CVE-2025 records published in July 2025
This page lists the 3,582 CVE-2025 records published in July 2025, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 14 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2025 list filters these records by severity or signal.
- Critical
- 58816.4% of these records
- Listed in CISA KEV
- 140.4% of these records
- Reported exploited
- 50.1% of these records
- Detection signal
- 1283.6% of these records
- Exploit code
- 1644.6% of these records
- Actionable vendor fix
- 2,25462.9% of these records
Figures as of 2026-10-24 13:47 UTC. Records published in July 2025 have had from about 15 months to about 16 months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-54834 | OPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumeration | 6.9CNA v4.0 | 0.5% | 2025-07-31 | Fix |
| CVE-2025-54833 | OPEXUS FOIAXpress Public Access Link (PAL) account-lockout and CAPTCHA protection bypass | 7.5v3.1 | 0.5% | 2025-07-31 | Fix |
| CVE-2025-54832 | OPEXUS FOIAXpress Public Access Link (PAL) state and territory list unauthorized modification | 5.3CNA v4.0 | 0.3% | 2025-07-31 | Fix |
| CVE-2025-54757 | Alfasado PowerCMS unrestricted file upload | 8.0v3.1 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-54752 | Alfasado PowerCMS CSV injection | 8.0v3.1 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-54589 | copyparty reflected XSS via Filter parameter | 6.3CNA v3.1 | 2.4% | 2025-07-31 | NucleiExploit codeFix |
| CVE-2025-54085 | Absolute Security Secure Access administrative console privilege escalation | 5.1CNA v4.0 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-53558 | ZTE Japan ZXHN-F660T weak credentials | 8.7CNA v4.0 | 1.4% | 2025-07-31 | Reported exploitedNuclei |
| CVE-2025-52289 | MagnusSolution MagnusBilling missing authorization | 8.0CISA ADP v3.1 | 0.4% | 2025-07-31 | Exploit code |
| CVE-2025-52203 | DevaslanPHP project-management stored cross-site scripting | 7.6CISA ADP v3.1 | 0.3% | 2025-07-31 | Fix |
| CVE-2025-51569 | LB-Link BL-CPE300M A cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-07-31 | |
| CVE-2025-51503 | Microweber has stored XSS vulnerability in User Profile fields | 7.6CISA ADP v3.1 | 0.5% | 2025-07-31 | |
| CVE-2025-51385 | D-Link DI-8200 stack-based buffer overflow | 3.5CISA ADP v3.1 | 0.4% | 2025-07-31 | Exploit code |
| CVE-2025-51384 | D-Link DI-8200 stack-based buffer overflow | 3.5CISA ADP v3.1 | 0.4% | 2025-07-31 | |
| CVE-2025-51383 | D-Link DI-8200 stack-based buffer overflow | 3.5CISA ADP v3.1 | 0.4% | 2025-07-31 | |
| CVE-2025-50867 | Vishalmathur Cloudclassroom takeassessment2.php endpoint of the SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2025-07-31 | Exploit code |
| CVE-2025-50866 | Vishalmathur Cloudclassroom cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-07-31 | |
| CVE-2025-50850 | Cs-cart missing brute-force protection | 8.6CISA ADP v3.1 | 0.2% | 2025-07-31 | |
| CVE-2025-50849 | CS-Cart user profile sticker setting insecure direct object reference | 8.0CISA ADP v3.1 | 0.3% | 2025-07-31 | |
| CVE-2025-50848 | Cs-cart cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-07-31 | |
| CVE-2025-50847 | Cs-cart cross-site request forgery | 6.5CISA ADP v3.1 | 0.1% | 2025-07-31 | |
| CVE-2025-50572 | Archer CSV export CSV injection | 8.8CISA ADP v3.1 | 0.4% | 2025-07-31 | |
| CVE-2025-50475 | Russound MBX-PRE-D67F firmware version An OS command injection | 9.8CISA ADP v3.1 | 7.7% | 2025-07-31 | |
| CVE-2025-50270 | AnQiCMS content management stored cross-site scripting | 6.1CISA ADP v3.1 | 0.4% | 2025-07-31 | |
| CVE-2025-49084 | Secure Access administrative console privilege escalation | 5.3CNA v4.0 | 0.3% | 2025-07-31 | Fix |
| CVE-2025-49083 | Absolute Security Secure Access administrative console insecure deserialization | 7.0CNA v4.0 | 0.4% | 2025-07-31 | Fix |
| CVE-2025-49082 | Absolute Security Secure Access administrative console permissions bypass | 5.1CNA v4.0 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-48073 | OpenEXR ScanLineProcess::run_fill null pointer Write in reduceMemory Mode | 4.6CNA v4.0 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-48072 | OpenEXR's Inaccurate Pointer Arithmetic can cause an Out-of-bounds Heap | 6.8CNA v4.0 | 0.5% | 2025-07-31 | Fix |
| CVE-2025-48071 | OpenEXR's Forged Unpacked Size can lead to heap-based buffer overflow in Deep Scanline Parsing | 8.4CNA v4.0 | 0.3% | 2025-07-31 | Fix |
| CVE-2025-46809 | Multi Linux Manager epxoses the plain text HTTP Proxy user:password in logs | 6.9CNA v4.0 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-46359 | Alfasado PowerCMS path traversal | 8.6CNA v4.0 | 0.6% | 2025-07-31 | Exploit codeFix |
| CVE-2025-45770 | jwt inadequate encryption strength | 7.0CISA ADP v3.1 | 0.1% | 2025-07-31 | |
| CVE-2025-45769 | Google php-jwt contains weak encryption | 6.5CISA ADP v3.1 | 0.1% | 2025-07-31 | Fix |
| CVE-2025-45768 | pyjwt missing encryption | 7.0CISA ADP v3.1 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-41688 | MB connect line mbNET HW1 high privilege RCE via LUA sandbox escape | 7.2CNA v3.1 | 0.7% | 2025-07-31 | Fix |
| CVE-2025-41396 | Alfasado PowerCMS file uploading feature of multiple versions path traversal | 6.5v3.1 | 0.4% | 2025-07-31 | Fix |
| CVE-2025-41391 | Alfasado PowerCMS multiple versions stored cross-site scripting | 5.1CNA v4.0 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-40980 | UltimateFosters UltimatePOS product name field stored cross-site scripting | 5.1CNA v4.0 | 0.5% | 2025-07-31 | |
| CVE-2025-37112 | HPE Telco Network Function Virtual Orchestrator hard-coded encryption keys found in System | 6.0CNA v3.1 | 0.1% | 2025-07-31 | |
| CVE-2025-37111 | HPE Telco Network Function Virtual Orchestrator Hard-Coded Authentication Keys found in System | 6.0CNA v3.1 | 0.1% | 2025-07-31 | |
| CVE-2025-37110 | HPE Telco Network Function Virtual Orchestrator insecure storage of sensitive information | 6.0CNA v3.1 | 0.1% | 2025-07-31 | |
| CVE-2025-37109 | HPE Telco Service Activator, protection mechanism failure | 3.5CNA v3.1 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-37108 | HPE Telco Service Activator, protection mechanism failure | 3.5CNA v3.1 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-36563 | Alfasado PowerCMS multiple versions reflected cross-site scripting | 5.3CNA v4.0 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-36040 | IBM Aspera Faspex session fixation | 6.5CNA v3.1 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-36039 | IBM Aspera Faspex client-side enforcement of server-side security | 6.5CNA v3.1 | 0.3% | 2025-07-31 | Fix |
| CVE-2025-34146 | nyariv SandboxJS prototype pollution sandbox escape DoS | 7.0CNA v4.0 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-29557 | ExaGrid EX10 MailConfiguration API information disclosure | 5.4CISA ADP v3.1 | 0.2% | 2025-07-31 | |
| CVE-2025-29556 | ExaGrid EX10 account creation API vulnerability | 7.3CISA ADP v3.1 | 0.3% | 2025-07-31 | |
| CVE-2025-26064 | Intelbras RX 1500 cross-site scripting | 7.3CISA ADP v3.1 | 1.0% | 2025-07-31 | Fix |
| CVE-2025-26063 | Intelbras RX 1500 command injection | 9.8CISA ADP v3.1 | 1.3% | 2025-07-31 | Fix |
| CVE-2025-26062 | Intelbras RX 1500 An improper access control | 9.8CISA ADP v3.1 | 1.1% | 2025-07-31 | Fix |
| CVE-2025-24854 | Apache JSPWiki: Cross-site scripting (XSS) in JSPWiki Image plugin | 6.1CISA ADP v3.1 | 0.4% | 2025-07-31 | Fix |
| CVE-2025-24853 | Apache JSPWiki: Cross-site scripting (XSS) in JSPWiki Header Link processing | 7.5CISA ADP v3.1 | 0.5% | 2025-07-31 | Fix |
| CVE-2025-23289 | NVIDIA Omniverse Launcher sensitive information in log files | 5.5CNA v3.1 | 0.1% | 2025-07-31 | Fix |
| CVE-2025-8426 | Marvell QConvergeConsole path traversal | 9.4CNA v3.0 | 1.3% | 2025-07-31 | |
| CVE-2025-8409 | code-projects Vehicle Management filter.php SQL injection | 9.8v3.1 | 0.4% | 2025-07-31 | |
| CVE-2025-8408 | code-projects Vehicle Management filter1.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-31 | |
| CVE-2025-8407 | code-projects Vehicle Management filter2.php SQL injection | 9.8v3.1 | 0.4% | 2025-07-31 | |
| CVE-2025-8401 | HT Mega Absolute Addons For Elementor WordPress plugin sensitive information exposure | 4.3CNA v3.1 | 0.3% | 2025-07-31 | Fix |
| CVE-2025-8382 | Campcodes Online Hotel Reservation System edit_room.php SQL injection | 8.8v3.1 | 0.5% | 2025-07-31 | |
| CVE-2025-8381 | Campcodes Online Hotel Reservation System add_reserve.php SQL injection | 8.8v3.1 | 0.5% | 2025-07-31 | |
| CVE-2025-8380 | Campcodes Online Hotel Reservation System add_query_account.php cross-site scripting | 5.4v3.1 | 0.3% | 2025-07-31 | |
| CVE-2025-8379 | Campcodes Online Hotel Reservation System edit_room.php unrestricted upload | 7.2v3.1 | 0.5% | 2025-07-31 | |
| CVE-2025-8378 | Campcodes Online Hotel Reservation System Login index.php SQL injection | 9.8v3.1 | 0.6% | 2025-07-31 | |
| CVE-2025-8376 | code-projects Vehicle Management updatebal.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-31 | |
| CVE-2025-8375 | code-projects Vehicle Management addvehicle.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-31 | |
| CVE-2025-8374 | code-projects Vehicle Management addcompany.php SQL injection | 9.8v3.1 | 0.4% | 2025-07-31 | |
| CVE-2025-8373 | code-projects Vehicle Management print.php SQL injection | 9.8v3.1 | 0.4% | 2025-07-31 | |
| CVE-2025-8372 | code-projects Exam Form Submission update_s7.php SQL injection | 9.8v3.1 | 0.4% | 2025-07-31 | |
| CVE-2025-8371 | code-projects Exam Form Submission update_s5.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-31 | |
| CVE-2025-8370 | Portabilis i-Educar educar_escolaridade_lst.php cross-site scripting | 6.1v3.1 | 0.5% | 2025-07-31 | |
| CVE-2025-8369 | Portabilis i-Educar educar_avaliacao_desempenho_lst.php cross-site scripting | 6.1v3.1 | 0.5% | 2025-07-31 | |
| CVE-2025-8368 | Portabilis i-Educar pesquisa_pessoa_lst.php cross-site scripting | 6.1v3.1 | 0.5% | 2025-07-31 | |
| CVE-2025-8367 | Portabilis i-Educar funcionario_vinculo_lst.php cross-site scripting | 6.1v3.1 | 0.4% | 2025-07-31 | |
| CVE-2025-8366 | Portabilis i-Educar educar_servidor_lst.php cross-site scripting | 6.1v3.1 | 0.4% | 2025-07-31 | |
| CVE-2025-8365 | Portabilis i-Educar atendidos_cad.php cross-site scripting | 6.1v3.1 | 0.3% | 2025-07-31 | |
| CVE-2025-8348 | Kehua Charging Pile Cloud Platform home improper authentication | 7.5v3.1 | 0.6% | 2025-07-31 | |
| CVE-2025-8347 | Kehua Charging Pile Cloud Platform findAllTask SQL injection | 6.5v3.1 | 0.3% | 2025-07-31 | |
| CVE-2025-8346 | Portabilis i-Educar educar_aluno_lst.php cross-site scripting | 6.1v3.1 | 0.4% | 2025-07-31 | |
| CVE-2025-8345 | Shanghai Lingdang Information Technology Lingdang CRM yunzhijiaApi.php delete_user SQL injection | 9.8v3.1 | 0.3% | 2025-07-31 | |
| CVE-2025-8344 | openviglet shio ShStaticFileAPI.java shStaticFileUpload unrestricted upload | 9.8v3.1 | 0.4% | 2025-07-31 | |
| CVE-2025-8343 | openviglet shio ShStaticFileAPI.java shStaticFilePreUpload path traversal | 9.8v3.1 | 0.9% | 2025-07-31 | |
| CVE-2025-8340 | code-projects Intern Membership Management System email field cross-site scripting | 6.1v3.1 | 0.5% | 2025-07-31 | |
| CVE-2025-8339 | code-projects Intern Membership Management System student_login.php SQL injection | 9.8v3.1 | 0.6% | 2025-07-31 | |
| CVE-2025-8338 | Projectworlds Online Admission System adminac.php SQL injection | 9.8v3.1 | 0.4% | 2025-07-31 | |
| CVE-2025-8286 | Güralp Systems FMUS Series and MIN Series Devices | 9.3CNA v4.0 | 1.3% | 2025-07-31 | Nuclei |
| CVE-2025-8213 | NinjaScanner Virus and Malware scan WordPress plugin arbitrary file deletion | 7.2CNA v3.1 | 0.5% | 2025-07-31 | Fix |
| CVE-2025-8192 | Android TV race condition in AndroidTV TvSettings | 6.9CNA v4.0 | 0.1% | 2025-07-31 | |
| CVE-2025-8151 | HT Mega WordPress plugin path traversal | 4.3CNA v3.1 | 0.4% | 2025-07-31 | Fix |
| CVE-2025-8068 | HT Mega WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.3% | 2025-07-31 | Fix |
| CVE-2025-7847 | AI Engine - Authenticated (Subscriber+) arbitrary file upload | 8.8CNA v3.1 | 1.1% | 2025-07-31 | Exploit codeFix |
| CVE-2025-7738 | Ansible django-ansible-base cleartext storage of sensitive information | 4.4CNA v3.1 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-7205 | GiveWP Donation Plugin and Fundraising Platform WordPress plugin stored cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-07-31 | Fix |
| CVE-2025-5720 | Customer Reviews for WooCommerce WordPress plugin unauthenticated stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-07-31 | Fix |
| CVE-2025-2813 | Phoenix Contact AXL F BK PN TPS HTTP service DoS | 7.5CNA v3.1 | 0.6% | 2025-07-31 | Fix |
| CVE-2025-54656 | Apache Struts Extras: Improper output neutralization for logs | 6.5CISA ADP v3.1 | 0.6% | 2025-07-30 | |
| CVE-2025-54586 | finos git-proxy GitProxy is susceptible to a hidden commits injection attack | 7.1CNA v3.1 | 0.4% | 2025-07-30 | Fix |
| CVE-2025-54585 | finos git-proxy GitProxy is vulnerable to a new branch approval exploit | 8.2CNA v4.0 | 0.4% | 2025-07-30 | Fix |
| CVE-2025-54584 | finos git-proxy GitProxy is vulnerable to a packfile parsing exploit | 7.0CNA v4.0 | 0.5% | 2025-07-30 | Fix |
| CVE-2025-54583 | finos git-proxy GitProxy bypasses approvals when pushing multiple branches | 8.3CNA v4.0 | 0.5% | 2025-07-30 | Fix |
| CVE-2025-54581 | vproxy is vulnerable to a divide by zero DoS attack | 7.5CNA v3.1 | 0.6% | 2025-07-30 | Fix |
| CVE-2025-54576 | OAuth2 Proxy skip_auth_routes authentication bypass | 9.1CNA v3.1 | 1.2% | 2025-07-30 | Fix |
| CVE-2025-54575 | SixLabors ImageSharp GIF decoder denial of service | 5.3CNA v3.1 | 0.4% | 2025-07-30 | Fix |
| CVE-2025-54573 | Cvat vulnerable to email verification bypass by use of basic authentication | 4.3CNA v3.1 | 0.3% | 2025-07-30 | Fix |
| CVE-2025-54572 | SAML-Toolkits ruby-saml ruby SAML DOS vulnerability with large SAML response | 6.9CNA v4.0 | 0.4% | 2025-07-30 | Fix |
| CVE-2025-54433 | Bugsink is vulnerable to path traversal attacks via event_id in ingestion | 7.2CNA v4.0 | 0.6% | 2025-07-30 | Fix |
| CVE-2025-54430 | dedupe is vulnerable to secret exfiltration via `issue_comment` | 9.1CNA v3.1 | 0.3% | 2025-07-30 | Exploit code |
| CVE-2025-54425 | Umbraco's Delivery API allows for cached requests to be returned with an invalid API key | 5.3CNA v3.1 | 0.3% | 2025-07-30 | Fix |
| CVE-2025-54410 | Moby's Firewalld reload removes bridge network isolation | 3.3CNA v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-54388 | Moby's Firewalld reload makes published container ports accessible from remote hosts | 5.1CNA v4.0 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-53944 | AutoGPT Platform exposes Graph Execution results via Authorization Gap | 7.7CNA v3.1 | 0.5% | 2025-07-30 | Fix |
| CVE-2025-53357 | GLPI permits reservation modification by unauthorized users | 5.4CNA v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-53113 | GLPI technicians can access unauthorized information through external links | 2.7CNA v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-53112 | GLPI's incomprehensive permission checks can lead to data removal from allowed users | 4.3CNA v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-53111 | GLPI exposes data to non-allowed users | 6.5CNA v3.1 | 0.3% | 2025-07-30 | Fix |
