVE-2025-49965](https://cve.now/CVE-2025-49965.md): WordPress PixelBeds Channel Manager and Hotel Booking Engine plugin \<= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Oganro PixelBeds Channel Manager and Hotel Booking Engine)
- [CVE-2025-49966](https://cve.now/CVE-2025-49966.md): WordPress Oganro Travel Portal Search Widget for HotelBeds APITUDE API plugin \<= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Oganro Travel Portal Search Widget for HotelBeds APITUDE API)
- [CVE-2025-49967](https://cve.now/CVE-2025-49967.md): WordPress Live Sports Streamthunder plugin \<= 2.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, marcusjansen Live Sports Streamthunder)
- [CVE-2025-49968](https://cve.now/CVE-2025-49968.md): WordPress XML Travel Portal Widget plugin \<= 2.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Oganro XML Travel Portal Widget)
- [CVE-2025-49969](https://cve.now/CVE-2025-49969.md): WordPress Zara 4 Image Compression plugin \<= 1.2.17.2 - Broken Access Control Vulnerability (CVSS 4.3, Zara 4 Image Compression)
- [CVE-2025-49970](https://cve.now/CVE-2025-49970.md): WordPress Hello FSE Blog theme \<= 1.0.6 - Broken Access Control Vulnerability (CVSS 4.3, sparklewpthemes Hello FSE Blog)
- [CVE-2025-49971](https://cve.now/CVE-2025-49971.md): WordPress eDS Responsive Menu plugin \<= 1.2 - Broken Access Control Vulnerability (CVSS 4.3, aThemeArt Translations eDS Responsive Menu)
- [CVE-2025-49972](https://cve.now/CVE-2025-49972.md): WordPress TM Replace Howdy plugin \<= 1.4.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, David Wood TM Replace Howdy)
- [CVE-2025-49973](https://cve.now/CVE-2025-49973.md): WordPress Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes plugin \<= 1.0.10 - Broken Access Control Vulnerability (CVSS 4.3, GrandPlugins Image Sizes Controller, Create Custom Image Si…)
- [CVE-2025-49974](https://cve.now/CVE-2025-49974.md): WordPress UpStream: a Project Management Plugin for WordPress plugin \<= 2.1.1 - Broken Access Control Vulnerability (CVSS 4.3, upstreamplugin UpStream: a Project Management Plugin for Wo…)
- [CVE-2025-49975](https://cve.now/CVE-2025-49975.md): WordPress JobWP plugin \<= 2.4.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Hossni Mubarak JobWP)
- [CVE-2025-49976](https://cve.now/CVE-2025-49976.md): WordPress WANotifier plugin \<= 2.7.12 - Broken Access Control vulnerability (CVSS 4.3, WANotifier Notifier)
- [CVE-2025-49977](https://cve.now/CVE-2025-49977.md): WordPress WP Inventory Manager plugin \<= 2.3.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WP Inventory Manager)
- [CVE-2025-49978](https://cve.now/CVE-2025-49978.md): WordPress JobSearch plugin \< 3.0.6 - Insecure Direct Object References (IDOR) Vulnerability (CVSS 4.3, eyecix JobSearch)
- [CVE-2025-49979](https://cve.now/CVE-2025-49979.md): WordPress Media Hygiene plugin \<= 4.0.1 - Broken Access Control vulnerability (CVSS 4.3, slui Media Hygiene)
- [CVE-2025-49980](https://cve.now/CVE-2025-49980.md): WordPress WP User Profile Avatar plugin \<= 1.0.6 - Broken Access Control Vulnerability (CVSS 4.3, WP Event Manager WP User Profile Avatar)
- [CVE-2025-49981](https://cve.now/CVE-2025-49981.md): WordPress User Roles and Capabilities plugin \<= 1.2.6 - Broken Access Control Vulnerability (CVSS 4.3, mahabub81 User Roles and Capabilities)
- [CVE-2025-49982](https://cve.now/CVE-2025-49982.md): WordPress WP Customer Area plugin \<= 8.3.4 - Broken Access Control vulnerability (CVSS 4.3, aguilatechnologies WP Customer Area)
- [CVE-2025-49983](https://cve.now/CVE-2025-49983.md): WordPress WPThumb plugin \<= 0.10 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.9, Joe Hoyle WPThumb)
- [CVE-2025-49984](https://cve.now/CVE-2025-49984.md): WordPress PowerPress Podcasting plugin \<= 11.13.11 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.9, blubrry PowerPress Podcasting)
