Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: June 2025

207 records · 18 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 3

  • CVE-2025-49113
    95Now

    Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a

    HighCVSS 8.8KEVWeaponizedEPSS 98%

    roundcube · webmailJun 2, 2025

  • CVE-2025-0324
    35Monitor

    The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.

    HighCVSS 8.8Proof of conceptEPSS 0%

    axis · axis osJun 2, 2025

  • CVE-2025-5438
    29Monitor

    Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 WPS command injection

    MediumCVSS 5.3No exploitEPSS 25%

    linksys · re9000 firmwareJun 2, 2025

  • CVE-2025-5441
    25Monitor

    Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 setDeviceURL os command injection

    MediumCVSS 5.3No exploitEPSS 13%

    linksys · re9000 firmwareJun 2, 2025

  • CVE-2025-5442
    25Monitor

    Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_pingGatewayByBBS os command injection

    MediumCVSS 5.3No exploitEPSS 13%

    linksys · re9000 firmwareJun 2, 2025

  • CVE-2025-5443
    25Monitor

    Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 wirelessAdvancedHidden os command injection

    MediumCVSS 5.3No exploitEPSS 13%

    linksys · re9000 firmwareJun 2, 2025

  • CVE-2025-5444
    25Monitor

    Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_UpgradeFWByBBS os command injection

    MediumCVSS 5.3No exploitEPSS 13%

    linksys · re9000 firmwareJun 2, 2025

  • CVE-2025-5445
    25Monitor

    Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_checkFWByBBS os command injection

    MediumCVSS 5.3No exploitEPSS 13%

    linksys · re9000 firmwareJun 2, 2025

  • CVE-2025-5446
    25Monitor

    Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_checkCredentialsByBBS os command injection

    MediumCVSS 5.3No exploitEPSS 13%

    linksys · re9000 firmwareJun 2, 2025

  • CVE-2025-5447
    30Monitor

    Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 ssid1MACFilter os command injection

    MediumCVSS 5.3No exploitEPSS 30%

    linksys · re9000 firmwareJun 2, 2025

  • CVE-2025-45542
    29Monitor

    SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0.

    HighCVSS 7.3Proof of conceptEPSS 1%

    vishalmathur · cloudclassroom-php projectJun 2, 2025

  • CVE-2024-7074
    32Monitor

    Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution

    MediumCVSS 6.8No exploitEPSS 17%

    wso2 · wso2 enterprise integratorJun 2, 2025

  • CVE-2025-20297
    30Monitor

    Reflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation component

    MediumCVSS 5.4No exploitEPSS 29%

    splunk · splunkJun 2, 2025

  • CVE-2025-27954
    26Monitor

    An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via

    MediumCVSS 6.5No exploitEPSS 0%

    philips · clinical collaboration platformJun 2, 2025

  • CVE-2025-27955
    26Monitor

    Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote att

    MediumCVSS 6.5No exploitEPSS 0%

    philips · clinical collaboration platformJun 2, 2025

  • CVE-2025-5086
    95Now

    Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025

    CriticalCVSS 9.0KEVWeaponizedEPSS 96%

    3ds · delmia aprisoJun 2, 2025

  • CVE-2025-5419
    67This week

    Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption

    HighCVSS 8.8KEVWeaponizedEPSS 7%

    google · chromeJun 2, 2025

  • CVE-2025-21480
    64This week

    Incorrect Authorization in Graphics Windows

    HighCVSS 8.6KEVWeaponizedEPSS 0%

    qualcomm · aqt1000 firmwareJun 3, 2025

  • CVE-2025-27038
    60This week

    Use After Free in Graphics

    HighCVSS 7.5KEVWeaponizedEPSS 1%

    qualcomm · ar8031 firmwareJun 3, 2025

  • CVE-2025-31710
    33Monitor

    In engineermode service, there is a possible command injection due to improper input validation.

