CVE-2025 records published in July 2025
Page four of four: records 3,001 to 3,582 of the 3,582 published in July 2025, newest first. The first page carries the figures for July 2025.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-7110 | Portabilis i-Educar School module educar_escola_lst.php cross-site scripting | 5.4v3.1 | 0.3% | 2025-07-07 | |
| CVE-2025-7109 | Portabilis i-Educar Student Benefits Registration cross-site scripting | 5.4v3.1 | 0.3% | 2025-07-07 | |
| CVE-2025-7108 | risesoft-y9 Digital-Infrastructure Y9FileController.java deleteFile path traversal | 5.3CNA v4.0 | 0.4% | 2025-07-07 | |
| CVE-2025-7107 | SimStudioAI Sim route.ts handleLocalFile path traversal | 7.5v3.1 | 0.9% | 2025-07-07 | |
| CVE-2025-7103 | BoyunCMS curl Index.php server-side request forgery | 7.5v3.1 | 0.4% | 2025-07-07 | |
| CVE-2025-7102 | BoyunCMS Server.php SQL injection | 9.8v3.1 | 0.3% | 2025-07-07 | |
| CVE-2025-7101 | BoyunCMS Configuration file install_ok.php code injection | 9.8v3.1 | 0.4% | 2025-07-07 | |
| CVE-2025-7100 | BoyunCMS Index.php unrestricted upload | 9.8v3.1 | 0.3% | 2025-07-07 | |
| CVE-2025-7099 | BoyunCMS Installation install2.php deserialization | 5.9v3.1 | 0.4% | 2025-07-07 | |
| CVE-2025-7057 | Wikimedia Foundation Mediawiki stored XSS in Quiz | 5.4CISA ADP v3.1 | 0.2% | 2025-07-07 | Fix |
| CVE-2025-7056 | Wikimedia Foundation Mediawiki stored XSS in UrlShortener | 6.3CISA ADP v3.1 | 0.2% | 2025-07-07 | Fix |
| CVE-2025-6811 | Mescius ActiveReports.NET TypeResolutionService class deserialization of untrusted data | 9.8CNA v3.0 | 0.8% | 2025-07-07 | |
| CVE-2025-6810 | Mescius ActiveReports.NET ReadValue deserialization of untrusted data remote code execution | 9.8CNA v3.0 | 0.8% | 2025-07-07 | |
| CVE-2025-6807 | Marvell QConvergeConsole getDriverTmpPath directory traversal information disclosure | 7.5v3.1 | 1.1% | 2025-07-07 | |
| CVE-2025-6806 | Marvell QConvergeConsole decryptFile directory traversal arbitrary file write | 7.5v3.1 | 1.2% | 2025-07-07 | |
| CVE-2025-6805 | Marvell QConvergeConsole deleteEventLogFile directory traversal arbitrary file deletion | 9.1v3.1 | 1.1% | 2025-07-07 | |
| CVE-2025-6804 | Marvell QConvergeConsole compressFirmwareDumpFiles directory traversal information disclosure | 7.5CNA v3.0 | 1.4% | 2025-07-07 | |
| CVE-2025-6803 | Marvell QConvergeConsole compressDriverFiles directory traversal information disclosure | 7.5CNA v3.0 | 1.4% | 2025-07-07 | |
| CVE-2025-6802 | Marvell QConvergeConsole getFileFromURL unrestricted file upload remote code execution | 9.8CNA v3.0 | 0.7% | 2025-07-07 | |
| CVE-2025-6801 | Marvell QConvergeConsole saveNICParamsToFile directory traversal arbitrary file write | 7.5v3.1 | 1.2% | 2025-07-07 | |
| CVE-2025-6800 | Marvell QConvergeConsole restoreESwitchConfig directory traversal information disclosure | 7.5CNA v3.0 | 1.4% | 2025-07-07 | |
| CVE-2025-6799 | Marvell QConvergeConsole getFileUploadBytes directory traversal information disclosure | 7.5CNA v3.0 | 1.4% | 2025-07-07 | |
| CVE-2025-6798 | Marvell QConvergeConsole deleteAppFile directory traversal arbitrary file deletion | 9.1v3.1 | 1.3% | 2025-07-07 | |
| CVE-2025-6797 | Marvell QConvergeConsole getFileUploadBytes directory traversal information disclosure | 7.5CNA v3.0 | 1.4% | 2025-07-07 | |
| CVE-2025-6796 | Marvell QConvergeConsole getAppFileBytes directory traversal information disclosure | 7.5CNA v3.0 | 1.4% | 2025-07-07 | |
| CVE-2025-6795 | Marvell QConvergeConsole getFileUploadSize directory traversal information disclosure | 7.5v3.1 | 1.1% | 2025-07-07 | |
| CVE-2025-6794 | Marvell QConvergeConsole saveAsText directory traversal remote code execution | 9.8CNA v3.0 | 1.5% | 2025-07-07 | |
| CVE-2025-6793 | Marvell QConvergeConsole QLogicDownloadImpl class path traversal | 9.4CNA v3.0 | 18.2% | 2025-07-07 | Metasploit |
| CVE-2025-6714 | MongoDB Server mongos load balancer support denial of service | 7.5CNA v3.1 | 0.3% | 2025-07-07 | Fix |
| CVE-2025-6713 | MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage | 7.7CNA v3.1 | 0.4% | 2025-07-07 | Exploit codeFix |
| CVE-2025-6712 | MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation | 6.5CNA v3.1 | 0.3% | 2025-07-07 | Fix |
| CVE-2025-6711 | Incomplete Redaction of Sensitive Information in MongoDB Server Logs | 4.4CNA v3.1 | 0.3% | 2025-07-07 | Fix |
| CVE-2025-6663 | GStreamer H266 Codec Parsing stack-based buffer overflow remote code execution | 7.8CNA v3.0 | 0.4% | 2025-07-07 | Fix |
| CVE-2025-6386 | parisneo/lollms lord of Large Language Models vulnerable to observable discrepancy attack | 7.5CNA v3.0 | 0.4% | 2025-07-07 | Fix |
| CVE-2025-6210 | Hardlink-based path traversal in run-llama/llama_index | 6.2CNA v3.0 | 0.3% | 2025-07-07 | Fix |
| CVE-2025-6209 | Arbitrary file read through path traversal in run-llama/llama_index | 7.5CNA v3.0 | 0.6% | 2025-07-07 | Fix |
| CVE-2025-6044 | Google ChromeOS Stylus tools component improper access control | 6.1CISA ADP v3.1 | 0.1% | 2025-07-07 | Fix |
| CVE-2025-5987 | Libssh: Invalid return code for chacha20 poly1305 with openssl backend | 8.1NVD v3.1 | 1.7% | 2025-07-07 | Fix |
| CVE-2025-5472 | Denial of service via Uncontrolled Recursive JSON Parsing in JSONReader in run-llama/llama_index | 6.5CNA v3.0 | 0.4% | 2025-07-07 | Fix |
| CVE-2025-4779 | Stored cross-site scripting (XSS) in lunary-ai/Lunary | 6.1NVD v3.1 | 0.4% | 2025-07-07 | Fix |
| CVE-2025-3920 | Hard-coded password in SUR-FBD CMMS | 8.5CNA v4.0 | 0.1% | 2025-07-07 | Fix |
| CVE-2025-3777 | Improper input validation in huggingface/Transformers | 3.5CNA v3.0 | 0.4% | 2025-07-07 | Fix |
| CVE-2025-3705 | Frauscher FDS102 OS command injection via USB Config Load | 6.8CNA v3.1 | 0.7% | 2025-07-07 | Fix |
| CVE-2025-3626 | Frauscher FDS102 OS command injection via Config upload in WebUI | 9.1CNA v3.1 | 0.9% | 2025-07-07 | Fix |
| CVE-2025-3467 | XSS vulnerability in langgenius/dify | 5.4NVD v3.1 | 0.4% | 2025-07-07 | Fix |
| CVE-2025-3466 | LangGenius Dify code node sandbox vulnerability | 7.2NVD v3.1 | 0.8% | 2025-07-07 | Fix |
| CVE-2025-3264 | Regular expression denial of service (ReDoS) in huggingface/Transformers | 5.3CNA v3.0 | 0.5% | 2025-07-07 | Fix |
| CVE-2025-3263 | Regular expression denial of service (ReDoS) in huggingface/Transformers | 5.3CNA v3.0 | 0.5% | 2025-07-07 | Fix |
| CVE-2025-3262 | Regular expression denial of service (ReDoS) in huggingface/Transformers | 7.5v3.1 | 0.4% | 2025-07-07 | Fix |
| CVE-2025-3225 | XML entity expansion vulnerability in run-llama/llama_index | 7.5CNA v3.0 | 0.4% | 2025-07-07 | Fix |
| CVE-2025-3046 | Path traversal via Symbolic Links in run-llama/llama_index | 7.5CNA v3.0 | 0.6% | 2025-07-07 | Fix |
| CVE-2025-3044 | MD5 Hash Collision in run-llama/llama_index | 5.3CNA v3.0 | 0.3% | 2025-07-07 | Fix |
| CVE-2025-1351 | IBM Storage Virtualize privilege escalation | 6.7CNA v3.1 | 0.1% | 2025-07-07 | Fix |
| CVE-2025-38235 | In the Linux kernel, the following vulnerability has been resolved: HID: appletb-kbd: fix "appletb_backlight" backlight device reference counting During appletb_kbd_probe, probe attempts to get the backlight device by name. When this happens backlight_device_get_by_name looks for a device in the b | 5.5v3.1 | 0.1% | 2025-07-06 | Fix |
| CVE-2025-27446 | Apache APISIX Java Plugin Runner incorrect permission assignment | 7.8CISA ADP v3.1 | 0.2% | 2025-07-06 | Fix |
| CVE-2025-7098 | Comodo Internet Security Premium File Name path traversal | 8.8v3.1 | 0.7% | 2025-07-06 | |
| CVE-2025-7097 | Comodo Internet Security Premium Manifest file cis_update_x64.xml os command injection | 8.8NVD v3.1 | 4.2% | 2025-07-06 | |
| CVE-2025-7096 | Comodo Internet Security Premium Manifest file cis_update_x64.xml integrity check | 8.8NVD v3.1 | 0.5% | 2025-07-06 | |
| CVE-2025-7095 | Comodo Internet Security Premium Update certificate validation | 6.1v3.1 | 0.3% | 2025-07-06 | |
| CVE-2025-7094 | Belkin F9K1122 webs formBSSetSitesurvey stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-07-06 | |
| CVE-2025-7093 | Belkin F9K1122 webs formSetLanguage stack-based overflow | 8.7CNA v4.0 | 6.8% | 2025-07-06 | Emerging Threats |
| CVE-2025-7092 | Belkin F9K1122 webs formWlanSetupWPS stack-based overflow | 8.7CNA v4.0 | 6.8% | 2025-07-06 | Emerging Threats |
| CVE-2025-7091 | Belkin F9K1122 webs formWlanMP stack-based overflow | 8.7CNA v4.0 | 7.7% | 2025-07-06 | Emerging Threats |
| CVE-2025-7090 | Belkin F9K1122 webs formConnectionSetting stack-based overflow | 8.7CNA v4.0 | 6.8% | 2025-07-06 | Emerging Threats |
| CVE-2025-7089 | Belkin F9K1122 webs formWanTcpipSetup stack-based overflow | 8.7CNA v4.0 | 6.8% | 2025-07-06 | Emerging Threats |
