CVE-2025 records published in August 2025
Page four of four: records 3,001 to 3,350 of the 3,350 published in August 2025, newest first. The first page carries the figures for August 2025.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-8556 | CIRCL FourQ elliptic curve key exchange improper input validation | 3.7CNA v3.1 | 0.5% | 2025-08-06 | Fix |
| CVE-2025-8420 | Campus Directory WordPress plugin eval injection | 8.1CNA v3.1 | 1.0% | 2025-08-06 | Fix |
| CVE-2025-8419 | Org.Keycloak/keycloak-services: Keycloak smtp inject vulnerability | 5.3CNA v3.1 | 0.4% | 2025-08-06 | Fix |
| CVE-2025-8100 | Element Pack Elementor Addons and Templates WordPress plugin stored cross-site scripting | 5.4v3.1 | 5.5% | 2025-08-06 | Fix |
| CVE-2025-7954 | Race condition in Shopware Voucher Submission | 8.1v3.1 | 0.4% | 2025-08-06 | |
| CVE-2025-7771 | Code execution / escalation of privileges in ThrottleStop | 8.7CNA v4.0 | 8.1% | 2025-08-06 | Exploit code |
| CVE-2025-7770 | Predictable Seed in Pseudo-Random Number Generator (PRNG) in Tigo Energy Cloud Connect Advanced | 8.7CNA v4.0 | 0.5% | 2025-08-06 | |
| CVE-2025-7769 | Improper neutralization of special elements used in a command in Tigo Energy Cloud Connect Advanced | 8.7CNA v4.0 | 19.1% | 2025-08-06 | Exploit code |
| CVE-2025-7768 | Tigo Energy Cloud Connect Advanced hard-coded credentials | 9.3CNA v4.0 | 0.6% | 2025-08-06 | |
| CVE-2025-7727 | Gutenverse WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-08-06 | Fix |
| CVE-2025-7502 | WPBakery Page Builder for WordPress plugin authenticated (Contributor+) stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-08-06 | Fix |
| CVE-2025-7498 | Exclusive Addons for Elementor WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-08-06 | Fix |
| CVE-2025-7399 | Betheme WordPress theme authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-06 | Fix |
| CVE-2025-7376 | Windows Shortcut Following (.LNK) vulnerability in multiple processes of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.9 | 5.9CNA v3.1 | 0.2% | 2025-08-06 | Fix |
| CVE-2025-7202 | Cross-site request forgery (CSRF) allowed remote control of Elgato Key Lights | 5.1CNA v4.0 | 0.2% | 2025-08-06 | |
| CVE-2025-7036 | CleverReach WP WordPress plugin unauthenticated SQL injection via title parameter | 7.5CNA v3.1 | 0.5% | 2025-08-06 | Fix |
| CVE-2025-6994 | Reveal Listing WordPress plugin unauthenticated privilege escalation | 9.8CNA v3.1 | 0.4% | 2025-08-06 | Fix |
| CVE-2025-6986 | FileBird WordPress Media Library Folders and File Manager plugin SQL injection | 6.5CNA v3.1 | 0.4% | 2025-08-06 | Fix |
| CVE-2025-6690 | WP Tournament Registration WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-06 | |
| CVE-2025-6634 | Autodesk 3ds Max TGA File Parsing memory corruption | 7.8CNA v3.1 | 0.2% | 2025-08-06 | Fix |
| CVE-2025-6633 | Autodesk 3ds Max RBG File Parsing out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-08-06 | Fix |
| CVE-2025-6632 | Autodesk 3ds Max PSD File Parsing out-of-bounds read | 5.3CNA v3.1 | 0.2% | 2025-08-06 | Fix |
| CVE-2025-6259 | esri-map-view WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-06 | |
| CVE-2025-6256 | Flex Guten WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-08-06 | Fix |
| CVE-2025-6013 | Vault LDAP MFA Enforcement Bypass when using Username as Alias | 6.5CNA v3.1 | 0.5% | 2025-08-06 | Fix |
| CVE-2025-5197 | Regular expression denial of service (ReDoS) in huggingface/Transformers | 5.3CNA v3.0 | 0.4% | 2025-08-06 | Fix |
| CVE-2025-3354 | IBM Tivoli Monitoring code execution | 8.1CNA v3.1 | 0.5% | 2025-08-06 | Fix |
| CVE-2025-3320 | IBM Tivoli Monitoring code execution | 8.1CNA v3.1 | 0.5% | 2025-08-06 | Fix |
| CVE-2025-2028 | Lack of TLS validation when downloading a CSV file including mapping from IPs to countries used ONLY for displaying country flags in logs | 6.5CNA v3.1 | 0.2% | 2025-08-06 | Fix |
| CVE-2025-54987 | Trend Micro Apex One OS command injection | 9.4CNA v3.1 | 19.7% | 2025-08-05 | Fix |
| CVE-2025-54982 | Zscaler Authentication Server SAML Public Key Validation issue | 9.6CNA v3.1 | 0.4% | 2025-08-05 | Fix |
| CVE-2025-54948 | Trend Micro Apex One OS command injection | 9.4CNA v3.1 | 23.9% | 2025-08-05 | KEVFix |
| CVE-2025-54874 | OpenJPEG allows OOB heap memory write in opj_jp2_read_header | 9.8NVD v3.1 | 0.6% | 2025-08-05 | Fix |
| CVE-2025-54871 | Electron Capture Node fuses improper access control | 5.5CNA v3.1 | 0.2% | 2025-08-05 | Fix |
| CVE-2025-54870 | VTun-ng's failure to initialize encryption modules may cause reversion to plaintext | 8.7CNA v4.0 | 0.2% | 2025-08-05 | Fix |
| CVE-2025-54868 | LibreChat exposes arbitrary chats through Meilisearch engine | 7.5CNA v3.1 | 0.4% | 2025-08-05 | Fix |
| CVE-2025-54865 | Tilesheets MediaWiki extension is vulnerable to potential SQL injection | 7.3CNA v3.1 | 0.4% | 2025-08-05 | |
| CVE-2025-54804 | Russh is missing an overflow check during channel windows adjust | 6.5CNA v3.1 | 0.4% | 2025-08-05 | Fix |
| CVE-2025-54803 | js-toml is vulnerable to prototype pollution | 7.9CNA v4.0 | 0.5% | 2025-08-05 | Fix |
| CVE-2025-54802 | pyLoad CNL Blueprint is vulnerable to path traversal | 9.8CNA v3.1 | 1.2% | 2025-08-05 | Fix |
| CVE-2025-54795 | Anthropic Claude Code command parsing command injection | 8.7CNA v4.0 | 1.0% | 2025-08-05 | Fix |
