Total
398152 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-27889 | 1 Wftpserver | 1 Wing Ftp Server | 2026-06-17 | N/A | 3.4 LOW |
| Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker. | |||||
| CVE-2025-27888 | 1 Apache | 1 Druid | 2026-06-17 | N/A | 5.4 MEDIUM |
| Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid. This issue affects all previous Druid versions. When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected. Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue. | |||||
| CVE-2025-27867 | 1 Apache | 1 Felix Http Webconsole Plugin | 2026-06-17 | N/A | 5.6 MEDIUM |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP Webconsole Plugin. This issue affects Apache Felix HTTP Webconsole Plugin: from Version 1.X through 1.2.0. Users are recommended to upgrade to version 1.2.2, which fixes the issue. | |||||
| CVE-2025-27853 | 1 Garmin | 2 Empirbus Wireless Display Unit, Empirbus Wireless Display Unit Firmware | 2026-06-17 | N/A | 7.3 HIGH |
| The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU web site only performs authentication with the client within the client's browser. The WebSockets used to communicate with the WDU server do not enforce any authentication. An attacker may bypass all authentication mechanisms by directly utilizing the remote APIs available on the websocket. | |||||
| CVE-2025-27852 | 1 Garmin | 2 Empirbus Wireless Display Unit, Empirbus Wireless Display Unit Firmware | 2026-06-17 | N/A | 5.0 MEDIUM |
| The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack. This allows an attacker on the local network segment to execute arbitrary JavaScript code within the context of the WDU webpage. Full administrator level access to the device is possible. To initiate an exploit of this vulnerability, the victim must execute two actions: (1) view a specific URL served by the WDU, and (2) click an element on the rendered page. | |||||
| CVE-2025-27851 | 1 Garmin | 2 Empirbus Wireless Display Unit, Empirbus Wireless Display Unit Firmware | 2026-06-17 | N/A | 9.3 CRITICAL |
| The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes WebSockets to control settings, including administrative settings. This allows a network attacker to take full control of a WDU. To initiate an exploit of this vulnerability, the victim must (1) be utilizing a web browser on a multihomed host that has local interfaces on the Garmin Marine Network as well as another network, and (2) access a malicious third party website created by the attacker. | |||||
| CVE-2025-27850 | 1 Garmin | 2 Empirbus Wireless Display Unit, Empirbus Wireless Display Unit Firmware | 2026-06-17 | N/A | 7.5 HIGH |
| The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, the web server follows the supplied links when serving content. No mechanisms to restrict those link targets to a specific area of the filesystem is enabled. This allows an attacker to retrieve arbitrary files from the device. | |||||
| CVE-2025-27847 | 2026-06-17 | N/A | 4.3 MEDIUM | ||
| In ESPEC North America Web Controller 3 before 3.3.8, /api/v4/auth/ users session privileges are not revoked on logout. | |||||
| CVE-2025-27846 | 2026-06-17 | N/A | 4.3 MEDIUM | ||
| In ESPEC North America Web Controller 3 before 3.3.8, an attacker with physical access can gain elevated privileges because GRUB and the BIOS are unprotected. | |||||
| CVE-2025-27845 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret. This allows for elevated permissions to the UI. | |||||
| CVE-2025-27840 | 1 Espressif | 2 Esp32, Esp32 Firmware | 2026-06-17 | N/A | 6.8 MEDIUM |
| Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory). | |||||
| CVE-2025-27839 | 2026-06-17 | N/A | 3.2 LOW | ||
| operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuineness check) that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible. | |||||
| CVE-2025-27837 | 1 Artifex | 1 Ghostscript | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gp_mswin.c and base/winrtsup.cpp. | |||||
| CVE-2025-27836 | 1 Artifex | 1 Ghostscript | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c. | |||||
| CVE-2025-27835 | 1 Artifex | 1 Ghostscript | 2026-06-17 | N/A | 7.8 HIGH |
| An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c. | |||||
| CVE-2025-27834 | 1 Artifex | 1 Ghostscript | 2026-06-17 | N/A | 7.8 HIGH |
| An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c. | |||||
| CVE-2025-27833 | 1 Artifex | 1 Ghostscript | 2026-06-17 | N/A | 7.8 HIGH |
| An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c. | |||||
| CVE-2025-27832 | 1 Artifex | 1 Ghostscript | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c. | |||||
| CVE-2025-27831 | 1 Artifex | 1 Ghostscript | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters to devices/vector/doc_common.c. | |||||
| CVE-2025-27830 | 1 Artifex | 1 Ghostscript | 2026-06-17 | N/A | 7.8 HIGH |
| An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for base/write_t1.c and psi/zfapi.c. | |||||