Total
400174 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-54576 | 1 Oauth2 Proxy Project | 1 Oauth2 Proxy | 2026-06-17 | N/A | 9.1 CRITICAL |
| OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions 7.10.0 and below, oauth2-proxy deployments are vulnerable when using the skip_auth_routes configuration option with regex patterns. Attackers can bypass authentication by crafting URLs with query parameters that satisfy configured regex patterns, allowing unauthorized access to protected resources. The issue stems from skip_auth_routes matching against the full request URI. Deployments using skip_auth_routes with regex patterns containing wildcards or broad matching patterns are most at risk. This issue is fixed in version 7.11.0. Workarounds include: auditing all skip_auth_routes configurations for overly permissive patterns, replacing wildcard patterns with exact path matches where possible, ensuring regex patterns are properly anchored (starting with ^ and ending with $), or implementing custom validation that strips query parameters before regex matching. | |||||
| CVE-2025-54575 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension block (with a missing block terminator) can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. This leads to a denial of service. Applications processing untrusted GIF input should upgrade to a patched version. This issue is fixed in versions 2.1.11 and 3.1.11. | |||||
| CVE-2025-54574 | 1 Squid-cache | 1 Squid | 2026-06-17 | N/A | 9.3 CRITICAL |
| Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions. | |||||
| CVE-2025-54573 | 1 Cvat | 1 Computer Vision Annotation Tool | 2026-06-17 | N/A | 4.3 MEDIUM |
| CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.1.0 through 2.41.0, email verification was not enforced when using Basic HTTP Authentication. As a result, users could create accounts using fake email addresses and use the product as verified users. Additionally, the missing email verification check leaves the system open to bot signups and further usage. CVAT 2.42.0 and later versions contain a fix for the issue. CVAT Enterprise customers have a workaround available; those customers may disable registration to prevent this issue. | |||||
| CVE-2025-54572 | 2026-06-17 | N/A | N/A | ||
| The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1. | |||||
| CVE-2025-54571 | 1 Owasp | 1 Modsecurity | 2026-06-17 | N/A | 6.1 MEDIUM |
| ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12. | |||||
| CVE-2025-54569 | 2026-06-17 | N/A | 4.5 MEDIUM | ||
| In Malwarebytes Binisoft Windows Firewall Control before 6.16.0.0, the installer is vulnerable to local privilege escalation. | |||||
| CVE-2025-54568 | 2026-06-17 | N/A | 3.7 LOW | ||
| Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separately for each edge node. | |||||
| CVE-2025-54567 | 1 Qemu | 1 Qemu | 2026-06-17 | N/A | 4.2 MEDIUM |
| hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327. | |||||
| CVE-2025-54566 | 1 Qemu | 1 Qemu | 2026-06-17 | N/A | 4.2 MEDIUM |
| hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327. | |||||
| CVE-2025-54564 | 2026-06-17 | N/A | 7.8 HIGH | ||
| uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution as the nobody user. | |||||
| CVE-2025-54563 | 1 Desktopalert | 1 Pingalert Application Server | 2026-06-17 | N/A | 7.5 HIGH |
| An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Incorrect Access Control, leading to Remote Information Disclosure. | |||||
| CVE-2025-54562 | 1 Desktopalert | 1 Pingalert Application Server | 2026-06-17 | N/A | 4.3 MEDIUM |
| A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Technical Information to be Disclosed through stack trace. | |||||
| CVE-2025-54561 | 1 Desktopalert | 1 Pingalert Application Server | 2026-06-17 | N/A | 4.3 MEDIUM |
| An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote access to content despite lack of the correct permission through a Broken Authorization Schema. | |||||
| CVE-2025-54560 | 1 Desktopalert | 1 Pingalert Application Server | 2026-06-17 | N/A | 3.8 LOW |
| A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Probing of internal infrastructure. | |||||
| CVE-2025-54559 | 1 Desktopalert | 1 Pingalert Application Server | 2026-06-17 | N/A | 3.7 LOW |
| An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote Path Traversal for loading arbitrary external content. | |||||
| CVE-2025-54558 | 2026-06-17 | N/A | 4.1 MEDIUM | ||
| OpenAI Codex CLI before 0.9.0 auto-approves ripgrep (aka rg) execution even with the --pre or --hostname-bin or --search-zip or -z flag. | |||||
| CVE-2025-54554 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries and database structure. | |||||
| CVE-2025-54551 | 2026-06-17 | N/A | 4.3 MEDIUM | ||
| Synapse Mobility 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 contain a privilege escalation vulnerability through external control of Web parameter. If exploited, a user of the product may escalate the privilege and access data that the user do not have permission to view by altering the parameters of the search function. | |||||
| CVE-2025-54548 | 2026-06-17 | N/A | 4.3 MEDIUM | ||
| On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes) | |||||