CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- linux, linux kernel +1 moreksmbd: use list_first_entry_or_null for opinfo_get_list()8.8 High
- linux, linux kernel +1 moredrm/amd/display: check stream id dml21 wrapper to get plane_id7.8 High
- wikimedia foundation mediawiki - mintydocs extension, yaronkoren mintydocs +1 moreStored XSS in MintyDocs3.7 Low
- progress software kendo ui for angular, kendo ui for jquery, kendoreact +3 more +5 moreCross-Site Scripting (XSS) in PdfViewer5.4 Medium
- wikimedia foundation mediawiki - mintydocs extension, yaronkoren mintydocs +1 moreStored XSS in MintyDocs6.5 Medium
- wikimedia foundation mediawiki - twocolconflict extension, wmde-fisch twocolconflict +1 moreStored XSS in TwoColConflict6.5 Medium
- dataeaseDataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability8.9 High
- linkwardenLinkwarden Local File Inclusion Vulnerability8.7 High
- stamparm maltrailstamparm/maltrail <=0.54 Remote Command Execution10.0 Critical
- anthropic slack mcp serverAnthropic Slack MCP Server Data Exfiltration via Link Unfurling9.3 Critical
- gfi kerio controlGFI Kerio Control Unsigned System Image Upload Root Code Execution9.4 Critical
- gfi kerio controlGFI Kerio Control GFIAgent Missing Authentication on Administrative Interfaces10.0 Critical
- gfi kerio controlGFI Kerio Control GFIAgent Authentication Bypass via Proxy Forwarding9.5 Critical
- hikvision integrated security management platformHikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson10.0 Critical
- ruijie nbr routerRuijie NBR Router Administrative Credential Disclosure8.7 High
- infinera g42, nokia g42 firmware +1 moreImproper Access Control Granularity impacting Infinera G424.9 Medium
- apache guacamoleApache Guacamole: Improper input validation of console codes6.8 Medium
- apache apisixApache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect5.3 Medium
- mollie payments for woocommerceWordPress Mollie Payments for WooCommerce plugin <= 8.0.2 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- infinera g42Improper File Access in Infinera G428.8 High
- infinera g42, nokia g42 firmware +1 moreImproper File Access in Infinera G426.5 Medium
- shamsbd71 all-in-one addons for elementor – widgetkit, themesgrove all-in-one addons for elementor +1 moreAll-in-One Addons for Elementor – WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via button+modal Widget6.4 Medium
- odin design vikingerVikinger <= 1.9.32 - Authenticated (Subscriber+) Arbitrary File Deletion via vikinger_delete_activity_media_ajax Function8.1 High
- infinera g42, nokia g42 firmware +1 moreImproper Input Validation in Infinera G426.5 Medium
- infinera g42, nokia g42 firmware +1 morePath Traversal Vulnerability in Infinera G427.5 High
- infinera g42, nokia g42 firmware +1 moreOperating System Misconfiguration in Infinera G427.0 High
- nokia single ranSOAP message input validation fault could in theory cause OAM service resource exhaustion2.0 Low
- nokia single ranThe Nokia Single RAN baseband reveals its software version through the MNO internal RAN management network3.3 Low
- nokia single ranAdministrative user shell input validation fault6.4 Medium
- nokia single ran airscale (flexi multiradio is not affected)Authenticated admin user can connect baseband internally from one board to another without needing to re-authentication7.1 High
- nokia single ranNokia Single RAN baseband OAM service extensive capabilities6.4 Medium
- nokia single ranOAM service path traversal issue caused by a crafted SOAP message PlanId field within the RAN management network6.4 Medium
- nokia single ranOAM service path traversal issue caused by a crafted SOAP message archive field within the RAN management network6.4 Medium
- nokia single ranOAM service stack overflow caused by crafted SOAP message within the MNO internal RAN management network4.2 Medium
- themerex education center | lms & online courses wordpress themeEducation Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection9.8 Critical
- red hat advanced cluster management for kubernetes 2.11 for rhel 9, advanced cluster management for kubernetes 2.12 for rhel 9, redhat advanced cluster management for kubernetes +2 moreRhacm: users with clusterreader role can see credentials from managed-clusters5.5 Medium
- bitapps bit form, bitpressadmin bit form – custom contact form, multi step, conversational form & payment form builder +1 moreContact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure5.3 Medium
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion7.5 High
- qualitia co., ltd. active! mail 6Cross-site request forgery vulnerability exists in Active! mail 6 BuildInfo: 6.60.06008562 and...2.1 Low
- qualitia co., ltd. active! mail 6Cross-site scripting vulnerability exists in Active! mail 6 BuildInfo: 6.30.01004145 to 6.60...5.1 Medium
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion8.8 High
- scripteo ads pro plugin - multi-purpose wordpress advertising manager, ads pro +1 moreAds Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Time-Based SQL Injection via ‘bsa_pro_id'7.5 High
- hellomohsinkhan wp front-end login and registerWP Front-end login and register <= 2.1.0 - Reflected Cross-Site Scripting6.1 Medium
- scripteo ads pro plugin - multi-purpose wordpress advertising manager, ads pro +1 moreAds Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injection via oid7.5 High
- chimp group home villas | real estate wordpress themeHome Villas | Real Estate WordPress Theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion8.8 High
- suhailahmad64 amazon products to woocommerceAmazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery7.2 High
- soumettre soumettre.frSoumettre.fr <= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion3.7 Low
- pwrplugins magic buttons for elementorMagic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode6.4 Medium
- codedropz drag and drop multiple file upload (pro) - woocommerceDrag and Drop Multiple File Upload (Pro) - WooCommerce <= 1.7.1 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File Upload9.8 Critical
- scripteo ads pro plugin - multi-purpose wordpress advertising manager, ads pro +1 moreAds Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion8.1 High
- Show moreLoading…