| CVE-2025-54794 | Anthropic Claude Code path validation path traversal | 7.7CNA v4.0 | 1.4% | 2025-08-05 | Exploit codeFix |
| CVE-2025-54780 | glpi-screenshot-plugin exposes local files in /ajax/screenshot.php | 7.7CNA v3.1 | 0.3% | 2025-08-05 | Fix |
| CVE-2025-54387 | IPX is vulnerable to path traversal via Prefix Matching Bypass | 6.9CNA v4.0 | 0.7% | 2025-08-05 | Fix |
| CVE-2025-54254 | Adobe Experience Manager improper restriction of XML external entity reference (XXE) | 8.6CNA v3.1 | 77.5% | 2025-08-05 | Emerging ThreatsFix |
| CVE-2025-54253 | Adobe Experience Manager forms code execution | 10.0CNA v3.1 | 88.3% | 2025-08-05 | KEVEmerging ThreatsExploit codeFix |
| CVE-2025-54135 | Cursor agent is vulnerable to prompt injection via MCP Special files | 8.6CNA v3.1 | 1.8% | 2025-08-05 | Exploit codeFix |
| CVE-2025-54130 | Cursor agent is vulnerable prompt injection via Editor Special files | 7.5CNA v3.1 | 0.3% | 2025-08-05 | Fix |
| CVE-2025-54119 | ADOdb's sqlite3 driver allows SQL injection | 10.0CNA v3.1 | 0.5% | 2025-08-05 | Fix |
| CVE-2025-53544 | Trilium Notes is vulnerable to brute-force Protection Bypass via Initial Sync Seed Retrieval | 7.5CNA v3.1 | 0.4% | 2025-08-05 | Fix |
| CVE-2025-53534 | tnb-labs panel RatPanel can perform remote command execution without authorization | 7.7CNA v4.0 | 0.6% | 2025-08-05 | Fix |
| CVE-2025-53417 | Delta Electronics DIAView file Parsing deserialization of untrusted data in DTM Soft | 9.3CNA v4.0 | 14.2% | 2025-08-05 | Fix |
| CVE-2025-52892 | EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache | 4.5CNA v3.1 | 0.2% | 2025-08-05 | Fix |
| CVE-2025-52237 | SSCMS path traversal | 6.5CISA ADP v3.1 | 0.5% | 2025-08-05 | |
| CVE-2025-52078 | Writebot AI Content Generator SaaS React Template file upload endpoint vulnerability | 6.5CISA ADP v3.1 | 0.3% | 2025-08-05 | Exploit code |
| CVE-2025-51857 | Halo AttachmentReconciler cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-08-05 | |
| CVE-2025-51628 | Agenzia Impresa Eccobook PdfHandler insecure direct object reference | 7.5CISA ADP v3.1 | 0.4% | 2025-08-05 | |
| CVE-2025-51627 | Agenzia Impresa Eccobook CaricaVerbale privilege escalation | 6.5CISA ADP v3.1 | 0.2% | 2025-08-05 | |
| CVE-2025-51541 | shopware stored cross-site scripting | 6.1CISA ADP v3.1 | 0.4% | 2025-08-05 | |
| CVE-2025-51060 | Cpuid Cpuz.sys improper access control | 6.5CISA ADP v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-50707 | ThinkPHP code injection | 9.8CISA ADP v3.1 | 1.0% | 2025-08-05 | |
| CVE-2025-50706 | ThinkPHP path traversal | 9.8CISA ADP v3.1 | 1.0% | 2025-08-05 | |
| CVE-2025-50688 | Twistedmatrix Twistedweb command injection | 6.5CISA ADP v3.1 | 4.8% | 2025-08-05 | |
| CVE-2025-50592 | Seacms cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2025-08-05 | Exploit code |
| CVE-2025-50454 | Blue Access' Cobalt X1 thru An authentication bypass | 6.5CISA ADP v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-47152 | PDF-XChange Editor EMF functionality out-of-bounds read | 6.5CNA v3.1 | 0.5% | 2025-08-05 | |
| CVE-2025-46958 | Adobe Experience Manager cross-site scripting (stored XSS) | 5.4CNA v3.1 | 0.3% | 2025-08-05 | Fix |
| CVE-2025-46658 | 4cstrategies Exonaut information disclosure through error messages | 9.8CISA ADP v3.1 | 0.4% | 2025-08-05 | |
| CVE-2025-45512 | denx U-Boot bootloader of DENX Software Engineering Das improper signature verification | 6.5CISA ADP v3.1 | 0.3% | 2025-08-05 | Exploit code |
| CVE-2025-44964 | BlueStacks improper certificate validation | 3.9CISA ADP v3.1 | 0.1% | 2025-08-05 | |
| CVE-2025-43980 | FIRSTNUM JC21A-04 SSH service vulnerability | 6.5CISA ADP v3.1 | 0.2% | 2025-08-05 | |
| CVE-2025-43979 | FIRSTNUM JC21A-04 xml_action.cgi OS command injection | 7.4CISA ADP v3.1 | 6.5% | 2025-08-05 | |
| CVE-2025-43978 | Jointelli 5G CPE 21H01 firmware ubus interface OS command injection | 7.4CISA ADP v3.1 | 1.1% | 2025-08-05 | |
| CVE-2025-41698 | Draeger: ICMHelper is vulnerable to a privilege escalation due too missing authorization | 7.8CNA v3.1 | 0.1% | 2025-08-05 | |
| CVE-2025-29745 | Emsisoft Anti-Malware scanning module information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2025-08-05 | |
| CVE-2025-27931 | PDF-XChange Editor EMF functionality out-of-bounds read | 6.5CNA v3.1 | 0.5% | 2025-08-05 | |
| CVE-2025-8586 | Libav MPEG file parser utils.c ff_seek_frame_binary null pointer dereference | 4.8CNA v4.0 | 0.2% | 2025-08-05 | |
| CVE-2025-8585 | Libav DSS File Demuxer avconv.c main double free | 4.8CNA v4.0 | 0.2% | 2025-08-05 | |
| CVE-2025-8584 | Libav AVI file parser buffer.c av_buffer_unref null pointer dereference | 4.8CNA v4.0 | 0.2% | 2025-08-05 | |
| CVE-2025-8573 | Concrete CMS 9 is vulnerable to stored XSS from Home Folder on Members Dashboard page | 2.0CNA v4.0 | 0.4% | 2025-08-05 | Exploit codeFix |
| CVE-2025-8571 | Concrete CMS vulnerable to reflected cross-site scripting in Conversation Messages Dashboard page | 4.8CNA v4.0 | 0.3% | 2025-08-05 | Exploit codeFix |
| CVE-2025-8555 | atjiu pybbs search cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-8554 | atjiu pybbs list cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-8553 | atjiu pybbs list cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-8552 | atjiu pybbs list cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-8551 | atjiu pybbs list cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-8550 | atjiu pybbs list cross-site scripting | 5.4v3.1 | 0.6% | 2025-08-05 | Exploit code |
