Total
424128 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-25651 | 1 Qualcomm | 104 Apq8009, Apq8009 Firmware, Apq8017 and 101 more | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| Memory corruption in bluetooth host due to integer overflow while processing BT HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music | |||||
| CVE-2022-25650 | 1 Mendix | 1 Mendix | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.27), Mendix Applications using Mendix 8 (All versions < V8.18.14), Mendix Applications using Mendix 9 (All versions < V9.12.0), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.3). When querying the database, it is possible to sort the results using a protected field. With this an authenticated attacker could extract information about the contents of a protected field. | |||||
| CVE-2022-25649 | 1 Storeapps | 1 Affiliate For Woocommerce | 2026-06-17 | N/A | 5.0 MEDIUM |
| Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress. | |||||
| CVE-2022-25648 | 3 Debian, Fedoraproject, Git | 4 Debian Linux, Extra Packages For Enterprise Linux, Fedora and 1 more | 2026-06-17 | 7.5 HIGH | 8.1 HIGH |
| The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection. | |||||
| CVE-2022-25647 | 4 Debian, Google, Netapp and 1 more | 6 Debian Linux, Gson, Active Iq Unified Manager and 3 more | 2026-06-17 | 5.0 MEDIUM | 7.7 HIGH |
| The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks. | |||||
| CVE-2022-25646 | 1 X-data-spreadsheet Project | 1 X-data-spreadsheet | 2026-06-17 | N/A | 5.4 MEDIUM |
| All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting (XSS) due to missing sanitization of values inserted into the cells. | |||||
| CVE-2022-25645 | 1 Dset Project | 1 Dset | 2026-06-17 | 6.8 MEDIUM | 6.5 MEDIUM |
| All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution. | |||||
| CVE-2022-25644 | 1 Get-process-by-name Project | 1 Get-process-by-name | 2026-06-17 | N/A | 9.8 CRITICAL |
| All versions of package @pendo324/get-process-by-name are vulnerable to Arbitrary Code Execution due to improper sanitization of getProcessByName function. | |||||
| CVE-2022-25643 | 1 Seatd Project | 1 Seatd | 2026-06-17 | 9.3 HIGH | 9.8 CRITICAL |
| seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname. | |||||
| CVE-2022-25642 | 1 Obyte | 1 Obyte | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Obyte (formerly Byteball) Wallet before 3.4.1 allows XSS. A crafted chat message can lead to remote code execution. | |||||
| CVE-2022-25641 | 2 Foxit, Microsoft | 4 Pdf Editor, Pdf Reader, Phantompdf and 1 more | 2026-06-17 | N/A | 5.5 MEDIUM |
| Foxit PDF Reader before 11.2.2 and PDF Editor before 11.2.2, and PhantomPDF before 10.1.8, mishandle cross-reference information during compressed-object parsing within signed documents. This leads to delivery of incorrect signature information via an Incremental Saving Attack and a Shadow Attack. | |||||
| CVE-2022-25640 | 1 Wolfssl | 1 Wolfssl | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificate_verify message from the handshake, and never present a certificate. | |||||
| CVE-2022-25638 | 1 Wolfssl | 1 Wolfssl | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sig_algo field differs between the certificate_verify message and the certificate message. | |||||
| CVE-2022-25636 | 4 Debian, Linux, Netapp and 1 more | 13 Debian Linux, Linux Kernel, H300e and 10 more | 2026-06-17 | 6.9 MEDIUM | 7.8 HIGH |
| net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload. | |||||
| CVE-2022-25635 | 3 Google, Linux, Realtek | 3 Android, Linux Kernel, Bluetooth Mesh Software Development Kit | 2026-06-17 | N/A | 6.5 MEDIUM |
| Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for broadcast network packet length. An unauthenticated attacker in the adjacent network can exploit this vulnerability to disrupt service. | |||||
| CVE-2022-25634 | 1 Qt | 1 Qt | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. | |||||
| CVE-2022-25631 | 1 Broadcom | 1 Symantec Endpoint Protection | 2026-06-17 | N/A | 7.8 HIGH |
| Symantec Endpoint Protection, prior to 14.3 RU6 (14.3.9210.6000), may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated | |||||
| CVE-2022-25630 | 1 Symantec | 1 Messaging Gateway | 2026-06-17 | N/A | 5.4 MEDIUM |
| An authenticated user can embed malicious content with XSS into the admin group policy page. | |||||
| CVE-2022-25629 | 1 Symantec | 1 Messaging Gateway | 2026-06-17 | N/A | 5.4 MEDIUM |
| An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotations page (Annotation Text Column). | |||||
| CVE-2022-25628 | 1 Broadcom | 1 Symantec Identity Governance And Administration | 2026-06-17 | N/A | 8.8 HIGH |
| An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4 | |||||