- [CVE-2025-49985](https://cve.now/CVE-2025-49985.md): WordPress Auto Upload Images plugin \<= 3.3.2 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.9, Ali Irani Auto Upload Images)
- [CVE-2025-49986](https://cve.now/CVE-2025-49986.md): WordPress Video List Manager plugin \<= 1.7 - Broken Access Control Vulnerability (CVSS 5.3, thanhtungtnt Video List Manager)
- [CVE-2025-49987](https://cve.now/CVE-2025-49987.md): WordPress CRM ERP Business Solution plugin \<= 1.13 - Broken Access Control Vulnerability (CVSS 5.3, WPFactory CRM ERP Business Solution)
- [CVE-2025-49988](https://cve.now/CVE-2025-49988.md): WordPress Contact Form 7 AWeber Extension plugin \<= 0.1.40 - Broken Access Control vulnerability (CVSS 5.3, Renzo Johnson Contact Form 7 AWeber Extension)
- [CVE-2025-49989](https://cve.now/CVE-2025-49989.md): WordPress App Builder plugin \<= 5.5.6 - Broken Access Control vulnerability (CVSS 5.3, App Cheap App Builder)
- [CVE-2025-49990](https://cve.now/CVE-2025-49990.md): WordPress ContentStudio plugin \<= 1.3.7 - Broken Access Control vulnerability (CVSS 5.3, Contentstudio)
- [CVE-2025-49991](https://cve.now/CVE-2025-49991.md): WordPress WP-Recall plugin \<= 16.26.14 - Broken Access Control Vulnerability (CVSS 5.3, tggfref WP-Recall)
- [CVE-2025-49993](https://cve.now/CVE-2025-49993.md): WordPress Cookie-Script.com plugin \<= 1.2.1 - Broken Access Control Vulnerability (CVSS 5.3, csarturas Cookie-Script.com)
- [CVE-2025-49995](https://cve.now/CVE-2025-49995.md): WordPress Download Attachments plugin \<= 1.3.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, dFactory Download Attachments)
- [CVE-2025-49996](https://cve.now/CVE-2025-49996.md): WordPress WP Visitor Statistics (Real Time Traffic) plugin \<= 8.4 - Broken Access Control vulnerability (CVSS 5.3, osama.esh WP Visitor Statistics)
- [CVE-2025-49997](https://cve.now/CVE-2025-49997.md): WordPress Giveaways and Contests by RafflePress plugin \<= 1.12.18 - Broken Access Control + CSRF Vulnerability (CVSS 5.3, Syed Balkhi Giveaways and Contests by RafflePress)
- [CVE-2025-49998](https://cve.now/CVE-2025-49998.md): WordPress WooCommerce Fortnox Integration plugin \<= 4.5.5 - Broken Access Control Vulnerability (CVSS 5.4, Wetail WooCommerce Fortnox Integration)
- [CVE-2025-50008](https://cve.now/CVE-2025-50008.md): WordPress WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily plugin \<= 1.2.4.5 - Broken Access Control Vulnerability (CVSS 5.4, cscode WooCommerce Manager – Customize and Control Cart pag…)
- [CVE-2025-50009](https://cve.now/CVE-2025-50009.md): WordPress Kata Plus plugin \<= 1.5.3 - Broken Access Control Vulnerability (CVSS 5.4, Climax Themes Kata Plus)
- [CVE-2025-50010](https://cve.now/CVE-2025-50010.md): WordPress Zapier for WordPress plugin \<= 1.5.2 - Broken Access Control Vulnerability (CVSS 5.4, Zapier for WordPress)
- [CVE-2025-50011](https://cve.now/CVE-2025-50011.md): WordPress plugin Recipes manager - WPH \<=1.0.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Félix Martínez Recipes manager - WPH)
- [CVE-2025-50012](https://cve.now/CVE-2025-50012.md): WordPress Inventory Presser plugin \<= 15.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, fridaysystems Inventory Presser)
- [CVE-2025-50013](https://cve.now/CVE-2025-50013.md): WordPress CSV Importer Improved plugin \<= 0.6.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Jason Judge CSV Importer Improved)
- [CVE-2025-50014](https://cve.now/CVE-2025-50014.md): WordPress PDPA Consent for Thailand plugin \<= 1.1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, iamapinan PDPA Consent for Thailand)
- [CVE-2025-50015](https://cve.now/CVE-2025-50015.md): WordPress Hand Talk plugin \<= 6.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Rodrigo Bastos Hand Talk)
- [CVE-2025-50016](https://cve.now/CVE-2025-50016.md): WordPress IP Based Login plugin \<= 2.4.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, brijeshk89 IP Based Login)