| CVE-2025-7088 | Belkin F9K1122 webs formPPPoESetup stack-based overflow | 8.7CNA v4.0 | 13.8% | 2025-07-06 | Emerging Threats |
| CVE-2025-7087 | Belkin F9K1122 webs formL2TPSetup stack-based overflow | 8.7CNA v4.0 | 13.4% | 2025-07-06 | Emerging Threats |
| CVE-2025-7086 | Belkin F9K1122 webs formPPTPSetup stack-based overflow | 8.7CNA v4.0 | 5.5% | 2025-07-06 | Emerging Threats |
| CVE-2025-7085 | Belkin F9K1122 webs formiNICWpsStart stack-based overflow | 8.7CNA v4.0 | 1.3% | 2025-07-06 | Emerging Threats |
| CVE-2025-7084 | Belkin F9K1122 webs formWpsStart stack-based overflow | 8.7CNA v4.0 | 1.5% | 2025-07-06 | Emerging Threats |
| CVE-2025-7083 | Belkin F9K1122 webs mp os command injection | 8.8v3.1 | 46.3% | 2025-07-06 | Emerging Threats |
| CVE-2025-7082 | Belkin F9K1122 webs formBSSetSitesurvey os command injection | 8.8v3.1 | 17.1% | 2025-07-06 | Emerging Threats |
| CVE-2025-7081 | Belkin F9K1122 webs formSetWanStatic os command injection | 8.8v3.1 | 19.9% | 2025-07-06 | Emerging Threats |
| CVE-2025-7080 | Done-0 Jank JWT Token jwt_utils.go hard-coded password | 6.3CNA v4.0 | 0.4% | 2025-07-06 | |
| CVE-2025-7079 | mao888 bluebell-plus JWT Token jwt.go hard-coded password | 8.1v3.1 | 0.8% | 2025-07-06 | |
| CVE-2025-7078 | 07FLYCMS/07FLY-CMS/07FlyCRM cross-site request forgery | 5.3CNA v4.0 | 0.3% | 2025-07-06 | |
| CVE-2025-7077 | Shenzhen Libituo Technology LBT-T300-T310 appy.cgi config_3g_para buffer overflow | 8.7CNA v4.0 | 1.1% | 2025-07-06 | |
| CVE-2025-7076 | BlackVue Dashcam 590X Configuration upload.cgi access control | 8.8v3.1 | 0.8% | 2025-07-06 | |
| CVE-2025-7075 | BlackVue Dashcam 590X HTTP endpoint upload.cgi unrestricted upload | 8.8v3.1 | 0.9% | 2025-07-06 | |
| CVE-2025-5333 | Unauthenticated remote code execution in IT Management Suite | 9.5CNA v4.0 | 0.7% | 2025-07-06 | Emerging ThreatsFix |
| CVE-2025-3108 | run-llama/llama_index critical deserialization of untrusted data | 7.5v3.1 | 0.4% | 2025-07-06 | Fix |
| CVE-2025-53605 | Crash due to uncontrolled recursion in protobuf crate | 5.9CNA v3.1 | 0.4% | 2025-07-05 | Fix |
| CVE-2025-53604 | pimeys web-push rust Web Push is vulnerable to a DoS attack | 4.0CNA v3.1 | 0.4% | 2025-07-05 | Fix |
| CVE-2025-53603 | Alinto SOPE null pointer dereference | 7.5CNA v3.1 | 0.7% | 2025-07-05 | Fix |
| CVE-2025-47228 | Scriptcase OS command injection | 6.7CNA v3.1 | 23.1% | 2025-07-05 | Exploit codeKCV |
| CVE-2025-47227 | Scriptcase incorrect behavior | 7.5CNA v3.1 | 2.1% | 2025-07-05 | Exploit codeKCV |
| CVE-2025-43711 | Tunnelblick incomplete cleanup | 8.1CNA v3.1 | 0.2% | 2025-07-05 | Fix |
| CVE-2025-26850 | Quest KACE Systems Management Appliance incorrect authorization | 9.3CNA v3.1 | 0.2% | 2025-07-05 | Fix |
| CVE-2025-7074 | vercel hyper rimraf-standalone.js ignoreMap redos | 7.5v3.1 | 0.6% | 2025-07-05 | |
| CVE-2025-53602 | Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint | 5.3CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-53600 | NAVER Whale browser origin validation error | 7.5CISA ADP v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-53599 | NAVER Whale browser cross-site scripting | 9.8CISA ADP v3.1 | 0.4% | 2025-07-04 | Fix |
| CVE-2025-53569 | Trust Payments Gateway for WooCommerce WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.1% | 2025-07-04 | Fix |
| CVE-2025-53568 | Radio Station WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-07-04 | Fix |
| CVE-2025-53566 | WP Visitor Statistics (Real Time Traffic) WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-53485 | Wikimedia MediaWiki SecurePoll extension missing authorization | 7.5CISA ADP v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-53484 | Wikimedia Foundation Mediawiki SecurePoll: Multiple locations vulnerable to cross-site scripting | 9.8CISA ADP v3.1 | 0.5% | 2025-07-04 | Fix |
| CVE-2025-53483 | Wikimedia MediaWiki SecurePoll extension cross-site request forgery | 8.8CISA ADP v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-53482 | Wikimedia Foundation Mediawiki IPInfo: Message key XSS | 6.1CISA ADP v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-53481 | Wikimedia Foundation Mediawiki denial of service vector on ipinfo/v0/norevision | 7.5CISA ADP v3.1 | 0.5% | 2025-07-04 | Fix |
| CVE-2025-53366 | Model Context Protocol Python SDK FastMCP server request validation denial of service | 8.7CNA v4.0 | 9.3% | 2025-07-04 | Fix |
| CVE-2025-53365 | Model Context Protocol Python SDK streamable HTTP transport denial of service | 8.7CNA v4.0 | 0.4% | 2025-07-04 | Fix |
| CVE-2025-52833 | LMS WordPress theme SQL injection | 9.3CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-52832 | NGG Smart Image Search WordPress plugin SQL injection | 9.3CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-52831 | Video List Manager WordPress plugin SQL injection | 9.3CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-52830 | bSecure Your Universal Checkout WordPress plugin SQL injection | 9.3CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-52828 | Red Art WordPress theme PHP object injection | 8.8CNA v3.1 | 0.4% | 2025-07-04 | Fix |
| CVE-2025-52813 | WordPress MobiLoud plugin broken access control | 8.1CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-52807 | Kossy - Minimalist eCommerce WordPress theme local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-07-04 | |
| CVE-2025-52805 | Leyka WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.5% | 2025-07-04 | |
| CVE-2025-52798 | JobSearch WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-52796 | WordPress WP-Recall plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-07-04 | |
| CVE-2025-52776 | Video List Manager WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-07-04 | |
| CVE-2025-52718 | Alone WordPress theme arbitrary code execution | 7.2CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-52497 | mbedtls off-by-one error | 4.8CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-52496 | mbedtls race condition | 7.8v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-50039 | VG WORT METIS WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-50032 | Paytiko for WooCommerce WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-49870 | Paid Member Subscriptions WordPress plugin SQL injection | 7.5CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-49867 | RealHomes WordPress theme privilege escalation | 9.8CNA v3.1 | 0.4% | 2025-07-04 | Fix |
| CVE-2025-49866 | Beautiful Cookie Consent Banner WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-49809 | mtr inclusion of untrusted functionality | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-49601 | mbedtls out-of-bounds read | 6.5v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-49600 | mbedtls missing cryptographic step | 4.9CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-49431 | MF Plus WPML WordPress plugin settings Change vulnerability | 6.5CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-49418 | Allmart WordPress plugin server side request forgery (SSRF) | 7.2CNA v3.1 | 0.2% | 2025-07-04 | |
| CVE-2025-49417 | WooCommerce Product Multi-Action WordPress plugin deserialization of untrusted data | 9.8CNA v3.1 | 0.4% | 2025-07-04 | |
| CVE-2025-49414 | FW Gallery WordPress plugin arbitrary file upload | 10.0CNA v3.1 | 0.4% | 2025-07-04 | |
| CVE-2025-49303 | Frontend Admin by DynamiApps WordPress plugin arbitrary file download | 6.8CNA v3.1 | 0.5% | 2025-07-04 | Fix |
| CVE-2025-49302 | Easy Stripe WordPress plugin remote code execution (RCE) | 10.0CNA v3.1 | 0.4% | 2025-07-04 | Fix |
| CVE-2025-49274 | Neom Blog WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-49247 | Team Showcase WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-49245 | Testimonials Showcase WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-49070 | WordPress Elessi theme local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-07-04 | Fix |
| CVE-2025-48952 | NetAlertX has Password Bypass vulnerability due to Loose Comparison in PHP | 9.4CNA v3.1 | 0.6% | 2025-07-04 | Fix |
| CVE-2025-48231 | Booking Calendar Contact Form WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-48172 | CHMLib integer overflow | 5.6CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-47634 | WC Pickup Store WordPress plugin settings Change vulnerability | 6.5CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-47627 | PrivateContent - Mail Actions WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.6% | 2025-07-04 | |
