Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,302 results · page 12 of 87
Jun 21, 2025A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0.0-B20230714.1105.CVE-2025-6399 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0.0-B20230714.1105. Affected is an unknown function of the file /boafrm/formIPv6Addr of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical.CVE-2025-6374 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. This issue affects the function formSetACLFilter of the file /goform/formSetACLFilter. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical.CVE-2025-6373 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. This vulnerability affects the function formSetWizard1 of the file /goform/formWlSiteSurvey. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01.CVE-2025-6372 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01. This affects the function formSetWizard1 of the file /goform/formSetWizard1. The manipulation of the argument curTime leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01.CVE-2025-6371 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetEnableWizard of the file /goform/formSetEnableWizard. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability classified as critical was found in D-Link DIR-619L 2.06B01.CVE-2025-6370 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in D-Link DIR-619L 2.06B01. Affected by this vulnerability is the function formWlanGuestSetup of the file /goform/formWlanGuestSetup. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability classified as critical has been found in D-Link DIR-619L 2.06B01.CVE-2025-6369 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in D-Link DIR-619L 2.06B01. Affected is the function formdumpeasysetup of the file /goform/formdumpeasysetup. The manipulation of the argument curTime/config.save_network_enabled leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability was found in HobbesOSR Kitten up to c4f8b7c3158983d1020af432be1b417b28686736 and classified as critical.CVE-2025-6365 · Other software · HobbesOSR · reported by VulDBMedium 6.9
A vulnerability was found in HobbesOSR Kitten up to c4f8b7c3158983d1020af432be1b417b28686736 and classified as critical. Affected by this issue is the function set_pte_at in the library /include/arch-arm64/pgtable.h. The manipulation leads to resource consumption. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- Kitten
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025Classified Listing: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52715 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Classified Listing classified-listing allows PHP Local File Inclusion.This issue affects Classified Listing: from n/a through <= 4.2.0.
- Product
- Classified Listing
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025A vulnerability was found in DedeCMS up to 5.7.2 and classified as critical.CVE-2025-6335 · Other software · Dedecms · reported by VulDBLow 2
A vulnerability was found in DedeCMS up to 5.7.2 and classified as critical. This issue affects some unknown processing of the file /include/dedetag.class.php of the component Template Handler. The manipulation of the argument notes leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025A vulnerability has been found in D-Link DIR-867 1.0 and classified as critical.CVE-2025-6334 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability has been found in D-Link DIR-867 1.0 and classified as critical. This vulnerability affects the function strncpy of the component Query String Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-867
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713.CVE-2025-6302 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Comment leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkn0sinna.notion.sitevuldb.com
Jun 19, 2025A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-6299 · Other software · TOTOLINK · reported by VulDBLow 2
A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the file /boa/formWSC. The manipulation of the argument targetAPSsid leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comvuldb.com
Jun 19, 2025A vulnerability has been found in D-Link DIR-825 2.03 and classified as critical.CVE-2025-6292 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability has been found in D-Link DIR-825 2.03 and classified as critical. This vulnerability affects the function sub_4091AC of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-825
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability, which was classified as critical, was found in D-Link DIR-825 2.03.CVE-2025-6291 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in D-Link DIR-825 2.03. This affects the function do_file of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-825
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical.CVE-2025-6282 · Other software · xlang-ai · reported by VulDBLow 2
A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical. Affected by this issue is the function create_upload_file of the file backend/api/file.py. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
- Product
- OpenAgents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability has been found in OpenBMB XAgent up to 1.0.0 and classified as critical.CVE-2025-6281 · Other software · OpenBMB · reported by VulDBLow 2
A vulnerability has been found in OpenBMB XAgent up to 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /conv/community. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used.
- Product
- XAgent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14.CVE-2025-6280 · Other software · TransformerOptimus · reported by VulDBLow 2
A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function download_attachment of the file SuperAGI/superagi/helper/read_email.py of the component EmailToolKit. The manipulation of the argument filename leads to path traversal. The exploit has been disclosed to the public and may be used.
- Product
- SuperAGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6.CVE-2025-6279 · Other software · Upsonic · reported by VulDBLow 2
A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. This issue affects the function cloudpickle.loads of the file /tools/add_tool of the component Pickle Handler. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used.
- Product
- Upsonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability classified as critical was found in Upsonic up to 0.55.6.CVE-2025-6278 · Other software · Upsonic · reported by VulDBLow 2
A vulnerability classified as critical was found in Upsonic up to 0.55.6. This vulnerability affects the function os.path.join of the file markdown/server.py. The manipulation of the argument file.filename leads to path traversal. The exploit has been disclosed to the public and may be used.
- Product
- Upsonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability classified as critical has been found in Brilliance Golden Link Secondary System up to 20250609.CVE-2025-6277 · Other software · Brilliance · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in Brilliance Golden Link Secondary System up to 20250609. This affects an unknown part of the file /storagework/custTakeInfoPage.htm. The manipulation of the argument custTradeName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Golden Link Secondary System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability was found in WebAssembly wabt up to 1.0.37 and classified as problematic.CVE-2025-6273 · Other software · WebAssembly · reported by VulDBLow 1.9
A vulnerability was found in WebAssembly wabt up to 1.0.37 and classified as problematic. This issue affects the function LogOpcode of the file src/binary-reader-objdump.cc. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains that this issue might not affect "real world wasm programs".