| CVE-2025-8549 | atjiu pybbs UserAdminController.java update weak password | 6.3CNA v4.0 | 0.4% | 2025-08-05 | |
| CVE-2025-8548 | atjiu pybbs Registered Email SettingsApiController.java sendEmailCode information exposure | 6.3CNA v4.0 | 0.5% | 2025-08-05 | |
| CVE-2025-8547 | atjiu pybbs email verification improper authorization | 6.9CNA v4.0 | 0.4% | 2025-08-05 | |
| CVE-2025-8546 | atjiu pybbs Verification Code login Captcha | 6.9CNA v4.0 | 0.5% | 2025-08-05 | |
| CVE-2025-8545 | Portabilis i-Educar educar_motivo_afastamento_cad.php cross-site scripting | 4.8v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-8544 | Portabilis i-Educar edit cross-site scripting | 4.8v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-8543 | Portabilis i-Educar educar_raca_cad.php cross-site scripting | 4.8v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-8542 | Portabilis i-Educar empresas_cad.php cross-site scripting | 4.8v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-8541 | Portabilis i-Educar public_uf_cad.php cross-site scripting | 4.8v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-8540 | Portabilis i-Educar public_municipio_cad.php cross-site scripting | 4.8v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-8539 | Portabilis i-Educar public_distrito_cad.php cross-site scripting | 4.8v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-8538 | Portabilis i-Educar novo cross-site scripting | 4.8v3.1 | 0.3% | 2025-08-05 | |
| CVE-2025-8537 | Axiomatic Bento4 mp4decrypt Mp4Decrypt.cpp SetDataSize allocation of resources | 5.9v3.1 | 0.6% | 2025-08-05 | |
| CVE-2025-8535 | cronoh NanoVault xrb URL main.js executeJavaScript cross-site scripting | 9.0v3.1 | 0.4% | 2025-08-05 | |
| CVE-2025-8534 | LibTIFF tiff2ps tiff2ps.c PS_Lvl2page null pointer dereference | 2.0CNA v4.0 | 0.2% | 2025-08-05 | Fix |
| CVE-2025-8315 | WP Easy Contact WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-08-05 | Fix |
| CVE-2025-8313 | Campus Directory WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-08-05 | Fix |
| CVE-2025-8295 | Employee Directory WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-08-05 | Fix |
| CVE-2025-8294 | Download Counter WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-08-05 | Fix |
| CVE-2025-7674 | navify Monitoring API input validation | 7.1CNA v4.0 | 0.3% | 2025-08-05 | Fix |
| CVE-2025-7050 | WP Cloud Plugins Use-your-Drive plugin for WordPress stored cross-site scripting | 7.2CNA v3.1 | 0.3% | 2025-08-05 | Fix |
| CVE-2025-7033 | Rockwell Automation heap-based buffer overflow in Arena® Simulation | 8.4CNA v4.0 | 0.3% | 2025-08-05 | Fix |
| CVE-2025-7032 | Rockwell Automation stack-based buffer overflow in Arena® Simulation | 8.4CNA v4.0 | 0.3% | 2025-08-05 | Fix |
| CVE-2025-7025 | Rockwell Automation heap-based buffer overflow in Arena® Simulation | 8.4CNA v4.0 | 0.3% | 2025-08-05 | Fix |
| CVE-2025-6207 | WP Import Export Lite WordPress plugin authenticated (Subscriber+) arbitrary file upload | 8.8v3.1 | 0.7% | 2025-08-05 | Fix |
| CVE-2025-5061 | WP Import Export Lite WordPress plugin authenticated (Subscriber+) arbitrary file upload | 8.8v3.1 | 0.7% | 2025-08-05 | Fix |
| CVE-2025-2810 | Draeger: ICMHelper is vulnerable to use of hard-coded cryptographic key | 5.5CNA v3.1 | 0.1% | 2025-08-05 | |
| CVE-2025-2611 | ICTBroadcast Unauthenticated Session Cookie RCE | 9.3CNA v4.0 | 8.1% | 2025-08-05 | Reported exploitedNucleiMetasploitEmerging ThreatsExploit code |
| CVE-2025-55014 | StarDict resource leak | 4.7CNA v3.1 | 0.4% | 2025-08-04 | Fix |
| CVE-2025-54962 | thiagoralves OpenPLC_v3 unrestricted file upload | 6.4CNA v3.1 | 0.2% | 2025-08-04 | Exploit code |
| CVE-2025-54554 | Tera Insights tiCrypt incorrect authorization | 5.3CNA v3.1 | 0.3% | 2025-08-04 | Exploit codeFix |
| CVE-2025-53395 | Macrium Reflect ReflectMonitor.exe uncontrolled search path | 7.7CNA v3.1 | 0.2% | 2025-08-04 | |
| CVE-2025-53394 | Macrium Reflect uncontrolled search path | 7.7CNA v3.1 | 0.1% | 2025-08-04 | |
| CVE-2025-52239 | ZKEACMS An arbitrary file upload | 9.8CISA ADP v3.1 | 0.4% | 2025-08-04 | |
| CVE-2025-51726 | CyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision attacks. This allows a malicious actor to craft a fake installer with a forged SHA-1 certificate that may still be accepted by Windows signature verification mecha | 8.4CISA ADP v3.1 | 0.1% | 2025-08-04 | |
| CVE-2025-51536 | Craws OpenAtlas default credentials | 9.8CISA ADP v3.1 | 0.5% | 2025-08-04 | |
| CVE-2025-51535 | Craws OpenAtlas default credentials | 9.1CISA ADP v3.1 | 0.4% | 2025-08-04 | |
| CVE-2025-51534 | Craws OpenAtlas Austrian Archaeological Institute cross-site scripting | 8.1CISA ADP v3.1 | 0.4% | 2025-08-04 | |
| CVE-2025-51390 | TOTOLINK N600R OS command injection | 9.8CISA ADP v3.1 | 1.8% | 2025-08-04 | |
| CVE-2025-51387 | Axosoft Gitkraken Desktop code injection | 9.8CISA ADP v3.1 | 0.6% | 2025-08-04 | |
| CVE-2025-50754 | Unisite CMS Report feature stored cross-site scripting | 9.6CISA ADP v3.1 | 0.6% | 2025-08-04 | Exploit code |
| CVE-2025-50422 | cairographics Cairo reachable assertion | 2.9CNA v3.1 | 0.2% | 2025-08-04 | Exploit codeFix |