| CVE-2025-47565 | EventON WordPress plugin broken access control | 6.3CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-47479 | WP Compress WordPress plugin broken authentication | 9.8v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-46733 | optee_os REE userspace code can panic TAs, leading to fTPM PCR reset and data disclosure | 7.9CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-39487 | Rankie WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-38234 | Linux kernel real-time scheduler race condition | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38233 | Linux kernel powerpc64 ftrace livepatching vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38232 | Linux kernel NFS server exports proc registration race condition | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38231 | Linux kernel nfsd null pointer dereference | 5.5NVD v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38230 | Linux kernel JFS vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38229 | Linux kernel cxusb DVB USB driver vulnerability | 5.5v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38228 | Linux kernel imagination memory leak | 5.5v3.1 | 0.1% | 2025-07-04 | Fix |
| CVE-2025-38227 | Linux kernel vidtv driver use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38226 | Linux kernel vivid test driver out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38225 | Linux kernel imx-jpeg driver vulnerability | 5.5v3.1 | 0.1% | 2025-07-04 | Fix |
| CVE-2025-38224 | Linux kernel kvaser_pciefd CAN driver out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38223 | Linux kernel Ceph client reachable assertion | 5.5v3.1 | 0.1% | 2025-07-04 | Fix |
| CVE-2025-38222 | Linux kernel ext4 inline data integer overflow | 5.5NVD v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38221 | Linux kernel ext4 out-of-bounds read | 7.1v3.1 | 0.1% | 2025-07-04 | Fix |
| CVE-2025-38220 | Linux kernel ext4 null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-04 | Fix |
| CVE-2025-38219 | Linux kernel F2FS vulnerability | 5.5v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38218 | Linux kernel F2FS vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38217 | Linux kernel hwmon time-of-check time-of-use race condition | 4.7v3.1 | 0.1% | 2025-07-04 | Fix |
| CVE-2025-38216 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Restore context entry setup order for aliased devices Commit 2031c469f816 ("iommu/vt-d: Add support for static identity domain") changed the context entry setup during domain attachment from a set-and-check policy to a | 8.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38215 | Linux kernel fbdev framebuffer registration null pointer dereference | 5.5NVD v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38214 | Linux kernel fbdev video mode handling null pointer dereference | 5.5NVD v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38212 | Linux kernel IPC shared memory lookup use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38211 | Linux kernel RDMA/iwcm use-after-free | 9.8CNA v3.1 | 0.4% | 2025-07-04 | Fix |
| CVE-2025-38210 | Linux kernel configfs TSM report null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-04 | Fix |
| CVE-2025-38209 | Linux kernel NVMe-TCP admin queue use-after-free | 9.8CNA v3.1 | 0.4% | 2025-07-04 | Fix |
| CVE-2025-38208 | Linux kernel SMB client automount null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38207 | Linux kernel uprobe VMA handling vulnerability | 5.5NVD v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38206 | Linux kernel exFAT upcase table double free | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38205 | Linux kernel AMD display driver divide by zero | 5.5v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38204 | Linux kernel JFS directory indices out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38203 | Linux kernel JFS trim ioctl null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38202 | Linux kernel BPF per-CPU map lookup vulnerability | 5.5v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38201 | Linux kernel nft_set_pipapo netfilter set vulnerability | 7.8NVD v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38200 | Linux kernel i40e Ethernet driver integer underflow | 5.5v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38199 | Linux kernel ath12k Wi-Fi driver memory leak | 5.5NVD v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38198 | Linux kernel fbcon console list vulnerability | 7.8NVD v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38197 | Linux kernel dell_rbu driver null pointer dereference | 7.3CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38196 | Linux kernel io_uring buffer cloning vulnerability | 5.5v3.1 | 0.1% | 2025-07-04 | Fix |
| CVE-2025-38195 | Linux kernel LoongArch huge page tables vulnerability | 5.5v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38194 | Linux kernel JFFS2 summary writing vulnerability | 5.5v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38193 | Linux kernel sch_sfq race condition | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38192 | Linux kernel net crash | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38191 | Linux kernel ksmbd session setup null pointer dereference | 7.5CNA v3.1 | 1.4% | 2025-07-04 | Fix |
| CVE-2025-38190 | Linux kernel ATM socket transmit accounting vulnerability | 5.5v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38189 | Linux kernel V3D GPU driver null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38188 | Linux kernel MSM a7xx GPU driver denial of service | 5.5v3.1 | 0.1% | 2025-07-04 | Fix |
| CVE-2025-38187 | Linux kernel Nouveau GSP RPC use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38186 | Linux kernel bnxt_en RoCE ULP driver double free | 5.5v3.1 | 0.1% | 2025-07-04 | Fix |
| CVE-2025-38185 | Linux kernel ATM TCP driver memory leak | 5.5v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38184 | Linux kernel TIPC ethernet bearer null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38183 | Linux kernel LAN743x PTP driver out-of-bounds write | 7.8v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38182 | Linux kernel ublk device driver vulnerability | 7.8v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38181 | Linux kernel calipso null pointer dereference | 7.5CNA v3.1 | 0.6% | 2025-07-04 | Fix |
| CVE-2025-38180 | Linux kernel ATM LEC proc interface use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38179 | Linux kernel SMB client RDMA transfer out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38177 | Linux kernel sch_hfsc incomplete cleanup | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38176 | Linux kernel binderfs inode eviction use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38175 | Linux kernel binder device list use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-38174 | Linux kernel Thunderbolt configuration request handling vulnerability | 8.8CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-32918 | Checkmk livestatus injection in autocomplete endpoint | 5.3CNA v4.0 | 0.4% | 2025-07-04 | Fix |
| CVE-2025-32311 | Pressroom WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-32297 | Simple Link Directory Pro WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-31037 | Homey WordPress theme reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-30983 | Card flip image slideshow WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-07-04 | |
| CVE-2025-30979 | Pixelating image slideshow gallery WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-30969 | iFrame Images Gallery WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-30947 | Cool fade popup WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-30943 | Posts Slider Shortcode WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-07-04 | |
| CVE-2025-30933 | LogisticsHub WordPress theme arbitrary file upload | 10.0CNA v3.1 | 0.4% | 2025-07-04 | |
| CVE-2025-30929 | fluXtore WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-29012 | CF7 7 Mailchimp Add-on WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-29007 | LMSACE Connect WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-07-04 | |
| CVE-2025-29001 | WooCommerce Shop Page Builder WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2025-07-04 | |
| CVE-2025-28983 | Click and Pledge Connect WordPress plugin privilege escalation via SQL injection | 9.8CNA v3.1 | 0.4% | 2025-07-04 | Fix |
| CVE-2025-28980 | Aviation Weather from NOAA WordPress plugin arbitrary file deletion | 7.7CNA v3.1 | 0.5% | 2025-07-04 | |
| CVE-2025-28978 | SB Breadcrumbs WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-28976 | Email Address Security by WebEmailProtector WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-07-04 | |
| CVE-2025-28971 | Easy Elements Hider WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-07-04 | |
