Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,302 results · page 10 of 87
Jul 6, 2025A vulnerability classified as critical was found in Belkin F9K1122 1.00.33.CVE-2025-7087 · Other software · Belkin · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in Belkin F9K1122 1.00.33. Affected by this vulnerability is the function formL2TPSetup of the file /goform/formL2TPSetup of the component webs. The manipulation of the argument L2TPUserName leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- F9K1122
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2025A vulnerability classified as critical has been found in Belkin F9K1122 1.00.33.CVE-2025-7086 · Other software · Belkin · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in Belkin F9K1122 1.00.33. Affected is the function formPPTPSetup of the file /goform/formPPTPSetup of the component webs. The manipulation of the argument pptpUserName leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- F9K1122
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2025A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical.CVE-2025-7082 · Other software · Belkin · reported by VulDBLow 2.1
A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this issue is the function formBSSetSitesurvey of the file /goform/formBSSetSitesurvey of the component webs. The manipulation of the argument wan_ipaddr/wan_netmask/wan_gateway/wl_ssid is directly passed by the attacker/so we can control the wan_ipaddr/wan_netmask/wan_gateway/wl_ssid leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- F9K1122
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2025A vulnerability has been found in Belkin F9K1122 1.00.33 and classified as critical.CVE-2025-7081 · Other software · Belkin · reported by VulDBLow 2.1
A vulnerability has been found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this vulnerability is the function formSetWanStatic of the file /goform/formSetWanStatic of the component webs. The manipulation of the argument m_wan_ipaddr/m_wan_netmask/m_wan_gateway/m_wan_staticdns1/m_wan_staticdns2 is directly passed by the attacker/so we can control the m_wan_ipaddr/m_wan_netmask/m_wan_gateway/m_wan_staticdns1/m_wan_staticdns2 leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- F9K1122
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2025A vulnerability, which was classified as problematic, was found in Done-0 Jank up to 322caebbad10568460364b9667aa62c3080bfc17.CVE-2025-7080 · Other software · Done-0 · reported by VulDBLow 2.9
A vulnerability, which was classified as problematic, was found in Done-0 Jank up to 322caebbad10568460364b9667aa62c3080bfc17. Affected is an unknown function of the file internal/utils/jwt_utils.go of the component JWT Token Handler. The manipulation of the argument accessSecret/refreshSecret with the input jank-blog-secret/jank-blog-refresh-secret leads to use of hard-coded password. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- Jank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2025A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0.CVE-2025-7079 · Other software · mao888 · reported by VulDBLow 2.9
A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebell_backend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plus leads to use of hard-coded password. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- bluebell-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2025A vulnerability classified as problematic was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.3.9.CVE-2025-7078 · Other software · 07fly · reported by VulDBLow 2.1
A vulnerability classified as problematic was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.3.9. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 07flycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2025A vulnerability classified as critical has been found in Shenzhen Libituo Technology LBT-T300-T310 up to 2.2.3.6.CVE-2025-7077 · Other software · Shenzhen Libituo Technology · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in Shenzhen Libituo Technology LBT-T300-T310 up to 2.2.3.6. This affects the function config_3g_para of the file /appy.cgi. The manipulation of the argument username_3g/password_3g leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- LBT-T300-T310
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2025A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1.CVE-2025-7074 · Other software · vercel · reported by VulDBLow 2.1
A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1. This affects the function expand/braceExpand/ignoreMap of the file hyper/bin/rimraf-standalone.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- hyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2025A vulnerability has been found in IROAD Dashcam Q9 up to 20250624 and classified as problematic.CVE-2025-7070 · Other software · IROAD · reported by VulDBMedium 5.3