| CVE-2025-50420 | Freedesktop Poppler uncontrolled recursion | 6.5CISA ADP v3.1 | 0.3% | 2025-08-04 | Exploit codeFix |
| CVE-2025-50341 | Axelor domain query filter SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2025-08-04 | |
| CVE-2025-50340 | SOGo Webmail email sending insecure direct object reference | 4.3CISA ADP v3.1 | 0.3% | 2025-08-04 | Exploit code |
| CVE-2025-48499 | FUJIFILM Business Innovation DocuPrint CP225 w out-of-bounds write | 6.9CNA v4.0 | 0.3% | 2025-08-04 | |
| CVE-2025-46206 | Artifex MuPDF uncontrolled recursion | 6.5CISA ADP v3.1 | 0.4% | 2025-08-04 | Fix |
| CVE-2025-46094 | LiquidFiles path traversal | 3.8CNA v3.1 | 0.5% | 2025-08-04 | Fix |
| CVE-2025-46093 | LiquidFiles incorrect permission assignment | 8.8NVD v3.1 | 0.6% | 2025-08-04 | Fix |
| CVE-2025-44963 | RUCKUS Network Director hard-coded cryptographic key | 8.1NVD v3.1 | 0.6% | 2025-08-04 | Fix |
| CVE-2025-44962 | RUCKUS SmartZone path traversal | 4.3v3.1 | 0.8% | 2025-08-04 | Fix |
| CVE-2025-44961 | RUCKUS SmartZone OS command injection | 8.8NVD v3.1 | 2.1% | 2025-08-04 | Fix |
| CVE-2025-44960 | RUCKUS SmartZone OS command injection | 8.8v3.1 | 1.8% | 2025-08-04 | Fix |
| CVE-2025-44958 | RUCKUS Network Director recoverable password storage | 7.5v3.1 | 0.3% | 2025-08-04 | Fix |
| CVE-2025-44957 | RUCKUS SmartZone authentication bypass | 8.8v3.1 | 0.9% | 2025-08-04 | Fix |
| CVE-2025-44955 | RUCKUS Network Director hard-coded password | 8.8v3.1 | 0.5% | 2025-08-04 | Fix |
| CVE-2025-44954 | SmartZone SSH access vulnerability | 9.8v3.1 | 0.7% | 2025-08-04 | Fix |
| CVE-2025-44643 | DrayTek AP903, AP912C and AP918R routing daemon configuration hard-coded credentials | 8.6CISA ADP v3.1 | 0.2% | 2025-08-04 | |
| CVE-2025-41691 | CODESYS Control DoS via unauthenticated null pointer dereference | 7.5CNA v3.1 | 0.5% | 2025-08-04 | Fix |
| CVE-2025-41659 | CODESYS Control PKI Exposure enables Remote Certificate Access | 8.3CNA v3.1 | 0.2% | 2025-08-04 | Fix |
| CVE-2025-41658 | CODESYS Toolkit exposes Sensitive files via Default Permissions | 5.5CNA v3.1 | 0.1% | 2025-08-04 | Fix |
| CVE-2025-38741 | Dell Enterprise SONiC OS hard-coded cryptographic key | 7.5CNA v3.1 | 0.4% | 2025-08-04 | Fix |
| CVE-2025-38739 | Dell Digital Delivery insufficiently protected credentials | 7.2CNA v3.1 | 0.4% | 2025-08-04 | Fix |
| CVE-2025-36607 | Dell Unity OS command injection | 7.8CNA v3.1 | 0.5% | 2025-08-04 | Fix |
| CVE-2025-36606 | Dell Unity OS command injection | 7.8CNA v3.1 | 0.5% | 2025-08-04 | Fix |
| CVE-2025-36605 | Dell Unity cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-08-04 | Fix |
| CVE-2025-36604 | Dell Unity OS command injection | 7.3CNA v3.1 | 66.4% | 2025-08-04 | NucleiEmerging ThreatsExploit codeFix |
| CVE-2025-36594 | Dell PowerProtect Data Domain Feature Release authentication bypass by spoofing | 9.8CNA v3.1 | 0.5% | 2025-08-04 | Fix |
| CVE-2025-34147 | Shenzhen Aitemi M300 Wi-Fi Repeater OS command injection via SSID | 9.4CNA v4.0 | 1.0% | 2025-08-04 | Emerging Threats |
| CVE-2025-30099 | Dell PowerProtect Data Domain Feature Release OS command injection | 7.8CNA v3.1 | 0.4% | 2025-08-04 | Fix |
| CVE-2025-30098 | Dell PowerProtect Data Domain Feature Release OS command injection | 6.7CNA v3.1 | 0.4% | 2025-08-04 | Fix |
| CVE-2025-30097 | Dell PowerProtect Data Domain Feature Release OS command injection | 6.7CNA v3.1 | 0.4% | 2025-08-04 | Fix |
| CVE-2025-30096 | Dell PowerProtect Data Domain Feature Release OS command injection | 6.7CNA v3.1 | 0.4% | 2025-08-04 | Fix |
| CVE-2025-27212 | Ubiquiti UniFi Access Reader Pro certain UniFi Access devices improper input validation | 9.8CISA ADP v3.1 | 1.2% | 2025-08-04 | Fix |
| CVE-2025-27211 | Ubiquiti EdgeMAX EdgeSwitch An improper input validation | 7.5CISA ADP v3.1 | 0.6% | 2025-08-04 | |
| CVE-2025-26476 | Dell ECS hard-coded cryptographic key | 8.4CNA v3.1 | 0.1% | 2025-08-04 | Fix |
| CVE-2025-26065 | Intelbras RX 1500 cross-site scripting | 7.3CISA ADP v3.1 | 0.4% | 2025-08-04 | Fix |
| CVE-2025-21120 | Dell Avamar Server information disclosure | 8.3CNA v3.1 | 0.3% | 2025-08-04 | Fix |
| CVE-2025-20702 | Airoha Technology AB156x the Airoha Bluetooth audio SDK unauthorized access | 8.8CISA ADP v3.1 | 11.5% | 2025-08-04 | KCV |
| CVE-2025-20701 | Airoha Technology AB156x the Airoha Bluetooth audio SDK privilege escalation | 8.8CISA ADP v3.1 | 8.7% | 2025-08-04 | Exploit codeKCVFix |
| CVE-2025-20700 | Airoha Technology AB156x the Airoha Bluetooth audio SDK insecure permissions | 8.8CISA ADP v3.1 | 9.2% | 2025-08-04 | |
| CVE-2025-20698 | MediaTek chipsets out-of-bounds write in Power HAL | 6.7CISA ADP v3.1 | 0.1% | 2025-08-04 | Fix |
| CVE-2025-20697 | MediaTek chipsets out-of-bounds write in Power HAL | 6.7CISA ADP v3.1 | 0.1% | 2025-08-04 | Fix |
| CVE-2025-20696 | MediaTek chipsets out-of-bounds write in DA | 6.8CISA ADP v3.1 | 0.1% | 2025-08-04 | Fix |
| CVE-2025-8530 | elunez Eladmin Druid application-prod.yml default credentials | 7.5v3.1 | 0.5% | 2025-08-04 | |
| CVE-2025-8529 | cloudfavorites favorites-web CollectController.java getCollectLogoUrl server-side request forgery | 5.3CNA v4.0 | 0.3% | 2025-08-04 | |
| CVE-2025-8528 | Exrick xboot getMenuList sensitive information in a cookie | 5.9v3.1 | 0.3% | 2025-08-04 | |