| CVE-2025-28969 | Gallery Widget WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-28968 | WP Wall WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-28967 | Contact Us page - Contact people LITE WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-28963 | URL Shortener WordPress plugin server side request forgery (SSRF) | 5.4CNA v3.1 | 0.2% | 2025-07-04 | |
| CVE-2025-28957 | OwnerRez API WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-28951 | Bulk Featured Image WordPress plugin arbitrary file upload | 9.1CNA v3.1 | 0.4% | 2025-07-04 | |
| CVE-2025-27358 | Frontend File Manager WordPress plugin content injection | 4.6CNA v3.1 | 0.2% | 2025-07-04 | |
| CVE-2025-27326 | Video Gallery Block WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-26591 | WP fancybox WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-24780 | Printcart Web to Print Product Designer for WooCommerce WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-24771 | Content Manager Light WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-24764 | (Simply) Guest Author Name WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-24757 | uDesign WordPress theme broken access control | 5.3CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-24748 | Avada WordPress theme broken access control | 5.3CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-24735 | Chatra Live Chat + ChatBot + Cart Saver WordPress plugin cross-site scripting (XSS) | 7.7CNA v3.1 | 0.4% | 2025-07-04 | Fix |
| CVE-2025-23972 | Contact Form 7 reCAPTCHA WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.1% | 2025-07-04 | |
| CVE-2025-23970 | Service Finder Booking WordPress plugin privilege escalation | 9.8CNA v3.1 | 0.8% | 2025-07-04 | |
| CVE-2025-7070 | IROAD Dashcam Q9 MFA Pairing request allocation of resources | 8.8v3.1 | 0.9% | 2025-07-04 | |
| CVE-2025-7069 | HDF5 H5FSsection.c H5FS__sect_link_size heap-based overflow | 5.5v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-7068 | HDF5 H5FL.c H5FL__malloc memory leak | 5.5v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-7067 | HDF5 H5FScache.c H5FS__sinfo_serialize_node_cb heap-based overflow | 5.5v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-7066 | Improper neutralization of input during web page generation (cross-site scripting) in Jirafeau | 6.1CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-7061 | Intelbras InControl operador CSV injection | 2.7NVD v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-7060 | Monitorr Installer mkdbajax.php input validation | 8.1v3.1 | 0.5% | 2025-07-04 | |
| CVE-2025-7053 | Cockpit save cross-site scripting | 6.1v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-7046 | Portfolio for Elementor and Image Gallery PowerFolio WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-6944 | Uncode Core WordPress plugin authenticated (Contributor+) stored cross-site scripting via shortcodes | 6.4CNA v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-6814 | Booking X - missing authorization to unauthenticated sensitive information disclosure | 7.5CNA v3.1 | 0.5% | 2025-07-04 | |
| CVE-2025-6787 | Smart Docs WordPress plugin authenticated (Contributor+) stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-6786 | DocCheck Login WordPress plugin unauthorized post access | 5.3CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-6783 | GoZen Forms WordPress plugin unauthenticated SQL injection via emdedSc | 7.5CNA v3.1 | 0.4% | 2025-07-04 | |
| CVE-2025-6782 | GoZen Forms WordPress plugin unauthenticated SQL injection via dirGZActiveForm | 7.5CNA v3.1 | 0.4% | 2025-07-04 | |
| CVE-2025-6740 | Contact Form 7 Database Addon WordPress plugin unauthenticated stored cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-6739 | WPQuiz WordPress plugin authenticated (Contributor+) SQL injection | 6.5CNA v3.1 | 0.3% | 2025-07-04 | |
| CVE-2025-6729 | PayMaster for WooCommerce WordPress plugin authenticated (Subscriber+) server-side request forgery | 6.4CNA v3.1 | 0.2% | 2025-07-04 | |
| CVE-2025-6673 | Easy restaurant menu manager WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-6586 | Download WordPress plugin authenticated (Administrator+) arbitrary file upload | 7.2CNA v3.1 | 1.3% | 2025-07-04 | Exploit codeFix |
| CVE-2025-6238 | AI Engine Insecure OAuth Implementation | 8.0CNA v3.1 | 0.4% | 2025-07-04 | Fix |
| CVE-2025-6056 | Ergon Informatik Airlock IAM observable discrepancy | 6.9CNA v4.0 | 0.4% | 2025-07-04 | |
| CVE-2025-6041 | yContributors WordPress plugin cross-site request forgery to stored cross-site scripting | 6.1CNA v3.1 | 0.1% | 2025-07-04 | |
| CVE-2025-6039 | ProcessingJS for WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-07-04 | |
| CVE-2025-5956 | WP Human Resource Management - missing authorization to Authenticated arbitrary User Deletion | 8.1v3.1 | 0.3% | 2025-07-04 | Fix |
| CVE-2025-5953 | WP Human Resource Management - missing authorization to Authenticated privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-07-04 | Fix |
| CVE-2025-5933 | RD Contacto WordPress plugin cross-site request forgery to settings update | 4.3CNA v3.1 | 0.1% | 2025-07-04 | |
| CVE-2025-5924 | WP Firebase Push Notification WordPress plugin cross-site request forgery to Broadcast Notification | 4.3CNA v3.1 | 0.1% | 2025-07-04 | |
| CVE-2025-5920 | Sharable Password Protected Posts WordPress plugin unauthenticated password Protect post access | 7.5CISA ADP v3.1 | 0.4% | 2025-07-04 | Fix |
| CVE-2025-5567 | Shortcodes Ultimate WordPress plugin Authenticted stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-07-04 | Fix |
| CVE-2025-5372 | Libssh: Incorrect return code handling in ssh_kdf in libssh | 8.8NVD v3.1 | 0.5% | 2025-07-04 | Fix |
| CVE-2025-5351 | Libssh: Double free vulnerability in libssh key export functions | 6.5NVD v3.1 | 0.6% | 2025-07-04 | Fix |
| CVE-2025-4414 | CMSMasters Content Composer WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-07-04 | Fix |
| CVE-2025-53502 | Wikimedia Foundation Mediawiki HTML injection in FeaturedFeeds | 6.5CISA ADP v3.1 | 0.2% | 2025-07-03 | |
| CVE-2025-53501 | Content Access Bypass in Scribunto | 8.8CISA ADP v3.1 | 0.4% | 2025-07-03 | Fix |
| CVE-2025-53500 | Stored XSS in MassEditRegex | 5.6CISA ADP v3.1 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-53490 | Multiple XSS in CampaignEvents | 5.6CISA ADP v3.1 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-53489 | XSS in GoogleDocs4MW | 5.6CISA ADP v3.1 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-53370 | Citizen stored XSS vulnerability through short descriptions | 8.6CNA v3.1 | 0.4% | 2025-07-03 | Fix |
| CVE-2025-53369 | MediaWiki Short Description extension stored cross-site scripting | 8.6CNA v3.1 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-53368 | Citizen is vulnerable to stored XSS attack in the legacy search bar | 8.6CNA v3.1 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-53367 | DjVuLibre MMRDecoder out-of-bounds write | 8.4CNA v4.0 | 0.9% | 2025-07-03 | Exploit codeFix |
| CVE-2025-52554 | n8n is vulnerable to improper authorization through its `/stop` endpoint | 4.9CNA v4.0 | 0.4% | 2025-07-03 | Fix |
| CVE-2025-50263 | Tenda AC6 buffer overflow | 8.1CISA ADP v3.1 | 0.5% | 2025-07-03 | |
| CVE-2025-50262 | Tenda AC6 buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-07-03 | |
| CVE-2025-50260 | Tenda AC6 stack-based buffer overflow | 7.5CISA ADP v3.1 | 0.4% | 2025-07-03 | |
| CVE-2025-50258 | Tenda AC6 buffer overflow | 8.1CISA ADP v3.1 | 0.5% | 2025-07-03 | |
| CVE-2025-49846 | wire-ios accidentally logs message contents | 4.1CNA v4.0 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-49826 | Next.js DoS vulnerability via cache poisoning | 7.5CNA v3.1 | 1.1% | 2025-07-03 | Fix |
| CVE-2025-49618 | Plesk Obsidian resource leak | 5.8CNA v3.1 | 0.4% | 2025-07-03 | |
| CVE-2025-49595 | n8n vulnerable to denial of service via Malformed Binary Data requests | 4.9CNA v3.1 | 0.5% | 2025-07-03 | Fix |
| CVE-2025-49032 | Gutenberg Blocks WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-49005 | Next.js cache poisoning due to omission of Vary header | 3.7CNA v3.1 | 0.5% | 2025-07-03 | Fix |
| CVE-2025-48939 | tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript | 4.2CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-45938 | Akeles OUT Of Office Assistant cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-45809 | LiteLLM BerriAI SQL injection | 5.4CISA ADP v3.1 | 0.3% | 2025-07-03 | Exploit code |
| CVE-2025-43713 | ASNA Assist and Registrar .NET remoting service insecure deserialization | 6.5CISA ADP v3.1 | 0.5% | 2025-07-03 | |