| CVE-2025-53022 | TrustedFirmware-M firmware upgrade module stack-based buffer overflow | 8.6CISA ADP v3.1 | 0.4% | 2025-07-30 | |
| CVE-2025-53008 | GLPI's MailCollector Receiver is vulnerable to credential exfiltration | 6.5CNA v3.1 | 0.3% | 2025-07-30 | Fix |
| CVE-2025-52897 | GLPI is vulnerable to XSS and open redirection attacks through planning feature | 6.5CNA v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-52567 | GLPI has overly permissive URL verification | 3.5CNA v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-52187 | Getprojects Create School Management System cross-site scripting | 8.2CISA ADP v3.1 | 0.4% | 2025-07-30 | |
| CVE-2025-51954 | Electronhub AI Playground cross-site scripting | 6.1CISA ADP v3.1 | 0.4% | 2025-07-30 | |
| CVE-2025-51951 | Andisearch cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-07-30 | |
| CVE-2025-50777 | Aziot 2MP Full Hd Smart Wi-fi Cctv Home Security Camera cleartext storage of sensitive information | 7.8CISA ADP v3.1 | 0.2% | 2025-07-30 | Exploit code |
| CVE-2025-50578 | LinuxServer Docker-heimdall open redirect | 9.8CISA ADP v3.1 | 2.8% | 2025-07-30 | Nuclei |
| CVE-2025-50464 | Iptime Nas Firmware upload.cgi module of the iptime buffer overflow | 6.5CISA ADP v3.1 | 0.5% | 2025-07-30 | |
| CVE-2025-47001 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2025-07-30 | Fix |
| CVE-2025-46811 | SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint | 9.3CNA v4.0 | 10.9% | 2025-07-30 | Exploit codeFix |
| CVE-2025-45620 | Averusa PTC310UV2 information disclosure | 8.1CISA ADP v3.1 | 0.7% | 2025-07-30 | Exploit code |
| CVE-2025-45619 | Averusa PTC310UV2 Firmware command injection | 6.5CISA ADP v3.1 | 0.7% | 2025-07-30 | Exploit code |
| CVE-2025-43277 | Apple macOS memory corruption | 7.8CISA ADP v3.1 | 0.3% | 2025-07-30 | Fix |
| CVE-2025-43276 | Apple macOS time-of-check time-of-use race condition | 5.3v3.1 | 0.4% | 2025-07-30 | Fix |
| CVE-2025-43275 | Apple macOS race condition | 9.8CISA ADP v3.1 | 0.6% | 2025-07-30 | Fix |
| CVE-2025-43274 | Apple macOS missing encryption | 4.4CISA ADP v3.1 | 0.1% | 2025-07-30 | Fix |
| CVE-2025-43273 | Apple macOS insecure permissions | 9.1CISA ADP v3.1 | 0.6% | 2025-07-30 | Fix |
| CVE-2025-43270 | Apple macOS unauthorized access | 8.8CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43267 | Apple macOS injection | 5.5CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43266 | Apple macOS incorrect permission assignment | 5.1CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43265 | Apple Safari out-of-bounds read | 4.0CISA ADP v3.1 | 0.3% | 2025-07-30 | Fix |
| CVE-2025-43261 | Apple macOS logic flaw | 9.8CISA ADP v3.1 | 0.8% | 2025-07-30 | Fix |
| CVE-2025-43260 | Apple macOS incorrect privilege assignment | 5.1CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43259 | Apple macOS personal information exposure | 4.6CISA ADP v3.1 | 0.3% | 2025-07-30 | Fix |
| CVE-2025-43256 | Apple macOS improper privilege management | 7.8CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43254 | Apple macOS out-of-bounds read | 7.1CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43253 | Apple macOS improper input validation | 9.8CISA ADP v3.1 | 0.7% | 2025-07-30 | Fix |
| CVE-2025-43252 | Apple macOS link following | 6.5CISA ADP v3.1 | 0.5% | 2025-07-30 | Fix |
| CVE-2025-43251 | Apple macOS incorrect authorization | 5.5CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43250 | Apple macOS path traversal | 4.0CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43249 | Apple macOS improper privilege management | 7.8CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43248 | Apple macOS improper privilege management | 7.8CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43247 | Apple macOS incorrect permission assignment | 5.5CISA ADP v3.1 | 0.5% | 2025-07-30 | Fix |
| CVE-2025-43246 | Apple macOS information disclosure | 5.5CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43245 | Apple macOS authentication bypass by spoofing | 9.8CISA ADP v3.1 | 0.7% | 2025-07-30 | Fix |
| CVE-2025-43244 | Apple macOS race condition | 9.8CISA ADP v3.1 | 0.6% | 2025-07-30 | Fix |
| CVE-2025-43243 | Apple macOS incorrect permission assignment | 9.8CISA ADP v3.1 | 0.7% | 2025-07-30 | Fix |
| CVE-2025-43241 | Apple macOS insecure permissions | 5.5CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43240 | Apple Safari logic flaw | 6.2CISA ADP v3.1 | 1.0% | 2025-07-30 | Fix |
| CVE-2025-43239 | Apple macOS out-of-bounds read | 7.1CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43237 | Apple macOS out-of-bounds write | 9.8CISA ADP v3.1 | 0.5% | 2025-07-30 | Fix |
| CVE-2025-43235 | Apple macOS denial of service | 5.5CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43234 | Apple macOS memory corruption | 9.8CISA ADP v3.1 | 1.0% | 2025-07-30 | Fix |
| CVE-2025-43233 | Apple macOS improper access control | 9.8CISA ADP v3.1 | 0.7% | 2025-07-30 | Fix |
| CVE-2025-43232 | Apple macOS insecure permissions | 9.8CISA ADP v3.1 | 0.7% | 2025-07-30 | Fix |
| CVE-2025-43230 | Apple iPadOS incorrect authorization | 4.0CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43229 | Apple Safari cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-07-30 | Fix |
| CVE-2025-43228 | Apple Safari UI misrepresentation | 4.3CISA ADP v3.1 | 0.9% | 2025-07-30 | Fix |
| CVE-2025-43227 | Apple Safari personal information exposure | 7.5CISA ADP v3.1 | 1.2% | 2025-07-30 | Fix |
| CVE-2025-43226 | Apple iPadOS out-of-bounds read | 4.0CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43225 | Apple iPadOS sensitive information in log files | 5.5CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43224 | Apple macOS out-of-bounds write | 7.1CISA ADP v3.1 | 0.3% | 2025-07-30 | Fix |
| CVE-2025-43223 | Apple iPadOS denial of service | 7.5CISA ADP v3.1 | 1.0% | 2025-07-30 | Fix |
| CVE-2025-43222 | Apple iPadOS use-after-free | 9.8CISA ADP v3.1 | 0.8% | 2025-07-30 | Fix |
| CVE-2025-43221 | Apple macOS out-of-bounds read | 7.1CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43220 | Apple iPadOS link following | 9.8CISA ADP v3.1 | 0.8% | 2025-07-30 | Fix |
| CVE-2025-43218 | Apple macOS out-of-bounds read | 5.5CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43217 | Apple iPadOS personal information exposure | 4.0CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43216 | Apple Safari use-after-free | 6.5CISA ADP v3.1 | 1.1% | 2025-07-30 | Fix |
| CVE-2025-43215 | Apple macOS information disclosure | 5.5CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43212 | Apple Safari memory corruption | 6.5CISA ADP v3.1 | 1.0% | 2025-07-30 | Fix |
| CVE-2025-43211 | Apple Safari resource exhaustion | 6.2CISA ADP v3.1 | 0.4% | 2025-07-30 | Fix |
| CVE-2025-43209 | Apple iPadOS out-of-bounds write | 9.8CISA ADP v3.1 | 0.9% | 2025-07-30 | Fix |
| CVE-2025-43206 | Apple macOS path traversal | 4.0CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43199 | Apple macOS improper privilege management | 9.8CISA ADP v3.1 | 0.8% | 2025-07-30 | Fix |
| CVE-2025-43198 | Apple macOS improper access control | 9.8CISA ADP v3.1 | 0.6% | 2025-07-30 | Fix |
| CVE-2025-43197 | Apple macOS incorrect authorization | 4.0CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43196 | Apple macOS path traversal | 7.8CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43195 | Apple macOS information disclosure | 5.5CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43194 | Apple macOS improper access control | 9.8CISA ADP v3.1 | 0.8% | 2025-07-30 | Fix |
| CVE-2025-43193 | Apple macOS denial of service | 9.8CISA ADP v3.1 | 0.8% | 2025-07-30 | Fix |
| CVE-2025-43192 | Apple macOS improper access control | 9.8CISA ADP v3.1 | 0.7% | 2025-07-30 | Fix |
| CVE-2025-43191 | Apple macOS path traversal | 6.2CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43189 | Apple macOS information disclosure | 9.8CISA ADP v3.1 | 0.8% | 2025-07-30 | Fix |
| CVE-2025-43188 | Apple macOS improper privilege management | 7.8CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43186 | Apple macOS memory corruption | 9.8CISA ADP v3.1 | 1.1% | 2025-07-30 | Fix |
| CVE-2025-43185 | Apple macOS improper signature verification | 5.5CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-43184 | Apple macOS improper access control | 9.8CISA ADP v3.1 | 0.7% | 2025-07-30 | Fix |
| CVE-2025-43018 | Certain HP LaserJet Pro Printers potential information disclosure | 6.9CNA v4.0 | 0.3% | 2025-07-30 | Fix |
| CVE-2025-38498 | Linux kernel mount namespace propagation vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-36611 | Dell Encryption link following | 7.3CNA v3.1 | 0.1% | 2025-07-30 | Fix |
| CVE-2025-36609 | Dell SmartFabric OS10 Software hard-coded password | 2.5CNA v3.1 | 0.1% | 2025-07-30 | Fix |
| CVE-2025-36608 | Dell SmartFabric OS10 Software XML external entity injection | 6.5CNA v3.1 | 0.5% | 2025-07-30 | Fix |
| CVE-2025-31281 | Apple macOS improper input validation | 9.1CISA ADP v3.1 | 1.1% | 2025-07-30 | Fix |
| CVE-2025-31280 | Apple macOS heap-based buffer overflow | 7.8CISA ADP v3.1 | 0.3% | 2025-07-30 | Fix |
| CVE-2025-31279 | Apple iPadOS insecure permissions | 9.8CISA ADP v3.1 | 1.0% | 2025-07-30 | Fix |
| CVE-2025-31278 | Apple Safari memory corruption | 8.8CISA ADP v3.1 | 1.2% | 2025-07-30 | Fix |
| CVE-2025-31276 | Apple iPadOS personal information exposure | 5.3CISA ADP v3.1 | 0.4% | 2025-07-30 | Fix |
| CVE-2025-31275 | Apple macOS improper handling of insufficient privileges | 6.2CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-31273 | Apple Safari memory corruption | 8.8CISA ADP v3.1 | 1.1% | 2025-07-30 | Fix |
| CVE-2025-31243 | Apple macOS improper privilege management | 7.8CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-31229 | Apple iOS and iPadOS weak password encoding | 9.1CISA ADP v3.1 | 0.8% | 2025-07-30 | Fix |
| CVE-2025-30480 | Dell PowerProtect Data Manager improper input validation | 6.5CNA v3.1 | 0.4% | 2025-07-30 | Fix |
| CVE-2025-30105 | Dell XtremIO sensitive information in log files | 8.8CNA v3.1 | 0.1% | 2025-07-30 | Fix |
| CVE-2025-30103 | Dell SmartFabric OS10 Software files accessible to external parties | 5.5CNA v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-26332 | Dell TechAdvisor sensitive information in log files | 8.8CNA v3.1 | 0.1% | 2025-07-30 | Fix |
| CVE-2025-25692 | PrestaShop _getHeaders function deserialization of untrusted data | 6.5CISA ADP v3.1 | 0.6% | 2025-07-30 | |
| CVE-2025-25691 | PrestaShop component /themes/import deserialization of untrusted data | 6.5CISA ADP v3.1 | 0.8% | 2025-07-30 | |
| CVE-2025-25011 | Beats uncontrolled search path element can lead to local privilege escalation when | 7.0CNA v3.1 | 0.1% | 2025-07-30 | Fix |
| CVE-2025-24224 | Apple iPadOS improper check for exceptional conditions | 7.5CISA ADP v3.1 | 1.2% | 2025-07-30 | Fix |
| CVE-2025-24188 | Apple Safari logic flaw | 6.5CISA ADP v3.1 | 0.6% | 2025-07-30 | Fix |
| CVE-2025-24119 | Apple macOS improper privilege management | 7.8CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-8353 | Devolutions Server unauthorized access | 5.9CISA ADP v3.1 | 0.4% | 2025-07-30 | Fix |
| CVE-2025-8337 | code-projects Simple Car Rental System add_vehicles.php cross-site scripting | 5.4v3.1 | 0.2% | 2025-07-30 | |
| CVE-2025-8336 | Campcodes Online Recruitment Management System ajax.php SQL injection | 9.8v3.1 | 0.4% | 2025-07-30 | |
| CVE-2025-8335 | code-projects Simple Car Rental System cross-site request forgery | 5.3CNA v4.0 | 0.2% | 2025-07-30 | |
| CVE-2025-8334 | Campcodes Online Recruitment Management System ajax.php SQL injection | 9.8v3.1 | 0.4% | 2025-07-30 | |
| CVE-2025-8333 | code-projects Online Farm System categoryvalue.php SQL injection | 9.8v3.1 | 0.4% | 2025-07-30 | |
| CVE-2025-8332 | code-projects Online Farm System register.php SQL injection | 9.8v3.1 | 0.4% | 2025-07-30 | |
| CVE-2025-8331 | code-projects Online Farm System forgot_pass.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-30 | |
| CVE-2025-8330 | code-projects Vehicle Management edit1.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-30 | |
| CVE-2025-8329 | code-projects Vehicle Management filter3.php SQL injection | 9.8v3.1 | 0.7% | 2025-07-30 | |
| CVE-2025-8328 | code-projects Exam Form Submission register.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-30 | |
| CVE-2025-8327 | code-projects Exam Form Submission delete_s8.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-30 | |
| CVE-2025-8326 | code-projects Exam Form Submission delete_s7.php SQL injection | 9.8v3.1 | 0.4% | 2025-07-30 | |
| CVE-2025-8323 | Ventem|e-School arbitrary file upload | 8.7CNA v4.0 | 0.6% | 2025-07-30 | Fix |
| CVE-2025-8322 | Ventem|e-School missing authorization | 8.7CNA v4.0 | 0.4% | 2025-07-30 | Fix |
| CVE-2025-8321 | Tesla Wall Connector arbitrary code execution | 6.8CNA v3.0 | 0.4% | 2025-07-30 | |
| CVE-2025-8320 | Tesla Wall Connector Content-Length header improper input validation remote code execution | 8.8CNA v3.0 | 0.3% | 2025-07-30 | |
| CVE-2025-8319 | Barracuda Message Archiver cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-8312 | Devolutions Server PAM automatic check-in feature deadlock | 7.1CISA ADP v3.1 | 0.3% | 2025-07-30 | Fix |
| CVE-2025-8292 | Google Chrome Media Stream use-after-free | 8.8CISA ADP v3.1 | 0.4% | 2025-07-30 | Fix |
| CVE-2025-8217 | Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension | 5.1CNA v4.0 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-6348 | Smart Slider 3 WordPress plugin SQL injection | 4.9CNA v3.1 | 0.4% | 2025-07-30 | Fix |
| CVE-2025-4426 | Insyde Software InsydeH2O SMM module information disclosure | 6.0CNA v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-4425 | Insyde Software InsydeH2O SetupAutomationSmm: Stack overflow vulnerability in SMI handler | 8.2CNA v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-4424 | Insyde Software InsydeH2O SMI handler improper input validation | 6.0CNA v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-4423 | Insyde Software InsydeH2O SMM module memory corruption | 8.2CNA v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-4422 | Insyde Software InsydeH2O SMM module out-of-bounds write | 8.2CNA v3.1 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-4421 | Insyde Software InsydeH2O SMM module out-of-bounds write | 8.2CNA v3.1 | 0.3% | 2025-07-30 | Fix |
| CVE-2025-1394 | Denial of service (DoS) vulnerabilitiey in Zigbee library | 5.9CNA v4.0 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-1221 | DoS in Zigbee device due to heavy traffic | 5.9CNA v4.0 | 0.2% | 2025-07-30 | Fix |
| CVE-2025-0712 | APM Server uncontrolled search path element can lead to local privilege escalation when | 7.0CNA v3.1 | 0.1% | 2025-07-30 | |
| CVE-2025-54769 | KL-001-2025-016: Xorux LPAR2RRD file upload directory traversal | 8.8CISA ADP v3.1 | 3.3% | 2025-07-29 | Exploit codeFix |
