Total
396876 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-13016 | 1 Mozilla | 1 Firefox | 2026-06-17 | N/A | 7.5 HIGH |
| Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5. | |||||
| CVE-2025-13015 | 1 Mozilla | 1 Firefox | 2026-06-17 | N/A | 3.4 LOW |
| Spoofing issue in Firefox. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30. | |||||
| CVE-2025-13014 | 1 Mozilla | 1 Firefox | 2026-06-17 | N/A | 8.8 HIGH |
| Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5. | |||||
| CVE-2025-13013 | 1 Mozilla | 1 Firefox | 2026-06-17 | N/A | 6.1 MEDIUM |
| Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5. | |||||
| CVE-2025-13012 | 1 Mozilla | 1 Firefox | 2026-06-17 | N/A | 7.5 HIGH |
| Race condition in the Graphics component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5. | |||||
| CVE-2025-13008 | 2026-06-17 | N/A | N/A | ||
| An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users. | |||||
| CVE-2025-13007 | 2026-06-17 | N/A | 6.1 MEDIUM | ||
| The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping on externally-sourced content. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted they can post malicious content to a connected Google Business Profile or Facebook page. | |||||
| CVE-2025-13006 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| The SurveyFunnel – Survey Plugin for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via several unprotected /wp-json/surveyfunnel/v2/ REST API endpoints. This makes it possible for unauthenticated attackers to extract sensitive data from survey responses. | |||||
| CVE-2025-13004 | 1 Farktor | 1 E-commerce Package | 2026-06-17 | N/A | 6.3 MEDIUM |
| Authorization Bypass Through User-Controlled Key vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Manipulating User-Controlled Variables. This issue affects E-Commerce Package: through 27112025. | |||||
| CVE-2025-13003 | 2026-06-17 | N/A | 7.6 HIGH | ||
| Authorization Bypass Through User-Controlled Key vulnerability in Aksis Computer Services and Consulting Inc. AxOnboard allows Exploitation of Trusted Identifiers. This issue affects AxOnboard: from 3.2.0 before 3.3.0. | |||||
| CVE-2025-13002 | 1 Farktor | 1 E-commerce Package | 2026-06-17 | N/A | 8.2 HIGH |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Cross-Site Scripting (XSS). This issue affects E-Commerce Package: through 27112025. | |||||
| CVE-2025-13001 | 1 Kieranoshea | 1 Donations | 2026-06-17 | N/A | 4.1 MEDIUM |
| The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as admin to perform SQL injection attacks | |||||
| CVE-2025-13000 | 1 Jimbob1953 | 1 Db-access | 2026-06-17 | N/A | 7.7 HIGH |
| The db-access WordPress plugin through 0.8.7 does not have authorization in an AJAX action, allowing any authenticated users, such as subscriber to perform SQLI attacks | |||||
| CVE-2025-12998 | 2026-06-17 | N/A | N/A | ||
| Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5. | |||||
| CVE-2025-12997 | 1 Medtronic | 1 Carelink Network | 2026-06-17 | N/A | 2.2 LOW |
| Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive user information. This issue affects CareLink Network: before December 4, 2025. | |||||
| CVE-2025-12996 | 1 Medtronic | 1 Carelink Network | 2026-06-17 | N/A | 4.1 MEDIUM |
| Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certain circumstances. This issue affects CareLink Network: before December 4, 2025. | |||||
| CVE-2025-12995 | 1 Medtronic | 1 Carelink Network | 2026-06-17 | N/A | 8.1 HIGH |
| Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances. This issue affects CareLink Network: before December 4, 2025. | |||||
| CVE-2025-12994 | 1 Medtronic | 1 Carelink Network | 2026-06-17 | N/A | 5.3 MEDIUM |
| Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account. This issue affects CareLink Network: before December 4, 2025. | |||||
| CVE-2025-12986 | 2026-06-17 | N/A | N/A | ||
| When a WF200/WGM160P device is configured to operate as an Access Point, it may be vulnerable to a denial of service triggered by a malformed packet. The device may recover automatically or require a hard reset. | |||||
| CVE-2025-12985 | 2026-06-17 | N/A | 8.4 HIGH | ||
| IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Licensing Operator image. | |||||