| CVE-2025-40723 | Stored cross-site scripting (XSS) vulnerability on Flatboard | 5.1CNA v4.0 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-40722 | Stored cross-site scripting (XSS) vulnerability on Flatboard | 5.1CNA v4.0 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-38173 | Linux kernel Marvell CESA crypto driver vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38172 | Linux kernel erofs use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38171 | Linux kernel max77705 power supply driver null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38170 | Linux kernel arm64 SME trap handling race condition | 5.5v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38169 | Linux kernel arm64 FPSIMD SME context switch vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38168 | Linux kernel Arm NI PMU driver denial of service | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38167 | Linux kernel NTFS3 filesystem null pointer dereference | 5.5NVD v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38166 | Linux kernel sockmap kTLS integration denial of service | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38165 | Linux kernel BPF sockmap memory leak | 7.5CNA v3.1 | 0.4% | 2025-07-03 | Fix |
| CVE-2025-38164 | Linux kernel f2fs zoned block device vulnerability | 7.1CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38163 | Linux kernel f2fs block count validation null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38162 | Linux kernel nftables pipapo set lookup table vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38161 | Linux kernel mlx5 RDMA receive queue destruction use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38160 | Linux kernel rpi null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38159 | Linux kernel rtw88 Wi-Fi driver firmware control out-of-bounds read | 7.1v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38158 | Linux kernel hisi_acc_vfio_pci migration vulnerability | 5.5v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38157 | Linux kernel ath9k_htc software beacon handling out-of-bounds write | 7.8v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38156 | Linux kernel mt7996 Wi-Fi driver WED init null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38155 | Linux kernel mt7915 Wi-Fi driver WED init null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38154 | Linux kernel BPF sockmap use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38153 | Linux kernel aqc111 USB Ethernet driver out-of-bounds read | 7.1v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38151 | Linux kernel RDMA/cma crash | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38150 | Linux kernel AF_PACKET device notifier improper locking | 7.8CNA v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38149 | Linux kernel PHY device link handling null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38148 | Linux kernel mscc memory leak | 5.5v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38147 | Linux kernel CALIPSO socket label handling null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38146 | Linux kernel openvswitch improper array index validation | 9.4CNA v3.1 | 0.5% | 2025-07-03 | Fix |
| CVE-2025-38145 | Linux kernel Aspeed LPC snoop driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38144 | Linux kernel lenovo_se30_wdt null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38143 | Linux kernel pm8941 WLED backlight driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38142 | Linux kernel asus-ec-sensors driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38141 | Linux kernel device mapper zone reporting use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38140 | Linux kernel device mapper zoned device table swap vulnerability | 5.5NVD v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38139 | Linux kernel netfs write-retry subrequest iterator out-of-bounds read | 9.8CNA v3.1 | 0.4% | 2025-07-03 | Fix |
| CVE-2025-38138 | Linux kernel TI UDMA driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38137 | Linux kernel PCI power control rescan use-after-free | 7.8NVD v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38136 | Linux kernel Renesas USBHS driver vulnerability | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38135 | Linux kernel MLB USIO serial driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38134 | Linux kernel USB ACPI USB4 device link null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38133 | Linux kernel AD4858 ADC channel handling out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38132 | Linux kernel Coresight config device list race condition | 5.5NVD v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38131 | Linux kernel Coresight active configuration use-after-free | 7.8v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38130 | Linux kernel HDMI audio helper null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38129 | Linux kernel page pool recycling use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38128 | Linux kernel Bluetooth MGMT HCI command sync vulnerability | 5.5v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38127 | Linux kernel ice Tx scheduler XDP callback improper error handling | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38126 | Linux kernel stmmac PTP timestamping divide by zero | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38125 | Linux kernel stmmac EST configuration vulnerability | 5.5NVD v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38124 | Linux kernel UDP GSO segmentation memory leak | 7.5CNA v3.1 | 0.5% | 2025-07-03 | Fix |
| CVE-2025-38123 | Linux kernel t7xx WWAN driver null pointer dereference | 9.8CNA v3.1 | 0.5% | 2025-07-03 | Fix |
| CVE-2025-38122 | Linux kernel gve TX DQO driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38121 | Linux kernel iwlwifi MLD Wi-Fi driver null pointer dereference | 5.5v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38120 | Linux kernel nf_tables pipapo set matching vulnerability | 9.4CNA v3.1 | 0.5% | 2025-07-03 | Fix |
| CVE-2025-38119 | Linux kernel UFS error handler denial of service | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38118 | Linux kernel Bluetooth advertisement monitor management use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38117 | Linux kernel Bluetooth management interface use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38116 | Linux kernel ath12k Wi-Fi driver use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38115 | Linux kernel sch_sfq crash | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38114 | Linux kernel e1000 Ethernet driver deadlock | 5.5v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38113 | Linux kernel ACPI CPPC null pointer dereference | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38112 | Linux kernel socket readable check race condition | 4.7v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-38111 | Linux kernel MDIO bus access out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38110 | Linux kernel MDIO bus clause 45 access out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38109 | Linux kernel mlx5 ECVF vport shutdown use-after-free | 7.8v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38108 | Linux kernel RED queueing discipline race condition | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38107 | Linux kernel ETS queueing discipline race condition | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38106 | Linux kernel io_uring SQ thread fdinfo use-after-free | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38105 | Linux kernel USB MIDI timer vulnerability | 5.5NVD v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38103 | Linux kernel USB HID descriptor parser out-of-bounds read | 7.1v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38102 | Linux kernel VMCI host notification race condition | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38101 | Linux kernel ring buffer subbuffer order out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38100 | Linux kernel x86 I/O bitmap handling null pointer dereference | 5.5NVD v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38099 | Linux kernel Bluetooth SCO voice settings vulnerability | 5.5v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38098 | Linux kernel AMD display writeback connector vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38097 | Linux kernel espintcp encapsulation socket vulnerability | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38096 | Linux kernel iwlwifi Wi-Fi driver vulnerability | 5.5NVD v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38095 | Linux kernel dma-buf fence signaling null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-38094 | Linux kernel Cadence MACB Ethernet driver deadlock | 5.5v3.1 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-34089 | Remote for Mac unauthenticated Remote code execution via AppleScript injection | 9.3CNA v4.0 | 2.3% | 2025-07-03 | MetasploitExploit code |
