CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- linux, linux kernel +1 moreBluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken5.5 Medium
- linux, linux kernel +1 moredrm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink7.8 High
- debian linux, linux kernel +1 moreespintcp: remove encap socket caching to avoid reference leak7.8 High
- linux, linux kernel +1 morewifi: iwlwifi: don't warn when if there is a FW error5.5 Medium
- debian linux, linux kernel +1 moredma-buf: insert memory barrier before updating num_fences7.8 High
- debian linux, linux kernel +1 morenet: cadence: macb: Fix a possible deadlock in macb_halt_tx.5.5 Medium
- peepso core: groupsPeepSo Core: Groups <= 6.4.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Description6.4 Medium
- bdthemes element pack, element pack elementor addons and templates +1 moreElement Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute6.4 Medium
quickjsOSS-FuzzUse-of-uninitialized-value in JS_DefinePropertyNo scoreclamavOSS-FuzzInvalid-free in pdf_decodestreamNo score- the wikimedia foundation mediawiki - centralauth extensionSecurity Authentication Bypass in CentralAuth8.8 High
- wikimedia foundation mediawikiMediaWiki should not consider autocreation as login for the purposes of security reauthentication0.0 None
- wikimedia foundation multimediaviewerImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')...0.0 None
- wikimedia foundation mediawikiXSS in Special:ApiSandbox0.0 None
- wikimedia foundation mediawiki"{{SITENAME}} registered email address has been changed" email sent to unverified email addresses2.1 Low
- wikimedia foundation mediawikiHTML injection in API action=feedcontributions output from i18n message0.0 None
- wikimedia foundation mediawikiComplete content leak of private wikis due to PasswordReset Wikitext injection in error message4.6 Medium
- tenda ac6 firmwareTenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the fromSetRouteStatic function...8.1 High
- tenda ac6 firmwareTenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetQosBand function via...7.5 High
- tenda ac6 firmwareTenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetFirewallCfg function...7.5 High
- tenda ac6 firmwareTenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the SetSysTimeCfg function via...8.1 High
- plesk obsidianIn Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS...5.8 Medium
- akeles out of office assistantAkeles Out of Office Assistant for Jira 4.0.1 is vulberable to Cross Site Scripting (XSS) via the...5.4 Medium
- litellmBerriAI litellm v1.65.4 was discovered to contain a SQL injection vulnerability via the /key...5.4 Medium
- No product listedASNA Assist and ASNA Registrar before 2025-03-31 allow deserialization attacks against .NET...6.5 Medium
- grafanaGrafana's insecure DingDing Alert integration exposes sensitive information4.3 Medium
- tianocore edk2iSCSI Remote Memory Corruption and Denial of Service6.3 Medium
- laundryLaundry 2.3.0 - Account Takeover via Reflected XSS5.1 Medium
- hp universal print driverHP Universal Print Driver – Potential Denial of Service4.8 Medium
- zulip, zulip server +1 moreZulip XSS in digest preview URL6.8 Medium
- nsclient++, nsclient nsclient\+\+ +1 moreNSClient++ Authenticated Remote Code Execution via ExternalScripts API7.5 High
- nsclient++, nsclient nsclient\+\+ +1 moreNSClient++ 0.5.2.35 Local Privilege Escalation via ExternalScripts and Web Interface7.3 High
- microweber, microweber ltd. cms +1 moreMicroweber CMS Authenticated Local File Inclusion via Backup API6.1 Medium
- luceeLucee Admin Interface Authenticated Remote Code Execution via Scheduled Job File Write9.4 Critical
- config pages viewer project pages viewer, drupal config pages viewer +1 moreConfig Pages Viewer - Critical - Access bypass - SA-CONTRIB-2025-0865.3 Medium
- drupal two-factor authentication (tfa), two-factor authentication project authentication +1 moreTwo-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-0856.5 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability8.8 High
- laundryLaundry 2.3.0 - Account Takeover via CSRF8.5 High
- cisco unified communications managerCisco Unified Communications Manager Static SSH Credentials Vulnerability10.0 Critical
- cisco broadworks application delivery platform, broadworks +1 moreCisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability4.8 Medium
- cisco enterprise chat and emailCisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability6.1 Medium
- cisco spaces connector, dna spaces connector +1 moreCisco Spaces Connector Privilege Escalation Vulnerability6.0 Medium
- delinea secret serverThe distributed engine of Secret Server versions 11.7.49 and earlier can be exploited during an...3.8 Low
- freedesktop popplerPoppler Use After Free Vulnerability5.5 Medium
- delinea secret serverSecret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that...3.8 Low
- cinnamon kotaemonkotaemon Vulnerable to Path Traversal via Link Upload6.5 Medium
- rust-ethereum ethereumethereum does not check transaction malleability for EIP-2930, EIP-1559 and EIP-7702 transactions6.9 Medium
- owasp-modsecurity modsecurityModSecurity empty XML tag causes segmentation fault6.5 Medium
- sysadminsmedia homeboxHomeBox Missing User Authorization5.3 Medium
- linux, linux kernel +1 morearm64: dts: qcom: x1e80100: Add GPU cooling5.5 Medium
- Show moreLoading…