Total
6627 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-65829 | 1 Meatmeet | 2 Meatmeet Pro Wifi \& Bluetooth Meat Thermometer, Meatmeet Pro Wifi \& Bluetooth Meat Thermometer Firmware | 2026-06-17 | N/A | 6.8 MEDIUM |
| The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures that only authenticated software can execute on the device. The Secure Boot process forms a chain of trust by verifying all mutable software entities involved in the Application Startup Flow. As a result, an attacker with physical access to the device can flash modified firmware to the device, resulting in the execution of malicious code upon startup. | |||||
| CVE-2025-65817 | 1 Lsc | 2 Smart Connect Indoor Ip Camera, Smart Connect Indoor Ip Camera Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh. | |||||
| CVE-2025-65719 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user interaction with a crafted HTML page. | |||||
| CVE-2025-65716 | 1 Shd101wyy | 1 Markdown Preview Enhanced | 2026-06-17 | N/A | 8.8 HIGH |
| An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file. | |||||
| CVE-2025-65715 | 1 Formulahendry | 1 Coderunner | 2026-06-17 | N/A | 7.8 HIGH |
| An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace. | |||||
| CVE-2025-65602 | 1 Chancms | 1 Chancms | 2026-06-17 | N/A | 9.8 CRITICAL |
| A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request. | |||||
| CVE-2025-65294 | 1 Aqara | 6 Camera Hub G3, Camera Hub G3 Firmware, Hub M2 and 3 more | 2026-06-17 | N/A | 9.8 CRITICAL |
| Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution. | |||||
| CVE-2025-65271 | 1 Azuriom | 1 Azuriom | 2026-06-17 | N/A | 8.8 HIGH |
| Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard components that render untrusted user input, potentially enabling privilege escalation to an administrative account. Fixed in Azuriom 1.2.7. | |||||
| CVE-2025-65108 | 2026-06-17 | N/A | 10.0 CRITICAL | ||
| md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5. | |||||
| CVE-2025-65099 | 1 Anthropic | 1 Claude Code | 2026-06-17 | N/A | 9.8 CRITICAL |
| Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would have required a user to start Claude Code in an untrusted directory and to be using Yarn 3.0 or above. This issue has been patched in version 1.0.39. | |||||
| CVE-2025-65037 | 1 Microsoft | 1 Azure Container Apps | 2026-06-17 | N/A | 10.0 CRITICAL |
| Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2025-65026 | 1 Esm | 1 Esm.sh | 2026-06-17 | N/A | 6.1 MEDIUM |
| esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter, esm.sh converts it to a JavaScript module by embedding the CSS content directly into a template literal without proper sanitization. An attacker can inject malicious JavaScript code using ${...} expressions within CSS files, which will execute when the module is imported by victim applications. This enables Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications. This issue has been patched in version 136. | |||||
| CVE-2025-64691 | 1 Aveva | 1 Process Optimization | 2026-06-17 | N/A | 8.8 HIGH |
| The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scripts and escalate privileges to OS system, potentially resulting in complete compromise of the model application server. | |||||
| CVE-2025-64676 | 1 Microsoft | 1 Purview | 2026-06-17 | N/A | 7.2 HIGH |
| '.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network. | |||||
| CVE-2025-64321 | 1 Salesforce | 1 Agentforce Vibes | 2026-06-17 | N/A | 5.3 MEDIUM |
| Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0. | |||||
| CVE-2025-64320 | 1 Salesforce | 1 Agentforce Vibes | 2026-06-17 | N/A | 6.5 MEDIUM |
| Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentforce Vibes Extension: before 3.2.0. | |||||
| CVE-2025-64318 | 1 Salesforce | 1 Mulesoft Anypoint Code Builder | 2026-06-17 | N/A | 5.3 MEDIUM |
| Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1. | |||||
| CVE-2025-64108 | 1 Anysphere | 1 Cursor | 2026-06-17 | N/A | 8.8 HIGH |
| Cursor is a code editor built for programming with AI. In versions 1.7.44 and below, various NTFS path quirks allow a prompt injection attacker to circumvent sensitive file protections and overwrite files which Cursor requires human approval to overwrite. Modification of some of the protected files can lead to RCE. Must be chained with a prompt injection or malicious model attach. Only affects systems supporting NTFS. This issue is fixed in version 2.0. | |||||
| CVE-2025-64050 | 1 Redaxo | 1 Redaxo | 2026-06-17 | N/A | 7.2 HIGH |
| A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template. | |||||
| CVE-2025-63706 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| NPM package next-npm-version1.0.1 is vulnerable to Command injection. | |||||