CVE-2025-58406

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published: Mar 2, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-584077.4Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trig CVE-2025-584085.9Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to ke CVE-2025-584093.5Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical m CVE-2025-58416.4The ACF Onyx Poll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and inc CVE-2025-584107.5Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers export CVE-2025-584118.8Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference coun CVE-2025-584126.1A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 thr CVE-2025-584137.5A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, CVE-2025-58425.4The Modern Design Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to,CVE-2025-584222.3RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history. If an attacker can perform a man-in-the-middl CVE-2025-584238.8Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, tr CVE-2025-584245.3On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which do not have message i