    HighCVSS 8.4Proof of conceptEPSS 0%

    google · androidJun 3, 2025

  • CVE-2025-21479
    64This week

    Incorrect Authorization in Graphics

    HighCVSS 8.6KEVWeaponizedEPSS 0%

    qualcomm · aqt1000 firmwareJun 3, 2025

  • CVE-2025-4138
    30Monitor

    Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory

    HighCVSS 7.5Proof of conceptEPSS 1%

    python software foundation · cpythonJun 3, 2025

  • CVE-2025-4517
    37Monitor

    Arbitrary writes via tarfile realpath overflow

    CriticalCVSS 9.4Proof of conceptEPSS 1%

    python software foundation · cpythonJun 3, 2025

  • CVE-2025-5504
    25Monitor

    TOTOLINK X2000R formWsc command injection

    MediumCVSS 5.3No exploitEPSS 13%

    totolink · x2000r firmwareJun 3, 2025

  • CVE-2025-44148
    55Plan

    Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx co

    CriticalCVSS 9.8Proof of conceptEPSS 54%

    mailenable · mailenableJun 3, 2025

  • CVE-2025-45854
    41Plan

    /server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.

    CriticalCVSS 10.0Proof of conceptEPSS 3%

    jehc · jehc-bpmJun 3, 2025

  • CVE-2025-48999
    30Monitor

    Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability

    MediumCVSS 6.8No exploitEPSS 10%

    dataease · dataeaseJun 3, 2025

  • CVE-2025-49001
    37Monitor

    Dataease Authentication Bypass Vulnerability

    HighCVSS 7.7Proof of conceptEPSS 21%

    dataease · dataeaseJun 3, 2025

  • CVE-2025-49002
    47Plan

    Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability

    HighCVSS 8.2Proof of conceptEPSS 49%

    dataease · dataeaseJun 3, 2025

  • CVE-2025-5527
    38Monitor

    Tenda RX3 SetStaticRouteCfg save_staticroute_data stack-based overflow

    HighCVSS 8.7No exploitEPSS 12%

    tenda · rx3 firmwareJun 3, 2025

  • CVE-2025-5548
    31Monitor

    FreeFloat FTP Server NOOP Command buffer overflow

    MediumCVSS 6.9Proof of conceptEPSS 14%

    freefloat · freefloat ftp serverJun 3, 2025

  • CVE-2025-49223
    39Monitor

    billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    naver · billboard.jsJun 3, 2025

  • CVE-2025-4578
    39Monitor

    File Provider <= 1.2.3 - Unauthenticated SQLi

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    dimdavid · file providerJun 4, 2025

  • CVE-2025-5569
    21Monitor

    IdeaCMS getList.html Goods sql injection

    MediumCVSS 5.3Proof of conceptEPSS 1%

    ideacms · ideacmsJun 4, 2025

  • CVE-2025-5571
    25Monitor

    D-Link DCS-932L setSystemAdmin os command injection

    MediumCVSS 5.3No exploitEPSS 13%

    dlink · dcs-932l firmwareJun 4, 2025

  • CVE-2025-5573
    25Monitor

    D-Link DCS-932L setSystemWizard setSystemControl os command injection

    MediumCVSS 5.3No exploitEPSS 14%

    dlink · dcs-932l firmwareJun 4, 2025

  • CVE-2025-29093
    32Monitor

    File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/Ga

    HighCVSS 8.2Proof of conceptEPSS 0%

    motivian · content management systemJun 4, 2025

  • CVE-2025-29094
    24Monitor

    Cross Site Scripting vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the M

    MediumCVSS 6.1Proof of conceptEPSS 0%

    motivian · content management systemJun 4, 2025

  • CVE-2025-5688
    30Monitor

    Out of Bounds Write in FreeRTOS-Plus-TCP

    HighCVSS 7.5Proof of conceptEPSS 0%

    amazon · freertosJun 4, 2025

  • CVE-2025-46203
    26Monitor

    An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/{id} endpoint.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    changeweb · unifiedtransformJun 4, 2025

  • CVE-2025-46204
    26Monitor

    An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/{id} endpoint.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    changeweb · unifiedtransformJun 4, 2025