- Product
- wabt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability has been found in wasm3 0.5.0 and classified as problematic.CVE-2025-6272 · Other software · Wasm3 Project · reported by VulDBLow 1.9
A vulnerability has been found in wasm3 0.5.0 and classified as problematic. This vulnerability affects the function MarkSlotAllocated of the file source/m3_compile.c. The manipulation leads to out-of-bounds write. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
- Product
- Wasm3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability, which was classified as problematic, was found in swftools up to 0.9.2.CVE-2025-6271 · Other software · Swftools · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, was found in swftools up to 0.9.2. This affects the function wav_convert2mono in the library lib/wav.c of the component wav2swf. The manipulation leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability, which was classified as critical, has been found in HDF5 up to 1.14.6.CVE-2025-6270 · Other software · Hdfgroup · reported by VulDBLow 1.9
A vulnerability, which was classified as critical, has been found in HDF5 up to 1.14.6. Affected by this issue is the function H5FS__sect_find_node of the file H5FSsection.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability classified as critical was found in HDF5 up to 1.14.6.CVE-2025-6269 · Other software · Hdfgroup · reported by VulDBLow 1.9
A vulnerability classified as critical was found in HDF5 up to 1.14.6. Affected by this vulnerability is the function H5C__reconstruct_cache_entry of the file H5Cimage.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025A vulnerability classified as problematic has been found in Luna Imaging up to 7.5.5.6.CVE-2025-6268 · Other software · Luna · reported by VulDBLow 2.1
A vulnerability classified as problematic has been found in Luna Imaging up to 7.5.5.6. Affected is an unknown function of the file /luna/servlet/view/search. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Imaging
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2025A vulnerability classified as critical was found in Webkul QloApps 1.6.1.CVE-2025-6173 · Other software · Webkul · reported by VulDBLow 2
A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_products_list.php. The manipulation of the argument packItself leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirms the existence of this flaw but considers it a low-level issue due to admin privilege pre-requisites. Still, a fix is planned for a future release.
- Product
- QloApps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2025A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5.CVE-2025-6167 · Other software · themanojdesai · reported by VulDBMedium 5.1
A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/agent_flow/server/api.py. The manipulation leads to path traversal. Upgrading to version 0.5.6 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- python-a2a
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2025A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615 and classified as critical.CVE-2025-6163 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002RU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2025A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical.CVE-2025-6162 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2025A vulnerability classified as critical has been found in D-Link DIR-665 1.00.CVE-2025-6158 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in D-Link DIR-665 1.00. This affects the function sub_AC78 of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-665
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability, which was classified as critical, was found in Steel Browser up to 0.1.3.CVE-2025-6152 · Other software · Steel · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Steel Browser up to 0.1.3. This affects the function handleFileUpload of the file api/src/modules/files/files.routes.ts. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. The patch is named 7ba93a10000fb77ee01731478ef40551a27bd5b9. It is recommended to apply a patch to fix this issue.
- Product
- Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20230714.1105.CVE-2025-6150 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical has been found in TOTOLINK A3002R 4.0.0-B20230531.1404.CVE-2025-6149 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in TOTOLINK A3002R 4.0.0-B20230531.1404. Affected is an unknown function of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical.CVE-2025-6145 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical.CVE-2025-6144 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formSysCmd of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713.CVE-2025-6143 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formNtp of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic.CVE-2025-6141 · Other software · GNU · reported by VulDBMedium 4.8
A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- ncurses
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinvisible-island.netlists.gnu.org
Jun 16, 2025A vulnerability, which was classified as problematic, was found in spdlog up to 1.15.1.CVE-2025-6140 · Other software · Gabime · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, was found in spdlog up to 1.15.1. This affects the function scoped_padder in the library include/spdlog/pattern_formatter-inl.h. The manipulation leads to resource consumption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.2 is able to address this issue. The identifier of the patch is 10320184df1eb4638e253a34b1eb44ce78954094. It is recommended to upgrade the affected component.
- Product
- Spdlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability, which was classified as problematic, has been found in TOTOLINK T10 4.1.8cu.5207.CVE-2025-6139 · Other software · TOTOLINK · reported by VulDBLow 1.1
A vulnerability, which was classified as problematic, has been found in TOTOLINK T10 4.1.8cu.5207. Affected by this issue is some unknown functionality of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- T10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Jun 16, 2025A vulnerability classified as critical was found in TOTOLINK T10 4.1.8cu.5207.CVE-2025-6138 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in TOTOLINK T10 4.1.8cu.5207. Affected by this vulnerability is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ssid5g leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- T10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Jun 16, 2025A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5207.CVE-2025-6137 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5207. Affected is the function setWiFiScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- T10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Jun 16, 2025A vulnerability has been found in Chanjet CRM 1.0 and classified as critical.CVE-2025-6132 · Other software · Chanjet · reported by VulDBMedium 5.5
A vulnerability has been found in Chanjet CRM 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysconfig/departmentsetting.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability, which was classified as problematic, was found in CodeAstro Food Ordering System 1.0.CVE-2025-6131 · Other software · CodeAstro · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, was found in CodeAstro Food Ordering System 1.0. Affected is an unknown function of the file /admin/store/edit/ of the component POST Request Parameter Handler. The manipulation of the argument Restaurant Name/Address leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Food Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Jun 16, 2025A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713.CVE-2025-6130 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This issue affects some unknown processing of the file /boafrm/formStats of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713.CVE-2025-6129 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This vulnerability affects unknown code of the file /boafrm/formSaveConfig of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713.CVE-2025-6128 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This affects an unknown part of the file /boafrm/formWirelessTbl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1200T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability, which was classified as critical, has been found in D-Link DIR-632 FW103B08.CVE-2025-6121 · Network & remote access · D-Link · reported by VulDBHigh 8.9
A vulnerability, which was classified as critical, has been found in D-Link DIR-632 FW103B08. Affected by this issue is the function get_pure_content of the component HTTP POST Request Handler. The manipulation of the argument Content-Length leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-632
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3.CVE-2025-6120 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function read_meshes in the library assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.