| CVE-2025-54768 | KL-001-2025-015: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information | 5.3CISA ADP v3.1 | 4.6% | 2025-07-29 | Fix |
| CVE-2025-54767 | KL-001-2025-014: Xorux LPAR2RRD Read Only User denial of service | 6.5CISA ADP v3.1 | 6.7% | 2025-07-29 | Fix |
| CVE-2025-54766 | Xorux XorMon-NG configuration export API information disclosure | 5.3CISA ADP v3.1 | 8.0% | 2025-07-29 | Fix |
| CVE-2025-54765 | KL-001-2025-013: Xorux XorMon-NG Web application privilege escalation to Administrator | 5.3CISA ADP v3.1 | 8.0% | 2025-07-29 | Fix |
| CVE-2025-54422 | Sandboxie exposes encrypted sandbox key during password change | 6.9CNA v4.0 | 0.1% | 2025-07-29 | Fix |
| CVE-2025-54381 | BentoML is vulnerable to an SSRF Attack through file upload Processing | 9.9CNA v3.1 | 16.1% | 2025-07-29 | Exploit codeFix |
| CVE-2025-54126 | Bytecode Alliance WebAssembly Micro Runtime iwasm address pool option improper access control | 6.9CNA v4.0 | 0.6% | 2025-07-29 | Fix |
| CVE-2025-53902 | Tuleap exposes artifacts to a mentioned user via email notifications | 4.3CNA v3.1 | 0.3% | 2025-07-29 | Fix |
| CVE-2025-53715 | TP-Link TL-WR841N Wan6to4TunnelCfgRpm.htm buffer overflow | 6.9CNA v4.0 | 0.3% | 2025-07-29 | |
| CVE-2025-53714 | TP-Link TL-WR841N WzdWlanSiteSurveyRpm_AP.htm buffer overflow | 6.9CNA v4.0 | 0.3% | 2025-07-29 | |
| CVE-2025-53713 | TP-Link TL-WR841N WlanNetworkRpm_APC.htm buffer overflow | 6.9CNA v4.0 | 0.3% | 2025-07-29 | |
| CVE-2025-53712 | TP-Link TL-WR841N WlanNetworkRpm_AP.htm buffer overflow | 6.9CNA v4.0 | 0.3% | 2025-07-29 | |
| CVE-2025-53711 | TP-Link TL-WR841N, TL-WR842ND and TL-WR949N WlanNetworkRpm.htm buffer overflow | 6.9CNA v4.0 | 0.3% | 2025-07-29 | |
| CVE-2025-53649 | SwitchBot App sensitive information in log files | 5.9CNA v4.0 | 0.1% | 2025-07-29 | |
| CVE-2025-53541 | Tuleap is vulnerable to XSS attacks when displaying the children of a parent artifact | 5.4CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-53102 | Discourse's WebAuthn challenge isn't cleared from user session after authentication | 8.2CNA v4.0 | 0.5% | 2025-07-29 | Fix |
| CVE-2025-53082 | Samsung Electronics Data Management Server Samsung DMS( arbitrary file deletion | 6.1CNA v3.1 | 0.5% | 2025-07-29 | Fix |
| CVE-2025-53081 | Samsung Electronics Data Management Server Samsung DMS( arbitrary file write | 6.4CNA v3.1 | 0.4% | 2025-07-29 | Fix |
| CVE-2025-53080 | Samsung Electronics Data Management Server path traversal | 7.1CNA v3.1 | 0.3% | 2025-07-29 | Fix |
| CVE-2025-53079 | Samsung Electronics Data Management Server Samsung DMS( absolute path traversal | 4.9CNA v3.1 | 0.5% | 2025-07-29 | Fix |
| CVE-2025-53078 | Samsung Electronics Data Management Server Samsung DMS( deserialization of untrusted data | 8.0CNA v3.1 | 0.4% | 2025-07-29 | Fix |
| CVE-2025-53077 | An execution after redirect in Samsung DMS(Data Management Server) allows attackers to execute limited functions without permissions. An attacker could compromise the integrity of the platform by executing this vulnerability. | 6.5CNA v3.1 | 0.3% | 2025-07-29 | Fix |
| CVE-2025-52899 | Tuleap vulnerable to user enumeration via the lost password form | 5.3CNA v3.1 | 0.3% | 2025-07-29 | Fix |
| CVE-2025-52490 | Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output | 7.3CISA ADP v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-52358 | Vivaldigroup Icontrol+ Server Vivaldi United Group cross-site scripting | 6.3CISA ADP v3.1 | 0.3% | 2025-07-29 | |
| CVE-2025-52284 | TOTOLINK X6000R command injection | 6.5CISA ADP v3.1 | 2.3% | 2025-07-29 | |
| CVE-2025-51970 | PuneethReddyHC online-shopping-system-advanced action.php endpoint SQL injection | 7.7CISA ADP v3.1 | 0.2% | 2025-07-29 | Exploit code |
| CVE-2025-51045 | PHPGurukul Pre-School Enrollment System SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2025-07-29 | |
| CVE-2025-51044 | PHPGurukul Nipah Virus Testing Management System SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2025-07-29 | |
| CVE-2025-50738 | Memos has cross-site scripting (XSS) vulnerability in Image URLs | 9.8CISA ADP v3.1 | 2.4% | 2025-07-29 | NucleiFix |
| CVE-2025-46059 | langchain-ai GmailToolkit code injection | 9.8CISA ADP v3.1 | 0.7% | 2025-07-29 | |
| CVE-2025-45346 | Bacula-web SQL injection | 8.1CISA ADP v3.1 | 0.7% | 2025-07-29 | Fix |
| CVE-2025-44137 | Maptiler Tileserver PHP path traversal | 8.2CISA ADP v3.1 | 1.4% | 2025-07-29 | Nuclei |
| CVE-2025-44136 | Maptiler Tileserver PHP cross-site scripting | 9.8CISA ADP v3.1 | 2.5% | 2025-07-29 | Nuclei |
| CVE-2025-43214 | Apple Safari buffer overflow | 6.5CISA ADP v3.1 | 1.0% | 2025-07-29 | Fix |
| CVE-2025-43213 | Apple Safari buffer overflow | 6.5CISA ADP v3.1 | 0.7% | 2025-07-29 | Fix |
| CVE-2025-41241 | VMware vCenter denial of service | 4.4CNA v3.1 | 0.3% | 2025-07-29 | Fix |
| CVE-2025-40686 | Reflected cross-site scripting (XSS) vulnerability in Human Resource Management System | 6.1v3.1 | 0.2% | 2025-07-29 | |
| CVE-2025-40685 | Reflected cross-site scripting (XSS) vulnerability in Human Resource Management System | 6.1v3.1 | 0.2% | 2025-07-29 | |
| CVE-2025-40684 | Reflected cross-site scripting (XSS) vulnerability in Human Resource Management System | 6.1v3.1 | 0.2% | 2025-07-29 | |
| CVE-2025-40683 | Reflected cross-site scripting (XSS) vulnerability in Human Resource Management System | 6.1v3.1 | 0.2% | 2025-07-29 | |
| CVE-2025-40682 | SQL injection vulnerability in Human Resource Management System | 9.8v3.1 | 0.3% | 2025-07-29 | |
| CVE-2025-40600 | SonicWall SonicOS format string | 9.8CISA ADP v3.1 | 0.9% | 2025-07-29 | Fix |
| CVE-2025-36071 | IBM Db2 denial of service | 6.5CNA v3.1 | 0.3% | 2025-07-29 | Fix |
| CVE-2025-36010 | IBM Db2 for Linux denial of service | 6.5CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-33114 | IBM Db2 for Linux denial of service | 5.3CNA v3.1 | 0.3% | 2025-07-29 | Fix |
| CVE-2025-33092 | IBM Db2 for Linux code execution | 7.8CNA v3.1 | 0.1% | 2025-07-29 | Fix |
| CVE-2025-31965 | HCL BigFix Remote Control is affected by an authorization bypass | 8.2CNA v3.1 | 0.2% | 2025-07-29 | |
| CVE-2025-31277 | Apple Multiple Products buffer overflow | 8.8CISA ADP v3.1 | 1.7% | 2025-07-29 | KEVKCVFix |
| CVE-2025-28172 | Grandstream UCM6510 missing brute-force protection | 6.5CISA ADP v3.1 | 0.3% | 2025-07-29 | |
| CVE-2025-28171 | Grandstream UCM6510 insecure storage of sensitive information | 6.5CISA ADP v3.1 | 0.3% | 2025-07-29 | |
| CVE-2025-28170 | Grandstream GXP1628 directory listing | 7.6CISA ADP v3.1 | 0.3% | 2025-07-29 | |
| CVE-2025-27514 | GLPI is susceptible to stored XSS attack through project's kanban | 4.5CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-26400 | SolarWinds Web Help Desk XML external entity injection (XXE) | 5.3CNA v3.1 | 0.3% | 2025-07-29 | Fix |
| CVE-2025-8264 | z-push/z-push-dev SQL injection | 9.1CNA v4.0 | 0.4% | 2025-07-29 | Fix |
| CVE-2025-8216 | Sky Addons for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-8196 | Magical Addons For Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-7849 | Memory corruption Issue in NI LabVIEW due to improper error handling | 8.5CNA v4.0 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-7848 | Missing input check in lvpict.cpp used in NI LabVIEW | 8.5CNA v4.0 | 5.7% | 2025-07-29 | Fix |
| CVE-2025-7811 | StreamWeasels YouTube Integration WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-7810 | StreamWeasels Kick Integration WordPress plugin stored cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-7809 | StreamWeasels Twitch Integration WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-7689 | Hydra Booking - missing authorization to Authenticated privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-07-29 | Fix |
| CVE-2025-7675 | Autodesk Shared Components 3DM File Parsing out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-7497 | Autodesk Shared Components PRT File Parsing out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-7458 | SQLite integer overflow in key info allocation may lead to information disclosure | 9.1NVD v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-7361 | Code injection vulnerability in NI LabVIEW when using CIN nodes | 8.5CNA v4.0 | 0.3% | 2025-07-29 | Fix |
| CVE-2025-6730 | Bonanza WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.2% | 2025-07-29 | |
| CVE-2025-6692 | YouTube Embed WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-07-29 | |
| CVE-2025-6681 | Fan Page WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-07-29 | |
| CVE-2025-6637 | Autodesk Shared Components PRT File Parsing out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-6636 | Autodesk Shared Components PRT File Parsing use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-6635 | Autodesk Shared Components PRT File Parsing out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-6631 | Autodesk Shared Components PRT File Parsing out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-6505 | Progress Software Hybrid Data Pipeline improper authentication | 8.1CNA v3.1 | 0.3% | 2025-07-29 | Fix |
| CVE-2025-6504 | Progress Software Hybrid Data Pipeline possibilities of IP spoofing via X-Forwarded-For (XFF) header | 8.4CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-6495 | Bricks Builder WordPress theme unauthenticated SQL injection via `p` parameter | 7.5CNA v3.1 | 0.5% | 2025-07-29 | Fix |
| CVE-2025-6175 | CRLF injection in DECE Software's Geodi | 7.2CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-6060 | XSS in DECE Software's Geodi | 5.4CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-5922 | Retrievable password hash protecting TSplus admin console | 4.8CNA v4.0 | 0.1% | 2025-07-29 | Fix |
| CVE-2025-5684 | MetForm WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-5587 | Appzend WordPress theme stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-07-29 | Fix |
| CVE-2025-5043 | Autodesk Shared Components 3DM File Parsing heap-based overflow | 7.8CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-5038 | Autodesk Shared Components X_T File Parsing memory corruption | 7.8CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-4674 | Unexpected command execution in untrusted VCS repositories in cmd/go | 8.6CISA ADP v3.1 | 0.4% | 2025-07-29 | Fix |
| CVE-2025-4566 | Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-4370 | Brizy WordPress plugin missing authorization to unauthenticated limited file upload | 5.3CNA v3.1 | 0.3% | 2025-07-29 | Fix |
| CVE-2025-3075 | Elementor WordPress plugin authenticated (Contributor+) stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-07-29 | Fix |
| CVE-2025-2928 | Genetec Security Center SQL injection | 7.2CNA v3.1 | 0.4% | 2025-07-29 | Fix |
| CVE-2025-2533 | IBM Db2 for Linux denial of service | 5.3CNA v3.1 | 0.3% | 2025-07-29 | Fix |
| CVE-2025-2179 | GlobalProtect App: Non Admin User can Disable the GlobalProtect App | 6.8CNA v4.0 | 0.1% | 2025-07-29 | Fix |
| CVE-2025-54569 | Malwarebytes Binisoft Windows Firewall Control incorrect authorization | 4.5CNA v3.1 | 0.1% | 2025-07-28 | Fix |
| CVE-2025-54538 | JetBrains TeamCity cleartext storage of sensitive information | 5.5CNA v3.1 | 0.3% | 2025-07-28 | Fix |
| CVE-2025-54537 | JetBrains TeamCity cleartext storage of sensitive information | 5.5CNA v3.1 | 0.3% | 2025-07-28 | Fix |
| CVE-2025-54536 | JetBrains TeamCity cross-site request forgery | 5.4CNA v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-54535 | JetBrains TeamCity weak hash | 5.8CNA v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-54534 | JetBrains TeamCity cross-site scripting | 4.8CNA v3.1 | 0.8% | 2025-07-28 | Fix |
| CVE-2025-54533 | JetBrains TeamCity incorrect authorization | 4.3CNA v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-54532 | JetBrains TeamCity incorrect authorization | 4.3CNA v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-54531 | JetBrains TeamCity relative path traversal | 7.7CNA v3.1 | 0.3% | 2025-07-28 | Fix |
| CVE-2025-54530 | JetBrains TeamCity incorrect default permissions | 7.5CNA v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-54529 | JetBrains TeamCity cross-site request forgery | 3.7CNA v3.1 | 0.1% | 2025-07-28 | Fix |
| CVE-2025-54528 | JetBrains TeamCity cross-site request forgery | 5.4CNA v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-54527 | JetBrains YouTrack clickjacking | 6.1CNA v3.1 | 0.3% | 2025-07-28 | Fix |
| CVE-2025-54429 | Polkadot Frontier's constructing smart contract can bypass precompile address bounding | 6.9CNA v4.0 | 0.5% | 2025-07-28 | Fix |
| CVE-2025-54428 | musombi123 RevelaCode-Backend insufficiently protected credentials | 9.8CNA v3.1 | 0.5% | 2025-07-28 | Fix |
| CVE-2025-54427 | Polkadot Frontier gas price inherent check vulnerability | 6.9CNA v4.0 | 0.6% | 2025-07-28 | |
| CVE-2025-54426 | Polkadot Frontier contains silent failure in Curve25519 arithmetic precompiles with malformed points | 9.9CNA v4.0 | 0.3% | 2025-07-28 | Fix |
| CVE-2025-54423 | copyparty has a DOM-based XSS vulnerability when displaying multimedia metadata | 5.4CNA v3.1 | 0.4% | 2025-07-28 | Fix |
| CVE-2025-54419 | Node-SAML Contains SAML signature verification | 10.0CNA v3.1 | 0.4% | 2025-07-28 | Fix |
| CVE-2025-54418 | CodeIgniter4's ImageMagick handler has command injection | 9.8CNA v3.1 | 1.5% | 2025-07-28 | Fix |
| CVE-2025-54299 | nobossextensions.com No Boss Testimonials component for Joomla stored cross-site scripting | 9.4CNA v4.0 | 0.4% | 2025-07-28 | |
| CVE-2025-54298 | Extension firecoders.com stored XSS vulnerability in CommentBox component for Joomla | 9.4CNA v4.0 | 0.4% | 2025-07-28 | |
| CVE-2025-53696 | Johnson Controls iSTAR Ultra download without integrity check | 9.3CNA v4.0 | 0.1% | 2025-07-28 | Fix |
| CVE-2025-53695 | Johnson Controls iSTAR Ultra OS command injection | 9.4CNA v4.0 | 0.9% | 2025-07-28 | Fix |
| CVE-2025-50494 | PHPGurukul Car Washing Management System session hijacking | 7.5CISA ADP v3.1 | 0.4% | 2025-07-28 | |
| CVE-2025-50493 | PHPGurukul Doctor Appointment Management System session hijacking | 7.5CISA ADP v3.1 | 0.3% | 2025-07-28 | |
| CVE-2025-50492 | PHPGurukul e-Diary Management System session hijacking | 7.5CISA ADP v3.1 | 0.4% | 2025-07-28 | |
| CVE-2025-50491 | PHPGurukul Bank Locker Management System insufficient session expiration | 7.1CISA ADP v3.1 | 0.3% | 2025-07-28 | |
| CVE-2025-50490 | PHPGurukul Student Result Management System session hijacking | 7.5CISA ADP v3.1 | 0.4% | 2025-07-28 | |
| CVE-2025-50489 | PHPGurukul Student Result Management System session hijacking | 7.5CISA ADP v3.1 | 0.5% | 2025-07-28 | |
| CVE-2025-50488 | PHPGurukul Online Library Management System insufficient session expiration | 7.1CISA ADP v3.1 | 0.3% | 2025-07-28 | |
| CVE-2025-50487 | PHPGurukul Blood Bank and Donor Management System insufficient session expiration | 7.1CISA ADP v3.1 | 0.3% | 2025-07-28 | |
| CVE-2025-50486 | PHPGurukul e-Diary Management System insufficient session expiration | 7.1CISA ADP v3.1 | 0.3% | 2025-07-28 | |
| CVE-2025-50485 | PHPGurukul Online Course Registration insufficient session expiration | 7.1CISA ADP v3.1 | 0.3% | 2025-07-28 | |