  • CVE-2025-5623
    43Plan

    D-Link DIR-816 qosClassifier stack-based overflow

    CriticalCVSS 9.3No exploitEPSS 18%

    dlink · dir-816 firmwareJun 4, 2025

  • CVE-2025-3054
    35Monitor

    WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload

    HighCVSS 8.8Proof of conceptEPSS 0%

    wedevs · wp user frontend proJun 5, 2025

  • CVE-2025-5640
    19Monitor

    PX4-Autopilot TRAJECTORY_REPRESENTATION_WAYPOINTS Message mavlink_receiver.cpp stack-based overflow

    MediumCVSS 4.8Proof of conceptEPSS 1%

    Jun 5, 2025

  • CVE-2025-5701
    36Monitor

    HyperComments <= 1.2.2 - Unauthenticated (Subscriber+) Arbitrary Options Update

    HighCVSS 8.8Proof of conceptEPSS 2%

    siteheart · hypercommentsJun 5, 2025

  • CVE-2025-47827
    49Plan

    In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature.

    MediumCVSS 4.6KEVWeaponizedEPSS 4%

    igel · igel osJun 5, 2025

  • CVE-2025-48907
    24Monitor

    Deserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availability.

    MediumCVSS 6.2Proof of conceptEPSS 0%

    huawei · harmonyosJun 6, 2025

  • CVE-2025-5755
    22Monitor

    SourceCodester Open Source Clinic Management System email_config.php sql injection

    MediumCVSS 5.5Proof of conceptEPSS 0%

    nikhil-bhalerao · open source clinic management systemJun 6, 2025

  • CVE-2025-41646
    54Plan

    RevPi Webstatus application is vulnerable to an authentication bypass

    CriticalCVSS 9.8Proof of conceptEPSS 51%

    kunbus · revpi statusJun 6, 2025

  • CVE-2025-38001
    22Monitor

    net_sched: hfsc: Address reentrant enqueue adding class to eltree twice

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelJun 6, 2025

  • CVE-2025-5792
    31Monitor

    TOTOLINK EX1200T HTTP POST Request formWlanRedirect buffer overflow

    HighCVSS 7.4No exploitEPSS 5%

    totolink · ex1200t firmwareJun 6, 2025

  • CVE-2025-5473
    42Plan

    GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 23%

    gimp · gimpJun 6, 2025

  • CVE-2025-49619
    40Plan

    Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation

    HighCVSS 8.5WeaponizedEPSS 20%

    skyvern · skyvernJun 7, 2025

  • CVE-2025-5840
    27Monitor

    SourceCodester Client Database Management System user_update_customer_order.php unrestricted upload

    MediumCVSS 6.9Proof of conceptEPSS 0%

    lerouxyxchire · client database management systemJun 7, 2025

  • CVE-2025-21082
    22Monitor

    arkui_ace_engine has a type confusion vulnerability

    MediumCVSS 5.5Proof of conceptEPSS 0%

    openatom · openharmonyJun 8, 2025

  • CVE-2025-4652
    24Monitor

    Broadstreet < 1.51.8 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    broadstreetads · broadstreetJun 9, 2025

  • CVE-2025-49131
    39Monitor

    FastGPT Sandbox Vulnerable to Sandbox Bypass

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    fastgpt · fastgptJun 9, 2025

  • CVE-2025-5880
    8Monitor

    Whistle get-temp-file path traversal

    LowCVSS 2.1Proof of conceptEPSS 0%

    Jun 9, 2025

  • CVE-2025-46178
    24Monitor

    Cross-Site Scripting (XSS) vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    vishalmathur · cloudclassroom-php projectJun 9, 2025

  • CVE-2025-47608
    60This week

    WordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection Vulnerability

    CriticalCVSS 9.3WeaponizedEPSS 1%

    sonalsinha21 · recover abandoned cart for woocommerceJun 9, 2025

  • CVE-2025-48129
    39Monitor

    WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Privilege Escalation Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    holest engineering · spreadsheet price changer for woocommerce and wp e-commerce – lightJun 9, 2025

