Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,827 results · page 35 of 137
Jun 20, 2025A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical.CVE-2025-6374 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. This issue affects the function formSetACLFilter of the file /goform/formSetACLFilter. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical.CVE-2025-6373 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. This vulnerability affects the function formSetWizard1 of the file /goform/formWlSiteSurvey. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01.CVE-2025-6372 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01. This affects the function formSetWizard1 of the file /goform/formSetWizard1. The manipulation of the argument curTime leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01.CVE-2025-6371 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetEnableWizard of the file /goform/formSetEnableWizard. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability classified as critical was found in D-Link DIR-619L 2.06B01.CVE-2025-6370 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in D-Link DIR-619L 2.06B01. Affected by this vulnerability is the function formWlanGuestSetup of the file /goform/formWlanGuestSetup. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability classified as critical has been found in D-Link DIR-619L 2.06B01.CVE-2025-6369 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in D-Link DIR-619L 2.06B01. Affected is the function formdumpeasysetup of the file /goform/formdumpeasysetup. The manipulation of the argument curTime/config.save_network_enabled leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability was found in HobbesOSR Kitten up to c4f8b7c3158983d1020af432be1b417b28686736 and classified as critical.CVE-2025-6365 · Other software · HobbesOSR · reported by VulDBMedium 6.9
A vulnerability was found in HobbesOSR Kitten up to c4f8b7c3158983d1020af432be1b417b28686736 and classified as critical. Affected by this issue is the function set_pte_at in the library /include/arch-arm64/pgtable.h. The manipulation leads to resource consumption. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- Kitten
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025Automatically Hierarchic Categories in Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50048 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atakan Au Automatically Hierarchic Categories in Menu automatically-hierarchic-categories-in-menu allows Stored XSS.This issue affects Automatically Hierarchic Categories in Menu: from n/a through <= 2.0.9.
- Product
- Automatically Hierarchic Categories in Menu
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Automatically Hierarchic Categories in Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025A vulnerability was found in DedeCMS up to 5.7.2 and classified as critical.CVE-2025-6335 · Other software · Dedecms · reported by VulDBLow 2
A vulnerability was found in DedeCMS up to 5.7.2 and classified as critical. This issue affects some unknown processing of the file /include/dedetag.class.php of the component Template Handler. The manipulation of the argument notes leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability has been found in D-Link DIR-867 1.0 and classified as critical.CVE-2025-6334 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability has been found in D-Link DIR-867 1.0 and classified as critical. This vulnerability affects the function strncpy of the component Query String Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-867
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.securitCVE-2025-5963 · Other software · Postbox · reported by cvd@cert.plMedium 4.8
The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacker with unprivileged access can use environment variables like DYLD_INSERT_LIBRARIES to successfully inject code in application's context and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. The original company behind Postbox is no longer operational, the software will no longer receive updates. The acquiring company (em Client) did not cooperate in vulnerability disclosure.
- Product
- Postbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plpostbox-inc.com
Jun 20, 2025The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.seCVE-2025-5255 · Other software · Core.ai · reported by cvd@cert.plMedium 4.8
The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacker with unprivileged access can use environment variables like DYLD_INSERT_LIBRARIES to successfully inject code in application's context and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in commit 0c75fb57f89d0b7d9b180026bc2624b7dcf807da
- Product
- Phoenix Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713.CVE-2025-6302 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Comment leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkn0sinna.notion.sitevuldb.com
Jun 19, 2025A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-6299 · Other software · TOTOLINK · reported by VulDBLow 2
A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the file /boa/formWSC. The manipulation of the argument targetAPSsid leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comvuldb.com
Jun 19, 2025A vulnerability has been found in D-Link DIR-825 2.03 and classified as critical.CVE-2025-6292 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability has been found in D-Link DIR-825 2.03 and classified as critical. This vulnerability affects the function sub_4091AC of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-825
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability, which was classified as critical, was found in D-Link DIR-825 2.03.CVE-2025-6291 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in D-Link DIR-825 2.03. This affects the function do_file of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-825
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical.CVE-2025-6282 · Other software · xlang-ai · reported by VulDBLow 2
A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical. Affected by this issue is the function create_upload_file of the file backend/api/file.py. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
- Product
- OpenAgents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability has been found in OpenBMB XAgent up to 1.0.0 and classified as critical.CVE-2025-6281 · Other software · OpenBMB · reported by VulDBLow 2
A vulnerability has been found in OpenBMB XAgent up to 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /conv/community. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used.