- [CVE-2025-50017](https://cve.now/CVE-2025-50017.md): WordPress WP Voting Contest plugin \<= 5.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Matt WP Voting Contest)
- [CVE-2025-50018](https://cve.now/CVE-2025-50018.md): WordPress Tealium plugin \<= 2.1.20 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Tealium)
- [CVE-2025-50019](https://cve.now/CVE-2025-50019.md): WordPress Simple Sticky Footer plugin \<= 1.3.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Sandor Kovacs Simple Sticky Footer)
- [CVE-2025-50020](https://cve.now/CVE-2025-50020.md): WordPress RDFa Breadcrumb plugin \<= 2.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Nitin Yawalkar RDFa Breadcrumb)
- [CVE-2025-50021](https://cve.now/CVE-2025-50021.md): WordPress Better Random Redirect plugin \<= 1.3.20 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Robert Peake Better Random Redirect)
- [CVE-2025-50022](https://cve.now/CVE-2025-50022.md): WordPress WP-FB-AutoConnect plugin \<= 4.6.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, JK WP-FB-AutoConnect)
- [CVE-2025-50023](https://cve.now/CVE-2025-50023.md): WordPress CodePen Embed Block plugin \<= 1.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Chris Coyier CodePen Embed Block)
- [CVE-2025-50024](https://cve.now/CVE-2025-50024.md): WordPress ATP Call Now plugin \<= 1.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Truong Thanh ATP Call Now)
- [CVE-2025-50025](https://cve.now/CVE-2025-50025.md): WordPress CP Polls plugin \<= 1.0.81 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, codepeople CP Polls)
- [CVE-2025-50026](https://cve.now/CVE-2025-50026.md): WordPress Spoki plugin \<= 2.17.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Spoki)
- [CVE-2025-50027](https://cve.now/CVE-2025-50027.md): WordPress Login/Signup Popup plugin \<= 2.9.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, xootix Login/Signup Popup)
- [CVE-2025-50030](https://cve.now/CVE-2025-50030.md): WordPress Spark Multipurpose theme \<= 1.0.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, sparklewpthemes Spark Multipurpose)
- [CVE-2025-50033](https://cve.now/CVE-2025-50033.md): WordPress Fitness Park theme \<= 1.1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, sparklewpthemes Fitness Park)
- [CVE-2025-50034](https://cve.now/CVE-2025-50034.md): WordPress Enhanced Blocks – Page Builder Blocks for Gutenberg plugin \<= 1.4.1 - Broken Access Control Vulnerability (CVSS 6.5, Mahmudul Hasan Arif Enhanced Blocks – Page Builder Blocks f…)
- [CVE-2025-50035](https://cve.now/CVE-2025-50035.md): WordPress Fyrebox Quizzes plugin \<= 3.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, CyrilG Fyrebox Quizzes)
- [CVE-2025-50036](https://cve.now/CVE-2025-50036.md): WordPress Mailing Group Listserv plugin \<= 3.0.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 6.5, Yamna Khawaja Mailing Group Listserv)
- [CVE-2025-50037](https://cve.now/CVE-2025-50037.md): WordPress Buying Buddy IDX CRM plugin \<= 2.3.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Buying Buddy IDX CRM)
- [CVE-2025-50038](https://cve.now/CVE-2025-50038.md): WordPress Anant Addons for Elementor plugin \<= 1.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, anantaddons Anant Addons for Elementor)
- [CVE-2025-50041](https://cve.now/CVE-2025-50041.md): WordPress Gutenberg Blocks – ACF Blocks Suite plugin \<= 2.6.11 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WP Engine Gutenberg Blocks – ACF Blocks Suite)
- [CVE-2025-50042](https://cve.now/CVE-2025-50042.md): WordPress WP Register Profile With Shortcode plugin \<= 3.6.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, aviplugins.com WP Register Profile With Shortcode)
- [CVE-2025-50043](https://cve.now/CVE-2025-50043.md): WordPress Code Engine plugin \<= 0.3.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Jordy Meow Code Engine)