| CVE-2025-34088 | Pandora FMS authenticated remote code execution via Ping module | 8.8v3.1 | 7.2% | 2025-07-03 | MetasploitExploit code |
| CVE-2025-34087 | Pi-Hole AdminLTE Whitelist (now Web Allowlist) remote command execution | 8.8NVD v3.1 | 6.9% | 2025-07-03 | MetasploitExploit codeFix |
| CVE-2025-34086 | Bolt CMS authenticated remote code execution via Profile injection and File Rename | 8.8NVD v3.1 | 4.2% | 2025-07-03 | MetasploitExploit codeFix |
| CVE-2025-34082 | IGEL OS Secure Terminal and Secure Shadow remote code execution | 9.3CNA v4.0 | 6.6% | 2025-07-03 | MetasploitExploit codeFix |
| CVE-2025-34061 | PHPStudy 2016-2018 backdoor remote code execution | 9.3CNA v4.0 | 1.9% | 2025-07-03 | MetasploitExploit code |
| CVE-2025-27461 | Endress+Hauser MEAC300-FNADE4 EPC2 Windows user login vulnerability | 7.6CNA v3.1 | 0.3% | 2025-07-03 | |
| CVE-2025-27460 | Endress+Hauser MEAC300-FNADE4 hard drive storage cleartext storage of sensitive information | 7.6CNA v3.1 | 0.1% | 2025-07-03 | |
| CVE-2025-27459 | Endress+Hauser MEAC300-FNADE4 VNC password storage recoverable password storage | 4.4CNA v3.1 | 0.2% | 2025-07-03 | |
| CVE-2025-27458 | Endress+Hauser MEAC300-FNADE4 VNC authentication weak cryptographic algorithm | 6.5CNA v3.1 | 0.2% | 2025-07-03 | |
| CVE-2025-27457 | Endress+Hauser MEAC300-FNADE4 VNC server cleartext transmission of sensitive information | 6.5CNA v3.1 | 0.3% | 2025-07-03 | |
| CVE-2025-27456 | Endress+Hauser MEAC300-FNADE4 SMB server login vulnerability | 7.5CNA v3.1 | 0.6% | 2025-07-03 | |
| CVE-2025-27455 | Endress+Hauser MEAC300-FNADE4 web application clickjacking | 4.3CNA v3.1 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-27454 | Endress+Hauser MEAC300-FNADE4 web application cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-07-03 | Fix |
| CVE-2025-27453 | Endress+Hauser MEAC300-FNADE4 PHPSESSION cookie vulnerability | 5.3CNA v3.1 | 0.4% | 2025-07-03 | Fix |
| CVE-2025-27452 | Endress+Hauser MEAC300-FNADE4 directory listing | 5.3CNA v3.1 | 0.5% | 2025-07-03 | Fix |
| CVE-2025-27451 | Endress+Hauser MEAC300-FNADE4 response discrepancy | 5.3CNA v3.1 | 0.4% | 2025-07-03 | Fix |
| CVE-2025-27450 | Endress+Hauser MEAC300-FNADE4 session cookies vulnerability | 6.5CNA v3.1 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-27449 | Endress+Hauser MEAC300-FNADE4 missing brute-force protection | 7.5CNA v3.1 | 0.6% | 2025-07-03 | Fix |
| CVE-2025-27448 | Endress+Hauser MEAC300-FNADE4 dashboard name field vulnerability | 6.8CNA v3.1 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-27447 | Endress+Hauser MEAC300-FNADE4 cross-site scripting | 7.4CNA v3.1 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-23968 | AiBud WP WordPress plugin arbitrary file upload | 9.1CNA v3.1 | 0.5% | 2025-07-03 | Exploit code |
| CVE-2025-6926 | Wikimedia Foundation Mediawiki security authentication bypass in CentralAuth | 8.8CISA ADP v3.1 | 0.5% | 2025-07-03 | Fix |
| CVE-2025-6587 | Exposure of system environment variables in Docker Desktop diagnostic logs | 5.2CNA v4.0 | 0.1% | 2025-07-03 | Fix |
| CVE-2025-6563 | Cross-site scripting via dst parameter in RouterOS WiFi hotspot | 4.8CNA v4.0 | 0.7% | 2025-07-03 | Exploit codeFix |
| CVE-2025-6074 | ABB RMC-100 authentication bypass to the MQTT configuration Web interface | 6.3CNA v4.0 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-6073 | ABB RMC-100 stack buffer overflow in MQTTCore | 8.2CNA v4.0 | 0.4% | 2025-07-03 | Fix |
| CVE-2025-6072 | ABB RMC-100 stack buffer overflow in MQTTCore | 8.2CNA v4.0 | 0.4% | 2025-07-03 | Fix |
| CVE-2025-6071 | ABB RMC-100 hard coded key used for AES encryption | 6.3CNA v4.0 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-5961 | Migration, Backup, Staging WPvivid Backup and Migration WordPress plugin arbitrary file upload | 7.2CNA v3.1 | 55.5% | 2025-07-03 | NucleiExploit codeFix |
| CVE-2025-5944 | Element Pack Addons for Elementor WordPress plugin DOM-based stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-5322 | VikRentCar Car Rental Management System WordPress plugin arbitrary file upload | 7.2CNA v3.1 | 0.8% | 2025-07-03 | Fix |
| CVE-2025-3702 | Melapress File Monitor WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-2932 | JKDEVKIT WordPress plugin authenticated (Subscriber+) arbitrary file deletion | 8.8CNA v3.1 | 0.8% | 2025-07-03 | |
| CVE-2025-2540 | Awesome Wp Image Gallery WordPress plugin cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-2537 | YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-07-03 | Fix |
| CVE-2025-1711 | Endress+Hauser MEAC300-FNADE4 default credentials | 4.3CNA v3.1 | 0.4% | 2025-07-03 | Fix |
| CVE-2025-1710 | Endress+Hauser MEAC300-FNADE4 maxView Storage Manager vulnerability | 7.5CNA v3.1 | 0.6% | 2025-07-03 | Fix |
| CVE-2025-1709 | Endress+Hauser MEAC300-FNADE4 PostgreSQL database credentials vulnerability | 6.5CNA v3.1 | 0.4% | 2025-07-03 | Fix |
| CVE-2025-1708 | Endress+Hauser MEAC300-FNADE4 PostgreSQL database SQL injection | 8.6CNA v3.1 | 0.5% | 2025-07-03 | Fix |
| CVE-2025-0885 | Incorrect authorization vulnerability affects OpenText™ GroupWise | 1.8CNA v4.0 | 0.1% | 2025-07-03 | |
| CVE-2025-53494 | Stored XSS in TwoColConflict | 6.5CISA ADP v3.1 | 0.3% | 2025-07-02 | Fix |
| CVE-2025-53493 | Stored XSS in MintyDocs | 6.5CISA ADP v3.1 | 0.3% | 2025-07-02 | Fix |
| CVE-2025-53492 | Stored XSS in MintyDocs | 3.7CISA ADP v3.1 | 0.3% | 2025-07-02 | Fix |
| CVE-2025-53359 | ethereum does not check transaction malleability for EIP-2930, EIP-1559 and EIP-7702 transactions | 6.9CNA v4.0 | 0.4% | 2025-07-02 | Fix |
| CVE-2025-53358 | kotaemon vulnerable to path traversal via Link upload | 6.5CNA v3.1 | 0.5% | 2025-07-02 | |
| CVE-2025-53110 | Model Context Protocol Servers vulnerable to Path Validation Bypass via Colliding Path Prefix | 7.3CNA v4.0 | 0.6% | 2025-07-02 | Fix |
| CVE-2025-53109 | Model Context Protocol servers Filesystem server link following | 7.3CNA v4.0 | 0.8% | 2025-07-02 | Fix |
| CVE-2025-53108 | HomeBox Missing User Authorization | 5.3CNA v4.0 | 0.3% | 2025-07-02 | Fix |
| CVE-2025-53106 | Graylog vulnerable to privilege escalation through API tokens | 8.8CNA v4.0 | 0.6% | 2025-07-02 | Fix |
| CVE-2025-53006 | Dataease PostgreSQL and Redshift Data Source JDBC Connection Parameters Bypass vulnerability | 8.9CNA v4.0 | 0.6% | 2025-07-02 | Fix |
| CVE-2025-52925 | OneLogin Active Directory Connector resource leak | 5.0CNA v3.1 | 0.2% | 2025-07-02 | Fix |
| CVE-2025-52891 | ModSecurity empty XML tag causes segmentation fault | 6.5CNA v3.1 | 0.4% | 2025-07-02 | Fix |
| CVE-2025-52886 | Poppler use-after-free | 5.9NVD v3.1 | 0.4% | 2025-07-02 | Fix |
| CVE-2025-52842 | Laundry account takeover via reflected XSS | 6.1v3.1 | 0.3% | 2025-07-02 | |
| CVE-2025-52841 | Laundry account takeover via CSRF | 8.8v3.1 | 0.2% | 2025-07-02 | |
| CVE-2025-52559 | Zulip XSS in digest preview URL | 6.8CNA v3.1 | 0.3% | 2025-07-02 | Fix |
| CVE-2025-52463 | Qualitia Active! mail 6 cross-site request forgery | 2.1CNA v4.0 | 0.1% | 2025-07-02 | |
| CVE-2025-52462 | Qualitia Active! mail 6 cross-site scripting | 5.1CNA v4.0 | 0.2% | 2025-07-02 | |
| CVE-2025-49713 | Microsoft Edge (Chromium-based) remote code execution | 8.8CNA v3.1 | 0.8% | 2025-07-02 | Fix |
| CVE-2025-49588 | Linkwarden local file inclusion | 8.7CNA v4.0 | 0.4% | 2025-07-02 | |
| CVE-2025-46647 | Apache APISIX OpenID Connect plugin authentication bypass | 5.3CISA ADP v3.1 | 0.5% | 2025-07-02 | Fix |
| CVE-2025-45814 | Novelsat NS3000 query.fcgi endpoint missing authentication | 9.8CISA ADP v3.1 | 0.6% | 2025-07-02 | |
| CVE-2025-45813 | Enensys Ipguardv2 hard-coded credentials | 9.8CISA ADP v3.1 | 0.5% | 2025-07-02 | |
| CVE-2025-45424 | Xinference improper access control | 5.3CISA ADP v3.1 | 0.4% | 2025-07-02 | |
| CVE-2025-45029 | WINSTAR WN572HP3 upload.cgi CONTENT_LENGTH handling heap-based buffer overflow | 6.5CISA ADP v3.1 | 0.2% | 2025-07-02 | |
| CVE-2025-43025 | HP Universal Print Driver potential denial of service | 4.8CNA v4.0 | 0.3% | 2025-07-02 | Fix |
| CVE-2025-39362 | Mollie Payments for WooCommerce WordPress plugin insecure direct object references (IDOR) | 6.5CNA v3.1 | 0.3% | 2025-07-02 | Fix |
| CVE-2025-38093 | In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: x1e80100: Add GPU cooling Unlike the CPU, the GPU does not throttle its speed automatically when it reaches high temperatures. With certain high GPU loads it is possible to reach the critical hardware shutdown te | 5.5v3.1 | 0.1% | 2025-07-02 | Fix |