| CVE-2025-50484 | PHPGurukul Small CRM insufficient session expiration | 7.1CISA ADP v3.1 | 0.3% | 2025-07-28 | |
| CVE-2025-43023 | HP Linux Imaging And Printing Software Use of DSA Key | 5.9CNA v4.0 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-40730 | HTML injection in Vox Media's Chorus CMS | 4.8CNA v4.0 | 0.3% | 2025-07-28 | |
| CVE-2025-38497 | Linux kernel USB gadget configfs out-of-bounds read | 7.1v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38496 | Linux kernel dm-bufio improper locking | 5.5v3.1 | 0.1% | 2025-07-28 | Fix |
| CVE-2025-38495 | Linux kernel HID core report buffer vulnerability | 8.8CNA v3.1 | 0.3% | 2025-07-28 | Fix |
| CVE-2025-38494 | Linux kernel HID core vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38493 | Linux kernel osnoise timerlat tracer buffer overflow | 5.5v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38492 | Linux kernel netfs subsystem race condition | 4.7v3.1 | 0.1% | 2025-07-28 | Fix |
| CVE-2025-38491 | Linux kernel MPTCP fallback handling vulnerability | 8.2CNA v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38490 | Linux kernel libwx Ethernet driver double free | 9.8CNA v3.1 | 0.3% | 2025-07-28 | Fix |
| CVE-2025-38489 | Linux kernel s390/bpf null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-28 | Fix |
| CVE-2025-38488 | Linux kernel SMB client message encryption use-after-free | 9.8CNA v3.1 | 0.7% | 2025-07-28 | Fix |
| CVE-2025-38487 | Linux kernel Aspeed LPC snoop driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38486 | In the Linux kernel, the following vulnerability has been resolved: soundwire: Revert "soundwire: qcom: Add set_channel_map api support" This reverts commit 7796c97df6b1b2206681a07f3c80f6023a6593d5. This patch broke Dragonboard 845c (sdm845). I see: Unexpected kernel BRK exception at EL1 | 7.8CNA v3.1 | 0.1% | 2025-07-28 | Fix |
| CVE-2025-38485 | Linux kernel fxls8962af accelerometer driver use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38484 | Linux kernel IIO backend debugfs interface out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38483 | Linux kernel das16m1 driver IRQ validation out-of-bounds read | 7.1v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38482 | Linux kernel das6402 driver IRQ validation out-of-bounds read | 7.1v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38481 | Linux kernel Comedi INSNLIST ioctl vulnerability | 5.5v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38480 | Linux kernel Comedi digital subdevice emulation vulnerability | 5.5v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38478 | Linux kernel Comedi subdevice instructions vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38477 | Linux kernel sch_qfq race condition | 7.8CNA v3.1 | 0.1% | 2025-07-28 | Fix |
| CVE-2025-38476 | Linux kernel rpl use-after-free | 9.8CNA v3.1 | 0.3% | 2025-07-28 | Fix |
| CVE-2025-38475 | Linux kernel SMC socket null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38474 | In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input. Rectify the omission. | 5.5v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38473 | Linux kernel Bluetooth L2CAP socket null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38472 | Linux kernel netfilter connection tracking vulnerability | 9.8CNA v3.1 | 0.4% | 2025-07-28 | Fix |
| CVE-2025-38471 | Linux kernel TLS socket receive queue use-after-free | 9.8CNA v3.1 | 0.4% | 2025-07-28 | Fix |
| CVE-2025-38470 | Linux kernel VLAN filtering memory leak | 7.8CNA v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38469 | Linux kernel KVM Xen schedop poll hypercall emulation vulnerability | 5.5v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-38468 | Linux kernel net/sched null pointer dereference | 5.5NVD v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-32731 | MedDream PACS Premium radiationDoseReport.php functionality reflected cross-site scripting | 6.1CNA v3.1 | 0.7% | 2025-07-28 | Emerging Threats |
| CVE-2025-30133 | Iroadau FX2 default credentials | 9.8CISA ADP v3.1 | 0.5% | 2025-07-28 | |
| CVE-2025-30126 | Marbella KR8s Dashcam FF remote control interface missing authentication | 5.3CISA ADP v3.1 | 0.3% | 2025-07-28 | |
| CVE-2025-30125 | Marbella KR8s Dashcam FF hard-coded credentials | 9.8CISA ADP v3.1 | 0.4% | 2025-07-28 | |
| CVE-2025-30124 | Marbella KR8s Dashcam FF SD card storage cleartext storage of sensitive information | 9.8CISA ADP v3.1 | 0.3% | 2025-07-28 | |
| CVE-2025-29534 | PowerStick Wave Dual-Band Wifi Extender cgi_vista.cgi OS command injection | 8.8CISA ADP v3.1 | 0.6% | 2025-07-28 | |
| CVE-2025-27802 | Stored cross-site scripting in Episerver Content Management System (CMS) Edit Preview | 4.8CNA v4.0 | 0.3% | 2025-07-28 | Fix |
| CVE-2025-27801 | Stored cross-site scripting in Episerver Content Management System (CMS) Media Selection Preview | 4.6CNA v4.0 | 0.4% | 2025-07-28 | Fix |
| CVE-2025-27800 | Stored cross-site scripting in Episerver Content Management System (CMS) Admin Dashboard | 4.8CNA v4.0 | 0.4% | 2025-07-28 | Fix |
| CVE-2025-27724 | MedDream PACS Premium login.php functionality privilege escalation | 9.8v3.1 | 0.5% | 2025-07-28 | |
| CVE-2025-26469 | MedDream PACS Premium incorrect default permissions | 9.8v3.1 | 0.5% | 2025-07-28 | |
| CVE-2025-24485 | MedDream PACS Premium cecho.php functionality server-side request forgery | 7.5v3.1 | 7.7% | 2025-07-28 | Emerging Threats |
| CVE-2025-8283 | Red Hat Enterprise Linux 10 netavark: Podman: Netavark may resolve hostnames to unexpected hosts | 3.7CNA v3.1 | 0.3% | 2025-07-28 | Fix |
| CVE-2025-8279 | Missing authentication for critical function in GitLab Language Server | 8.7CNA v3.1 | 0.4% | 2025-07-28 | Fix |
| CVE-2025-8275 | bsc Peru Cocktails App improper export of android application components | 4.8CNA v4.0 | 0.1% | 2025-07-28 | |
| CVE-2025-8274 | Campcodes Online Recruitment Management System ajax.php SQL injection | 9.8v3.1 | 0.4% | 2025-07-28 | |
| CVE-2025-8273 | code-projects Exam Form Submission update_s8.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-28 | |
| CVE-2025-8272 | code-projects Exam Form Submission update_fst.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-28 | |
| CVE-2025-8271 | code-projects Exam Form Submission delete_s3.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-28 | |
| CVE-2025-8270 | code-projects Exam Form Submission delete_s2.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-28 | |
| CVE-2025-8269 | code-projects Exam Form Submission delete_s1.php SQL injection | 9.8v3.1 | 0.6% | 2025-07-28 | |
| CVE-2025-8267 | ssrfcheck server-side request forgery | 5.3NVD v3.1 | 0.5% | 2025-07-28 | Fix |
| CVE-2025-8266 | yanyutao0402 ChanCMS collect.js getArticle deserialization | 5.3CNA v4.0 | 1.0% | 2025-07-28 | NucleiFix |
| CVE-2025-8265 | 299Ko CMS File Management view unrestricted upload | 5.1CNA v4.0 | 0.4% | 2025-07-28 | |
| CVE-2025-8262 | yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos | 7.5v3.1 | 0.7% | 2025-07-28 | |
| CVE-2025-8261 | Vaelsys VaelsysV4 User Creation vgrid_server.php improper authorization | 9.8v3.1 | 0.6% | 2025-07-28 | |
| CVE-2025-8260 | Vaelsys VaelsysV4 Web interface vgrid_server.php weak hash | 7.5v3.1 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-8259 | Vaelsys VaelsysV4 Web interface vgrid_server.php execute_DataObjectProc os command injection | 9.8v3.1 | 3.2% | 2025-07-28 | Fix |
| CVE-2025-8258 | Cool Mo Maigcal Number App improper export of android application components | 4.8CNA v4.0 | 0.2% | 2025-07-28 | |
| CVE-2025-8257 | Lobby Universe Lobby App improper export of android application components | 4.8CNA v4.0 | 0.2% | 2025-07-28 | |
| CVE-2025-8256 | code-projects Online Ordering System product.php unrestricted upload | 9.8v3.1 | 0.4% | 2025-07-28 | |
| CVE-2025-8255 | code-projects Exam Form Submission register.php unrestricted upload | 9.8v3.1 | 0.6% | 2025-07-28 | |
| CVE-2025-8254 | Campcodes Courier Management System view_parcel.php SQL injection | 9.8v3.1 | 0.3% | 2025-07-28 | |
| CVE-2025-8253 | code-projects Exam Form Submission delete_s6.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-28 | |
| CVE-2025-8252 | code-projects Exam Form Submission delete_s5.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-28 | |
| CVE-2025-8251 | code-projects Exam Form Submission delete_s4.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-28 | |
| CVE-2025-8250 | code-projects Exam Form Submission update_s4.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-28 | |
| CVE-2025-8249 | code-projects Exam Form Submission update_s3.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-28 | |
| CVE-2025-8248 | code-projects Online Ordering System signup.php SQL injection | 9.8v3.1 | 0.4% | 2025-07-28 | |
| CVE-2025-8247 | Projectworlds Online Admission System admin.php SQL injection | 8.8v3.1 | 0.3% | 2025-07-28 | |
| CVE-2025-8194 | Python CPython tarfile infinite loop during parsing with negative member offset | 7.5CNA v3.1 | 0.7% | 2025-07-28 | Fix |
| CVE-2025-7676 | Microsoft DLL hijacking of all PE32 executables on Windows 11 for ARM CPUs | 5.4CNA v4.0 | 0.1% | 2025-07-28 | Fix |
| CVE-2025-6918 | SQLi in Ncvav's Virtual PBX Software | 9.8CNA v3.1 | 0.3% | 2025-07-28 | Fix |
| CVE-2025-6250 | Privilege Management for Windows elevation of privilege | 7.1CNA v4.0 | 0.2% | 2025-07-28 | Fix |
| CVE-2025-5997 | Privilege escalation in Beamsec PhishPro | 8.8CNA v3.1 | 0.4% | 2025-07-28 | Fix |
| CVE-2025-4056 | GLib: GLib crash after long command line | 7.5NVD v3.1 | 0.5% | 2025-07-28 | Fix |
| CVE-2025-2297 | Privilege Management for Windows elevation of privilege | 7.2CNA v4.0 | 0.1% | 2025-07-28 | Fix |
| CVE-2025-54597 | LinuxServer Heimdall cross-site scripting | 6.1NVD v3.1 | 0.6% | 2025-07-27 | NucleiFix |
| CVE-2025-8246 | TOTOLINK X15 HTTP POST request formRoute buffer overflow | 7.5v3.1 | 0.8% | 2025-07-27 | |
| CVE-2025-8245 | TOTOLINK X15 HTTP POST request formMultiAPVLAN buffer overflow | 7.5v3.1 | 1.1% | 2025-07-27 | |
| CVE-2025-8244 | TOTOLINK X15 HTTP POST request formMapDelDevice buffer overflow | 9.8v3.1 | 1.2% | 2025-07-27 | |
| CVE-2025-8243 | TOTOLINK X15 HTTP POST request formMapDel buffer overflow | 7.5v3.1 | 1.1% | 2025-07-27 | |
| CVE-2025-8242 | TOTOLINK X15 HTTP POST request formFilter buffer overflow | 7.5v3.1 | 1.1% | 2025-07-27 | |
| CVE-2025-8241 | 1000 Projects ABC Courier Management System report.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-27 | |
| CVE-2025-8240 | code-projects Exam Form Submission dashboard.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-27 | |
| CVE-2025-8239 | code-projects Exam Form Submission admin SQL injection | 9.8v3.1 | 0.5% | 2025-07-27 | |
| CVE-2025-8238 | code-projects Exam Form Submission update_s2.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-27 | |
| CVE-2025-8237 | code-projects Exam Form Submission update_s1.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-27 | |
| CVE-2025-8236 | code-projects Online Ordering System edit_product.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-27 | |
| CVE-2025-8235 | code-projects Online Ordering System product.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-27 | |
| CVE-2025-8234 | code-projects Online Ordering System delete_member.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-27 | |
| CVE-2025-8233 | code-projects Online Ordering System user.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-27 | |
| CVE-2025-8232 | code-projects Online Ordering System delete_user.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-27 | |
| CVE-2025-8231 | D-Link DIR-890L UART Port rgbin hard-coded credentials | 7.0CNA v4.0 | 0.7% | 2025-07-27 | |
| CVE-2025-8230 | Campcodes Courier Management System manage_user.php SQL injection | 8.8v3.1 | 0.4% | 2025-07-27 | |
| CVE-2025-8229 | Campcodes Courier Management System parcel_list.php SQL injection | 8.8v3.1 | 0.5% | 2025-07-27 | |
| CVE-2025-8228 | yanyutao0402 ChanCMS getPages server-side request forgery | 8.8v3.1 | 0.6% | 2025-07-27 | Fix |
| CVE-2025-8227 | yanyutao0402 ChanCMS getArticle deserialization | 9.8v3.1 | 0.7% | 2025-07-27 | Fix |
| CVE-2025-8226 | yanyutao0402 ChanCMS find information disclosure | 9.8v3.1 | 0.6% | 2025-07-27 | |
| CVE-2025-8225 | GNU Binutils DWARF Section dwarf.c process_debug_info memory leak | 4.8CNA v4.0 | 0.2% | 2025-07-27 | Fix |
| CVE-2025-8224 | GNU Binutils BFD library elf.c bfd_elf_get_str_section null pointer dereference | 5.5NVD v3.1 | 0.3% | 2025-07-27 | Fix |
| CVE-2025-8223 | jerryshensjf JPACookieShop 蛋糕商城JPA版 AdminTypeCustController.java cross-site request forgery | 5.3CNA v4.0 | 0.3% | 2025-07-27 | |
| CVE-2025-8222 | jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java cross-site scripting | 5.4v3.1 | 0.4% | 2025-07-27 | |
| CVE-2025-8221 | jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsCustController.java goodsSearch cross-site scripting | 6.1v3.1 | 0.5% | 2025-07-27 | |
| CVE-2025-8220 | Engeman Web Password Recovery RecoveryPass SQL injection | 9.4v3.1 | 0.6% | 2025-07-27 | Exploit code |
| CVE-2025-8219 | Shanghai Lingdang Information Technology Lingdang CRM tabdetail_moduleSave_dxkp.php SQL injection | 9.8v3.1 | 0.4% | 2025-07-27 | |
| CVE-2025-8104 | Memory Usage WordPress plugin cross-site request forgery to limited plugin installation | 4.3CNA v3.1 | 0.2% | 2025-07-27 | Fix |
| CVE-2025-6241 | Lakeside Software SysTrack LsiAgent service privilege escalation | 4.4CISA ADP v3.1 | 0.2% | 2025-07-27 | Fix |
| CVE-2025-5120 | Sandbox escape vulnerability in huggingface/smolagents | 10.0v3.1 | 26.3% | 2025-07-27 | Fix |
| CVE-2025-54416 | Tj-actions/branch-names Contains command injection | 9.1CNA v3.1 | 0.6% | 2025-07-26 | Exploit codeFix |
| CVE-2025-54415 | Dag-factory's CI/CD Workflow allows for Repository takeover and Secret Exfiltration | 9.1CNA v4.0 | 0.7% | 2025-07-26 | Exploit codeFix |
| CVE-2025-54414 | Anubis accepts crafted redirect URLs in pass-challenge Try Again buttons | 5.1CNA v4.0 | 0.5% | 2025-07-26 | Fix |
| CVE-2025-54413 | skops model deserialization arbitrary code execution | 8.7CNA v4.0 | 0.1% | 2025-07-26 | Fix |
| CVE-2025-54412 | skops' Inconsistent Trusted Type Validation enables Hidden `operator` Methods Execution | 8.7CNA v4.0 | 0.1% | 2025-07-26 | Fix |
| CVE-2025-54385 | XWiki Platform's searchDocuments API allows for SQL injection | 8.6CNA v4.0 | 0.6% | 2025-07-26 | Fix |
| CVE-2025-54380 | Opencast still publishes global system account credentials | 6.5CNA v3.1 | 0.4% | 2025-07-26 | Fix |
| CVE-2025-54378 | haxtheweb issues HAX CMS Backend lacks Comprehensive Authorization Checks | 8.3CNA v3.1 | 0.5% | 2025-07-26 | Fix |
| CVE-2025-54366 | FreeScout's deserialization of untrusted data leads to remote code execution | 8.6CNA v4.0 | 1.0% | 2025-07-26 | Fix |
| CVE-2025-50185 | DbGate allows Unauthorized File Access via CSV plugin | 7.0CNA v4.0 | 0.4% | 2025-07-26 | |
| CVE-2025-50184 | DbGate allows for File Traversal via file parameter | 7.1CNA v4.0 | 0.6% | 2025-07-26 | Fix |
| CVE-2025-8211 | Roothub SystemConfigAdminController.java edit cross-site scripting | 6.1v3.1 | 0.4% | 2025-07-26 | |
