Total
557 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-62168 | 1 Squid-cache | 1 Squid | 2026-06-17 | N/A | 10.0 CRITICAL |
| Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off. | |||||
| CVE-2025-61959 | 1 Vertikalsystems | 1 Hospital Manager Backend Services | 2026-06-17 | N/A | 5.3 MEDIUM |
| Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET version information, stack traces, internal paths, and the insecure configuration 'customErrors mode="Off"', which could have facilitated reconnaissance by unauthenticated attackers. | |||||
| CVE-2025-5731 | 2 Infinispan, Redhat | 4 Infinispan, Data Grid, Jboss Enterprise Application Platform and 1 more | 2026-06-17 | N/A | 5.5 MEDIUM |
| A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found. | |||||
| CVE-2025-59853 | 1 Hcltech | 1 Dfxanalytics | 2026-06-17 | N/A | 3.1 LOW |
| HCL DFXAnalytics is affected by an Improper Error Handling vulnerability where the application exposes detailed stack traces in responses, which could allow an attacker to gain insights into the application's internal structure, code logic, and environment configurations. | |||||
| CVE-2025-59016 | 1 Typo3 | 1 Typo3 | 2026-06-17 | N/A | 4.3 MEDIUM |
| Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations. | |||||
| CVE-2025-55676 | 1 Microsoft | 3 Windows 11 24h2, Windows 11 25h2, Windows Server 2025 | 2026-06-17 | N/A | 5.5 MEDIUM |
| Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose information locally. | |||||
| CVE-2025-55250 | 1 Hcltech | 1 Aion | 2026-06-17 | N/A | 1.8 LOW |
| HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information disclosure or aiding further attacks. | |||||
| CVE-2025-54791 | 1 Openmicroscopy | 1 Omero-web | 2026-06-17 | N/A | 5.3 MEDIUM |
| OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This issue has been patched in version 5.29.2. A workaround involves disabling the Forgot password option in OMERO.web using the omero.web.show_forgot_password configuration property. | |||||
| CVE-2025-54562 | 1 Desktopalert | 1 Pingalert Application Server | 2026-06-17 | N/A | 4.3 MEDIUM |
| A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Technical Information to be Disclosed through stack trace. | |||||
| CVE-2025-54291 | 1 Canonical | 1 Lxd | 2026-06-17 | N/A | 5.3 MEDIUM |
| Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses. | |||||
| CVE-2025-53803 | 1 Microsoft | 14 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 11 more | 2026-06-17 | N/A | 5.5 MEDIUM |
| Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally. | |||||
| CVE-2025-52671 | 1 Revive-adserver | 1 Revive Adserver | 2026-06-17 | N/A | 4.3 MEDIUM |
| Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in use. | |||||
| CVE-2025-52641 | 1 Hcltech | 1 Aion | 2026-06-17 | N/A | 2.9 LOW |
| HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information may provide insights into the underlying environment, which could potentially aid in further targeted actions or limited information disclosure. | |||||
| CVE-2025-52619 | 1 Hcltech | 1 Bigfix Saas | 2026-06-17 | N/A | 5.3 MEDIUM |
| HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages disclose sensitive version information about the underlying platform. | |||||
| CVE-2025-52611 | 1 Hcltech | 1 Icontrol | 2026-06-17 | N/A | 3.1 LOW |
| HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in the application's JavaScript code. Specifically, the code attempts to read the property dashboard key from an object that is undefined. This issue likely stems from one of the following: A missing or improperly initialized object. | |||||
| CVE-2025-52606 | 1 Hcltech | 1 Icontrol | 2026-06-17 | N/A | 4.3 MEDIUM |
| HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security tactic. Received input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type. | |||||
| CVE-2025-4166 | 2 Hashicorp, Openbao | 2 Vault, Openbao | 2026-06-17 | N/A | 4.5 MEDIUM |
| Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20. | |||||
| CVE-2025-49128 | 2026-06-17 | N/A | 4.0 MEDIUM | ||
| Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's `JsonLocation._appendSourceDesc` method allows up to 500 bytes of unintended memory content to be included in exception messages. When parsing JSON from a byte array with an offset and length, the exception message incorrectly reads from the beginning of the array instead of the logical payload start. This results in possible information disclosure in systems using pooled or reused buffers, like Netty or Vert.x. This issue was silently fixed in jackson-core version 2.13.0, released on September 30, 2021, via PR #652. All users should upgrade to version 2.13.0 or later. If upgrading is not immediately possible, applications can mitigate the issue by disabling exception message exposure to clients to avoid returning parsing exception messages in HTTP responses and/or disabling source inclusion in exceptions to prevent Jackson from embedding any source content in exception messages, avoiding leakage. | |||||
| CVE-2025-48562 | 1 Google | 1 Android | 2026-06-17 | N/A | 5.0 MEDIUM |
| In writeContent of RemotePrintDocument.java, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. | |||||
| CVE-2025-47813 | 1 Wftpserver | 1 Wing Ftp Server | 2026-06-17 | N/A | 4.3 MEDIUM |
| loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie. | |||||