- [CVE-2025-50044](https://cve.now/CVE-2025-50044.md): WordPress Real Estate Manager plugin \<= 7.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 6.5, Rameez Iqbal Real Estate Manager)
- [CVE-2025-50045](https://cve.now/CVE-2025-50045.md): WordPress Related Products Manager for WooCommerce plugin \<= 1.6.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, ProWCPlugins Related Products Manager for WooCommerce)
- [CVE-2025-50046](https://cve.now/CVE-2025-50046.md): WordPress WPComplete plugin \<= 2.9.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, StellarWP WPComplete)
- [CVE-2025-50047](https://cve.now/CVE-2025-50047.md): WordPress Sitekit plugin \<= 1.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, webvitaly Sitekit)
- [CVE-2025-50048](https://cve.now/CVE-2025-50048.md): WordPress Automatically Hierarchic Categories in Menu plugin \<= 2.0.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Atakan Au Automatically Hierarchic Categories in Menu)
- [CVE-2025-50049](https://cve.now/CVE-2025-50049.md): WordPress Modern Footnotes plugin \<= 1.4.19 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, prismtechstudios Modern Footnotes)
- [CVE-2025-50050](https://cve.now/CVE-2025-50050.md): WordPress Jobs for WordPress plugin \<= 2.7.14 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, BlueGlass Interactive AG Jobs for WordPress)
- [CVE-2025-50051](https://cve.now/CVE-2025-50051.md): WordPress WP-Members plugin \<= 3.5.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Chad Butler WP-Members)
- [CVE-2025-52772](https://cve.now/CVE-2025-52772.md): WordPress Virtual Moderator plugin \<= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Adnan Haque (a11n) Virtual Moderator)
- [CVE-2025-52780](https://cve.now/CVE-2025-52780.md): WordPress Logo Manager For Samandehi plugin \<= 0.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Mohammad Parsa Logo Manager For Samandehi)
- [CVE-2025-52781](https://cve.now/CVE-2025-52781.md): WordPress TinyNav plugin \<= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Beee TinyNav)
- [CVE-2025-52782](https://cve.now/CVE-2025-52782.md): WordPress Scroll UP plugin \<= 2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, King Rayhan Scroll UP)
- [CVE-2025-52783](https://cve.now/CVE-2025-52783.md): WordPress Change Cart button Colors WooCommerce plugin \<= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, themelocation Change Cart button Colors WooCommerce)
- [CVE-2025-52784](https://cve.now/CVE-2025-52784.md): WordPress Bluff Post plugin \<= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, hideoguchi Bluff Post)
- [CVE-2025-52789](https://cve.now/CVE-2025-52789.md): WordPress Lewe ChordPress plugin \<= 4.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability (CVSS 7.1, George Lewe Lewe ChordPress)
- [CVE-2025-52790](https://cve.now/CVE-2025-52790.md): WordPress WP-DownloadCounter plugin \<= 1.01 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, r-win WP-DownloadCounter)
- [CVE-2025-52791](https://cve.now/CVE-2025-52791.md): WordPress Knowledge Base – Knowledge Base Maker plugin \<= 1.1.8 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, devfelixmoira Knowledge Base – Knowledge Base Maker)
- [CVE-2025-52792](https://cve.now/CVE-2025-52792.md): WordPress WP User Stylesheet Switcher plugin \<= v2.2.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, vgstef WP User Stylesheet Switcher)
- [CVE-2025-52793](https://cve.now/CVE-2025-52793.md): WordPress Esselink.nu Settings plugin \<= 4.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Esselink.nu Settings)
- [CVE-2025-52794](https://cve.now/CVE-2025-52794.md): WordPress Creative Contact Form plugin \<= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Creative-Solutions Creative Contact Form)