- Product
- XAgent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14.CVE-2025-6280 · Other software · TransformerOptimus · reported by VulDBLow 2
A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function download_attachment of the file SuperAGI/superagi/helper/read_email.py of the component EmailToolKit. The manipulation of the argument filename leads to path traversal. The exploit has been disclosed to the public and may be used.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via CVE-2025-6384 · Other software · CrafterCMS · reported by security@craftersoftware.comHigh 7.3
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution). This issue affects CrafterCMS: from 4.0.0 through 4.2.2.
- Product
- CrafterCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6.CVE-2025-6279 · Other software · Upsonic · reported by VulDBLow 2
A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. This issue affects the function cloudpickle.loads of the file /tools/add_tool of the component Pickle Handler. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used.
- Product
- Upsonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability classified as critical was found in Upsonic up to 0.55.6.CVE-2025-6278 · Other software · Upsonic · reported by VulDBLow 2
A vulnerability classified as critical was found in Upsonic up to 0.55.6. This vulnerability affects the function os.path.join of the file markdown/server.py. The manipulation of the argument file.filename leads to path traversal. The exploit has been disclosed to the public and may be used.
- Product
- Upsonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability classified as critical has been found in Brilliance Golden Link Secondary System up to 20250609.CVE-2025-6277 · Other software · Brilliance · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in Brilliance Golden Link Secondary System up to 20250609. This affects an unknown part of the file /storagework/custTakeInfoPage.htm. The manipulation of the argument custTradeName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Golden Link Secondary System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability, which was classified as critical, has been found in HDF5 up to 1.14.6.CVE-2025-6270 · Other software · Hdfgroup · reported by VulDBLow 1.9
A vulnerability, which was classified as critical, has been found in HDF5 up to 1.14.6. Affected by this issue is the function H5FS__sect_find_node of the file H5FSsection.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability classified as critical was found in HDF5 up to 1.14.6.CVE-2025-6269 · Other software · Hdfgroup · reported by VulDBLow 1.9
A vulnerability classified as critical was found in HDF5 up to 1.14.6. Affected by this vulnerability is the function H5C__reconstruct_cache_entry of the file H5Cimage.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2025CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component.CVE-2025-26198 · Other software · Vishalmathur · reported by MITRECritical 9.8
CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data.
- Product
- Cloudclassroom-php Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 18, 2025In the Linux kernel, the following vulnerability has been resolved: alloc_tag: allocate percpu counters for module tags dynamically When a module gets unloadeCVE-2025-38076 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: alloc_tag: allocate percpu counters for module tags dynamically When a module gets unloaded it checks whether any of its tags are still in use and if so, we keep the memory containing module's allocation tags alive until all tags are unused. However percpu counters referenced by the tags are freed by free_module(). This will lead to UAF if the memory allocated by a module is accessed after module was unloaded. To fix this we allocate percpu counters for module allocation tags dynamically and we keep it alive for tags which are still in use after module unloading. This also removes the requirement of a larger PERCPU_MODULE_RESERVE when memory allocation profiling is enabled because percpu memory for counters does not need to be reserved anymore.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 18, 2025In the Linux kernel, the following vulnerability has been resolved: x86/mm: Check return value from memblock_phys_alloc_range() At least with CONFIG_PHYSICAL_CVE-2025-38071 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Check return value from memblock_phys_alloc_range() At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of contiguous free memory available at this point, the kernel will crash and burn because memblock_phys_alloc_range() returns 0 on failure, which leads memblock_phys_free() to throw the first 4 MiB of physical memory to the wolves. At a minimum it should fail gracefully with a meaningful diagnostic, but in fact everything seems to work fine without the weird reserve allocation.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 17, 2025An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical acCVE-2025-49487 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.8
An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations. An attacker must have had physical access to the target system in order to exploit this vulnerability due to need to access a certain hardware component. Also note: this vulnerability only affected the SaaS client version of WFBSS only, meaning the on-premise version of Worry-Free Business Security was not affected, and this issue was addressed in a previous WFBSS monthly maintenance update. Therefore no other customer action is required to mitigate if the WFBSS agents are on the regular SaaS maintenance deployment schedule and this disclosure is for informational purposes only.
