CVEs published June 28, 2025
46 CVEs were published on June 28, 2025: 3 critical, 12 high.
- Published
- 46
- Critical
- 3
- High
- 12
- Medium
- 28
- Low
- 2
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Preh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…
- 12
- code-projects Inventory Management System
- 8
- HDF5
- 3
- IBM Datacap
- 3
- Linux
- 3
- aaluoxiang oa_system
- 1
- Akka · com.typesafe.akka:akka-cluster-metrics_3 +1
- 1
- Apache Software Foundation Apache Seata · org.apache.seata:…
- 1
- BeeTeam368 Extensions
- 1
- BeeTeam368 Extensions Pro
- 1
Critical 3
- CVE-2025-32897Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata ServerApache Software Foundation Apache Seata · org.apache.seata:…
- CVE-2025-5304PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via wpnb_pto_new_users_add Functionblafoley PT Project Notebooks – Take Meeting minutes, creat…
- CVE-2025-53391The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit allow_any/allow_inactivDebian zulucrypt
High 12
- CVE-2025-6825TOTOLINK A702R HTTP POST Request formWlSiteSurvey buffer overflowTOTOLINK A702R
- CVE-2025-6824TOTOLINK X15 HTTP POST Request formParentControl buffer overflowTOTOLINK X15
- CVE-2023-28905Heap buffer overflow in picserverPreh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…
- CVE-2023-28906Command injection in networking servicePreh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…
- CVE-2023-28909Integer Overflow Leading to MTU BypassPreh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…
- CVE-2023-28910Disabled Abortion FlagPreh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…
- CVE-2025-1991IBM Informix Dynamic Server denial of serviceIBM Informix Dynamic Server
- CVE-2025-38085mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast raceLinux
- CVE-2025-38084mm/hugetlb: unshare page tables during VMA split, not beforeLinux
- CVE-2025-6755Game Users Share Buttons <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Deletion via themeNameId Parametergameusers Game Users Share Buttons
- CVE-2025-6381BeeTeam368 Extensions <= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File DeletionBeeTeam368 Extensions
- CVE-2025-6379BeeTeam368 Extensions Pro <= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File DeletionBeeTeam368 Extensions Pro
Medium, low and unrated 31
- CVE-2025-6834code-projects Inventory Management System editPayment.php sql injectioncode-projects Inventory Management System
- CVE-2025-6829aaluoxiang oa_system External Address Book outAddress sql injectionaaluoxiang oa_system
- CVE-2025-6828code-projects Inventory Management System orders.php sql injectioncode-projects Inventory Management System
- CVE-2025-6827code-projects Inventory Management System editOrder.php sql injectioncode-projects Inventory Management System
- CVE-2025-6826code-projects Payroll Management System ajax.php sql injectioncode-projects Payroll Management System
- CVE-2025-6823code-projects Inventory Management System editProduct.php sql injectioncode-projects Inventory Management System
- CVE-2025-6822code-projects Inventory Management System removeProduct.php sql injectioncode-projects Inventory Management System
- CVE-2025-6821code-projects Inventory Management System createOrder.php sql injectioncode-projects Inventory Management System
- CVE-2025-6820code-projects Inventory Management System createProduct.php sql injectioncode-projects Inventory Management System
- CVE-2025-6819code-projects Inventory Management System removeBrand.php sql injectioncode-projects Inventory Management System
- CVE-2023-28902Denial of Service via integer underflow in picserverPreh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…
- CVE-2023-28903An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to causPreh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…
- CVE-2023-28904Bypass of secure boot processPreh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…
- CVE-2023-28907A lack of access restrictions on internal memory regionsPreh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…
- CVE-2023-28908Integer Overflow in Non-Fragmented Data ReceptionPreh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…
- CVE-2023-28911Arbitrary Channel Disconnection Resulting in Denial of ServicePreh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…
- CVE-2023-28912Cleartext Phonebook InformationPreh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…
- CVE-2023-29113A lack of access control in custom IPC mechanismPreh Car Connect GmbH (JOYNEXT GmbH) Volkswagen MIB3 infota…
- CVE-2025-6818HDF5 H5Ochunk.c H5O__chunk_protect heap-based overflowHDF5
- CVE-2025-6817HDF5 H5Centry.c H5C__load_entry resource consumptionHDF5
- CVE-2025-6816HDF5 H5Ofsinfo.c H5O__fsinfo_encode heap-based overflowHDF5
- CVE-2025-38086net: ch9200: fix uninitialised access during mii_nway_restartLinux
- CVE-2025-5937MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Resetvideowhisper MicroPayments – Fans Paysite: Paid Creator Sub…
- CVE-2025-6252Qi Addons For Elementor <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingqodeinteractive Qi Addons For Elementor
- CVE-2025-6350WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.32 - Authenticated (Contributor+) Stored Cross-Site Scriptingrextheme WP VR – 360 Panorama and Free Virtual Tour Builder…
- CVE-2024-52900IBM Cognos Analytics cross-site scriptingIBM Cognos Analytics
- CVE-2025-36027IBM Datacap clickjackingIBM Datacap
- CVE-2025-36026IBM Datacap information disclosureIBM Datacap
- CVE-2024-39730IBM Datacap clickjackingIBM Datacap
- CVE-2025-53392In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directNetgate pfSense
- CVE-2025-53393In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics.Akka · com.typesafe.akka:akka-cluster-metrics_3 +1