- [CVE-2025-52795](https://cve.now/CVE-2025-52795.md): WordPress WP Front User Submit / Front Editor plugin \<= 5.0.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, aharonyan WP Front User Submit / Front Editor)
- [CVE-2025-52802](https://cve.now/CVE-2025-52802.md): WordPress Import YouTube videos as WP Posts plugin \<= 2.1 - Broken Access Control Vulnerability (CVSS 7.5, enguerranws Import YouTube videos as WP Posts)
- [CVE-2025-52821](https://cve.now/CVE-2025-52821.md): WordPress Video List Manager plugin \<= 1.7 - SQL Injection Vulnerability (CVSS 8.5, thanhtungtnt Video List Manager)
- [CVE-2025-52822](https://cve.now/CVE-2025-52822.md): WordPress WP Roadmap plugin \<= 2.1.3 - SQL Injection vulnerability (CVSS 8.5, Iqonic Design WP Roadmap)
- [CVE-2025-52825](https://cve.now/CVE-2025-52825.md): WordPress Real Estate Manager plugin \<= 7.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 8.8, Rameez Iqbal Real Estate Manager)
- [CVE-2025-52733](https://cve.now/CVE-2025-52733.md): WordPress ANON::form embedded secure form plugin \<= 1.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Anonform Ab ANON::form embedded secure form)
- [CVE-2025-52719](https://cve.now/CVE-2025-52719.md): WordPress ProfileGrid plugin \<= 5.9.5.2 - Full Path Disclosure (FPD) Vulnerability (CVSS 4.3, Metagauss ProfileGrid)
- [CVE-2025-52715](https://cve.now/CVE-2025-52715.md): WordPress Classified Listing plugin \<= 4.2.0 - Local File Inclusion Vulnerability (CVSS 7.5, RadiusTheme Classified Listing)
- [CVE-2025-52713](https://cve.now/CVE-2025-52713.md): WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin \<= 1.27.8 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 6.4, Post and Page Builder by BoldGrid)
- [CVE-2025-52711](https://cve.now/CVE-2025-52711.md): WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin \<= 1.27.8 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Post and Page Builder by BoldGrid)
- [CVE-2025-52710](https://cve.now/CVE-2025-52710.md): WordPress File Manager Pro plugin \<= 1.8.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Ninja Team File Manager Pro)
- [CVE-2025-52708](https://cve.now/CVE-2025-52708.md): WordPress HUSKY plugin \<= 1.3.7 - Local File Inclusion Vulnerability (CVSS 7.5, RealMag777 HUSKY)
- [CVE-2025-52707](https://cve.now/CVE-2025-52707.md): WordPress Firelight Lightbox plugin \<= 2.3.16 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Firelight Lightbox)
- [CVE-2025-6346](https://cve.now/CVE-2025-6346.md): SourceCodester Advance Charity Management System fundDetails.php sql injection (CVSS 5.3, SourceCodester Advance Charity Management System)
- [CVE-2025-3319](https://cve.now/CVE-2025-3319.md): IBM Spectrum Protect Server authentication bypass (CVSS 8.1, IBM Spectrum Protect Server)
- [CVE-2025-3228](https://cve.now/CVE-2025-3228.md): Unauthorized Guest user access to Playbook (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-3227](https://cve.now/CVE-2025-3227.md): Unauthorized channel member management through playbook runs (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-6345](https://cve.now/CVE-2025-6345.md): SourceCodester My Food Recipe Add Recipe Page add-recipe.php addRecipeModal cross site scripting (CVSS 5.1, SourceCodester My Food Recipe)
- [CVE-2025-6344](https://cve.now/CVE-2025-6344.md): code-projects Online Shoe Store contactus.php sql injection (CVSS 6.9, code-projects Online Shoe Store)
- [CVE-2024-7586](https://cve.now/CVE-2024-7586.md): Insertion of Sensitive Information into Log File in GitLab (CVSS 4.1, GitLab)
- [CVE-2024-53298](https://cve.now/CVE-2024-53298.md): Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.1, contains a missing authorization vulnerability in the NFS export. (CVSS 9.8, Dell PowerScale OneFS)
- [CVE-2025-32753](https://cve.now/CVE-2025-32753.md): Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.1, contains an improper neutralization of special elements used in an SQL command ('S (CVSS 5.3, Dell PowerScale OneFS)