| CVE-2025-38092 | Linux kernel ksmbd oplock info list null pointer dereference | 8.8CNA v3.1 | 0.3% | 2025-07-02 | Fix |
| CVE-2025-38091 | Linux kernel AMD display DML21 stream handling vulnerability | 7.8v3.1 | 0.2% | 2025-07-02 | Fix |
| CVE-2025-36630 | Tenable Nessus local privilege escalation | 8.4CNA v3.1 | 0.2% | 2025-07-02 | Fix |
| CVE-2025-34079 | NSClient++ authenticated remote code execution via ExternalScripts API | 7.8v3.1 | 1.7% | 2025-07-02 | MetasploitExploit code |
| CVE-2025-34078 | NSClient++ local privilege escalation via ExternalScripts and Web interface | 7.8v3.1 | 0.7% | 2025-07-02 | Exploit code |
| CVE-2025-34076 | Microweber CMS authenticated local file inclusion via Backup API | 7.2NVD v3.1 | 2.2% | 2025-07-02 | MetasploitFix |
| CVE-2025-34074 | Lucee Admin Interface Authenticated remote code execution via Scheduled Job File Write | 9.4CNA v4.0 | 2.2% | 2025-07-02 | Exploit code |
| CVE-2025-34073 | Stamparm/Maltrail remote command execution | 10.0CNA v4.0 | 5.5% | 2025-07-02 | NucleiMetasploitExploit code |
| CVE-2025-34072 | Anthropic Slack MCP Server Data Exfiltration via Link Unfurling | 9.3CNA v4.0 | 0.4% | 2025-07-02 | |
| CVE-2025-34071 | GFI Kerio Control Unsigned System Image Upload Root code execution | 9.8v3.1 | 0.8% | 2025-07-02 | KCV |
| CVE-2025-34070 | GFI Kerio Control GFIAgent missing authentication on Administrative Interfaces | 9.8v3.1 | 0.8% | 2025-07-02 | KCV |
| CVE-2025-34069 | GFI Kerio Control GFIAgent authentication bypass via Proxy Forwarding | 9.8v3.1 | 0.7% | 2025-07-02 | KCV |
| CVE-2025-34067 | Hikvision Integrated Security Management Platform remote command execution via applyCT Fastjson | 10.0CNA v4.0 | 22.0% | 2025-07-02 | Emerging Threats |
| CVE-2025-34057 | Ruijie NBR Router Administrative credential disclosure | 8.7CNA v4.0 | 10.1% | 2025-07-02 | |
| CVE-2025-27026 | Improper access control Granularity impacting Infinera G42 | 4.9CNA v3.1 | 0.4% | 2025-07-02 | Fix |
| CVE-2025-27025 | Improper File Access in Infinera G42 | 8.8CNA v3.1 | 0.6% | 2025-07-02 | Fix |
| CVE-2025-27024 | Improper File Access in Infinera G42 | 6.5v3.1 | 0.3% | 2025-07-02 | Fix |
| CVE-2025-27023 | Improper input validation in Infinera G42 | 6.5v3.1 | 0.5% | 2025-07-02 | Fix |
| CVE-2025-27022 | Path traversal vulnerability in Infinera G42 | 6.5NVD v3.1 | 0.6% | 2025-07-02 | Fix |
| CVE-2025-27021 | Operating System Misconfiguration in Infinera G42 | 7.8v3.1 | 0.1% | 2025-07-02 | Fix |
| CVE-2025-24335 | Nokia Single RAN OAM service resource exhaustion | 2.0CISA ADP v3.1 | 0.5% | 2025-07-02 | |
| CVE-2025-24334 | Nokia Single RAN RAN management interface information disclosure | 3.3CISA ADP v3.1 | 0.1% | 2025-07-02 | |
| CVE-2025-24333 | Nokia Single RAN administrative user shell input validation fault | 6.4CISA ADP v3.1 | 0.2% | 2025-07-02 | |
| CVE-2025-24332 | Nokia Single RAN AirScale bsoc SSH service authentication bypass | 7.1CISA ADP v3.1 | 0.2% | 2025-07-02 | |
| CVE-2025-24331 | Nokia Single RAN baseband OAM service extensive capabilities | 6.4CISA ADP v3.1 | 0.2% | 2025-07-02 | |
| CVE-2025-24330 | Nokia Single RAN OAM service path traversal | 6.4CISA ADP v3.1 | 0.3% | 2025-07-02 | |
| CVE-2025-24329 | Nokia Single RAN OAM service path traversal | 6.4CISA ADP v3.1 | 0.3% | 2025-07-02 | |
| CVE-2025-24328 | Nokia Single RAN OAM service stack-based buffer overflow | 4.2CISA ADP v3.1 | 0.2% | 2025-07-02 | |
| CVE-2025-20310 | Cisco Enterprise Chat And Email stored cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-07-02 | Fix |
| CVE-2025-20309 | Cisco Unified Communications Manager Static SSH Credentials vulnerability | 10.0CNA v3.1 | 1.2% | 2025-07-02 | Fix |
| CVE-2025-20308 | Cisco Spaces Connector privilege escalation | 6.0CNA v3.1 | 0.2% | 2025-07-02 | Fix |
| CVE-2025-20307 | Cisco BroadWorks Application Delivery Platform cross-site scripting | 4.8CNA v3.1 | 0.3% | 2025-07-02 | Fix |
| CVE-2025-6943 | Delinea Secret Server improper privilege management | 3.8CNA v3.1 | 0.2% | 2025-07-02 | Fix |
| CVE-2025-6942 | Delinea Secret Server insecure direct object reference | 3.8CNA v3.1 | 0.1% | 2025-07-02 | Fix |
| CVE-2025-6725 | Progress Software Kendo UI for jQuery cross-site scripting (XSS) in PdfViewer | 5.4CNA v3.1 | 0.3% | 2025-07-02 | |
| CVE-2025-6687 | Magic Buttons for Elementor WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-07-02 | |
| CVE-2025-6686 | Magic Buttons for Elementor WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-07-02 | Fix |
| CVE-2025-6464 | Forminator Forms WordPress plugin PHP object injection | 8.8v3.1 | 0.5% | 2025-07-02 | Fix |
| CVE-2025-6463 | Forminator Forms WordPress plugin arbitrary file deletion | 8.8CNA v3.1 | 14.9% | 2025-07-02 | Fix |
| CVE-2025-6459 | Ads Pro Plugin WordPress plugin cross-site request forgery | 8.8CNA v3.1 | 0.2% | 2025-07-02 | |
| CVE-2025-6437 | Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager unauthenticated SQL injection via oid | 7.5CNA v3.1 | 0.4% | 2025-07-02 | |
| CVE-2025-6017 | Red Hat Advanced Cluster Management information disclosure | 5.5CNA v3.1 | 0.1% | 2025-07-02 | |
| CVE-2025-5817 | Amazon Products to WooCommerce WordPress plugin unauthenticated server-side request forgery | 7.2CNA v3.1 | 0.3% | 2025-07-02 | |
| CVE-2025-5746 | Drag and Drop Multiple File Upload (Pro) WooCommerce and - unauthenticated arbitrary file upload | 9.8CNA v3.1 | 0.7% | 2025-07-02 | Fix |
| CVE-2025-5692 | Lead Form Data Collection to CRM WordPress plugin missing authorization authenticated Many actions | 4.3v3.1 | 0.2% | 2025-07-02 | Fix |
| CVE-2025-5339 | Ads Pro Plugin WordPress plugin SQL injection | 7.5CNA v3.1 | 0.4% | 2025-07-02 | |
| CVE-2025-5014 | Home Villas Real Estate WordPress theme authenticated (Subscriber+) arbitrary file deletion | 8.8CNA v3.1 | 0.8% | 2025-07-02 | |
| CVE-2025-4946 | Vikinger WordPress theme arbitrary file deletion | 8.1CNA v3.1 | 0.7% | 2025-07-02 | Fix |
| CVE-2025-4689 | Ads Pro Plugin WordPress plugin local file inclusion | 9.8CNA v3.1 | 0.6% | 2025-07-02 | |
| CVE-2025-4654 | Soumettre.fr WordPress plugin unauthorized access | 3.7CNA v3.1 | 0.3% | 2025-07-02 | Fix |
| CVE-2025-4381 | Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager unauthenticated SQL injection | 7.5CNA v3.1 | 0.4% | 2025-07-02 | |
| CVE-2025-4380 | Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager unauthenticated local file inclusion | 9.8v3.1 | 42.8% | 2025-07-02 | NucleiExploit code |
| CVE-2025-2330 | All-in-One Addons for Elementor WidgetKit WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-07-02 | Fix |
| CVE-2025-53107 | @cyanheads/git-mcp-server vulnerable to command injection in several tools | 7.5CNA v3.1 | 24.5% | 2025-07-01 | Fix |
| CVE-2025-53104 | gluestack-ui command injection vulnerability via discussion-to-slack GitHub Action Workflow | 9.1CNA v3.1 | 1.2% | 2025-07-01 | Exploit code |
| CVE-2025-53103 | junit-team junit-framework JUnit OpenTestReportGeneratingListener can leak git credentials | 5.8CNA v3.1 | 0.1% | 2025-07-01 | Fix |
| CVE-2025-53100 | RestDB's Codehooks.io MCP Server vulnerable to command injection | 8.6CNA v4.0 | 1.3% | 2025-07-01 | Fix |
| CVE-2025-53099 | Sentry Missing Invalidation of Authorization Codes during OAuth Exchange and Revocation | 5.5CNA v4.0 | 0.8% | 2025-07-01 | Fix |
| CVE-2025-53096 | Sunshine clickjacking in the UI leads to unauthorized actions being performed | 5.4CNA v3.1 | 0.2% | 2025-07-01 | Fix |
| CVE-2025-53095 | Sunshine application-wide CSRF in the UI leads to command injection as Administrator | 9.7CNA v3.1 | 0.2% | 2025-07-01 | Fix |
| CVE-2025-53005 | Dataease PostgreSQL Data Source JDBC Connection Parameters Bypass vulnerability | 8.9CNA v4.0 | 0.6% | 2025-07-01 | Fix |
| CVE-2025-53003 | JanssenProject jans janssen Config API returns results without scope verification | 8.2CNA v4.0 | 0.4% | 2025-07-01 | Fix |
| CVE-2025-52294 | Trust Wallet screen lock authentication bypass | 5.7CISA ADP v3.1 | 0.2% | 2025-07-01 | |
| CVE-2025-52101 | linjiashop JWT authentication authentication bypass | 9.8CISA ADP v3.1 | 0.5% | 2025-07-01 | |
| CVE-2025-50641 | Tenda AC6 buffer overflow | 6.5CISA ADP v3.1 | 0.4% | 2025-07-01 | |
| CVE-2025-50405 | Intelbras RX 1500 improper access control | 6.5CISA ADP v3.1 | 0.4% | 2025-07-01 | |
| CVE-2025-50404 | Intelbras RX 1500 integer overflow | 5.3CISA ADP v3.1 | 9.9% | 2025-07-01 | |
| CVE-2025-49741 | Microsoft Edge (Chromium-based) information disclosure | 7.4CNA v3.1 | 3.9% | 2025-07-01 | Exploit codeFix |