| CVE-2025-8527 | Exrick xboot Swagger SecurityController.java server-side request forgery | 8.8v3.1 | 0.3% | 2025-08-04 | |
| CVE-2025-8526 | Exrick xboot UploadController.java upload unrestricted upload | 9.8v3.1 | 0.3% | 2025-08-04 | |
| CVE-2025-8525 | Exrick xboot Spring Boot Admin/Spring Actuator information disclosure | 6.9CNA v4.0 | 0.5% | 2025-08-04 | |
| CVE-2025-8524 | Boquan DotWallet App improper export of android application components | 4.8CNA v4.0 | 0.1% | 2025-08-04 | |
| CVE-2025-8523 | RiderLike Fruit Crush-Brain App improper export of android application components | 4.8CNA v4.0 | 0.1% | 2025-08-04 | |
| CVE-2025-8522 | givanz Vvvebjs node.js save.php path traversal | 2.3CNA v4.0 | 0.3% | 2025-08-04 | |
| CVE-2025-8521 | givanz Vvveb Add Type post-types cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-04 | Fix |
| CVE-2025-8520 | givanz Vvveb Drag-and-Drop Editor editor server-side request forgery | 5.1CNA v4.0 | 0.4% | 2025-08-04 | Fix |
| CVE-2025-8519 | givanz Vvveb Drag-and-Drop Editor editor information disclosure | 5.1CNA v4.0 | 0.4% | 2025-08-04 | Fix |
| CVE-2025-8518 | givanz Vvveb Code Editor code.php save code injection | 7.2NVD v3.1 | 2.1% | 2025-08-04 | MetasploitExploit codeFix |
| CVE-2025-8517 | givanz Vvveb session fixation | 5.3CNA v4.0 | 2.2% | 2025-08-04 | Exploit codeFix |
| CVE-2025-8516 | Kingdee Cloud-Starry-Sky Enterprise Edition IIS-K3CloudMiniApp FileUploadAction.class path traversal | 6.9CNA v4.0 | 0.8% | 2025-08-04 | Fix |
| CVE-2025-8515 | Intelbras InControl JSON endpoint operador information disclosure | 3.7v3.1 | 0.3% | 2025-08-04 | |
| CVE-2025-8341 | grafana-infinity-datasource SSRF in Infinity Datasource plugin | 5.0CNA v3.1 | 0.3% | 2025-08-04 | Fix |
| CVE-2025-8109 | GPU DDK GPU shader shared memory corrupted using ptrace to disrupt GPU operation | 8.8CISA ADP v3.1 | 0.4% | 2025-08-04 | Fix |
| CVE-2025-7844 | wolfSSL wolfTPM RSA key export function stack-based buffer overflow | 1.0CNA v4.0 | 0.1% | 2025-08-04 | |
| CVE-2025-6205 | Dassault Systèmes DELMIA Apriso missing authorization | 9.1CNA v3.1 | 73.8% | 2025-08-04 | KEVNucleiFix |
| CVE-2025-6204 | Dassault Systèmes DELMIA Apriso code injection | 8.0CNA v3.1 | 79.3% | 2025-08-04 | KEVNucleiFix |
| CVE-2025-5988 | Red Hat Ansible Automation Platform aap-gateway: Csrf origin checking is disabled | 5.3CNA v3.1 | 0.3% | 2025-08-04 | Fix |
| CVE-2025-4604 | Liferay Portal CAPTCHA Bypass for Gogo Shell | 6.9CNA v4.0 | 0.2% | 2025-08-04 | Fix |
| CVE-2025-4599 | Liferay Portal cross-site scripting | 2.0CNA v4.0 | 0.2% | 2025-08-04 | Fix |
| CVE-2025-0932 | Mali GPU Userspace Driver allows access to already freed memory | 4.3CISA ADP v3.1 | 0.3% | 2025-08-04 | Fix |
| CVE-2025-54956 | r-lib gh incorrect resource transfer | 3.2CNA v3.1 | 0.1% | 2025-08-03 | Fix |
| CVE-2025-54955 | OpenNebula race condition | 8.1CNA v3.1 | 0.4% | 2025-08-03 | Fix |
| CVE-2025-54351 | ES iperf3 unprotected alternate channel | 10.0v3.1 | 0.4% | 2025-08-03 | Fix |
| CVE-2025-54350 | ES iperf3 reachable assertion | 5.3v3.1 | 0.4% | 2025-08-03 | Fix |
| CVE-2025-54349 | ES iperf3 off-by-one error | 10.0v3.1 | 0.4% | 2025-08-03 | Fix |
| CVE-2025-52133 | xwiki-contrib Mocca Calendar cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-08-03 | Fix |
| CVE-2025-52132 | xwiki-contrib Mocca Calendar cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-08-03 | Fix |
| CVE-2025-52131 | xwiki-contrib Mocca Calendar cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-08-03 | Fix |
| CVE-2025-8513 | Caixin News App improper export of android application components | 4.8CNA v4.0 | 0.1% | 2025-08-03 | |
| CVE-2025-8512 | TVB Big Big Shop App improper export of android application components | 4.8CNA v4.0 | 0.1% | 2025-08-03 | |
| CVE-2025-8511 | Portabilis i-Diario Observações diario-de-observacoes cross-site scripting | 5.4NVD v3.1 | 0.3% | 2025-08-03 | |
| CVE-2025-8510 | Portabilis i-Educar educar_matricula_lst.php Gerar cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-03 | |
| CVE-2025-8509 | Portabilis i-Educar educar_servidor_cad.php cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-03 | |
| CVE-2025-8508 | Portabilis i-Educar educar_avaliacao_desempenho_cad.php cross-site scripting | 5.4v3.1 | 0.4% | 2025-08-03 | |
| CVE-2025-8507 | Portabilis i-Educar educar_funcao_lst.php cross-site scripting | 5.4v3.1 | 0.3% | 2025-08-03 | |
| CVE-2025-8506 | 495300897 wx-shop editUI cross-site scripting | 5.1CNA v4.0 | 0.3% | 2025-08-03 | |
| CVE-2025-8505 | 495300897 wx-shop cross-site request forgery | 5.3CNA v4.0 | 0.2% | 2025-08-03 | |
| CVE-2025-8504 | code-projects Kitchen Treasure userregistration.php unrestricted upload | 9.8v3.1 | 0.4% | 2025-08-03 | |
| CVE-2025-8503 | code-projects Online Medicine Guide adaddmed.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-03 | |
| CVE-2025-8502 | code-projects Online Medicine Guide changepass.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-03 | |
| CVE-2025-8501 | code-projects Human Resource Integrated System action.php cross-site scripting | 5.4v3.1 | 0.4% | 2025-08-03 | |
| CVE-2025-8500 | code-projects Human Resource Integrated System action.php SQL injection | 8.8v3.1 | 0.5% | 2025-08-03 | |
| CVE-2025-8499 | code-projects Online Medicine Guide cusfindambulence2.php SQL injection | 9.8v3.1 | 0.6% | 2025-08-03 | |