- [CVE-2025-6343](https://cve.now/CVE-2025-6343.md): code-projects Online Shoe Store admin\_product.php sql injection (CVSS 6.9, code-projects Online Shoe Store)
- [CVE-2025-6342](https://cve.now/CVE-2025-6342.md): code-projects Online Shoe Store admin\_football.php sql injection (CVSS 6.9, code-projects Online Shoe Store)
- [CVE-2025-6341](https://cve.now/CVE-2025-6341.md): code-projects School Fees Payment System cross-site request forgery (CVSS 5.3, code-projects School Fees Payment System)
- [CVE-2025-6340](https://cve.now/CVE-2025-6340.md): code-projects School Fees Payment System branch.php cross site scripting (CVSS 5.1, code-projects School Fees Payment System)
- [CVE-2025-6339](https://cve.now/CVE-2025-6339.md): ponaravindb Hospital Management System func3.php sql injection (CVSS 6.9, ponaravindb Hospital Management System)
- [CVE-2025-6337](https://cve.now/CVE-2025-6337.md): TOTOLINK A3002R/A3002RU HTTP POST Request formTmultiAP buffer overflow (CVSS 8.7, TOTOLINK A3002R · TOTOLINK A3002RU)
- [CVE-2025-6336](https://cve.now/CVE-2025-6336.md): TOTOLINK EX1200T HTTP POST Request formTmultiAP buffer overflow (CVSS 8.7, TOTOLINK EX1200T)
- [CVE-2025-38083](https://cve.now/CVE-2025-38083.md): net\_sched: prio: fix a race in prio\_tune() (CVSS 7.8, Linux)
- [CVE-2025-4102](https://cve.now/CVE-2025-4102.md): Beaver Builder Plugin (Starter Version) \<= 2.9.1 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2, The Beaver Builder Team Beaver Builder Plugin)
- [CVE-2025-6335](https://cve.now/CVE-2025-6335.md): DedeCMS Template dedetag.class.php command injection (CVSS 5.1, DedeCMS)
- [CVE-2025-6334](https://cve.now/CVE-2025-6334.md): D-Link DIR-867 Query String strncpy stack-based overflow (CVSS 8.7, D-Link DIR-867)
- [CVE-2025-6333](https://cve.now/CVE-2025-6333.md): PHPGurukul Directory Management System admin-profile.php sql injection (CVSS 5.3, PHPGurukul Directory Management System)
- [CVE-2025-6332](https://cve.now/CVE-2025-6332.md): PHPGurukul Directory Management System manage-directory.php sql injection (CVSS 5.3, PHPGurukul Directory Management System)
- [CVE-2025-4981](https://cve.now/CVE-2025-4981.md): Path Traversal Leading to RCE by Any Authenticated Mattermost User (CVSS 9.9, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-5963](https://cve.now/CVE-2025-5963.md): TCC Bypass via Dylib Injection in Postbox (CVSS 4.8, Postbox)
- [CVE-2025-5255](https://cve.now/CVE-2025-5255.md): TCC Bypass via Dylib Injection in Phoenix Code (CVSS 4.8, Core.ai Phoenix Code)
- [CVE-2025-6331](https://cve.now/CVE-2025-6331.md): PHPGurukul Directory Management System search-directory.php sql injection (CVSS 5.3, PHPGurukul Directory Management System)
- [CVE-2025-6330](https://cve.now/CVE-2025-6330.md): PHPGurukul Directory Management System searchdata.php sql injection (CVSS 6.9, PHPGurukul Directory Management System)
- [CVE-2025-6329](https://cve.now/CVE-2025-6329.md): ScriptAndTools Real Estate Management System User Delete userdelete.php authorization (CVSS 5.3, ScriptAndTools Real Estate Management System)
- [CVE-2025-6328](https://cve.now/CVE-2025-6328.md): D-Link DIR-815 hedwig.cgi sub\_403794 stack-based overflow (CVSS 8.7, D-Link DIR-815)
- [CVE-2025-6323](https://cve.now/CVE-2025-6323.md): PHPGurukul Pre-School Enrollment System enrollment.php sql injection (CVSS 6.9, PHPGurukul Pre-School Enrollment System)
- [CVE-2025-6322](https://cve.now/CVE-2025-6322.md): PHPGurukul Pre-School Enrollment System visit.php sql injection (CVSS 6.9, PHPGurukul Pre-School Enrollment System)
- [CVE-2025-6321](https://cve.now/CVE-2025-6321.md): PHPGurukul Pre-School Enrollment System add-subadmin.php sql injection (CVSS 5.3, PHPGurukul Pre-School Enrollment System)
- [CVE-2025-6320](https://cve.now/CVE-2025-6320.md): PHPGurukul Pre-School Enrollment System add-class.php sql injection (CVSS 5.3, PHPGurukul Pre-School Enrollment System)