A vulnerability has been found in IROAD Dashcam Q9 up to 20250624 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component MFA Pairing Request Handler. The manipulation leads to allocation of resources. The attack needs to be done within the local network. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dashcam Q9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2025A vulnerability, which was classified as problematic, was found in HDF5 1.14.6.CVE-2025-7069 · Other software · Hdfgroup · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5FS__sect_link_size of the file src/H5FSsection.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2025A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6.CVE-2025-7068 · Other software · Hdfgroup · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affects the function H5FL__malloc of the file src/H5FL.c. The manipulation leads to memory leak. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2025A vulnerability classified as problematic was found in HDF5 1.14.6.CVE-2025-7067 · Other software · Hdfgroup · reported by VulDBLow 1.9
A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5FS__sinfo_serialize_node_cb of the file src/H5FScache.c. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025A vulnerability, which was classified as critical, was found in TOTOLINK A3002RU 3.0.0-B20230809.1615.CVE-2025-6953 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in TOTOLINK A3002RU 3.0.0-B20230809.1615. Affected is an unknown function of the file /boafrm/formParentControl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002RU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025A vulnerability, which was classified as problematic, has been found in Open5GS up to 2.7.5.CVE-2025-6952 · Other software · Open5gs · reported by VulDBMedium 4.8
A vulnerability, which was classified as problematic, has been found in Open5GS up to 2.7.5. This issue affects the function amf_state_operational of the file src/amf/amf-sm.c of the component AMF Service. The manipulation leads to reachable assertion. It is possible to launch the attack on the local host. The identifier of the patch is 53e9e059ed96b940f7ddcd9a2b68cb512524d5db. It is recommended to apply a patch to fix this issue.
- Product
- Open5gs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025A vulnerability classified as problematic was found in SAFECAM X300 up to 20250611.CVE-2025-6951 · Other software · SAFECAM · reported by VulDBLow 2.1
A vulnerability classified as problematic was found in SAFECAM X300 up to 20250611. This vulnerability affects unknown code of the component FTP Service. The manipulation leads to use of default credentials. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- X300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025A vulnerability classified as critical was found in TOTOLINK A702R 4.0.0-B20230721.1521.CVE-2025-6940 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in TOTOLINK A702R 4.0.0-B20230721.1521. Affected by this vulnerability is an unknown functionality of the file /boafrm/formParentControl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025A vulnerability classified as critical has been found in TOTOLINK A3002RU 3.0.0-B20230809.1615.CVE-2025-6939 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in TOTOLINK A3002RU 3.0.0-B20230809.1615. Affected is an unknown function of the file /boafrm/formWlSiteSurvey of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002RU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025A vulnerability, which was classified as problematic, was found in D-Link DCS-7517 up to 2.02.0.CVE-2025-6932 · Network & remote access · D-Link · reported by VulDBLow 2.9
A vulnerability, which was classified as problematic, was found in D-Link DCS-7517 up to 2.02.0. This affects the function g_F_n_GenPassForQlync of the file /bin/httpd of the component Qlync Password Generation Handler. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DCS-7517
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn2.v50to.ccvuldb.com
Jun 30, 2025A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0.CVE-2025-6931 · Network & remote access · D-Link · reported by VulDBLow 2.9
A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generate_pass_from_mac of the file /bin/httpd of the component Root Password Generation Handler. The manipulation leads to insufficient entropy. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DCS-6517
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn2.v50to.cccdn2.v50to.cc
Jun 30, 2025A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical.CVE-2025-6925 · Other software · Dromara · reported by VulDBMedium 5.5
A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RuoYi-Vue-Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015.CVE-2025-6916 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginAuth.htm. The manipulation of the argument authCode/goURL leads to missing authentication. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used.