| CVE-2025-8498 | code-projects Online Medicine Guide index.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-03 | |
| CVE-2025-8497 | code-projects Online Medicine Guide cusfindphar2.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-03 | |
| CVE-2025-8496 | Projectworlds Online Admission System viewform.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-03 | |
| CVE-2025-8495 | code-projects Intern Membership Management System edit_admin_query.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-03 | |
| CVE-2025-8494 | code-projects Intern Membership Management System delete_student.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-03 | |
| CVE-2025-54796 | Copyparty is vulnerable to Regex denial of service (ReDoS) attacks through Recent Uploads page | 7.5CNA v3.1 | 0.4% | 2025-08-02 | Fix |
| CVE-2025-54790 | Files: Potential for SQL injection through File Browse and List Operations | 9.2CNA v4.0 | 0.3% | 2025-08-02 | Fix |
| CVE-2025-54789 | Files is vulnerable to Reflected Self-XSS through its File Move Functionality | 5.1CNA v4.0 | 0.3% | 2025-08-02 | Fix |
| CVE-2025-54782 | @nestjs/Devtools-integration's CSRF to sandbox escape allows for RCE against JS Developers | 9.4CNA v4.0 | 53.3% | 2025-08-02 | NucleiExploit codeFix |
| CVE-2025-54781 | Himmelblau leaks an Intune service access token in its logs | 2.8CNA v3.1 | 0.1% | 2025-08-02 | Fix |
| CVE-2025-54386 | traefik path traversal | 7.3CNA v4.0 | 1.1% | 2025-08-02 | Fix |
| CVE-2025-54136 | Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals | 7.2CNA v3.1 | 26.7% | 2025-08-02 | Exploit codeFix |
| CVE-2025-54133 | Cursor's MCP Install Deeplink Does not Show arguments in its User-Dialog | 5.3CNA v4.0 | 0.4% | 2025-08-02 | Fix |
| CVE-2025-23290 | NVIDIA GPU Display Drivers information disclosure | 2.5CNA v3.1 | 0.1% | 2025-08-02 | Fix |
| CVE-2025-23288 | NVIDIA GPU Display Drivers system information disclosure | 3.3CNA v3.1 | 0.1% | 2025-08-02 | Fix |
| CVE-2025-23287 | NVIDIA GPU Display Drivers system information disclosure | 3.3CNA v3.1 | 0.2% | 2025-08-02 | Fix |
| CVE-2025-23286 | NVIDIA GPU Display Drivers out-of-bounds read | 4.4CNA v3.1 | 0.1% | 2025-08-02 | Fix |
| CVE-2025-23285 | NVIDIA GPU Display Drivers incorrect permission assignment | 5.5CNA v3.1 | 0.2% | 2025-08-02 | Fix |
| CVE-2025-23284 | NVIDIA GPU Display Drivers stack-based buffer overflow | 7.8CNA v3.1 | 0.2% | 2025-08-02 | Fix |
| CVE-2025-23283 | NVIDIA GPU Display Drivers stack-based buffer overflow | 7.8CNA v3.1 | 0.2% | 2025-08-02 | Fix |
| CVE-2025-23281 | NVIDIA GPU Display Drivers use-after-free | 7.0CNA v3.1 | 0.2% | 2025-08-02 | Fix |
| CVE-2025-23279 | NVIDIA GPU Display Drivers time-of-check time-of-use race condition | 7.0CNA v3.1 | 0.1% | 2025-08-02 | Fix |
| CVE-2025-23278 | NVIDIA GPU Display Drivers improper array index validation | 7.1CNA v3.1 | 0.2% | 2025-08-02 | Fix |
| CVE-2025-23277 | NVIDIA GPU Display Drivers denial of service | 7.3CNA v3.1 | 0.2% | 2025-08-02 | Fix |
| CVE-2025-23276 | NVIDIA GPU Display Drivers files accessible to external parties | 7.8CNA v3.1 | 0.2% | 2025-08-02 | Fix |
| CVE-2025-8493 | code-projects Intern Membership Management System edit_student_query.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-02 | |
| CVE-2025-8488 | Ultimate Addons for Elementor WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.3% | 2025-08-02 | Fix |
| CVE-2025-8471 | Projectworlds Online Admission System adminlogin.php SQL injection | 9.8v3.1 | 0.7% | 2025-08-02 | Exploit code |
| CVE-2025-8470 | SourceCodester Online Hotel Reservation System deleteroom.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-02 | |
| CVE-2025-8469 | SourceCodester Online Hotel Reservation System deletegallery.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-02 | |
| CVE-2025-8468 | code-projects Wazifa System reset.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-02 | |
| CVE-2025-8467 | code-projects Wazifa System regcontrol.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-02 | |
| CVE-2025-8466 | code-projects Online Farm System forgot_passfarmer.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-02 | |
| CVE-2025-8400 | Image Gallery WordPress plugin reflected cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-08-02 | |
| CVE-2025-8399 | Mmm Unity Loader WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-02 | |
| CVE-2025-8391 | Magic Edge Lite WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-02 | |
| CVE-2025-8317 | Custom Word Cloud WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-02 | |
| CVE-2025-8212 | Medical Addon for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-02 | Fix |
| CVE-2025-8152 | WP CTA WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.3% | 2025-08-02 | Fix |
| CVE-2025-8146 | Qi Addons for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-02 | Fix |
| CVE-2025-7710 | Brave Conversion Engine (PRO) WordPress plugin authentication bypass to Administrator | 9.8CNA v3.1 | 0.6% | 2025-08-02 | Fix |
| CVE-2025-7694 | Woffice Core WordPress plugin authenticated (Contributor+) arbitrary file deletion | 7.5v3.1 | 0.9% | 2025-08-02 | Fix |
| CVE-2025-7500 | Ocean Social Sharing WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-08-02 | Fix |
| CVE-2025-6832 | All in One Time Clock Lite WordPress plugin reflected cross-site scripting | 6.1CNA v3.1 | 0.2% | 2025-08-02 | Fix |