- [CVE-2025-6257](https://cve.now/CVE-2025-6257.md): Euro FxRef Currency Converter \<= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via currency Shortcode (CVSS 6.4, joostdekeijzer Euro FxRef Currency Converter)
- [CVE-2025-6319](https://cve.now/CVE-2025-6319.md): PHPGurukul Pre-School Enrollment System add-teacher.php sql injection (CVSS 5.3, PHPGurukul Pre-School Enrollment System)
- [CVE-2025-6318](https://cve.now/CVE-2025-6318.md): PHPGurukul Pre-School Enrollment System check\_availability.php sql injection (CVSS 6.9, PHPGurukul Pre-School Enrollment System)
- [CVE-2025-6317](https://cve.now/CVE-2025-6317.md): code-projects Online Shoe Store confirm.php sql injection (CVSS 6.9, code-projects Online Shoe Store)
- [CVE-2025-6316](https://cve.now/CVE-2025-6316.md): code-projects Online Shoe Store admin\_running.php sql injection (CVSS 6.9, code-projects Online Shoe Store)
- [CVE-2025-6315](https://cve.now/CVE-2025-6315.md): code-projects Online Shoe Store cart2.php sql injection (CVSS 6.9, code-projects Online Shoe Store)
- [CVE-2025-6314](https://cve.now/CVE-2025-6314.md): Campcodes Sales and Inventory System cat\_update.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-6313](https://cve.now/CVE-2025-6313.md): Campcodes Sales and Inventory System cat\_add.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-50054](https://cve.now/CVE-2025-50054.md): Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too la (CVSS 5.5, OpenVPN ovpn-dco-win)
- [CVE-2025-6312](https://cve.now/CVE-2025-6312.md): Campcodes Sales and Inventory System cash\_transaction.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-5125](https://cve.now/CVE-2025-5125.md): Custom Post Carousels with Owl \< 1.4.12 - Contributor+ Stored XSS (CVSS 4.8, Custom Post Carousels with Owl)
- [CVE-2025-6311](https://cve.now/CVE-2025-6311.md): Campcodes Sales and Inventory System account\_add.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-6310](https://cve.now/CVE-2025-6310.md): PHPGurukul Emergency Ambulance Hiring Portal index.php sql injection (CVSS 6.9, PHPGurukul Emergency Ambulance Hiring Portal)
- [CVE-2025-6309](https://cve.now/CVE-2025-6309.md): PHPGurukul Emergency Ambulance Hiring Portal add-ambulance.php sql injection (CVSS 5.3, PHPGurukul Emergency Ambulance Hiring Portal)
- [CVE-2025-6308](https://cve.now/CVE-2025-6308.md): PHPGurukul Emergency Ambulance Hiring Portal bwdates-request-report-details.php sql injection (CVSS 5.3, PHPGurukul Emergency Ambulance Hiring Portal)
- [CVE-2025-6307](https://cve.now/CVE-2025-6307.md): code-projects Online Shoe Store edit\_customer.php sql injection (CVSS 6.9, code-projects Online Shoe Store)
- [CVE-2025-6306](https://cve.now/CVE-2025-6306.md): code-projects Online Shoe Store admin\_index.php sql injection (CVSS 6.9, code-projects Online Shoe Store)
- [CVE-2025-6305](https://cve.now/CVE-2025-6305.md): code-projects Online Shoe Store admin\_feature.php sql injection (CVSS 6.9, code-projects Online Shoe Store)
- [CVE-2025-6304](https://cve.now/CVE-2025-6304.md): code-projects Online Shoe Store cart.php sql injection (CVSS 6.9, code-projects Online Shoe Store)
- [CVE-2025-6303](https://cve.now/CVE-2025-6303.md): code-projects Online Shoe Store contactus1.php sql injection (CVSS 6.9, code-projects Online Shoe Store)
- [CVE-2025-6302](https://cve.now/CVE-2025-6302.md): TOTOLINK EX1200T cstecgi.cgi setStaticDhcpConfig stack-based overflow (CVSS 8.7, TOTOLINK EX1200T)
- [CVE-2025-6301](https://cve.now/CVE-2025-6301.md): PHPGurukul Notice Board System Add Notice manage-notices.php cross site scripting (CVSS 4.8, PHPGurukul Notice Board System)
- [CVE-2025-6264](https://cve.now/CVE-2025-6264.md): Velociraptor priviledge escalation via UpdateConfig artifact (CVSS 5.5, Rapid7 Velociraptor · www.velocidex.com/golang/velociraptor)