| CVE-2025-8210 | Yeelink Yeelight App com.yeelight.cherry component vulnerability | 4.4v3.1 | 0.2% | 2025-07-26 | |
| CVE-2025-8207 | Canara ai1 Mobile Banking App com.canarabank.mobility component vulnerability | 4.4v3.1 | 0.2% | 2025-07-26 | |
| CVE-2025-8206 | Comodo Dragon IP DNS Leakage Detector cross-site scripting | 4.7v3.1 | 0.5% | 2025-07-26 | |
| CVE-2025-8205 | Comodo Dragon IP DNS Leakage Detector cleartext transmission | 6.3CNA v4.0 | 0.5% | 2025-07-26 | |
| CVE-2025-8204 | Comodo Dragon HSTS security check | 3.7v3.1 | 0.6% | 2025-07-26 | |
| CVE-2025-8203 | Jingmen Zeyou Large File Upload Control index.jsp SQL injection | 9.8v3.1 | 0.4% | 2025-07-26 | |
| CVE-2025-8198 | MinimogWP The High Converting eCommerce WordPress theme unauthenticated Price manipulation | 7.5CNA v3.1 | 0.3% | 2025-07-26 | Fix |
| CVE-2025-8191 | macrozheng mall Swagger UI index.html cross-site scripting | 5.4NVD v3.1 | 1.8% | 2025-07-26 | NucleiExploit codeFix |
| CVE-2025-8190 | Campcodes Courier Management System print_pdets.php SQL injection | 8.8v3.1 | 0.4% | 2025-07-26 | |
| CVE-2025-8189 | Campcodes Courier Management System edit_user.php SQL injection | 8.8v3.1 | 0.4% | 2025-07-26 | |
| CVE-2025-8188 | Campcodes Courier Management System edit_staff.php SQL injection | 8.8v3.1 | 0.4% | 2025-07-26 | |
| CVE-2025-8187 | Campcodes Courier Management System edit_parcel.php SQL injection | 8.8v3.1 | 0.4% | 2025-07-26 | |
| CVE-2025-8186 | Campcodes Courier Management System edit_branch.php SQL injection | 8.8v3.1 | 0.4% | 2025-07-26 | |
| CVE-2025-8185 | 1000 Projects ABC Courier Management System getbyid.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-26 | |
| CVE-2025-8184 | D-Link DIR-513 HTTP POST request formSetWanL2TPtriggers formSetWanL2TPcallback stack-based overflow | 9.8NVD v3.1 | 13.2% | 2025-07-26 | Emerging Threats |
| CVE-2025-8182 | Tenda AC18 Samba smb.conf weak password | 7.4v3.1 | 0.4% | 2025-07-26 | |
| CVE-2025-8181 | TOTOLINK N600R/X2000R FTP service vsftpd.conf least privilege violation | 8.6CNA v4.0 | 1.0% | 2025-07-26 | |
| CVE-2025-8180 | Tenda CH22 deleteUserName formdeleteUserName buffer overflow | 8.7CNA v4.0 | 9.6% | 2025-07-26 | |
| CVE-2025-8179 | PHPGurukul Local Services Search Engine Management System changeimage.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-26 | |
| CVE-2025-8178 | Tenda AC10 RequestsProcessLaid heap-based overflow | 8.7CNA v4.0 | 0.8% | 2025-07-26 | |
| CVE-2025-8177 | LibTIFF thumbnail.c setrow buffer overflow | 7.8v3.1 | 0.3% | 2025-07-26 | Fix |
| CVE-2025-8176 | LibTIFF tiffmedian.c get_histogram use-after-free | 7.8v3.1 | 0.3% | 2025-07-26 | Fix |
| CVE-2025-8175 | D-Link DI-8400 jhttpd usb_paswd.asp null pointer dereference | 7.5NVD v3.1 | 1.6% | 2025-07-26 | |
| CVE-2025-8174 | code-projects Voting System candidates_add.php unrestricted upload | 5.3CNA v4.0 | 0.4% | 2025-07-26 | |
| CVE-2025-8103 | WPeMatico RSS Feed Fetcher WordPress plugin cross-site request forgery to plugin deactivation | 4.3CNA v3.1 | 0.2% | 2025-07-26 | Fix |
| CVE-2025-8097 | WoodMart WordPress theme improper input validation | 5.3CNA v3.1 | 0.3% | 2025-07-26 | Fix |
| CVE-2025-7501 | Wonder Slider Lite and Wonder Slider WordPress plugin Dom-based stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-07-26 | Fix |
| CVE-2025-6991 | Kallyas WordPress theme authenticated (Contributor+) local file inclusion | 7.5CNA v3.1 | 0.8% | 2025-07-26 | Fix |
| CVE-2025-6989 | Kallyas WordPress theme authenticated (Contributor+) arbitrary Folder deletion | 8.1CNA v3.1 | 0.4% | 2025-07-26 | Fix |
| CVE-2025-6987 | Advanced iFrame WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-07-26 | Fix |
| CVE-2025-6895 | MelaPress Login Security - authentication bypass to privilege escalation | 9.8CNA v3.1 | 0.7% | 2025-07-26 | Fix |
| CVE-2025-5529 | Educenter WordPress theme authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-07-26 | Fix |
| CVE-2025-54596 | Abnormal AI Abnormal Security incorrect authorization | 4.3CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-54568 | Akamai Rate Control incorrect behavior | 3.7CNA v3.1 | 0.3% | 2025-07-25 | Fix |
| CVE-2025-54567 | QEMU incorrect behavior | 5.4v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-54566 | QEMU external control of critical state data | 5.4v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-54558 | OpenAI Codex CLI inclusion of untrusted functionality | 4.1CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-52455 | Salesforce Tableau Server server-side request forgery | 5.3CISA ADP v3.1 | 0.3% | 2025-07-25 | Fix |
| CVE-2025-52454 | Salesforce Tableau Server server-side request forgery | 8.2CISA ADP v3.1 | 0.3% | 2025-07-25 | Fix |
| CVE-2025-52453 | Salesforce Tableau Server server-side request forgery | 8.2CISA ADP v3.1 | 0.3% | 2025-07-25 | Fix |
| CVE-2025-52452 | Salesforce Tableau Server path traversal | 8.5CISA ADP v3.1 | 0.4% | 2025-07-25 | Fix |
| CVE-2025-52449 | Salesforce Tableau Server unrestricted file upload | 8.5CISA ADP v3.1 | 0.3% | 2025-07-25 | Fix |
| CVE-2025-52448 | Salesforce Tableau Server insecure direct object reference | 8.1CISA ADP v3.1 | 0.4% | 2025-07-25 | Fix |
| CVE-2025-52447 | Salesforce Tableau Server insecure direct object reference | 8.1CISA ADP v3.1 | 0.4% | 2025-07-25 | Fix |
| CVE-2025-52446 | Salesforce Tableau Server insecure direct object reference | 8.0CISA ADP v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-52360 | Koha Library Management System OPAC search feature cross-site scripting | 8.8CISA ADP v3.1 | 0.5% | 2025-07-25 | |
| CVE-2025-51411 | Vishalmathur Institute-of-current-students reflected cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-07-25 | |
| CVE-2025-46199 | getgrav grav cross-site scripting | 9.8CISA ADP v3.1 | 0.8% | 2025-07-25 | |
| CVE-2025-46198 | getgrav grav cross-site scripting | 8.8CISA ADP v3.1 | 0.6% | 2025-07-25 | |
| CVE-2025-45960 | Tawk.to cross-site scripting | 6.1CISA ADP v3.1 | 0.4% | 2025-07-25 | |
| CVE-2025-45939 | Apwide Golive server-side request forgery | 6.5CISA ADP v3.1 | 0.3% | 2025-07-25 | Fix |
| CVE-2025-45893 | OpenCart cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-07-25 | |
| CVE-2025-45892 | OpenCart cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-07-25 | |
| CVE-2025-45777 | Abeltechsoft Chavara Matrimony improper authentication | 9.8CISA ADP v3.1 | 0.7% | 2025-07-25 | |
| CVE-2025-45467 | Unitree Go 1 incorrect default permissions | 7.1CISA ADP v3.1 | 0.3% | 2025-07-25 | Exploit code |
| CVE-2025-45466 | Unitree Go 1 hard-coded credentials | 8.8CISA ADP v3.1 | 0.6% | 2025-07-25 | |
| CVE-2025-45406 | CodeIgniter4 v4.6.0 A stored cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-07-25 | Exploit code |
| CVE-2025-44608 | Vishalmathur CloudClassroom-PHP-Project SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-07-25 | Exploit code |
| CVE-2025-43712 | JHipster UI misrepresentation | 8.0CISA ADP v3.1 | 0.3% | 2025-07-25 | |
| CVE-2025-38467 | Linux kernel Exynos7 DECON display driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38466 | Linux kernel uprobes vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38465 | Linux kernel netlink socket buffer accounting memory leak | 5.5NVD v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38464 | Linux kernel TIPC connection handling use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38463 | Linux kernel TCP send path integer underflow | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38462 | Linux kernel vsock transport lookup race condition | 4.7v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38461 | Linux kernel vsock transport assignment race condition | 7.0CNA v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38460 | Linux kernel ATM CLIP driver null pointer dereference | 7.0CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38459 | Linux kernel ATM CLIP driver uncontrolled recursion | 7.8v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38458 | Linux kernel ATM CLIP driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38457 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Abort __tc_modify_qdisc if parent class does not exist Lion's patch [1] revealed an ancient bug in the qdisc API. Whenever a user creates/modifies a qdisc specifying as a parent another qdisc, the qdisc API will, during | 5.5NVD v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38456 | Linux kernel IPMI message handler out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38455 | Linux kernel KVM SEV vCPU migration null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38454 | Linux kernel ad1816a ALSA driver null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38453 | Linux kernel io_uring message ring vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38452 | Linux kernel rtsn Ethernet driver null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38451 | Linux kernel MD bitmap statistics vulnerability | 5.5NVD v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38450 | Linux kernel mt7925 Wi-Fi driver null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38449 | Linux kernel DRM GEM framebuffer handling use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38448 | Linux kernel USB gadget serial driver race condition | 4.7v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38447 | Linux kernel reverse mapping unmap path out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38446 | Linux kernel i.MX clock driver out-of-bounds read | 7.3CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38445 | Linux kernel RAID1 driver vulnerability | 7.1v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38444 | Linux kernel RAID10 driver memory leak | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38443 | Linux kernel nbd use-after-free | 7.8v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38442 | Linux kernel block device buffered I/O null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38441 | Linux kernel netfilter flowtable PPPoE handling vulnerability | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38440 | Linux kernel net/mlx5e null pointer dereference | 7.8CNA v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38439 | Linux kernel bnxt_en XDP_REDIRECT DMA handling vulnerability | 9.8CNA v3.1 | 0.5% | 2025-07-25 | Fix |
| CVE-2025-38438 | Linux kernel SOF Intel HDA driver memory leak | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38437 | Linux kernel ksmbd oplock and lease break handling use-after-free | 8.8CNA v3.1 | 0.4% | 2025-07-25 | Fix |
| CVE-2025-38436 | Linux kernel DRM scheduler fence signaling vulnerability | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38435 | Linux kernel riscv xtheadvector context switching vulnerability | 7.8CNA v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38434 | Linux kernel riscv access_ok address check vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38433 | Linux kernel riscv runtime constant patching null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38432 | Linux kernel netpoll UDP checksum handling improper initialization | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38431 | Linux kernel SMB client symlink handling vulnerability | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38430 | In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This patch adds a check that the rpc procedu | 9.8CNA v3.1 | 0.6% | 2025-07-25 | Fix |
| CVE-2025-38429 | Linux kernel MHI endpoint ring buffer race condition | 10.0CNA v3.1 | 0.4% | 2025-07-25 | Fix |
| CVE-2025-38428 | Linux kernel ims-pcu firmware flashing out-of-bounds write | 7.8v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38427 | Linux kernel screen_info framebuffer relocation vulnerability | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38426 | Linux kernel amdgpu RAS EEPROM handling vulnerability | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38425 | Linux kernel Tegra I2C driver vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38424 | Linux kernel perf events subsystem vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38423 | Linux kernel wcd9375 codec driver double free | 7.8v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38422 | Linux kernel lan743x EEPROM and OTP handling vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38421 | Linux kernel AMD PMF driver double free | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38420 | Linux kernel carl9170 Wi-Fi driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38419 | Linux kernel remoteproc core memory leak | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38418 | Linux kernel remoteproc core memory leak | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38417 | Linux kernel ice eswitch driver memory leak | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38416 | Linux kernel NFC NCI UART driver vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38415 | Linux kernel Squashfs filesystem out-of-bounds write | 7.8v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38414 | Linux kernel ath12k Wi-Fi driver denial of service | 5.5NVD v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38413 | In the Linux kernel, the following vulnerability has been resolved: virtio-net: xsk: rx: fix the frame's length check When calling buf_to_xdp, the len argument is the frame data's length without virtio header's length (vi->hdr_len). We check that len with xsk_pool_get_rx_frame_size() + vi->hdr_l | 7.7CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38412 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks After retrieving WMI data blocks in sysfs callbacks, check for the validity of them before dereferencing their content. | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38411 | Linux kernel netfs request handling double free | 9.8CNA v3.1 | 0.3% | 2025-07-25 | Fix |
| CVE-2025-38410 | Linux kernel MSM DRM submit path memory leak | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38409 | Linux kernel MSM DRM submit path memory leak | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38408 | Linux kernel genirq/irq_sim null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38407 | Linux kernel RISC-V SBI CPU ops denial of service | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38406 | Linux kernel ath6kl Wi-Fi driver denial of service | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38405 | Linux kernel NVMe target bio integrity memory leak | 7.5CNA v3.1 | 0.4% | 2025-07-25 | Fix |
| CVE-2025-38404 | Linux kernel USB Type-C DisplayPort alt mode driver deadlock | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38403 | Linux kernel VMCI vsock transport vulnerability | 7.8v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38402 | Linux kernel idpf driver null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38401 | Linux kernel mtk-sd memory corruption | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38400 | Linux kernel NFS proc filesystem init vulnerability | 5.5NVD v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38399 | Linux kernel SCSI target persistent reservation code null pointer dereference | 7.5CNA v3.1 | 0.5% | 2025-07-25 | Fix |
