Total
398677 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-45429 | 1 Tenda | 2 Ac9, Ac9 Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| In the Tenda ac9 v1.0 router with firmware V15.03.05.14_multi, there is a stack overflow vulnerability in /goform/WifiWpsStart, which may lead to remote arbitrary code execution. | |||||
| CVE-2025-45428 | 1 Tenda | 2 Ac9, Ac9 Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| In Tenda ac9 v1.0 with firmware V15.03.05.14_multi, the rebootTime parameter of /goform/SetSysAutoRebbotCfg has a stack overflow vulnerability, which can lead to remote arbitrary code execution. | |||||
| CVE-2025-45427 | 1 Tenda | 2 Ac9, Ac9 Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| In Tenda AC9 v1.0 with firmware V15.03.05.14_multi, the security parameter of /goform/WifiBasicSet has a stack overflow vulnerability, which can lead to remote arbitrary code execution. | |||||
| CVE-2025-45424 | 1 Xinference | 1 Xinference | 2026-06-17 | N/A | 5.3 MEDIUM |
| Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication. | |||||
| CVE-2025-45406 | 2026-06-17 | N/A | 6.1 MEDIUM | ||
| A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter. NOTE: this is disputed by the Supplier because attackers cannot influence the value of debugbar_time, and because debugbar-related data is automatically escaped by the CodeIgniter Parser class. | |||||
| CVE-2025-45388 | 2026-06-17 | N/A | 6.1 MEDIUM | ||
| Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting (XSS) in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface, the payload executes. NOTE: this is disputed by the Supplier because "It has been well documented that when serving uploaded files using a method outside of Wagtail (which admittedly is the default), it requires additional configuration from the developer, because Wagtail cannot control how these are served. ... For example, if a Wagtail instance is configured to upload files into AWS S3, Wagtail cannot control the permissions on how they're served, nor any headers used when serving them (a limitation of S3)." | |||||
| CVE-2025-45387 | 1 Osticket | 1 Osticket | 2026-06-17 | N/A | 5.4 MEDIUM |
| osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php. | |||||
| CVE-2025-45379 | 1 Dell | 1 Cloudlink | 2026-06-17 | N/A | 8.4 HIGH |
| Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell access of system. | |||||
| CVE-2025-45378 | 1 Dell | 1 Cloudlink | 2026-06-17 | N/A | 9.1 CRITICAL |
| Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A Privileged user with known password can break into command shell of CloudLink server and gain access of shell and escalate privilege, gain unauthorized access of system. If ssh is enabled with web credentials of server, attack is possible through network with known privileged user/password. | |||||
| CVE-2025-45376 | 1 Dell | 1 Repository Manager | 2026-06-17 | N/A | 7.5 HIGH |
| Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. | |||||
| CVE-2025-45375 | 1 Dell | 1 Data Domain Operating System | 2026-06-17 | N/A | 4.4 MEDIUM |
| Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service. | |||||
| CVE-2025-45346 | 1 Bacula | 1 Bacula-web | 2026-06-17 | N/A | 8.1 HIGH |
| SQL Injection vulnerability in Bacula-web before v.9.7.1 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request. | |||||
| CVE-2025-45333 | 1 Berkeley-abc | 1 Abc | 2026-06-17 | N/A | 7.5 HIGH |
| berkeley-abc abc 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the Abc_NtkCecFraigPart function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes. | |||||
| CVE-2025-45332 | 1 Vkoskiv | 1 C-ray | 2026-06-17 | N/A | 7.5 HIGH |
| vkoskiv c-ray 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the parse_mtllib function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes. | |||||
| CVE-2025-45331 | 1 Ricko | 1 Brplot | 2026-06-17 | N/A | 7.5 HIGH |
| brplot v420.69.1 contains a Null Pointer Dereference (NPD) vulnerability in the br_dagens_handle_once function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes. | |||||
| CVE-2025-45326 | 1 Magdesign | 2 Pocketvj Control Panel, Pocketvj Control Panel Firmware | 2026-06-17 | N/A | 6.5 MEDIUM |
| An issue in PocketVJ CP PocketVJ-CP-v3 pvj 3.9.1 allows remote attackers to execute arbitrary code via the submit_size.php component. | |||||
| CVE-2025-45322 | 1 Lopalopa | 1 Online Service Management Portal | 2026-06-17 | N/A | 8.8 HIGH |
| kashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in osms/Requester/CheckStatus.php via the checkid parameter. | |||||
| CVE-2025-45321 | 1 Lopalopa | 1 Online Service Management Portal | 2026-06-17 | N/A | 8.8 HIGH |
| kashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in /osms/Requester/Requesterchangepass.php via the parameter: rPassword. | |||||
| CVE-2025-45320 | 1 Lopalopa | 1 Online Service Management Portal | 2026-06-17 | N/A | 5.3 MEDIUM |
| A Directory Listing Vulnerability was found in the /osms/Requester/ directory of the Kashipara Online Service Management Portal V1.0. | |||||
| CVE-2025-45317 | 1 Hortusfox | 1 Hortusfox | 2026-06-17 | N/A | 6.5 MEDIUM |
| A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary code via a crafted archive. | |||||