Total
35983 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-5387 | 1 Huayi-tec | 1 Jeewms | 2026-06-17 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability classified as critical has been found in JeeWMS up to 20250504. Affected is the function dogenerate of the file /generateController.do?dogenerate of the component File Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. | |||||
| CVE-2025-5382 | 1 Devolutions | 1 Devolutions Server | 2026-06-17 | N/A | 6.8 MEDIUM |
| Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA. | |||||
| CVE-2025-5184 | 1 Summerpearlgroup | 1 Vacation Rental Management Platform | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. It has been classified as problematic. Affected is an unknown function of the component HTTP Response Header Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component. | |||||
| CVE-2025-5136 | 1 Project Team | 1 Tmall Demo | 2026-06-17 | 2.6 LOW | 3.7 LOW |
| A vulnerability, which was classified as problematic, was found in Tmall Demo up to 20250505. This affects an unknown part of the file /tmall/order/pay/ of the component Payment Identifier Handler. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-5129 | 1 Sangfor | 1 Atrust | 2026-06-17 | 6.0 MEDIUM | 7.0 HIGH |
| A vulnerability has been found in Sangfor 零信任访问控制系统 aTrust 2.3.10.60 and classified as critical. Affected by this vulnerability is an unknown functionality in the library MSASN1.dll. The manipulation leads to uncontrolled search path. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-59943 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-06-17 | N/A | 8.1 HIGH |
| phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often used as an identifier for password resets, notifications, and administrative actions, this flaw can cause account ambiguity and, in certain configurations, may lead to privilege escalation or account takeover. This issue is fixed in version 4.0.13. | |||||
| CVE-2025-59921 | 1 Fortinet | 1 Fortiadc | 2026-06-17 | N/A | 6.5 MEDIUM |
| An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1.4 and below, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to obtain sensitive data via crafted HTTP or HTTPs requests. | |||||
| CVE-2025-59851 | 1 Hcltech | 1 Dfxanalytics | 2026-06-17 | N/A | 3.7 LOW |
| HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, which could allow an attacker to identify and exploit publicly known security vulnerabilities to gain unauthorized access or compromise the application. | |||||
| CVE-2025-59704 | 1 Entrust | 10 Nshield 5c, Nshield 5c Firmware, Nshield Connect Xc Base and 7 more | 2026-06-17 | N/A | 4.6 MEDIUM |
| Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow an attacker to gain access the the BIOS menu because is has no password. | |||||
| CVE-2025-59500 | 1 Microsoft | 1 Azure Notification Service | 2026-06-17 | N/A | 7.7 HIGH |
| Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2025-59494 | 1 Microsoft | 1 Azure Monitor Agent | 2026-06-17 | N/A | 7.8 HIGH |
| Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2025-59481 | 1 F5 | 21 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Advanced Web Application Firewall and 18 more | 2026-06-17 | N/A | 8.7 HIGH |
| A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to execute arbitrary system commands with higher privileges. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2025-59294 | 1 Microsoft | 14 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 11 more | 2026-06-17 | N/A | 2.1 LOW |
| Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unauthorized attacker to disclose information with a physical attack. | |||||
| CVE-2025-59284 | 1 Microsoft | 5 Windows 11 22h2, Windows 11 23h2, Windows 11 24h2 and 2 more | 2026-06-17 | N/A | 3.3 LOW |
| Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally. | |||||
| CVE-2025-59273 | 1 Microsoft | 1 Azure Event Grid | 2026-06-17 | N/A | 7.3 HIGH |
| Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network. | |||||
| CVE-2025-59250 | 1 Microsoft | 1 Jdbc Driver For Sql Server | 2026-06-17 | N/A | 8.1 HIGH |
| Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network. | |||||
| CVE-2025-59249 | 1 Microsoft | 2 Exchange Server, Exchange Server Subscription Edition | 2026-06-17 | N/A | 8.8 HIGH |
| Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2025-59248 | 1 Microsoft | 2 Exchange Server, Exchange Server Subscription Edition | 2026-06-17 | N/A | 7.5 HIGH |
| Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | |||||
| CVE-2025-59228 | 1 Microsoft | 1 Sharepoint Server | 2026-06-17 | N/A | 8.8 HIGH |
| Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | |||||
| CVE-2025-59199 | 1 Microsoft | 11 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 8 more | 2026-06-17 | N/A | 7.8 HIGH |
| Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally. | |||||