- Product
- Trend Micro Worry-Free Business Security Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comzerodayinitiative.com
Jun 17, 2025A vulnerability classified as critical was found in Webkul QloApps 1.6.1.CVE-2025-6173 · Other software · Webkul · reported by VulDBLow 2
A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_products_list.php. The manipulation of the argument packItself leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirms the existence of this flaw but considers it a low-level issue due to admin privilege pre-requisites. Still, a fix is planned for a future release.
- Product
- QloApps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2025A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5.CVE-2025-6167 · Other software · themanojdesai · reported by VulDBMedium 5.1
A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/agent_flow/server/api.py. The manipulation leads to path traversal. Upgrading to version 0.5.6 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- python-a2a
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2025A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615 and classified as critical.CVE-2025-6163 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002RU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2025A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical.CVE-2025-6162 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2025A vulnerability classified as critical has been found in D-Link DIR-665 1.00.CVE-2025-6158 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in D-Link DIR-665 1.00. This affects the function sub_AC78 of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-665
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability, which was classified as critical, was found in Steel Browser up to 0.1.3.CVE-2025-6152 · Other software · Steel · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Steel Browser up to 0.1.3. This affects the function handleFileUpload of the file api/src/modules/files/files.routes.ts. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. The patch is named 7ba93a10000fb77ee01731478ef40551a27bd5b9. It is recommended to apply a patch to fix this issue.
- Product
- Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20230714.1105.CVE-2025-6150 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical has been found in TOTOLINK A3002R 4.0.0-B20230531.1404.CVE-2025-6149 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in TOTOLINK A3002R 4.0.0-B20230531.1404. Affected is an unknown function of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical.CVE-2025-6145 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical.CVE-2025-6144 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formSysCmd of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713.CVE-2025-6143 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formNtp of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical was found in TOTOLINK T10 4.1.8cu.5207.CVE-2025-6138 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in TOTOLINK T10 4.1.8cu.5207. Affected by this vulnerability is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ssid5g leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- T10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Jun 16, 2025A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5207.CVE-2025-6137 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5207. Affected is the function setWiFiScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- T10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Jun 16, 2025A vulnerability has been found in Chanjet CRM 1.0 and classified as critical.CVE-2025-6132 · Other software · Chanjet · reported by VulDBMedium 5.5
A vulnerability has been found in Chanjet CRM 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysconfig/departmentsetting.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713.CVE-2025-6130 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This issue affects some unknown processing of the file /boafrm/formStats of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713.CVE-2025-6129 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This vulnerability affects unknown code of the file /boafrm/formSaveConfig of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713.CVE-2025-6128 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This affects an unknown part of the file /boafrm/formWirelessTbl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability, which was classified as critical, has been found in D-Link DIR-632 FW103B08.CVE-2025-6121 · Network & remote access · D-Link · reported by VulDBHigh 8.9
A vulnerability, which was classified as critical, has been found in D-Link DIR-632 FW103B08. Affected by this issue is the function get_pure_content of the component HTTP POST Request Handler. The manipulation of the argument Content-Length leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-632
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3.CVE-2025-6120 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function read_meshes in the library assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A flaw was found in the temporary user record that authd uses in the pre-auth NSS.CVE-2025-5689 · Other software · Canonical · reported by security@ubuntu.comHigh 8.5
A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part of the root group in the context of that SSH session.
- Product
- authd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3.CVE-2025-6119 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3. Affected is the function Assimp::BVHLoader::ReadNodeChannels in the library assimp/code/AssetLib/BVH/BVHLoader.cpp. The manipulation of the argument pNode leads to use after free. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.