  • CVE-2025-48281
    37Monitor

    WordPress MyStyle Custom Product Designer plugin <= 3.21.1 - SQL Injection Vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    mystyleplatform · mystyle custom product designerJun 9, 2025

  • CVE-2025-46041
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page descrip

    MediumCVSS 5.4Proof of conceptEPSS 0%

    anchorcms · anchor cmsJun 9, 2025

  • CVE-2025-49136
    40Plan

    listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

    MediumCVSS 6.5WeaponizedEPSS 1%

    nadh · listmonkJun 9, 2025

  • CVE-2025-5915
    26Monitor

    Libarchive: heap buffer over read in copy_from_lzss_window() at archive_read_support_format_rar.c

    MediumCVSS 6.6Proof of conceptEPSS 0%

    libarchive · libarchiveJun 9, 2025

  • CVE-2025-5903
    32Monitor

    TOTOLINK T10 POST Request cstecgi.cgi setWiFiAclRules buffer overflow

    HighCVSS 7.4No exploitEPSS 11%

    totolink · t10 firmwareJun 9, 2025

  • CVE-2025-5904
    32Monitor

    TOTOLINK T10 POST Request cstecgi.cgi setWiFiMeshName buffer overflow

    HighCVSS 7.4No exploitEPSS 11%

    totolink · t10 firmwareJun 9, 2025

  • CVE-2025-5905
    32Monitor

    TOTOLINK T10 POST Request cstecgi.cgi setWiFiRepeaterCfg buffer overflow

    HighCVSS 7.4No exploitEPSS 11%

    totolink · t10 firmwareJun 9, 2025

  • CVE-2025-4601
    37Monitor

    RH - Real Estate WordPress Theme <= 4.4.0 - Authenticated (Subscriber+) Privilege Escalation

    HighCVSS 8.8Proof of conceptEPSS 6%

    inspirythemes · rh - real estate wordpress themeJun 10, 2025

  • CVE-2025-4840
    30Monitor

    Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 0%

    erumfaham · likes and dislikesJun 10, 2025

  • CVE-2025-27817
    51Plan

    Apache Kafka Client: Arbitrary file read and SSRF vulnerability

    HighCVSS 7.5Proof of conceptEPSS 68%

    apache · kafkaJun 10, 2025

  • CVE-2024-29198
    33Monitor

    GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost

    HighCVSS 8.2Proof of conceptEPSS 2%

    osgeo · geoserverJun 10, 2025

  • CVE-2025-27505
    21Monitor

    GeoServer Missing Authorization on REST API Index

    MediumCVSS 5.3Proof of conceptEPSS 1%

    osgeo · geoserverJun 10, 2025

  • CVE-2025-30220
    49Plan

    GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

    CriticalCVSS 9.1Proof of conceptEPSS 42%

    geotools · geotoolsJun 10, 2025

  • CVE-2025-4653
    40Plan

    Remote Code Execution leads to Command Injection

    HighCVSS 7.0WeaponizedEPSS 3%

    pandora fms · pandora itsmJun 10, 2025

  • CVE-2024-50562
    19Monitor

    An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and bel

    MediumCVSS 4.8Proof of conceptEPSS 1%

    fortinet · fortisaseJun 10, 2025

  • CVE-2025-32710
    32Monitor

    Windows Remote Desktop Services Remote Code Execution Vulnerability

    HighCVSS 8.1Proof of conceptEPSS 1%

    microsoft · windows server 2008Jun 10, 2025

  • CVE-2025-33053
    91Now

    Internet Shortcut Files Remote Code Execution Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 87%

    microsoft · windows 10 1507Jun 10, 2025

  • CVE-2025-33071
    39Monitor

    Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability

    HighCVSS 8.1No exploitEPSS 23%

    microsoft · windows server 2012Jun 10, 2025

  • CVE-2025-33073
    90Now

    Windows SMB Client Elevation of Privilege Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 82%