- Product
- T6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025A vulnerability, which was classified as critical, was found in D-Link DI-7300G+ and DI-8200G 17.12.20A1/19.12.25A1.CVE-2025-6899 · Network & remote access · D-Link · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in D-Link DI-7300G+ and DI-8200G 17.12.20A1/19.12.25A1. This affects an unknown part of the file msp_info.htm. The manipulation of the argument flag/cmd/iface leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-7300G+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025A vulnerability, which was classified as critical, has been found in D-Link DI-7300G+ 19.12.25A1.CVE-2025-6898 · Network & remote access · D-Link · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, has been found in D-Link DI-7300G+ 19.12.25A1. Affected by this issue is some unknown functionality of the file in proxy_client.asp. The manipulation of the argument proxy_srv/proxy_lanport/proxy_lanip/proxy_srvport leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-7300G+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025A vulnerability classified as critical was found in D-Link DI-7300G+ 19.12.25A1.CVE-2025-6897 · Network & remote access · D-Link · reported by VulDBLow 2
A vulnerability classified as critical was found in D-Link DI-7300G+ 19.12.25A1. Affected by this vulnerability is an unknown functionality of the file httpd_debug.asp. The manipulation of the argument Time leads to os command injection. The exploit has been disclosed to the public and may be used.
- Product
- DI-7300G+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1.CVE-2025-6896 · Network & remote access · D-Link · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1. Affected is an unknown function of the file wget_test.asp. The manipulation of the argument url leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-7300G+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2025A vulnerability was found in Tenda AC5 15.03.06.47 and classified as critical.CVE-2025-6887 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was found in Tenda AC5 15.03.06.47 and classified as critical. Affected by this issue is some unknown functionality of the file /goform/SetSysTimeCfg. The manipulation of the argument time/timeZone leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitelavender-bicycle-a5a.notion.site
Jun 30, 2025A vulnerability has been found in Tenda AC5 15.03.06.47 and classified as critical.CVE-2025-6886 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability has been found in Tenda AC5 15.03.06.47 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime/schedEndTime leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitelavender-bicycle-a5a.notion.site
Jun 29, 2025A vulnerability classified as critical has been found in D-Link DIR-513 1.0.CVE-2025-6882 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in D-Link DIR-513 1.0. This affects an unknown part of the file /goform/formSetWanPPTP. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-513
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2025A vulnerability, which was classified as problematic, was found in DaiCuo up to 1.3.13.CVE-2025-6865 · Other software · Daicuo · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, was found in DaiCuo up to 1.3.13. This affects an unknown part of the file /admin.php/addon/index. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Daicuo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2025A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2.CVE-2025-6864 · Other software · Seacms · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2. Affected by this issue is some unknown functionality of the file /admin_type.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2025A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic.CVE-2025-5878 · Other software · ESAPI · reported by VulDBMedium 5.5
A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.
- Product
- esapi-java-legacy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2025A vulnerability was found in HDF5 1.14.6 and classified as problematic.CVE-2025-6858 · Other software · Hdfgroup · reported by VulDBLow 1.9
A vulnerability was found in HDF5 1.14.6 and classified as problematic. Affected by this issue is the function H5C__flush_single_entry of the file src/H5Centry.c. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2025A vulnerability has been found in HDF5 1.14.6 and classified as problematic.CVE-2025-6857 · Other software · Hdfgroup · reported by VulDBLow 1.9
A vulnerability has been found in HDF5 1.14.6 and classified as problematic. Affected by this vulnerability is the function H5G__node_cmp3 of the file src/H5Gnode.c. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2025A vulnerability, which was classified as problematic, was found in HDF5 1.14.6.CVE-2025-6856 · Other software · Hdfgroup · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5FL__reg_gc_list of the file src/H5FL.c. The manipulation leads to use after free. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2025A vulnerability, which was classified as critical, has been found in chatchat-space Langchain-Chatchat up to 0.3.1.CVE-2025-6855 · Other software · chatchat-space · reported by VulDBLow 2
A vulnerability, which was classified as critical, has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This issue affects some unknown processing of the file /v1/file. The manipulation of the argument flag leads to path traversal. The exploit has been disclosed to the public and may be used.
