Total
398591 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-41654 | 2026-06-17 | N/A | 8.2 HIGH | ||
| An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by the watchdog. | |||||
| CVE-2025-41653 | 2026-06-17 | N/A | 7.5 HIGH | ||
| An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a specially crafted HTTP request with a malicious header, potentially causing the server to crash or become unresponsive. | |||||
| CVE-2025-41652 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker could exploit this weakness by performing brute-force attacks to guess valid credentials or by using MD5 collision techniques to forge authentication hashes, potentially compromising the device. | |||||
| CVE-2025-41651 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system compromise. | |||||
| CVE-2025-41650 | 2026-06-17 | N/A | 7.5 HIGH | ||
| An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially cause a denial-of-service. | |||||
| CVE-2025-41649 | 2026-06-17 | N/A | 7.5 HIGH | ||
| An unauthenticated remote attacker can exploit insufficient input validation to write data beyond the bounds of a buffer, potentially leading to a denial-of-service condition for the devices. | |||||
| CVE-2025-41648 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI. | |||||
| CVE-2025-41647 | 2026-06-17 | N/A | 5.5 MEDIUM | ||
| A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the password being displayed in plain text under special conditions. | |||||
| CVE-2025-41646 | 1 Kunbus | 1 Revpi Status | 2026-06-17 | N/A | 9.8 CRITICAL |
| An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device | |||||
| CVE-2025-41645 | 2026-06-17 | N/A | 8.6 HIGH | ||
| An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake. | |||||
| CVE-2025-41459 | 2026-06-17 | N/A | 7.8 HIGH | ||
| Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local attackers to bypass biometric and PIN-based access control via repeated PIN attempts or dynamic code injection. | |||||
| CVE-2025-41458 | 2026-06-17 | N/A | 5.5 MEDIUM | ||
| Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s filesystem. | |||||
| CVE-2025-41452 | 2026-06-17 | N/A | N/A | ||
| Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions | |||||
| CVE-2025-41451 | 2026-06-17 | N/A | N/A | ||
| Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system. | |||||
| CVE-2025-41450 | 2026-06-17 | N/A | 8.2 HIGH | ||
| Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2 | |||||
| CVE-2025-41444 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2026-06-17 | N/A | 8.3 HIGH |
| Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module. | |||||
| CVE-2025-41443 | 1 Mattermost | 1 Mattermost Server | 2026-06-17 | N/A | 4.3 MEDIUM |
| Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint | |||||
| CVE-2025-41442 | 1 Advantech | 1 Iview | 2026-06-17 | N/A | 5.4 MEDIUM |
| A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulating certain input parameters, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other malicious activities. | |||||
| CVE-2025-41441 | 1 Synck | 1 Mailform Pro Cgi | 2026-06-17 | N/A | 5.3 MEDIUM |
| Mailform Pro CGI prior to 4.3.4 generates error messages containing sensitive information, which may allow a remote unauthenticated attacker to obtain coupon codes. This vulnerability only affects products that use the coupon feature. | |||||
| CVE-2025-41439 | 2026-06-17 | N/A | 6.1 MEDIUM | ||
| A reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of the user who accessed the product. | |||||