    microsoft · windows 10 1507Jun 10, 2025

  • CVE-2025-47163
    41Plan

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 20%

    microsoft · sharepoint enterprise serverJun 10, 2025

  • CVE-2025-47165
    32Monitor

    Microsoft Excel Remote Code Execution Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 2%

    microsoft · 365 appsJun 10, 2025

  • CVE-2025-47166
    41Plan

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 21%

    microsoft · sharepoint enterprise serverJun 10, 2025

  • CVE-2025-47171
    27Monitor

    Microsoft Outlook Remote Code Execution Vulnerability

    MediumCVSS 6.7Proof of conceptEPSS 1%

    microsoft · 365 appsJun 10, 2025

  • CVE-2025-47175
    32Monitor

    Microsoft PowerPoint Remote Code Execution Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 2%

    microsoft · 365 appsJun 10, 2025

  • CVE-2025-47176
    31Monitor

    Microsoft Outlook Remote Code Execution Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 0%

    microsoft · 365 appsJun 10, 2025

  • CVE-2025-47957
    33Monitor

    Microsoft Word Remote Code Execution Vulnerability

    HighCVSS 8.4Proof of conceptEPSS 1%

    microsoft · 365 appsJun 10, 2025

  • CVE-2025-47962
    31Monitor

    Windows SDK Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 1%

    microsoft · windows software development kitJun 10, 2025

  • CVE-2024-41502
    24Monitor

    Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) via the form field "Observaces" (observances) in the "

    MediumCVSS 6.1Proof of conceptEPSS 0%

    jetimob · imobiliariaJun 10, 2025

  • CVE-2024-41503
    24Monitor

    Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the field "Ttulo" (title) inside the filter Save op

    MediumCVSS 6.1Proof of conceptEPSS 0%

    jetimob · imobiliariaJun 10, 2025

  • CVE-2024-41504
    24Monitor

    Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS).

    MediumCVSS 6.1Proof of conceptEPSS 0%

    jetimob · imobiliariaJun 10, 2025

  • CVE-2024-41505
    24Monitor

    Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the "Pessoas" (persons) section via the field "Prof

    MediumCVSS 6.1Proof of conceptEPSS 0%

    jetimob · imobiliariaJun 10, 2025

  • CVE-2025-3052
    32Monitor

    An arbitrary write vulnerability in Microsoft signed UEFI firmware from DT Research Inc.

    HighCVSS 8.2Proof of conceptEPSS 0%

    dt research · biosflashshellJun 10, 2025

  • CVE-2025-47029
    21Monitor

    Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

    MediumCVSS 5.4Proof of conceptEPSS 0%

    adobe · experience managerJun 10, 2025

  • CVE-2025-1055
    22Monitor

    K7 Security Anti-Malware: IOCTL in K7RKScan.sys Allows Arbitrary Termination of High-Privilege and System Processes by a Low-Privilege User

    MediumCVSS 5.6Proof of conceptEPSS 0%

    k7 security · k7 security anti-malwareJun 10, 2025

  • CVE-2025-49091
    32Monitor

    KDE Konsole before 25.04.2 allows remote code execution in a certain scenario.

    HighCVSS 8.2Proof of conceptEPSS 0%

    kde · konsoleJun 10, 2025

  • CVE-2025-4275
    31Monitor

    SecureFlashDxe: Incorrect UEFI variable attributes check allows usage of invalid certificate

    HighCVSS 7.8Proof of conceptEPSS 0%

    insyde software · insydeh2oJun 10, 2025

  • CVE-2025-5959
    39Monitor

    Type Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra

    HighCVSS 8.8No exploitEPSS 13%

    google · chromeJun 10, 2025

  • CVE-2025-32711
    32Monitor

    M365 Copilot Information Disclosure Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 8%

    microsoft · 365 copilotJun 11, 2025

  • CVE-2025-6002
    28Monitor

    VirtueMart - Unrestricted File Upload

    HighCVSS 7.2Proof of conceptEPSS 0%

    virtuemart · virtuemartJun 11, 2025