| CVE-2025-38398 | Linux kernel spi-qpic-snand kernel panic | 7.8CNA v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38397 | Linux kernel NVMe multipath vulnerability | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38396 | Linux kernel secretmem vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38395 | Linux kernel GPIO regulator driver out-of-bounds read | 8.4CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38394 | Linux kernel appletb-kbd memory corruption | 7.8v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38393 | Linux kernel NFSv4 pNFS layout draining race condition | 7.5CNA v3.1 | 0.4% | 2025-07-25 | Fix |
| CVE-2025-38392 | Linux kernel idpf driver improper locking | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38391 | Linux kernel USB Type-C DisplayPort alt mode driver out-of-bounds read | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38390 | Linux kernel ARM FF-A firmware driver memory leak | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38389 | Linux kernel i915 GPU driver vulnerability | 7.8v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38388 | Linux kernel ARM FF-A firmware driver improper locking | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38387 | Linux kernel mlx5 event subscription null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38386 | Linux kernel ACPICA AML interpreter use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38385 | Linux kernel lan78xx USB Ethernet driver improper resource release | 7.8v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38384 | Linux kernel SPI NAND ECC engine driver memory leak | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38383 | Linux kernel vmalloc NUMA info reporting race condition | 4.7v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38382 | Linux kernel Btrfs log replay vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38381 | Linux kernel cs40l50 vibrator driver null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38379 | Linux kernel SMB client channel reconnection vulnerability | 7.5CNA v3.1 | 0.4% | 2025-07-25 | Fix |
| CVE-2025-38378 | Linux kernel appletb-kbd use-after-free | 7.8v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38377 | Linux kernel rose protocol driver use-after-free | 8.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38376 | Linux kernel chipidea USB gadget controller driver denial of service | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38375 | Linux kernel virtio-net XDP driver out-of-bounds read | 8.4CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38374 | Linux kernel OP-TEE FF-A notification driver improper locking | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38373 | Linux kernel mlx5 memory region deregistration deadlock | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38372 | Linux kernel mlx5 on-demand paging handling vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38371 | Linux kernel v3d GPU driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38370 | Linux kernel Btrfs free space tree vulnerability | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38369 | Linux kernel idxd workqueue driver use-after-free | 7.8v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38368 | Linux kernel tps6594 PFSM driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38367 | Linux kernel EIOINTC interrupt controller improper array index validation | 8.8CNA v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38366 | Linux kernel EIOINTC interrupt controller vulnerability | 7.8CNA v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38365 | Linux kernel Btrfs directory logging race condition | 9.1CNA v3.1 | 0.3% | 2025-07-25 | Fix |
| CVE-2025-38364 | Linux kernel maple tree allocator null pointer dereference | 5.5NVD v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38363 | Linux kernel tegra display driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38362 | Linux kernel amdgpu display HDCP null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38361 | Linux kernel amdgpu display driver vulnerability | 7.8v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38360 | Linux kernel amdgpu display driver vulnerability | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38359 | Linux kernel s390 secure storage access improper locking | 5.5NVD v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38358 | Linux kernel Btrfs reclaim worker race condition | 4.7v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-38357 | Linux kernel FUSE filesystem vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38356 | Linux kernel xe GuC driver vulnerability | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38355 | Linux kernel xe GPU driver vulnerability | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38354 | Linux kernel msm GPU driver vulnerability | 5.5v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-38353 | Linux kernel xe GPU driver improper locking | 5.5v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-36728 | SimpleHelp cross-site request forgery | 8.8NVD v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-36727 | SimpleHelp inclusion of functionality from untrusted control sphere | 8.8NVD v3.1 | 0.4% | 2025-07-25 | Fix |
| CVE-2025-34139 | Sitecore XM/XP/XC and Managed Cloud arbitrary file read | 8.7CNA v4.0 | 0.5% | 2025-07-25 | Fix |
| CVE-2025-34136 | Commvault CommServe web server unauthenticated SQL injection | 6.9CNA v4.0 | 0.5% | 2025-07-25 | Fix |
| CVE-2025-34114 | OpenBlow Missing Critical Security headers | 8.4CNA v4.0 | 0.2% | 2025-07-25 | |
| CVE-2025-30135 | Iroadau FX2 missing authentication | 9.4CISA ADP v3.1 | 0.6% | 2025-07-25 | |
| CVE-2025-30086 | CNCF Harbor users API endpoint information disclosure | 4.9CISA ADP v3.1 | 0.6% | 2025-07-25 | Fix |
| CVE-2025-29631 | Gardyn Home Kit Firmware OS command injection | 9.8CISA ADP v3.1 | 2.1% | 2025-07-25 | KCVFix |
| CVE-2025-29629 | Gardyn Home Kit Firmware default credentials | 8.8CISA ADP v3.1 | 0.5% | 2025-07-25 | Fix |
| CVE-2025-29628 | Gardyn Home Kit Firmware improper message integrity enforcement | 8.1CISA ADP v3.1 | 0.3% | 2025-07-25 | Exploit codeKCVFix |
| CVE-2025-8183 | Null pointer dereference in µD3TN | 7.5CNA v3.1 | 0.5% | 2025-07-25 | Fix |
| CVE-2025-8173 | 1000 Projects ABC Courier Management System Add_reciver.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-25 | |
| CVE-2025-8172 | itsourcecode Employee Management System index.php SQL injection | 8.8v3.1 | 0.4% | 2025-07-25 | |
| CVE-2025-8171 | code-projects Document Management System insert.php unrestricted upload | 5.3CNA v4.0 | 0.4% | 2025-07-25 | |
| CVE-2025-8170 | TOTOLINK T6 MQTT Packet meshSlaveDlfw tcpcheck_net buffer overflow | 8.7CNA v4.0 | 1.1% | 2025-07-25 | |
| CVE-2025-8169 | D-Link DIR-513 HTTP POST request formSetWanPPTPpath formSetWanPPTPcallback buffer overflow | 9.8NVD v3.1 | 1.7% | 2025-07-25 | Emerging Threats |
| CVE-2025-8168 | D-Link DIR-513 formSetWanPPPoE websAspInit buffer overflow | 9.8NVD v3.1 | 1.6% | 2025-07-25 | Emerging Threats |
| CVE-2025-8167 | code-projects Church Donation System edit_members.php cross-site scripting | 5.4v3.1 | 0.3% | 2025-07-25 | |
| CVE-2025-8166 | code-projects Church Donation System HTTP POST request index.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-25 | |
| CVE-2025-8165 | code-projects Food Review System approve_reservation.php SQL injection | 8.8v3.1 | 0.5% | 2025-07-25 | |
| CVE-2025-8164 | code-projects Public Chat Room send_message.php SQL injection | 8.8v3.1 | 0.4% | 2025-07-25 | |
| CVE-2025-8163 | deerwms deer-wms-2 list SQL injection | 8.8v3.1 | 0.4% | 2025-07-25 | |
| CVE-2025-8162 | deerwms deer-wms-2 list SQL injection | 8.8v3.1 | 0.5% | 2025-07-25 | |
| CVE-2025-8161 | deerwms deer-wms-2 export SQL injection | 8.8v3.1 | 0.5% | 2025-07-25 | |
| CVE-2025-8160 | Tenda AC20 httpd SetSysTimeCfg buffer overflow | 8.7CNA v4.0 | 1.3% | 2025-07-25 | Emerging Threats |
| CVE-2025-8159 | D-Link DIR-513 HTTP POST request formLanguageChange stack-based overflow | 9.8NVD v3.1 | 16.7% | 2025-07-25 | Emerging Threats |
| CVE-2025-8158 | PHPGurukul Login and User Management System yesterday-reg-users.php SQL injection | 7.2v3.1 | 0.4% | 2025-07-25 | |
| CVE-2025-8157 | PHPGurukul User Registration and Login and User Management lastthirtyays-reg-users.php SQL injection | 7.2v3.1 | 0.5% | 2025-07-25 | |
| CVE-2025-8156 | PHPGurukul User Registration and Login and User Management lastsevendays-reg-users.php SQL injection | 7.2v3.1 | 0.4% | 2025-07-25 | |
| CVE-2025-8155 | D-Link DCS-6010L Management application vb.htm cross-site scripting | 5.4NVD v3.1 | 21.8% | 2025-07-25 | Emerging Threats |
| CVE-2025-8140 | TOTOLINK A702R HTTP POST request formWlanMultipleAP buffer overflow | 8.7CNA v4.0 | 8.8% | 2025-07-25 | Emerging Threats |
| CVE-2025-8139 | TOTOLINK A702R HTTP POST request formPortFw buffer overflow | 8.7CNA v4.0 | 1.1% | 2025-07-25 | Emerging Threats |
| CVE-2025-8138 | TOTOLINK A702R HTTP POST request formOneKeyAccessButton buffer overflow | 8.7CNA v4.0 | 8.8% | 2025-07-25 | Emerging Threats |
| CVE-2025-8137 | TOTOLINK A702R HTTP POST request formIpQoS buffer overflow | 8.7CNA v4.0 | 1.1% | 2025-07-25 | |
| CVE-2025-8136 | TOTOLINK A702R HTTP POST request formFilter buffer overflow | 7.5v3.1 | 1.1% | 2025-07-25 | |
| CVE-2025-8135 | itsourcecode Insurance Management System updateAgent.php SQL injection | 8.8v3.1 | 0.4% | 2025-07-25 | |
| CVE-2025-8134 | PHPGurukul BP Monitoring Management System bwdates-report-result.php SQL injection | 8.8v3.1 | 0.5% | 2025-07-25 | |
| CVE-2025-8133 | yanyutao0402 ChanCMS gather.js getArticle server-side request forgery | 5.3CNA v4.0 | 0.4% | 2025-07-25 | Fix |
| CVE-2025-8132 | yanyutao0402 ChanCMS utils.js delfile path traversal | 5.3CNA v4.0 | 0.6% | 2025-07-25 | Fix |
| CVE-2025-8131 | Tenda AC20 SetStaticRouteCfg stack-based overflow | 8.7CNA v4.0 | 1.1% | 2025-07-25 | |
| CVE-2025-8129 | KoaJS Koa HTTP header response.js back redirect | 6.1v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-8128 | zhousg letao product.js unrestricted upload | 5.3CNA v4.0 | 0.3% | 2025-07-25 | |
| CVE-2025-8127 | deerwms deer-wms-2 list SQL injection | 8.8v3.1 | 0.4% | 2025-07-25 | |
| CVE-2025-8126 | deerwms deer-wms-2 export SQL injection | 8.8v3.1 | 0.4% | 2025-07-25 | |
| CVE-2025-8125 | deerwms deer-wms-2 allocatedList SQL injection | 9.8v3.1 | 0.5% | 2025-07-25 | |
| CVE-2025-8124 | deerwms deer-wms-2 unallocatedList SQL injection | 8.8v3.1 | 0.4% | 2025-07-25 | |
| CVE-2025-8101 | Linkify prototype pollution and HTML attribute injection (XSS) | 8.8CNA v4.0 | 0.5% | 2025-07-25 | Fix |
| CVE-2025-7742 | Authentication bypass in LG Innotek Camera | 8.3CNA v4.0 | 0.7% | 2025-07-25 | |
| CVE-2025-7022 | My Reservation System WordPress plugin reflected XSS | 6.1CISA ADP v3.1 | 0.3% | 2025-07-25 | |
| CVE-2025-5835 | Droip WordPress plugin missing authorization to authenticated (Subscriber+) Many actions | 8.8CNA v3.1 | 0.4% | 2025-07-25 | Fix |
| CVE-2025-5831 | Droip WordPress plugin authenticated (Subscriber+) arbitrary file upload | 8.8CNA v3.1 | 0.6% | 2025-07-25 | Fix |
| CVE-2025-5449 | Libssh: Integer overflow in libssh sftp server packet length validation leading to denial of service | 6.5NVD v3.1 | 0.9% | 2025-07-25 | Fix |
| CVE-2025-5254 | Stored XSS in Kron Technologies' Kron PAM | 6.1CNA v3.1 | 0.4% | 2025-07-25 | Fix |
| CVE-2025-5253 | DoS in Kron Technologies' Kron PAM | 6.5CNA v3.1 | 0.4% | 2025-07-25 | Fix |
| CVE-2025-3873 | silabs.com WiseConnect buffer overflow in Si91x crypto APIs | 6.0CNA v4.0 | 0.3% | 2025-07-25 | Fix |
| CVE-2025-3508 | Certain HP DesignJet products information disclosure | 6.0CNA v4.0 | 0.9% | 2025-07-25 | Fix |
| CVE-2025-2329 | High traffic causes corrupt SPI packets in OpenThread leading to denial of service | 5.3CNA v4.0 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-0253 | HCL IEM is affected by a cookie attribute not set vulnerability | 2.0CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-0252 | HCL IEM cleartext transmission | 2.6CNA v3.1 | 0.1% | 2025-07-25 | Fix |
| CVE-2025-0251 | HCL IEM session fixation | 2.6CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-0250 | HCL IEM is affected by an authorization token sent in cookie vulnerability | 2.2CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-0249 | HCL IEM is affected by an improper invalidation of access or JWT token vulnerability | 3.3CNA v3.1 | 0.2% | 2025-07-25 | Fix |
| CVE-2025-54379 | eKuiper API endpoints handling SQL queries with user-controlled table names | 8.9CNA v4.0 | 0.8% | 2025-07-24 | Fix |
| CVE-2025-54369 | Node-SAML SAML authentication bypass | 9.3CNA v4.0 | 0.5% | 2025-07-24 | Fix |
| CVE-2025-53940 | Quiet uses insecure, inconsistent verification on local backend token | 8.5CNA v4.0 | 3.6% | 2025-07-24 | Fix |
| CVE-2025-53084 | WWBN AVideo videosList page parameter functionality cross-site scripting | 6.1NVD v3.1 | 0.7% | 2025-07-24 | |
| CVE-2025-51089 | Tenda AC8 heap-based buffer overflow | 6.5CISA ADP v3.1 | 7.4% | 2025-07-24 | Emerging Threats |
| CVE-2025-51088 | Tenda AC8 stack-based buffer overflow | 5.3CISA ADP v3.1 | 7.4% | 2025-07-24 | Emerging Threats |
| CVE-2025-51087 | Tenda AC8 stack-based buffer overflow | 8.6CISA ADP v3.1 | 11.0% | 2025-07-24 | Emerging Threats |
| CVE-2025-51085 | Tenda AC8 stack-based buffer overflow | 5.3CISA ADP v3.1 | 7.4% | 2025-07-24 | Emerging Threats |
| CVE-2025-51082 | Tenda AC8 stack-based buffer overflow | 5.3CISA ADP v3.1 | 0.4% | 2025-07-24 | Emerging Threats |
| CVE-2025-50128 | WWBN AVideo videoNotFound cross-site scripting | 6.1NVD v3.1 | 0.8% | 2025-07-24 | |
| CVE-2025-48732 | WWBN AVideo incomplete denylist | 9.8v3.1 | 1.1% | 2025-07-24 | |
| CVE-2025-47061 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2025-07-24 | Fix |
| CVE-2025-46996 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2025-07-24 | Fix |
| CVE-2025-46993 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2025-07-24 | Fix |
| CVE-2025-46410 | WWBN AVideo cross-site scripting | 6.1NVD v3.1 | 0.8% | 2025-07-24 | |
| CVE-2025-45731 | 2FAuth group deletion race condition | 6.5v3.1 | 0.3% | 2025-07-24 | |
| CVE-2025-45702 | Softperfect Connection Quality Monitor plaintext password storage | 6.5CISA ADP v3.1 | 0.2% | 2025-07-24 | |
| CVE-2025-41420 | WWBN AVideo userLogin cancelUri parameter functionality cross-site scripting | 9.6CNA v3.1 | 1.2% | 2025-07-24 | |
| CVE-2025-41240 | VMware bitnamicharts/appsmith files accessible to external parties | 10.0CNA v3.1 | 0.7% | 2025-07-24 | Fix |
| CVE-2025-40680 | Encryption of sensitive data in CapillaryScope missing | 6.9CNA v4.0 | 0.1% | 2025-07-24 | Fix |
| CVE-2025-36548 | WWBN AVideo cross-site scripting | 9.6v3.1 | 1.0% | 2025-07-24 | |
| CVE-2025-36005 | IBM MQ Operator information disclosure | 5.9CNA v3.1 | 0.2% | 2025-07-24 | Fix |
| CVE-2025-33109 | IBM i privilege escalation | 7.5CNA v3.1 | 0.4% | 2025-07-24 | Fix |
| CVE-2025-33013 | IBM MQ Operator information disclosure | 6.2CNA v3.1 | 0.1% | 2025-07-24 | Fix |
