Total
7618 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-67979 | 2026-06-17 | N/A | 9.9 CRITICAL | ||
| Improper Control of Generation of Code ('Code Injection') vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Code Injection.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.1. | |||||
| CVE-2025-67944 | 2026-06-17 | N/A | 9.1 CRITICAL | ||
| Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through <= 8.1.8. | |||||
| CVE-2025-67887 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| 1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privileged users who can upload new translated pages to the website. | |||||
| CVE-2025-67847 | 1 Moodle | 1 Moodle | 2026-06-17 | N/A | 8.8 HIGH |
| A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines. Successful exploitation could result in a full compromise of the Moodle application. | |||||
| CVE-2025-67113 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| OS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint to execute arbitrary commands as root via a crafted TR-069 Download URL that is passed unescaped into the firmware upgrade pipeline. | |||||
| CVE-2025-67031 | 2026-06-17 | N/A | 6.3 MEDIUM | ||
| ORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote Code Execution vulnerability in the participant profile field processing subsystem. Certain field configurations accept values beginning with the prefix "func:" which are passed directly into an eval() call inside tagsets/participant.php and tagsets/options.php. | |||||
| CVE-2025-66916 | 1 Dromara | 1 Ruoyi-vue-plus | 2026-06-17 | N/A | 9.4 CRITICAL |
| The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing. | |||||
| CVE-2025-66913 | 1 Jeecg | 1 Jimureport | 2026-06-17 | N/A | 9.8 CRITICAL |
| JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied JDBC URL directly to the H2 driver, allowing the use of certain directives to execute arbitrary Java code. A different vulnerability than CVE-2025-10770. | |||||
| CVE-2025-66580 | 1 Openagentplatform | 1 Dive | 2026-06-17 | N/A | 9.6 CRITICAL |
| Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. A critical Stored Cross-Site Scripting (XSS) vulnerability exists in versions prior to 0.11.1 in the Mermaid diagram rendering component. The application allows the execution of arbitrary JavaScript via `javascript:`. An attacker can exploit this to inject a malicious Model Context Protocol (MCP) server configuration, leading to Remote Code Execution (RCE) on the victim's machine when the node is clicked. Version 0.11.1 fixes the issue. | |||||
| CVE-2025-66078 | 2026-06-17 | N/A | 9.1 CRITICAL | ||
| Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclusion.This issue affects Hotel Booking Lite: from n/a through <= 5.2.3. | |||||
| CVE-2025-65829 | 1 Meatmeet | 2 Meatmeet Pro Wifi \& Bluetooth Meat Thermometer, Meatmeet Pro Wifi \& Bluetooth Meat Thermometer Firmware | 2026-06-17 | N/A | 6.8 MEDIUM |
| The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures that only authenticated software can execute on the device. The Secure Boot process forms a chain of trust by verifying all mutable software entities involved in the Application Startup Flow. As a result, an attacker with physical access to the device can flash modified firmware to the device, resulting in the execution of malicious code upon startup. | |||||
| CVE-2025-65817 | 1 Lsc | 2 Smart Connect Indoor Ip Camera, Smart Connect Indoor Ip Camera Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh. | |||||
| CVE-2025-65716 | 1 Shd101wyy | 1 Markdown Preview Enhanced | 2026-06-17 | N/A | 8.8 HIGH |
| An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file. | |||||
| CVE-2025-65715 | 1 Formulahendry | 1 Coderunner | 2026-06-17 | N/A | 7.8 HIGH |
| An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace. | |||||
| CVE-2025-65602 | 1 Chancms | 1 Chancms | 2026-06-17 | N/A | 9.8 CRITICAL |
| A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request. | |||||
| CVE-2025-65037 | 1 Microsoft | 1 Azure Container Apps | 2026-06-17 | N/A | 10.0 CRITICAL |
| Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2025-64691 | 1 Aveva | 1 Process Optimization | 2026-06-17 | N/A | 8.8 HIGH |
| The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scripts and escalate privileges to OS system, potentially resulting in complete compromise of the model application server. | |||||
| CVE-2025-64676 | 1 Microsoft | 1 Purview | 2026-06-17 | N/A | 7.2 HIGH |
| '.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network. | |||||
| CVE-2025-64321 | 1 Salesforce | 1 Agentforce Vibes | 2026-06-17 | N/A | 5.3 MEDIUM |
| Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0. | |||||
| CVE-2025-64320 | 1 Salesforce | 1 Agentforce Vibes | 2026-06-17 | N/A | 6.5 MEDIUM |
| Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentforce Vibes Extension: before 3.2.0. | |||||