| CVE-2025-6754 | SEO Metrics WordPress plugin missing authorization authenticated privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-08-02 | Fix |
| CVE-2025-6722 | BitFire WordPress plugin unauthenticated information exposure | 5.3CNA v3.1 | 0.3% | 2025-08-02 | Fix |
| CVE-2025-6626 | ShortPixel Adaptive Images WordPress plugin stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-08-02 | Fix |
| CVE-2025-6078 | Partner Web notes page stored cross-site scripting | 5.4CISA ADP v3.1 | 0.4% | 2025-08-02 | Fix |
| CVE-2025-6077 | Partner Web administrator account vulnerability | 9.8CISA ADP v3.1 | 0.7% | 2025-08-02 | Fix |
| CVE-2025-6076 | Partner Web reports tab file upload vulnerability | 8.8CISA ADP v3.1 | 0.7% | 2025-08-02 | Fix |
| CVE-2025-4588 | 360 Photo Spheres WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-02 | |
| CVE-2025-54939 | litespeedtech LSQUIC resource exhaustion | 7.5v3.1 | 0.8% | 2025-08-01 | Exploit codeFix |
| CVE-2025-54792 | LocalSend is vulnerable to man-in-the-middle Attacks, leading to File Interception | 9.3CNA v4.0 | 0.3% | 2025-08-01 | Fix |
| CVE-2025-54595 | Pearcleaner's unauthenticated access to privileged XPC helper allows root command execution | 7.3CNA v3.1 | 0.2% | 2025-08-01 | Fix |
| CVE-2025-54593 | FreshRSS is vulnerable to RCE attacks by authenticated admin | 7.2CNA v3.1 | 0.8% | 2025-08-01 | Fix |
| CVE-2025-54590 | webfinger.js is vulnerable to blind SSRF attacks through localhost | 6.9CNA v4.0 | 0.6% | 2025-08-01 | Fix |
| CVE-2025-54574 | Squid's URN Handling can lead to buffer overflow | 9.3CNA v3.1 | 24.0% | 2025-08-01 | Exploit codeFix |
| CVE-2025-54564 | ChargePoint Home Flex uploadsm bz2 decompression command injection | 7.8CISA ADP v3.1 | 0.2% | 2025-08-01 | |
| CVE-2025-54424 | 1Panel Agent Bypasses Certificate Verification leading to arbitrary command execution | 8.1CNA v3.1 | 0.9% | 2025-08-01 | Exploit codeFix |
| CVE-2025-54132 | Cursor's Mermaid Diagram tool is vulnerable to an arbitrary Image Fetch | 4.4CNA v3.1 | 0.4% | 2025-08-01 | Fix |
| CVE-2025-54131 | Cursor bypasses its allow list to execute arbitrary commands | 6.4CNA v3.1 | 0.5% | 2025-08-01 | Fix |
| CVE-2025-53399 | Sipwise rtpengine origin validation error | 6.9CNA v4.0 | 6.3% | 2025-08-01 | Fix |
| CVE-2025-53012 | MaterialX's lack of Import Depth Limit leads to DoS (denial of service) via stack exhaustion | 5.5CNA v4.0 | 0.9% | 2025-08-01 | Fix |
| CVE-2025-53011 | MaterialX is vulnerable to null pointer dereference due to Unchecked implGraphOutput | 2.0CNA v4.0 | 0.5% | 2025-08-01 | Fix |
| CVE-2025-53010 | Academy Software Foundation MaterialX MaterialXCore null pointer dereference | 2.0CNA v4.0 | 0.5% | 2025-08-01 | Fix |
| CVE-2025-53009 | MaterialX stack overflow via lack of MTLX XML Parsing Recursion Limit | 5.5CNA v4.0 | 0.6% | 2025-08-01 | Fix |
| CVE-2025-52390 | Saurus CMS Community Edition full-text search class SQL injection | 9.1CISA ADP v3.1 | 0.6% | 2025-08-01 | |
| CVE-2025-52361 | AK-Nord USB-Server-LXL firmware lighttpd init script incorrect default permissions | 7.8CISA ADP v3.1 | 0.2% | 2025-08-01 | |
| CVE-2025-52327 | Carmelogarcia Restaurant Order System SQL injection | 7.8CISA ADP v3.1 | 0.2% | 2025-08-01 | |
| CVE-2025-51504 | Microweber XSS vulnerability in the homepage endpoint | 7.6CISA ADP v3.1 | 0.5% | 2025-08-01 | |
| CVE-2025-51502 | Microweber has reflected XSS vulnerability in the layout parameter | 6.1CISA ADP v3.1 | 0.8% | 2025-08-01 | Nuclei |
| CVE-2025-51501 | Microweber has reflected XSS vulnerability in the id parameter | 6.1CISA ADP v3.1 | 0.8% | 2025-08-01 | Nuclei |
| CVE-2025-50870 | Institute of Current Students student details endpoint information disclosure | 9.8CISA ADP v3.1 | 0.4% | 2025-08-01 | |
| CVE-2025-50869 | qureydetails.php page of Institute-of-Current-Students stored cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-08-01 | |
| CVE-2025-50868 | takeassessment2.php file of CloudClassroom-PHP-Project SQL injection | 6.5CISA ADP v3.1 | 0.2% | 2025-08-01 | |
| CVE-2025-50472 | ms-swift model cache loading insecure deserialization | 9.8CISA ADP v3.1 | 1.4% | 2025-08-01 | |
| CVE-2025-50460 | MS SWIFT remote code execution via unsafe PyYAML deserialization | 9.8CISA ADP v3.1 | 2.7% | 2025-08-01 | Exploit code |
| CVE-2025-49832 | Asterisk is vulnerable to remote DoS and possible RCE Attacks during Memory Allocation | 6.5CNA v3.1 | 0.5% | 2025-08-01 | Fix |
| CVE-2025-48074 | OpenEXR's Unbounded file Header Values can lead to Out-Of-Memory Errors | 4.6CNA v4.0 | 0.3% | 2025-08-01 | Fix |
| CVE-2025-46018 | Cscsw Pay Mobile authentication bypass by spoofing | 5.4CISA ADP v3.1 | 0.3% | 2025-08-01 | Exploit code |
| CVE-2025-45778 | Languagesloth The Language Sloth Language Sloth Web application v1.0 stored cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-08-01 | |
| CVE-2025-45767 | jose weak encryption | 7.0CISA ADP v3.1 | 0.2% | 2025-08-01 | |
| CVE-2025-45150 | X-d Lab Langchain-chatglm-webui insecure permissions | 9.8CISA ADP v3.1 | 0.5% | 2025-08-01 | |
| CVE-2025-44139 | emlog unrestricted file upload | 7.2CISA ADP v3.1 | 0.7% | 2025-08-01 | |
| CVE-2025-41376 | CRLF injection in LimeSurvey | 5.3v3.1 | 0.5% | 2025-08-01 | Fix |
| CVE-2025-41375 | SQL injection in LimeSurvey | 9.8v3.1 | 0.6% | 2025-08-01 | Fix |
