Total
396899 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-13677 | 2026-06-17 | N/A | 4.9 MEDIUM | ||
| The Simple Download Counter plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.2.2. This is due to insufficient path validation in the `simple_download_counter_parse_path()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which may contain sensitive information such as database credentials (wp-config.php) or system files. Please note that the vendor opted to continue to allow remote file downloads from arbitrary locations on the server, however, has disabled this functionality on multi-sites and provided a warning to site owners in the readme.txt when they install the plugin. While not an optimal patch, we have considered this sufficient and recommend users proceed to use the plugin with caution. | |||||
| CVE-2025-13676 | 2026-06-17 | N/A | 6.1 MEDIUM | ||
| The JustClick registration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on the `PHP_SELF` server variable. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | |||||
| CVE-2025-13675 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. | |||||
| CVE-2025-13674 | 1 Wireshark | 1 Wireshark | 2026-06-17 | N/A | 5.5 MEDIUM |
| BPv7 dissector crash in Wireshark 4.6.0 allows denial of service | |||||
| CVE-2025-13673 | 2026-06-17 | N/A | 7.5 HIGH | ||
| The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This vulnerability was partially mitigated in versions 3.9.4 and 3.9.6. | |||||
| CVE-2025-13672 | 1 Opentext | 1 Web Site Management Server | 2026-06-17 | N/A | 5.4 MEDIUM |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Reflected XSS. The vulnerability could allow injecting malicious JavaScript inside URL parameters that was then rendered with the preview of the page, so that malicious scripts could be executed on the client side. This issue affects Web Site Management Server: 16.7.0, 16.7.1. | |||||
| CVE-2025-13671 | 1 Opentext | 1 Web Site Management Server | 2026-06-17 | N/A | 6.5 MEDIUM |
| Cross-Site Request Forgery (CSRF) vulnerability in OpenText™ Web Site Management Server allows Cross Site Request Forgery. The vulnerability could make a user, with active session inside the product, click on a page that contains this malicious HTML triggering to perform changes unconsciously. This issue affects Web Site Management Server: 16.7.0, 16.7.1. | |||||
| CVE-2025-13670 | 2 Intel, Microsoft | 2 High Level Synthesis Compiler, Windows | 2026-06-17 | N/A | 6.7 MEDIUM |
| The High Level Synthesis Compiler i++ command for Windows is vulnerable to a DLL planting vulnerability | |||||
| CVE-2025-13669 | 2 Intel, Microsoft | 2 High Level Synthesis Compiler, Windows | 2026-06-17 | N/A | 6.7 MEDIUM |
| Uncontrolled Search Path Element vulnerability in Altera High Level Synthesis Compiler on Windows allows Search Order Hijacking.This issue affects High Level Synthesis Compiler: from 19.1 through 24.3. | |||||
| CVE-2025-13668 | 2 Intel, Microsoft | 2 Quartus Prime, Windows | 2026-06-17 | N/A | 6.7 MEDIUM |
| A potential security vulnerability in Quartus® Prime Pro Edition Design Software may allow escalation of privilege. | |||||
| CVE-2025-13667 | 2026-06-17 | N/A | 6.4 MEDIUM | ||
| The WP Recipe Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Skill Level' input field in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2025-13666 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| The Helloprint plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.2. This is due to the plugin registering a public REST API endpoint without implementing authorization checks to verify request authenticity. This makes it possible for unauthenticated attackers to arbitrarily modify WooCommerce order statuses via the /wp-json/helloprint/v1/complete_order_from_helloprint_callback endpoint by providing a valid order reference ID. | |||||
| CVE-2025-13665 | 2 Intel, Microsoft | 2 Quartus Prime, Windows | 2026-06-17 | N/A | 6.7 MEDIUM |
| The System Console Utility for Windows is vulnerable to a DLL planting vulnerability | |||||
| CVE-2025-13664 | 2 Intel, Microsoft | 2 Quartus Prime, Windows | 2026-06-17 | N/A | 6.7 MEDIUM |
| A potential security vulnerability in Quartus® Prime Standard Edition Design Software may allow escalation of privilege. | |||||
| CVE-2025-13663 | 2 Intel, Microsoft | 2 Quartus Prime, Windows | 2026-06-17 | N/A | 6.7 MEDIUM |
| Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation directory if the target installation directory already exists. | |||||
| CVE-2025-13662 | 1 Ivanti | 1 Endpoint Manager | 2026-06-17 | N/A | 7.8 HIGH |
| Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code. User Interaction is required. | |||||
| CVE-2025-13661 | 1 Ivanti | 1 Endpoint Manager | 2026-06-17 | N/A | 7.1 HIGH |
| Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required. | |||||
| CVE-2025-13660 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3. This is due to the plugin exposing a public AJAX endpoint that allows anyone to search for and retrieve user email addresses without any authentication or capability checks. This makes it possible for unauthenticated attackers to enumerate user accounts and extract email addresses via the guest_support_handler=ajax endpoint with the request=get_users parameter. | |||||
| CVE-2025-13659 | 1 Ivanti | 1 Endpoint Manager | 2026-06-17 | N/A | 8.8 HIGH |
| Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required. | |||||
| CVE-2025-13658 | 2026-06-17 | N/A | N/A | ||
| A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code signing and execution controls. Exploitation results in SYSTEM-level privileges. | |||||