| CVE-2025-32429 | XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter | 9.3CNA v4.0 | 87.0% | 2025-07-24 | Reported exploitedNucleiExploit codeFix |
| CVE-2025-31955 | HCL iAutomate is affected by a sensitive data exposure | 7.6CNA v3.1 | 0.3% | 2025-07-24 | Fix |
| CVE-2025-31953 | HCL iAutomate is affected by hard-coded credentials | 7.1CNA v3.1 | 0.3% | 2025-07-24 | Fix |
| CVE-2025-31952 | HCL iAutomate is affected by an insufficient session expiration | 7.1CNA v3.1 | 0.3% | 2025-07-24 | Fix |
| CVE-2025-26397 | SolarWinds Observability Self-Hosted deserialization of untrusted data local privilege escalation | 7.8CNA v3.1 | 0.3% | 2025-07-24 | Fix |
| CVE-2025-25214 | WWBN AVideo race condition | 7.5v3.1 | 1.0% | 2025-07-24 | |
| CVE-2025-22165 | Atlassian Sourcetree improper privilege management | 5.9CNA v4.0 | 0.1% | 2025-07-24 | Fix |
| CVE-2025-8123 | deerwms deer-wms-2 edit SQL injection | 8.8v3.1 | 0.4% | 2025-07-24 | |
| CVE-2025-8115 | PHPGurukul Taxi Stand Management System new-autoortaxi-entry-form.php cross-site scripting | 5.4v3.1 | 0.4% | 2025-07-24 | |
| CVE-2025-8114 | Libssh: Null pointer dereference in libssh kex session id calculation | 4.7NVD v3.1 | 0.2% | 2025-07-24 | Fix |
| CVE-2025-8107 | OB OceanBase Server improper privilege management | 6.3CNA v3.1 | 0.3% | 2025-07-24 | Fix |
| CVE-2025-8071 | Mine CloudVod WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2025-07-24 | Fix |
| CVE-2025-8009 | Security Ninja Secure Firewall and Secure Malware Scanner - Authenticated arbitrary file read | 4.9CNA v3.1 | 0.6% | 2025-07-24 | Fix |
| CVE-2025-7966 | Get Youtube Subs WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2025-07-24 | |
| CVE-2025-7959 | Station Pro WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2025-07-24 | |
| CVE-2025-7852 | WPBookit WordPress plugin unauthenticated arbitrary file upload via image_upload_handle function | 9.8CNA v3.1 | 1.5% | 2025-07-24 | Fix |
| CVE-2025-7835 | iThoughts Advanced Code Editor WordPress plugin cross-site request forgery to settings update | 4.3CNA v3.1 | 0.2% | 2025-07-24 | |
| CVE-2025-7822 | WP Wallcreeper WordPress plugin missing authorization authenticated Cache Enable/Disable | 4.3CNA v3.1 | 0.3% | 2025-07-24 | |
| CVE-2025-7780 | AI Engine WordPress plugin missing URL Scheme validation to authenticated arbitrary file read | 6.5CNA v3.1 | 0.5% | 2025-07-24 | Fix |
| CVE-2025-7745 | ABB AC500 V2 modbus TCP buffer overread | 6.9CNA v4.0 | 0.4% | 2025-07-24 | Fix |
| CVE-2025-7695 | Dataverse Integration - missing authorization to Authenticated privilege escalation | 8.8CNA v3.1 | 0.6% | 2025-07-24 | Fix |
| CVE-2025-7690 | Affiliate Plus WordPress plugin cross-site request forgery to stored cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-07-24 | |
| CVE-2025-7640 | hiWeb Export Posts WordPress plugin cross-site request forgery to arbitrary file deletion | 8.1CNA v3.1 | 0.9% | 2025-07-24 | |
| CVE-2025-7437 | Ebook Store WordPress plugin unauthenticated arbitrary file upload | 9.8CNA v3.1 | 1.3% | 2025-07-24 | Fix |
| CVE-2025-7404 | Calibre Web and Autocaliweb have OS command injection | 9.8v3.1 | 2.8% | 2025-07-24 | Exploit codeFix |
| CVE-2025-7001 | Insufficient granularity of access control in GitLab | 4.3CNA v3.1 | 0.4% | 2025-07-24 | Fix |
| CVE-2025-6998 | Calibre Web and Autocaliweb ReDoS | 8.7CNA v4.0 | 0.8% | 2025-07-24 | Exploit codeFix |
| CVE-2025-6588 | FunnelCockpit WordPress plugin reflected cross-site scripting via `error` parameter | 6.1CNA v3.1 | 0.4% | 2025-07-24 | Fix |
| CVE-2025-6539 | Voltax Video Player WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-07-24 | |
| CVE-2025-6441 | tobias_conrad WebinarIgnition missing authorization | 9.8CNA v3.1 | 1.0% | 2025-07-24 | Fix |
| CVE-2025-6387 | WP Get The Table WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2025-07-24 | Fix |
| CVE-2025-6385 | WP Applink WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-07-24 | |
| CVE-2025-6382 | Taeggie Feed WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2025-07-24 | Fix |
| CVE-2025-6380 | ONLYOFFICE Docs - missing authorization to unauthenticated privilege escalation | 9.8CNA v3.1 | 0.7% | 2025-07-24 | Fix |
| CVE-2025-6262 | muse.ai video embedding WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2025-07-24 | Fix |
| CVE-2025-6260 | Network Thermostat X-Series WiFi Thermostats missing authentication for critical function | 9.3CNA v4.0 | 0.5% | 2025-07-24 | Fix |
| CVE-2025-5243 | Arbitrary file upload in SMG Software's Information Portal | 10.0CNA v3.1 | 1.5% | 2025-07-24 | Fix |
| CVE-2025-5084 | Post Grid Master WordPress plugin reflected cross-site scripting via argsArray['read_more_text'] | 6.1CNA v3.1 | 0.5% | 2025-07-24 | Fix |
| CVE-2025-5039 | Autodesk AutoCAD privilege Ecalation due to untrusted search path | 7.8CNA v3.1 | 0.2% | 2025-07-24 | Fix |
| CVE-2025-4976 | Exposure of sensitive information due to incompatible policies in GitLab | 4.3CNA v3.1 | 0.4% | 2025-07-24 | Fix |
| CVE-2025-4968 | WPBakery Page Builder WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-07-24 | Fix |
| CVE-2025-4822 | SQLi in Bayraktar Solar Energies' ScadaWatt Otopilot | 9.8CNA v3.1 | 0.7% | 2025-07-24 | Fix |
| CVE-2025-4784 | SQLi in Moderec's Tourtella | 9.8CNA v3.1 | 0.5% | 2025-07-24 | Fix |
| CVE-2025-4608 | Structured Content WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2025-07-24 | Fix |
| CVE-2025-4395 | Medtronic MyCareLink Patient Monitor built-in user account vulnerability | 6.8CNA v3.1 | 0.3% | 2025-07-24 | Fix |
| CVE-2025-4394 | Medtronic MyCareLink Patient Monitor internal storage filesystem cleartext storage | 6.8CNA v3.1 | 0.2% | 2025-07-24 | Fix |
| CVE-2025-4393 | Medtronic MyCareLink Patient Monitor deserialization | 6.5CNA v3.1 | 0.2% | 2025-07-24 | Fix |
| CVE-2025-3669 | Supreme Addons for Beaver Builder WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2025-07-24 | |
| CVE-2025-3614 | ElementsKit Elementor Addons and Templates WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-07-24 | Fix |
| CVE-2025-1299 | Missing authorization in GitLab | 4.3CNA v3.1 | 0.3% | 2025-07-24 | Fix |
| CVE-2025-0765 | Incorrect authorization in GitLab | 4.3CNA v3.1 | 0.4% | 2025-07-24 | Fix |
| CVE-2025-54455 | Samsung Electronics MagicINFO 9 Server hard-coded credentials | 9.1CNA v3.1 | 0.6% | 2025-07-23 | |
| CVE-2025-54454 | Samsung Electronics MagicINFO 9 Server hard-coded credentials | 9.1CNA v3.1 | 0.5% | 2025-07-23 | Fix |
| CVE-2025-54453 | Samsung Electronics MagicINFO 9 Server path traversal | 8.8CNA v3.1 | 34.3% | 2025-07-23 | |
| CVE-2025-54452 | Samsung Electronics MagicINFO 9 Server improper authentication | 7.3CNA v3.1 | 0.4% | 2025-07-23 | Fix |
| CVE-2025-54451 | Samsung Electronics MagicINFO 9 Server code injection | 9.8CNA v3.1 | 0.6% | 2025-07-23 | Fix |
| CVE-2025-54450 | Samsung Electronics MagicINFO 9 Server path traversal | 7.2CNA v3.1 | 0.6% | 2025-07-23 | |
| CVE-2025-54449 | Samsung Electronics MagicINFO 9 Server unrestricted file upload | 9.8CNA v3.1 | 0.6% | 2025-07-23 | |
| CVE-2025-54448 | Samsung Electronics MagicINFO 9 Server unrestricted file upload | 9.8CNA v3.1 | 0.6% | 2025-07-23 | |
| CVE-2025-54447 | Samsung Electronics MagicINFO 9 Server unrestricted file upload | 8.1CNA v3.1 | 0.5% | 2025-07-23 | |
| CVE-2025-54446 | Samsung Electronics MagicINFO 9 Server path traversal | 9.8CNA v3.1 | 0.6% | 2025-07-23 | |
| CVE-2025-54445 | Samsung Electronics MagicINFO 9 Server XML external entity injection | 8.2CNA v3.1 | 17.7% | 2025-07-23 | Fix |
| CVE-2025-54444 | Samsung Electronics MagicINFO 9 Server unrestricted file upload | 9.8CNA v3.1 | 0.6% | 2025-07-23 | |
| CVE-2025-54443 | Samsung Electronics MagicINFO 9 Server path traversal | 9.8CNA v3.1 | 0.6% | 2025-07-23 | |
| CVE-2025-54442 | Samsung Electronics MagicINFO 9 Server unrestricted file upload | 9.8CNA v3.1 | 0.5% | 2025-07-23 | |
| CVE-2025-54441 | Samsung Electronics MagicINFO 9 Server unrestricted file upload | 8.8CNA v3.1 | 15.4% | 2025-07-23 | |
| CVE-2025-54440 | Samsung Electronics MagicINFO 9 Server unrestricted file upload | 9.8CNA v3.1 | 0.5% | 2025-07-23 | |
| CVE-2025-54439 | Samsung Electronics MagicINFO 9 Server unrestricted file upload | 8.8CNA v3.1 | 13.5% | 2025-07-23 | Fix |
| CVE-2025-54438 | Samsung Electronics MagicINFO 9 Server path traversal | 9.8CNA v3.1 | 0.6% | 2025-07-23 | Fix |
| CVE-2025-54377 | RooCodeInc Roo-Code Roo Code lacks Line Break Validation in its command execution tool | 7.8CNA v3.1 | 1.1% | 2025-07-23 | Fix |
| CVE-2025-54365 | Fastapi-guard patch contains bypassable RegEx | 7.8CNA v4.0 | 0.8% | 2025-07-23 | Fix |
| CVE-2025-54297 | Extension compojoom.com stored XSS vulnerability in CComment component for Joomla | 7.0CNA v4.0 | 0.2% | 2025-07-23 | |
| CVE-2025-54296 | Extension mooj.org stored XSS vulnerability in ProFiles component for Joomla | 7.0CNA v4.0 | 0.2% | 2025-07-23 | |
| CVE-2025-54295 | Extension dj-extensions.com reflected XSS vulnerability in DJ-Reviews component for Joomla | 5.1CNA v4.0 | 0.3% | 2025-07-23 | |
| CVE-2025-54294 | Extension Stackideas.com SQLi vulnerability in Komento component for Joomla | 9.3CNA v4.0 | 0.3% | 2025-07-23 | |
| CVE-2025-54139 | haxtheweb issues HAX CMS' application pages are vulnerable to clickjacking | 4.3CNA v3.1 | 0.3% | 2025-07-23 | Fix |
| CVE-2025-54120 | PCL-Community PCL2-CE PCL Community Edition exposes login credentials in logs | 9.3CNA v4.0 | 0.1% | 2025-07-23 | Fix |
| CVE-2025-54090 | Apache HTTP Server: RewriteCond expr always evaluates to true in | 6.3CISA ADP v3.1 | 0.8% | 2025-07-23 | Fix |
| CVE-2025-53942 | authentik has an insufficient check for account active status during OAuth/SAML authentication | 7.1CNA v4.0 | 0.5% | 2025-07-23 | Fix |
| CVE-2025-53882 | SUSE openSUSE Tumbleweed reliance on untrusted input in a security decision | 4.8CNA v4.0 | 0.1% | 2025-07-23 | Fix |
| CVE-2025-53537 | LibHTP's memory leak with lzma can lead to resource starvation | 7.5CNA v3.1 | 0.4% | 2025-07-23 | Fix |
| CVE-2025-50481 | Mezzanine CMS vulnerable to cross-site scripting | 4.8CISA ADP v3.1 | 0.6% | 2025-07-23 | Exploit code |
| CVE-2025-50477 | lbry-desktop v0.53.9 A open redirect | 5.4CISA ADP v3.1 | 0.3% | 2025-07-23 | |
| CVE-2025-50127 | Extension dj-extensions.com SQLi vulnerability in DJ-Flyer component for Joomla | 8.5CNA v4.0 | 0.3% | 2025-07-23 | |
| CVE-2025-47281 | Kyverno's Improper JMESPath Variable Evaluation leads to denial of service | 7.7CNA v3.1 | 0.5% | 2025-07-23 | Fix |
| CVE-2025-47187 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to perform a file upload attack due to missing authentication mec | 7.5CISA ADP v3.1 | 0.8% | 2025-07-23 | Emerging ThreatsFix |
| CVE-2025-46686 | Redis multi-bulk command handling memory leak | 3.5CNA v3.1 | 0.3% | 2025-07-23 | Fix |
| CVE-2025-46171 | vBulletin denial of service | 5.4CISA ADP v3.1 | 0.3% | 2025-07-23 | |
| CVE-2025-46099 | pluck-cms Pluck unrestricted file upload | 7.2NVD v3.1 | 0.5% | 2025-07-23 | |
| CVE-2025-44109 | Pinokio v3.6.23 A open redirect | 5.4CISA ADP v3.1 | 0.3% | 2025-07-23 | |
| CVE-2025-43881 | SYNCK GRAPHICA Real-time Bus Tracking System input issue exists improper input validation | 5.3CNA v4.0 | 0.3% | 2025-07-23 | |
| CVE-2025-43489 | HP Poly Clariti Manager insecure deserialization | 2.0CNA v4.0 | 0.3% | 2025-07-23 | Fix |
| CVE-2025-43488 | HP Poly Clariti Manager cross-site scripting | 2.0CNA v4.0 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-43487 | HP Poly Clariti Manager Sudo configuration privilege escalation | 6.9CNA v4.0 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-43486 | HP Poly Clariti Manager stored cross-site scripting | 5.7CNA v4.0 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-43485 | HP Poly Clariti Manager log files information disclosure | 5.7CNA v4.0 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-43484 | HP Poly Clariti Manager reflected cross-site scripting | 6.0CNA v4.0 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-43483 | HP Poly Clariti Manager hard-coded cryptographic key | 5.9CNA v4.0 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-42947 | Code injection vulnerability in SAP FICA ODN framework | 5.5CNA v3.1 | 0.3% | 2025-07-23 | Fix |
| CVE-2025-41687 | Weidmueller: Unauthenticated stack-based buffer overflow in u-link Management API | 9.8CNA v3.1 | 0.7% | 2025-07-23 | Fix |
| CVE-2025-41684 | Weidmueller: Root command injection via Unsanitized Input in tls_iotgen_setting endpoint | 8.8CNA v3.1 | 0.7% | 2025-07-23 | Fix |
| CVE-2025-41683 | Weidmueller: Root command injection via Unsanitized Input in event_mail_test endpoint | 8.8CNA v3.1 | 0.7% | 2025-07-23 | Fix |
| CVE-2025-40599 | SonicWall SMA 100 Series arbitrary file upload | 9.1CISA ADP v3.1 | 9.7% | 2025-07-23 | Fix |
| CVE-2025-40598 | SonicWall SMA 100 Series SMA100 series web interface reflected cross-site scripting | 6.1CISA ADP v3.1 | 46.2% | 2025-07-23 | Emerging ThreatsFix |
| CVE-2025-40597 | SonicWall SMA 100 Series SMA100 series web interface heap-based buffer overflow | 7.5CISA ADP v3.1 | 22.7% | 2025-07-23 | Emerging ThreatsFix |
| CVE-2025-40596 | SonicWall SMA 100 Series SMA100 series web interface stack-based buffer overflow | 7.3CISA ADP v3.1 | 45.0% | 2025-07-23 | Emerging ThreatsFix |
| CVE-2025-36117 | IBM Db2 Mirror for i session fixation | 6.3CNA v3.1 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-36116 | IBM Db2 Mirror for i cross-site websocket hijacking | 6.3CNA v3.1 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-33077 | IBM Engineering Systems Design Rhapsody code execution | 8.8CNA v3.1 | 0.4% | 2025-07-23 | Fix |
| CVE-2025-33076 | IBM Engineering Systems Design Rhapsody code execution | 8.8CNA v3.1 | 0.4% | 2025-07-23 | Fix |
| CVE-2025-33020 | IBM Engineering Systems Design Rhapsody information disclosure | 5.9CNA v3.1 | 0.1% | 2025-07-23 | Fix |
| CVE-2025-32019 | Harbor's repository description page allows for XSS | 4.1CNA v3.1 | 0.3% | 2025-07-23 | Fix |
| CVE-2025-31701 | Dahua IPC buffer overflow | 8.1CNA v3.1 | 0.8% | 2025-07-23 | |
| CVE-2025-31700 | Dahua IPC buffer overflow | 8.1CNA v3.1 | 0.9% | 2025-07-23 | Exploit code |
| CVE-2025-27930 | ManageEngine Applications Manager stored XSS | 6.4CNA v3.1 | 0.4% | 2025-07-23 | Fix |
| CVE-2025-8070 | ASUSTOR ABP and AES unquoted service path | 9.2CNA v4.0 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-8069 | Local privilege escalation vulnerability in AWS Client VPN Windows Client | 7.3CNA v4.0 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-8060 | Tenda AC23 httpd setMacFilterCfg sub_46C940 stack-based overflow | 8.7CNA v4.0 | 0.8% | 2025-07-23 | |
| CVE-2025-8058 | The GNU C Library glibc double free | 5.9CNA v4.0 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-8021 | files-bucket-server vulnerable to directory traversal | 8.7CNA v4.0 | 0.8% | 2025-07-23 | |
| CVE-2025-8020 | private-ip vulnerable to server-side request forgery | 8.8CNA v4.0 | 0.3% | 2025-07-23 | |
| CVE-2025-7722 | Social Streams WordPress plugin authenticated (Subscriber+) privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-07-23 | |