| CVE-2025-49492 | ASR Falcon_Linux、Kestrel、Lapwing_Linux out-of-bounds write in lte-telephony | 7.4CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-49491 | ASR Falcon_Linux、Kestrel、Lapwing_Linux improper resource release | 5.4CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-49490 | ASR Falcon_Linux、Kestrel、Lapwing_Linux resource leak | 5.4CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-49489 | ASR Falcon_Linux、Kestrel、Lapwing_Linux improper resource release | 5.4CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-49488 | ASR Falcon_Linux、Kestrel、Lapwing_Linux improper resource release | 5.4CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-49483 | ASR Falcon_Linux、Kestrel、Lapwing_Linux improper resource release | 5.4CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-49482 | ASR Falcon_Linux、Kestrel、Lapwing_Linux improper resource release | 5.4CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-49481 | ASR Falcon_Linux、Kestrel、Lapwing_Linux improper resource release | 5.4CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-49480 | ASR Falcon_Linux、Kestrel、Lapwing_Linux out-of-bounds access in lte-telephony | 7.4CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-49029 | Custom Login And Signup Widget WordPress plugin arbitrary code execution | 9.1CNA v3.1 | 2.4% | 2025-07-01 | NucleiExploit code |
| CVE-2025-48379 | Pillow vulnerable to write buffer overflow on BCn encoding | 7.1CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-46259 | The Plus Addons for Elementor - Pro WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-45872 | ZrLog server-side request forgery | 9.8CISA ADP v3.1 | 0.5% | 2025-07-01 | |
| CVE-2025-45083 | Ullu parental pin feature improper access control | 6.1CISA ADP v3.1 | 0.1% | 2025-07-01 | |
| CVE-2025-45081 | IITB SSO improper access control | 8.8CISA ADP v3.1 | 0.3% | 2025-07-01 | |
| CVE-2025-45006 | RISC-V processor mstatus SUM bit handling vulnerability | 9.1CISA ADP v3.1 | 0.5% | 2025-07-01 | |
| CVE-2025-41656 | PILZ: Missing authentication in Node-RED integration | 10.0CNA v3.1 | 12.5% | 2025-07-01 | Exploit codeFix |
| CVE-2025-41648 | PILZ: Authentication bypass in IndustrialPI Webstatus | 9.8CNA v3.1 | 0.8% | 2025-07-01 | Fix |
| CVE-2025-37099 | HPE Insight Remote Support remote code execution | 9.8CISA ADP v3.1 | 0.8% | 2025-07-01 | Fix |
| CVE-2025-37098 | HPE Insight Remote Support path traversal | 7.5CISA ADP v3.1 | 46.3% | 2025-07-01 | Fix |
| CVE-2025-37097 | HPE Insight Remote Support exposed dangerous method | 7.5CISA ADP v3.1 | 0.5% | 2025-07-01 | Fix |
| CVE-2025-36582 | Dell NetWorker information disclosure | 4.8CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-36056 | IBM System Storage Virtualization Engine TS7700 cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-07-01 | Fix |
| CVE-2025-34081 | CONPROSYS HMI System (CHS) Exposed PHP Debug Info | 7.5v3.1 | 0.7% | 2025-07-01 | Fix |
| CVE-2025-34080 | CONPROSYS HMI System (CHS) reflected cross-site scripting | 6.1v3.1 | 1.3% | 2025-07-01 | Fix |
| CVE-2025-34066 | AVTECH IP camera, DVR, and NVR Devices Unauthenticated information disclosure | 8.3CNA v4.0 | 0.3% | 2025-07-01 | Exploit code |
| CVE-2025-34065 | AVTECH IP camera, DVR, and NVR Devices authentication bypass via /nobody URL Path | 6.9CNA v4.0 | 0.6% | 2025-07-01 | Exploit code |
| CVE-2025-34064 | OneLogin AD Connector Log S3 Bucket Hijack leading to Cross-Tenant data leakage | 9.0CNA v4.0 | 0.5% | 2025-07-01 | Fix |
| CVE-2025-34063 | OneLogin AD Connector JWT authentication bypass via Exposed Signing Key | 10.0CNA v4.0 | 0.6% | 2025-07-01 | Fix |
| CVE-2025-34062 | OneLogin AD Connector API Credential and Signing key exposure | 5.7CNA v4.0 | 0.2% | 2025-07-01 | Fix |
| CVE-2025-34060 | Monero Forum remote code execution via arbitrary file read and Cookie Forgery | 10.0CNA v4.0 | 0.8% | 2025-07-01 | |
| CVE-2025-34059 | Dahua Smart Cloud Gateway Registration Management Platform SQL injection | 8.7CNA v4.0 | 0.5% | 2025-07-01 | |
| CVE-2025-34058 | Hikvision Streaming Media Management Server /systemLog/downFile.php arbitrary file read | 8.7CNA v4.0 | 0.9% | 2025-07-01 | |
| CVE-2025-34056 | AVTECH IP camera, DVR, and NVR Devices Authenticated Root command execution | 9.4CNA v4.0 | 1.8% | 2025-07-01 | Exploit code |
| CVE-2025-34055 | AVTECH IP camera, DVR, and NVR Devices Authenticated Root command execution | 9.4CNA v4.0 | 1.5% | 2025-07-01 | Exploit code |
| CVE-2025-34054 | AVTECH IP camera, DVR, and NVR Devices Unauthenticated command injection | 10.0CNA v4.0 | 2.7% | 2025-07-01 | Exploit code |
| CVE-2025-34053 | AVTECH IP camera, DVR, and NVR Devices authentication bypass via .cab Path Manipulation | 6.9CNA v4.0 | 0.6% | 2025-07-01 | Exploit code |
| CVE-2025-34051 | AVTECH DVR Devices server-side request forgery | 6.9CNA v4.0 | 0.6% | 2025-07-01 | Exploit code |
| CVE-2025-34050 | AVTECH IP Camera, DVR, and NVR Devices cross-site request forgery | 5.1CNA v4.0 | 0.3% | 2025-07-01 | Exploit code |
| CVE-2025-27153 | Escalade GLPI plugin vulnerable to improper access control | 6.5CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-6963 | Campcodes Employee Management System myprofile.php SQL injection | 9.8v3.1 | 0.6% | 2025-07-01 | |
| CVE-2025-6962 | Campcodes Employee Management System myprofileup.php SQL injection | 9.8v3.1 | 0.6% | 2025-07-01 | |
| CVE-2025-6961 | Campcodes Employee Management System mark.php SQL injection | 9.8v3.1 | 0.6% | 2025-07-01 | |
| CVE-2025-6960 | Campcodes Employee Management System empproject.php SQL injection | 9.8v3.1 | 0.6% | 2025-07-01 | |
| CVE-2025-6959 | Campcodes Employee Management System eloginwel.php SQL injection | 9.8v3.1 | 0.6% | 2025-07-01 | |
| CVE-2025-6958 | Campcodes Employee Management System edit.php SQL injection | 9.8v3.1 | 0.6% | 2025-07-01 | |
| CVE-2025-6957 | Campcodes Employee Management System eprocess.php SQL injection | 9.8v3.1 | 0.6% | 2025-07-01 | |
| CVE-2025-6956 | Campcodes Employee Management System changepassemp.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-01 | |
| CVE-2025-6955 | Campcodes Employee Management System aprocess.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-01 | |
| CVE-2025-6954 | Campcodes Employee Management System applyleave.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-01 | |
| CVE-2025-6953 | TOTOLINK A3002RU HTTP POST request formParentControl buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-07-01 | |
| CVE-2025-6952 | Open5GS AMF service amf-sm.c amf_state_operational assertion | 4.8CNA v4.0 | 0.2% | 2025-07-01 | |
| CVE-2025-6951 | SAFECAM X300 FTP service default credentials | 5.3CNA v4.0 | 0.3% | 2025-07-01 | |
| CVE-2025-6940 | TOTOLINK A702R HTTP POST request formParentControl buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-07-01 | |
| CVE-2025-6939 | TOTOLINK A3002RU HTTP POST request formWlSiteSurvey buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-07-01 | |
| CVE-2025-6938 | code-projects Simple Pizza Ordering System editcus.php SQL injection | 9.8v3.1 | 0.6% | 2025-07-01 | |
| CVE-2025-6937 | code-projects Simple Pizza Ordering System large.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-01 | |
| CVE-2025-6936 | code-projects Simple Pizza Ordering System addpro.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-01 | |
| CVE-2025-6935 | Campcodes Sales and Inventory System payment_add.php SQL injection | 9.8v3.1 | 0.5% | 2025-07-01 | |
| CVE-2025-6934 | Opal Estate Pro WordPress plugin unauthenticated privilege escalation via on_regiser_user | 9.8CNA v3.1 | 25.6% | 2025-07-01 | NucleiExploit code |
| CVE-2025-6920 | Ai-inference-server: Authentication bypass via unprotected inference endpoint in API | 5.3CNA v3.1 | 0.3% | 2025-07-01 | |
| CVE-2025-6756 | Ultra Addons for Contact Form 7 WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-07-01 | Fix |
| CVE-2025-6600 | GitHub Enterprise Server information disclosure vulnerability exposes Private Repository Names | 6.3CNA v4.0 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-6297 | Debian dpkg dpkg-deb: Fix cleanup for control member with restricted directories | 8.2CISA ADP v3.1 | 0.4% | 2025-07-01 | Fix |
| CVE-2025-6224 | Key leakage in juju/utils certificates | 6.5CNA v3.1 | 0.2% | 2025-07-01 | Fix |
| CVE-2025-6081 | Pass-back attack in Konica Minolta bizhub 227 multifunctional printers | 6.8CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-5967 | Trellix Endpoint Security HX ENS HX stored cross-site scripting | 5.3CNA v4.0 | 0.2% | 2025-07-01 | |
| CVE-2025-5314 | Dear Flipbook WordPress plugin reflected cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-5072 | ASR Falcon_Linux、Kestrel、Lapwing_Linux resource leak | 5.4CNA v3.1 | 0.3% | 2025-07-01 | Fix |
| CVE-2025-2141 | IBM System Storage Virtualization Engine TS7700 cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-07-01 | Fix |