- [CVE-2025-6300](https://cve.now/CVE-2025-6300.md): PHPGurukul Employee Record Management System editempeducation.php sql injection (CVSS 6.9, PHPGurukul Employee Record Management System)
- [CVE-2025-6299](https://cve.now/CVE-2025-6299.md): TOTOLINK N150RT formWSC os command injection (CVSS 5.1, TOTOLINK N150RT)
- [CVE-2025-6296](https://cve.now/CVE-2025-6296.md): code-projects Hostel Management System empty\_rooms.php sql injection (CVSS 6.9, code-projects Hostel Management System)
- [CVE-2025-6295](https://cve.now/CVE-2025-6295.md): code-projects Hostel Management System allocated\_rooms.php sql injection (CVSS 6.9, code-projects Hostel Management System)
- [CVE-2025-49715](https://cve.now/CVE-2025-49715.md): Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability (CVSS 7.5, Microsoft Dynamics 365 FastTrack Implementation)
- [CVE-2025-6294](https://cve.now/CVE-2025-6294.md): code-projects Hostel Management System contact.php sql injection (CVSS 6.9, code-projects Hostel Management System)
- [CVE-2025-48058](https://cve.now/CVE-2025-48058.md): PowSyBl Core contains Polynomial REDoS’es (CVSS 6.3, powsybl-core · com.powsybl:powsybl-commons)
- [CVE-2025-6293](https://cve.now/CVE-2025-6293.md): code-projects Hostel Management System contact\_manager.php sql injection (CVSS 6.9, code-projects Hostel Management System)
- [CVE-2025-6292](https://cve.now/CVE-2025-6292.md): D-Link DIR-825 HTTP POST Request sub\_4091AC stack-based overflow (CVSS 8.7, D-Link DIR-825)
- [CVE-2025-6291](https://cve.now/CVE-2025-6291.md): D-Link DIR-825 HTTP POST Request do\_file stack-based overflow (CVSS 8.7, D-Link DIR-825)
- [CVE-2025-6288](https://cve.now/CVE-2025-6288.md): PHPGurukul Bus Pass Management System Profile Page admin-profile.php cross site scripting (CVSS 4.8, PHPGurukul Bus Pass Management System)
- [CVE-2025-32875](https://cve.now/CVE-2025-32875.md): An issue was discovered in the COROS application through 3.8.12 for Android. (CVSS 5.7)
- [CVE-2025-32876](https://cve.now/CVE-2025-32876.md): An issue was discovered on COROS PACE 3 devices through 3.0808.0. (CVSS 6.8)
- [CVE-2025-32877](https://cve.now/CVE-2025-32877.md): An issue was discovered on COROS PACE 3 devices through 3.0808.0. (CVSS 9.8)
- [CVE-2025-32878](https://cve.now/CVE-2025-32878.md): An issue was discovered on COROS PACE 3 devices through 3.0808.0. (CVSS 9.8)
- [CVE-2025-32879](https://cve.now/CVE-2025-32879.md): An issue was discovered on COROS PACE 3 devices through 3.0808.0. (CVSS 8.8)
- [CVE-2025-32880](https://cve.now/CVE-2025-32880.md): An issue was discovered on COROS PACE 3 devices through 3.0808.0. (CVSS 9.8)
- [CVE-2025-44203](https://cve.now/CVE-2025-44203.md): In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs (CVSS 7.5)
- [CVE-2025-44635](https://cve.now/CVE-2025-44635.md): There are multiple unauthorized remote command execution vulnerabilities in the H3C ER2200G2, ERG2-450W, ERG2-1200W, ERG2-1350W, NR1200W ser (CVSS 9.8)
- [CVE-2025-45331](https://cve.now/CVE-2025-45331.md): brplot v420.69.1 contains a Null Pointer Dereference (NPD) vulnerability in the br\_dagens\_handle\_once function of its data processing module (CVSS 7.5)
- [CVE-2025-45890](https://cve.now/CVE-2025-45890.md): Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter (CVSS 9.8)
- [CVE-2025-46158](https://cve.now/CVE-2025-46158.md): An issue in redoxOS kernel before commit 5d41cd7c allows a local attacker to cause a denial of service via the \`setitimer\` syscall (CVSS 6.2)
- [CVE-2025-46179](https://cve.now/CVE-2025-46179.md): A SQL Injection vulnerability was discovered in the askquery.php file of CloudClassroom-PHP Project v1.0. (CVSS 9.8)
- [CVE-2025-48705](https://cve.now/CVE-2025-48705.md): An issue was discovered in COROS PACE 3 through 3.0808.0. (CVSS 7.5)
- [CVE-2025-48706](https://cve.now/CVE-2025-48706.md): An issue was discovered in COROS PACE 3 through 3.0808.0. (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.