| CVE-2025-6261 | Fleetwire Fleet Management WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-6215 | Omnishop /users/register endpoint missing authorization | 5.3CNA v3.1 | 0.3% | 2025-07-23 | |
| CVE-2025-6214 | Omnishop WordPress plugin cross-site request forgery to arbitrary user deletion | 6.5CNA v3.1 | 0.2% | 2025-07-23 | |
| CVE-2025-6190 | Realty Portal Agent WordPress plugin missing authorization authenticated privilege escalation | 8.8CNA v3.1 | 0.5% | 2025-07-23 | |
| CVE-2025-6174 | WordPress Qwizcards plugin reflected XSS | 6.1CISA ADP v3.1 | 0.5% | 2025-07-23 | NucleiFix |
| CVE-2025-6054 | YANewsflash WordPress plugin cross-site request forgery to stored cross-site scripting | 6.1CNA v3.1 | 0.1% | 2025-07-23 | |
| CVE-2025-6018 | Pam-config: Lpe from unprivileged to allow_active in pam | 7.8CNA v3.1 | 1.1% | 2025-07-23 | Exploit codeKCVFix |
| CVE-2025-5818 | Featured Image Plus Quick and Bulk Edit with Unsplash WordPress plugin server-side request forgery | 5.5CNA v3.1 | 0.3% | 2025-07-23 | Fix |
| CVE-2025-5753 | Valuation Calculator WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-07-23 | Fix |
| CVE-2025-4700 | Improper neutralization of input during web page generation (cross-site scripting) in GitLab | 8.7CNA v3.1 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-4439 | Improper neutralization of input during web page generation (cross-site scripting) in GitLab | 7.7CNA v3.1 | 0.3% | 2025-07-23 | Fix |
| CVE-2025-4411 | XSS in Dataprom Informatics' PACS-ACSS | 6.5CNA v3.1 | 0.3% | 2025-07-23 | Fix |
| CVE-2025-4296 | Open redirect in HotelRunner's B2B | 4.7CNA v3.1 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-2634 | Out-of-bounds read vulnerability in NI LabVIEW when building font map | 7.3CNA v4.0 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-2633 | Out-of-bounds read vulnerability in NI LabVIEW when loading fonts | 7.3CNA v4.0 | 0.2% | 2025-07-23 | Fix |
| CVE-2025-54141 | ViewVC's standalone server exposes arbitrary server filesystem content | 7.5CNA v3.1 | 0.9% | 2025-07-22 | Fix |
| CVE-2025-54140 | pyLoad has path traversal vulnerability in json/upload endpoint that allows arbitrary file write | 7.5CNA v3.1 | 0.7% | 2025-07-22 | Fix |
| CVE-2025-54138 | LibreNMS has authenticated local file inclusion in ajax_form.php that allows RCE | 7.5CNA v3.1 | 1.1% | 2025-07-22 | Fix |
| CVE-2025-54137 | haxtheweb issues NodeJS version of the HAX CMS application is distributed with Default Secrets | 7.3CNA v3.1 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-54072 | yt-dlp OS command injection | 7.5CNA v3.1 | 0.6% | 2025-07-22 | Fix |
| CVE-2025-53703 | DuraComm DP-10iN-100-MU cleartext transmission of sensitive information | 8.7CNA v4.0 | 0.1% | 2025-07-22 | Fix |
| CVE-2025-53538 | Suricata's mishandling of data on HTTP2 stream 0 can lead to resource starvation | 7.5CNA v3.1 | 0.5% | 2025-07-22 | Fix |
| CVE-2025-53472 | ELECOM WRC-BE36QS-B OS command injection | 8.6CNA v4.0 | 1.1% | 2025-07-22 | |
| CVE-2025-52580 | Gift Pad "region PAY" App sensitive information in log files | 2.4CNA v4.0 | 0.2% | 2025-07-22 | |
| CVE-2025-51867 | Deepfiction AI insecure direct object reference | 6.5CISA ADP v3.1 | 0.3% | 2025-07-22 | |
| CVE-2025-51865 | Ai2 Playground insecure direct object reference | 8.8CISA ADP v3.1 | 0.4% | 2025-07-22 | Exploit code |
| CVE-2025-51864 | AIBOX LLM chat reflected cross-site scripting | 6.5CISA ADP v3.1 | 0.4% | 2025-07-22 | |
| CVE-2025-51863 | ChatGPT Unli Self cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-07-22 | |
| CVE-2025-51862 | TelegAI insecure direct object reference | 6.1CISA ADP v3.1 | 0.2% | 2025-07-22 | |
| CVE-2025-51860 | TelegAI stored cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-07-22 | |
| CVE-2025-51859 | Chaindesk thru stored cross-site scripting | 6.5CISA ADP v3.1 | 0.4% | 2025-07-22 | |
| CVE-2025-51858 | ChatPlayground.ai Self cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-07-22 | Exploit code |
| CVE-2025-51482 | letta remote code execution | 8.8CISA ADP v3.1 | 1.9% | 2025-07-22 | Reported exploitedNucleiExploit code |
| CVE-2025-51481 | Dagster local file inclusion | 6.6CISA ADP v3.1 | 0.5% | 2025-07-22 | Fix |
| CVE-2025-51480 | onnx allows arbitrary file overwrite in download_model_with_test_data | 8.8CISA ADP v3.1 | 0.6% | 2025-07-22 | Fix |
| CVE-2025-51479 | onyx update_user_group authorization bypass | 5.4CISA ADP v3.1 | 0.3% | 2025-07-22 | |
| CVE-2025-51475 | SuperAGI arbitrary file write | 5.0CISA ADP v3.1 | 0.8% | 2025-07-22 | |
| CVE-2025-51472 | SuperAGI code injection | 6.5CISA ADP v3.1 | 0.4% | 2025-07-22 | |
| CVE-2025-51471 | Ollama vulnerable to Cross-Domain token exposure | 6.9CISA ADP v3.1 | 18.5% | 2025-07-22 | Exploit code |
| CVE-2025-51464 | Aim vulnerable to cross-site scripting | 8.8CISA ADP v3.1 | 0.6% | 2025-07-22 | |
| CVE-2025-51463 | Aimstack aim restore_run_backup path traversal | 7.0CISA ADP v3.1 | 0.5% | 2025-07-22 | |
| CVE-2025-51462 | infiniflow ragflow api.apps.dialog_app.set_dialog stored cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-07-22 | |
| CVE-2025-51459 | DB-GPT command injection | 6.5CISA ADP v3.1 | 0.3% | 2025-07-22 | |
| CVE-2025-51458 | DB-GPT editor_sql_run and query_ex in eosphoros-ai SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-07-22 | Exploit code |
| CVE-2025-48964 | iputils integer overflow | 6.5CNA v3.1 | 0.4% | 2025-07-22 | Fix |
| CVE-2025-48733 | DuraComm DP-10iN-100-MU missing authentication for critical function | 8.7CNA v4.0 | 0.4% | 2025-07-22 | Fix |
| CVE-2025-48498 | Bloomberg Comdb2 Distributed Transaction component null pointer dereference | 7.5CNA v3.1 | 0.6% | 2025-07-22 | |
| CVE-2025-46354 | Bloomberg Comdb2 denial of service | 7.5CNA v3.1 | 0.8% | 2025-07-22 | Emerging Threats |
| CVE-2025-46267 | ELECOM WRC-BE36QS-B hidden functionality | 6.9CNA v4.0 | 0.3% | 2025-07-22 | |
| CVE-2025-43022 | HP Poly Clariti Manager SQL injection | 7.3CNA v4.0 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-43021 | HP Poly Clariti Manager default credentials | 5.9CNA v4.0 | 0.2% | 2025-07-22 | Fix |
| CVE-2025-43020 | HP Poly Clariti Manager command injection | 5.7CNA v4.0 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-41425 | DuraComm DP-10iN-100-MU cross-site scripting | 7.2CNA v4.0 | 0.4% | 2025-07-22 | Fix |
| CVE-2025-38352 | Linux Kernel time-of-check time-of-use (TOCTOU) race condition | 7.8CNA v3.1 | 1.3% | 2025-07-22 | KEVExploit codeFix |
| CVE-2025-36520 | Bloomberg Comdb2 null pointer dereference | 7.5CNA v3.1 | 0.9% | 2025-07-22 | Emerging Threats |
| CVE-2025-36512 | Bloomberg Comdb2 A denial of service | 7.5CNA v3.1 | 0.5% | 2025-07-22 | |
| CVE-2025-35966 | Bloomberg Comdb2 CDB2SQLQUERY protocol buffer message handling null pointer dereference | 7.5CNA v3.1 | 0.6% | 2025-07-22 | |
| CVE-2025-34143 | ETQ Reliance CG authentication bypass via Trailing Space RCE | 9.3CNA v4.0 | 38.0% | 2025-07-22 | NucleiFix |
| CVE-2025-34142 | ETQ Reliance CG (legacy) XML external entity injection | 6.9CNA v4.0 | 0.9% | 2025-07-22 | Fix |
| CVE-2025-34141 | ETQ Reliance CG (legacy) reflected cross-site scripting | 5.1CNA v4.0 | 1.9% | 2025-07-22 | NucleiFix |
| CVE-2025-34140 | ETQ Reliance CG/NXG API authorization bypass via ;localized-text URI Suffix | 8.7CNA v4.0 | 0.6% | 2025-07-22 | Fix |
| CVE-2025-31513 | An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can elevate to administrator privileges via the IsAdminApprover parameter in a Request%20Building%20Access requestSubmit API call. The vendor has stated that the system is protected by updating to a version equal to or greater tha | 6.5CISA ADP v3.1 | 0.3% | 2025-07-22 | |
| CVE-2025-31512 | An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval via isAddedByApprover in a Request%20Building%20Access requestSubmit API call. The vendor has stated that the system is protected by updating to a version equal to or greater than one of the following b | 7.3CISA ADP v3.1 | 0.4% | 2025-07-22 | |
| CVE-2025-31511 | An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval by changing the user ID in a Request%20Building%20Access requestSubmit API call. The vendor has stated that the system is protected by updating to a version equal to or greater than one of the following | 7.3CISA ADP v3.1 | 0.4% | 2025-07-22 | |
| CVE-2025-8044 | Mozilla memory safety bugs fixed in Firefox 141 and Thunderbird 141 | 9.8CISA ADP v3.1 | 0.4% | 2025-07-22 | Fix |
| CVE-2025-8043 | Mozilla Firefox incorrect URL truncation | 9.8CISA ADP v3.1 | 0.4% | 2025-07-22 | Fix |
| CVE-2025-8040 | Mozilla memory safety bugs fixed in Firefox ESR, Thunderbird ESR, Firefox 141 and Thunderbird 141 | 8.8CISA ADP v3.1 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-8039 | Mozilla Firefox search terms persisted in URL bar | 8.1CISA ADP v3.1 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-8038 | Mozilla Firefox CSP frame-src was not correctly enforced for paths | 9.8CISA ADP v3.1 | 0.2% | 2025-07-22 | Fix |
| CVE-2025-8037 | Mozilla Firefox nameless cookies shadow secure cookies | 9.1CISA ADP v3.1 | 0.2% | 2025-07-22 | Fix |
| CVE-2025-8036 | Mozilla Firefox DNS rebinding circumvents CORS | 8.1CISA ADP v3.1 | 0.4% | 2025-07-22 | Fix |
| CVE-2025-8035 | Mozilla Firefox memory safety bugs | 8.8CISA ADP v3.1 | 0.4% | 2025-07-22 | Fix |
| CVE-2025-8034 | Mozilla Firefox memory safety bugs | 8.8CISA ADP v3.1 | 0.4% | 2025-07-22 | Fix |
| CVE-2025-8033 | Mozilla Firefox incorrect JavaScript state machine for generators | 6.5CISA ADP v3.1 | 0.4% | 2025-07-22 | Fix |
| CVE-2025-8032 | Mozilla Firefox XSLT documents could bypass CSP | 8.1CISA ADP v3.1 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-8031 | Mozilla Firefox incorrect URL stripping in CSP reports | 9.8CISA ADP v3.1 | 0.5% | 2025-07-22 | Fix |
| CVE-2025-8030 | Mozilla Firefox potential user-assisted code execution in Copy as cURL command | 8.1CISA ADP v3.1 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-8029 | Mozilla Firefox javascript: URLs executed on object and embed tags | 8.1CISA ADP v3.1 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-8028 | Mozilla Firefox large branch table could lead to truncated instruction | 9.8CISA ADP v3.1 | 0.5% | 2025-07-22 | Fix |
| CVE-2025-8027 | Mozilla Firefox JavaScript engine only wrote partial return value to stack | 6.5CISA ADP v3.1 | 0.4% | 2025-07-22 | Fix |
| CVE-2025-8019 | Shenzhen Libituo Technology LBT-T300-T310 appy.cgi sub_40B6F0 buffer overflow | 8.7CNA v4.0 | 0.8% | 2025-07-22 | |
| CVE-2025-8018 | code-projects Food Ordering Review System reservation_page.php SQL injection | 8.8v3.1 | 0.4% | 2025-07-22 | Exploit code |
| CVE-2025-8017 | Tenda AC7 httpd setMacFilterCfg formSetMacFilterCfg stack-based overflow | 8.7CNA v4.0 | 13.2% | 2025-07-22 | Emerging Threats |
| CVE-2025-8015 | Shortcodes Ultimate WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-07-22 | Fix |
| CVE-2025-8011 | Google Chrome V8 type confusion | 8.8CISA ADP v3.1 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-8010 | Google Chrome V8 type confusion | 8.8CISA ADP v3.1 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-7953 | Sanluan PublicCMS viewer.html redirect | 6.1v3.1 | 0.3% | 2025-07-22 | |
| CVE-2025-7952 | TOTOLINK T6 MQTT Packet wireless.so ckeckKeepAlive command injection | 8.8v3.1 | 24.5% | 2025-07-22 | Emerging Threats |
| CVE-2025-7951 | code-projects Public Chat Room send_message.php cross-site scripting | 5.4v3.1 | 0.3% | 2025-07-22 | |
| CVE-2025-7950 | code-projects Public Chat Room login.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-22 | |
| CVE-2025-7949 | Sanluan PublicCMS preview.html redirect | 6.1v3.1 | 0.3% | 2025-07-22 | |
| CVE-2025-7948 | jshERP updatePwd password recovery | 6.5v3.1 | 0.4% | 2025-07-22 | |
| CVE-2025-7947 | jshERP Account delete improper authorization | 8.1v3.1 | 0.4% | 2025-07-22 | |
| CVE-2025-7946 | PHPGurukul Apartment Visitors Management System search-visitor.php cross-site scripting | 6.1v3.1 | 0.5% | 2025-07-22 | |
| CVE-2025-7945 | D-Link DIR-513 formSetWanDhcpplus buffer overflow | 8.7CNA v4.0 | 7.1% | 2025-07-22 | Emerging Threats |
| CVE-2025-7900 | Insecure direct object reference in extension femanager (femanager) | 5.3CNA v4.0 | 0.2% | 2025-07-22 | Fix |
| CVE-2025-7899 | Insecure direct object reference in extension powermail (powermail) | 6.0CNA v4.0 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-7766 | Lantronix Provisioning Manager improper restriction of XML external entity reference | 8.6CNA v4.0 | 1.8% | 2025-07-22 | Exploit codeFix |
| CVE-2025-7724 | Unauthenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2 | 8.7CNA v4.0 | 0.9% | 2025-07-22 | Fix |
| CVE-2025-7723 | Authenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2 | 8.5CNA v4.0 | 0.8% | 2025-07-22 | Fix |
| CVE-2025-7705 | ABB Switch Actuator 4 DU-83330 authentication bypass due to compatibility mode enabled by default | 8.6CNA v4.0 | 0.2% | 2025-07-22 | |
| CVE-2025-7692 | Orion Login with SMS WordPress plugin authentication bypass via Weak OTP | 8.1CNA v3.1 | 0.5% | 2025-07-22 | |
| CVE-2025-7687 | Latest Post Accordian Slider WordPress plugin cross-site request forgery | 6.1CNA v3.1 | 0.1% | 2025-07-22 | |
| CVE-2025-7685 | Like and Share My Site WordPress plugin cross-site request forgery to stored cross-site scripting | 6.1CNA v3.1 | 0.1% | 2025-07-22 | |
| CVE-2025-7645 | Extensions For CF7 WordPress plugin unauthenticated arbitrary file deletion Triggered | 8.1CNA v3.1 | 0.8% | 2025-07-22 | Fix |
| CVE-2025-7644 | Pixel Gallery Addons for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-07-22 | Fix |
| CVE-2025-7495 | WP-Members WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-7427 | Uncontrolled search path element in Arm Development Studio | 5.9v3.1 | 0.2% | 2025-07-22 | Fix |
| CVE-2025-7371 | Okta On-Premises Provisioning Agent sensitive information in log files | 6.8CNA v3.1 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-6831 | User Registration WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-6741 | Devolutions Server secure message component improper access control | 7.1CNA v4.0 | 0.4% | 2025-07-22 | Fix |
| CVE-2025-6585 | WP JobHunt WordPress plugin insecure direct object reference to arbitrary account deletion | 8.1CNA v3.1 | 0.4% | 2025-07-22 | |
| CVE-2025-6523 | Devolutions Server emergency authentication component weak credentials | 9.5CNA v4.0 | 0.4% | 2025-07-22 | Fix |
| CVE-2025-6213 | Nginx Cache Purge Preload WordPress plugin authenticated (Administrator+) remote code execution | 7.2CNA v3.1 | 0.7% | 2025-07-22 | Fix |
| CVE-2025-6187 | bSecure - missing authorization to unauthenticated privilege escalation via order_info REST endpoint | 9.8CNA v3.1 | 0.7% | 2025-07-22 | |
| CVE-2025-6082 | Birth Chart Compatibility WordPress plugin unauthenticated full path exposure | 5.3CNA v3.1 | 1.6% | 2025-07-22 | Exploit code |
| CVE-2025-5240 | CRM and Lead Management by vcita WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-07-22 | Fix |
| CVE-2025-5042 | Autodesk Revit RFA File Parsing out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-07-22 | Fix |