| CVE-2025-41374 | SQL injection vulnerability in Gandia Integra Total | 8.8v3.1 | 0.6% | 2025-08-01 | Fix |
| CVE-2025-41373 | SQL injection vulnerability in Gandia Integra Total | 8.8v3.1 | 1.1% | 2025-08-01 | Exploit codeFix |
| CVE-2025-41372 | SQL injection vulnerability in Gandia Integra Total | 8.8v3.1 | 0.6% | 2025-08-01 | Fix |
| CVE-2025-41371 | SQL injection vulnerability in Gandia Integra Total | 8.8NVD v3.1 | 0.6% | 2025-08-01 | Fix |
| CVE-2025-41370 | SQL injection vulnerability in Gandia Integra Total | 8.8NVD v3.1 | 0.6% | 2025-08-01 | Fix |
| CVE-2025-33118 | IBM QRadar SIEM cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-01 | Fix |
| CVE-2025-31716 | UNISOC chipsets bootloader out-of-bounds write | 5.1CNA v3.1 | 0.1% | 2025-08-01 | Fix |
| CVE-2025-8480 | Alpine iLX-507 command injection remote code execution | 8.0CNA v3.0 | 0.7% | 2025-08-01 | |
| CVE-2025-8477 | Alpine iLX-507 vCard Parsing stack-based buffer overflow remote code execution | 7.4CNA v3.0 | 0.3% | 2025-08-01 | |
| CVE-2025-8476 | Alpine iLX-507 TIDAL improper certificate validation | 8.0v3.1 | 0.1% | 2025-08-01 | |
| CVE-2025-8475 | Alpine iLX-507 AVRCP stack-based buffer overflow remote code execution | 7.4CNA v3.0 | 0.3% | 2025-08-01 | |
| CVE-2025-8474 | Alpine iLX-507 CarPlay stack-based buffer overflow code execution | 6.8CNA v3.0 | 0.2% | 2025-08-01 | |
| CVE-2025-8473 | Alpine iLX-507 UPDM_wstpCBCUpdStart command injection | 6.6v3.1 | 0.7% | 2025-08-01 | |
| CVE-2025-8472 | Alpine iLX-507 vCard Parsing stack-based buffer overflow remote code execution | 7.4CNA v3.0 | 0.3% | 2025-08-01 | |
| CVE-2025-8454 | Debian devscripts improper signature verification | 9.8CISA ADP v3.1 | 0.2% | 2025-08-01 | |
| CVE-2025-8443 | code-projects Online Medicine Guide login.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-01 | |
| CVE-2025-8442 | code-projects Online Medicine Guide cussignup.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-01 | |
| CVE-2025-8441 | code-projects Online Medicine Guide pharsignup.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-01 | |
| CVE-2025-8439 | code-projects Wazifa System updatesettings.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-01 | |
| CVE-2025-8438 | code-projects Wazifa System postpublish.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-01 | |
| CVE-2025-8437 | code-projects Kitchen Treasure userregistration.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-01 | |
| CVE-2025-8436 | Projectworlds Online Admission System viewdoc.php SQL injection | 9.8v3.1 | 0.4% | 2025-08-01 | |
| CVE-2025-8435 | code-projects Online Movie Streaming admin-control.php authorization | 6.9CNA v4.0 | 0.4% | 2025-08-01 | |
| CVE-2025-8434 | code-projects Online Movie Streaming admin.php authorization | 6.9CNA v4.0 | 0.4% | 2025-08-01 | |
| CVE-2025-8433 | code-projects Document Management System dell.php unlink path traversal | 5.3CNA v4.0 | 0.5% | 2025-08-01 | |
| CVE-2025-8431 | PHPGurukul Boat Booking System add-boat.php SQL injection | 9.8v3.1 | 0.5% | 2025-08-01 | |
| CVE-2025-7845 | Stratum Elementor Widgets WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-01 | Fix |
| CVE-2025-7725 | Photos WordPress plugin stored cross-site scripting | 7.2CNA v3.1 | 0.2% | 2025-08-01 | Fix |
| CVE-2025-7646 | The Plus Addons for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-08-01 | Fix |
| CVE-2025-7443 | BerqWP WordPress plugin unauthenticated arbitrary file upload | 8.1CNA v3.1 | 1.0% | 2025-08-01 | Fix |
| CVE-2025-6398 | ASUS AI Suite IOMap64.sys driver null pointer dereference | 6.7CNA v4.0 | 0.2% | 2025-08-01 | Fix |
| CVE-2025-6228 | Sina Extension for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-08-01 | Fix |
| CVE-2025-6037 | Vault Certificate Auth Method Did not Validate Common Name for Non-CA Certificates | 6.8CNA v3.1 | 0.2% | 2025-08-01 | Fix |
| CVE-2025-6015 | Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse | 5.7CNA v3.1 | 0.3% | 2025-08-01 | Fix |
| CVE-2025-6014 | Vault TOTP Secrets Engine Code Reuse | 6.5CNA v3.1 | 0.4% | 2025-08-01 | Fix |
| CVE-2025-6011 | Timing side-channel in Vault’s Userpass Auth method | 3.7CNA v3.1 | 0.3% | 2025-08-01 | Fix |
| CVE-2025-6004 | Vault Userpass and LDAP User Lockout Bypass | 5.3CNA v3.1 | 0.4% | 2025-08-01 | Fix |
| CVE-2025-6000 | HashiCorp Vault arbitrary remote code execution via Plugin Catalog Abuse | 9.1CNA v3.1 | 0.9% | 2025-08-01 | Fix |
| CVE-2025-5999 | Vault Root Namespace Operator may Elevate Token Privileges | 7.2CNA v3.1 | 0.5% | 2025-08-01 | Fix |
| CVE-2025-5954 | Service Finder SMS System WordPress plugin unauthenticated privilege escalation | 9.8CNA v3.1 | 0.4% | 2025-08-01 | |
| CVE-2025-5947 | Service Finder Bookings WordPress plugin authentication bypass via user Switch Cookie | 9.8CNA v3.1 | 4.4% | 2025-08-01 | NucleiExploit codeFix |
| CVE-2025-5921 | SureForms WordPress plugin reflected XSS | 5.8CISA ADP v3.1 | 0.2% | 2025-08-01 | Fix |
| CVE-2025-4684 | BlockSpare Image Carousel and Image Slider widgets stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-08-01 | Fix |
| CVE-2025-4523 | IDonate - missing authorization to Authenticated sensitive information disclosure | 6.5v3.1 | 0.3% | 2025-08-01 | Fix |
| CVE-2025-2824 | IBM Operational Decision Manager HTTP open redirect | 7.4CNA v3.1 | 0.3% | 2025-08-01 | Fix |