- Product
- Langchain-Chatchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2025A vulnerability classified as problematic was found in chatchat-space Langchain-Chatchat up to 0.3.1.CVE-2025-6854 · Other software · chatchat-space · reported by VulDBLow 2.1
A vulnerability classified as problematic was found in chatchat-space Langchain-Chatchat up to 0.3.1. This vulnerability affects unknown code of the file /v1/files?purpose=assistants. The manipulation leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Langchain-Chatchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2025A vulnerability classified as critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1.CVE-2025-6853 · Other software · chatchat-space · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This affects the function upload_temp_docs of the file /knowledge_base/upload_temp_docs of the component Backend. The manipulation of the argument flag leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Langchain-Chatchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025A vulnerability, which was classified as critical, has been found in Conjure Position Department Service Quality Evaluation System up to 1.0.11.CVE-2025-6839 · Other software · Conjure · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, has been found in Conjure Position Department Service Quality Evaluation System up to 1.0.11. Affected by this issue is the function eval of the file public/assets/less/bootstrap-less/mixins/head.php. The manipulation of the argument payload leads to backdoor. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Position Department Service Quality Evaluation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comnote-hxlab.wetolink.com
Jun 28, 2025A vulnerability was found in aaluoxiang oa_system up to c3a08168c144f27256a90838492c713f55f1b207 and classified as critical.CVE-2025-6829 · Other software · aaluoxiang · reported by VulDBMedium 5.3
A vulnerability was found in aaluoxiang oa_system up to c3a08168c144f27256a90838492c713f55f1b207 and classified as critical. This issue affects the function outAddress of the component External Address Book Handler. The manipulation leads to sql injection. The attack may be initiated remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
- Product
- oa_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025A vulnerability classified as critical was found in TOTOLINK A702R up to 4.0.0-B20230721.1521.CVE-2025-6825 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in TOTOLINK A702R up to 4.0.0-B20230721.1521. Affected by this vulnerability is an unknown functionality of the file /boafrm/formWlSiteSurvey of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025A vulnerability classified as critical has been found in TOTOLINK X15 up to 1.0.0-B20230714.1105.CVE-2025-6824 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in TOTOLINK X15 up to 1.0.0-B20230714.1105. Affected is an unknown function of the file /boafrm/formParentControl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025A vulnerability, which was classified as problematic, was found in HDF5 1.14.6.CVE-2025-6818 · Other software · Hdfgroup · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5O__chunk_protect of the file /src/H5Ochunk.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6.CVE-2025-6817 · Other software · Hdfgroup · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affects the function H5C__load_entry of the file /src/H5Centry.c. The manipulation leads to resource consumption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025A vulnerability classified as problematic was found in HDF5 1.14.6.CVE-2025-6816 · Other software · Hdfgroup · reported by VulDBLow 1.9
A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5O__fsinfo_encode of the file /src/H5Ofsinfo.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7.CVE-2025-6776 · Other software · xiaoyunjie · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.8 is able to address this issue. The name of the patch is e23559b98c8ea2957f09978c29f4e512ba789eb6. It is recommended to upgrade the affected component.
- Product
- openvpn-cms-flask
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7.CVE-2025-6775 · Other software · xiaoyunjie · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function create_user of the file /app/api/v1/openvpn.py of the component User Creation Endpoint. The manipulation of the argument Username leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.8 is able to address this issue. The patch is named e23559b98c8ea2957f09978c29f4e512ba789eb6. It is recommended to upgrade the affected component.
- Product
- openvpn-cms-flask
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025A vulnerability classified as critical has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8.CVE-2025-6768 · Other software · sfturing · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is the function findAllHosByCondition of the file HospitalServiceImpl.java. The manipulation of the argument hospitalName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- hosp_order
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9.CVE-2025-6765 · Other software · Intelbras · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/operador/ of the component HTTP PUT Request Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- InControl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025A vulnerability classified as critical has been found in diyhi bbs up to 6.8.CVE-2025-6762 · Other software · diyhi · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in diyhi bbs up to 6.8. This affects the function getUrl of the file /admin/login of the component HTTP Header Handler. The manipulation of the argument Host leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- bbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.