CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- antwerpes doccheck loginDocCheck Login <= 1.1.5 - Unauthorized Post Access5.3 Medium
- open zipkin zipkinZipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint5.3 Medium
- arm mbed tls, mbed mbedtls +1 moreMbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in...4.8 Medium
- arm mbed tls, mbed mbedtls +1 moreMbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations...7.8 High
- mtrmtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by...7.8 High
- mbed mbedtls, trustedfirmware mbed tls +1 moreIn MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not check that the input buffer...4.8 Medium
- mbed mbedtls, trustedfirmware mbed tls +1 moreIn MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash...4.9 Medium
- chmlibCHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c...5.6 Medium
- tunnelblickTunnelblick 3.5beta06 before 7.0, when incompletely uninstalled, allows attackers to execute...8.1 High
- quest kace systems management applianceThe agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1...9.3 Critical
- e4jconnect vikrentcar, e4jvikwp vikrentcar car rental management system +1 moreVikRentCar Car Rental Management System <= 1.4.3 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
- djvunet djvulibreDjVuLibre OOB-Write Vulnerability in MMRDecoder8.4 High
- vercel next.jsNext.js DoS vulnerability via cache poisoning7.5 High
- vercel next.js, vercel +1 moreNext.js cache poisoning due to omission of Vary header3.7 Low
- n8nn8n Improper Authorization in Workflow Execution Stop Endpoint Allows Terminating Other Users’ Workflows4.9 Medium
- phpNULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix5.9 Medium
- starcitizentools mediawiki-extensions-shortdescriptionCitizen Short Description stored XSS vulnerability through wikitext8.6 High
- phppgsql extension does not check for errors during escaping5.9 Medium
- phpNull byte termination in hostnames3.7 Low
- aexol studio remote for macRemote for Mac Unauthenticated Remote Code Execution via AppleScript Injection9.3 Critical
- com.ritense.valtimo web, pi-hole +1 morePi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution9.0 Critical
- artica st pandora fms, pandora fms fms +1 morePandora FMS Authenticated Remote Code Execution via Ping Module8.6 High
- go standard library osIGEL OS Secure Terminal and Secure Shadow Remote Code Execution9.3 Critical
- bolt cms, boltcms bolt +1 moreBolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename7.5 High
- henan xiaopi security technology co., ltd. phpstudyPHPStudy 2016-2018 Backdoor Remote Code Execution Vulnerability9.3 Critical
- starcitizen.tools citizen, starcitizentools mediawiki-skins-citizen +1 moreCitizen stored XSS vulnerability through short descriptions8.6 High
- starcitizen.tools citizen, starcitizentools mediawiki-skins-citizen +1 moreCitizen is vulnerable to stored XSS attack in the legacy search bar8.6 High
- webfactory aibud wpWordPress AiBud WP plugin <= 1.9 - Arbitrary File Upload vulnerability9.1 Critical
- abb rmc-100, rmc-100 lite +1 moreHard Coded Key used for AES encryption6.3 Medium
- abb rmc-100, rmc-100 lite +1 moreStack Buffer Overflow in MQTTCore8.2 High
- abb rmc-100, rmc-100 lite +1 moreStack Buffer Overflow in MQTTCore8.2 High
- abb rmc-100, rmc-100 lite +1 moreAuthentication Bypass to the MQTT configuration Web Interface6.3 Medium
- wireapp wire-ioswire-ios accidentally logs message contents4.1 Medium
- amauric tarteaucitron.js, amauri tarteaucitronjs +1 moretarteaucitron.js vulnerable to DOM Clobbering via document.currentScript4.2 Medium
- malvineous masseditregex, wikimedia foundation mediawiki - masseditregex extension +1 moreStored XSS in MassEditRegex5.6 Medium
- wikimedia foundation mediawiki - scribunto extension, xtex scribunto +1 moreContent Access Bypass in Scribunto8.8 High
- wikimedia foundation mediawiki - featuredfeeds extensionHTML injection in FeaturedFeeds6.5 Medium
- jackphoenix googledocs4mw, wikimedia foundation mediawiki - googledocs4mw extension +1 moreXSS in GoogleDocs4MW5.6 Medium
- jly campaignevents, the wikimedia foundation mediawiki - campaignevents extension +1 moreMultiple XSS in CampaignEvents5.6 Medium
gnutlsTuxCare,gnutls-c++TuxCare,gnutls-daneTuxCare +2 more +4 moreUpdate of gnutlsNo scoregithub.com/lf-edge/ekuiperGo,github.com/lf-edge/ekuiper/v2Go +1 moreeKuiper /config/uploads API arbitrary file writing may lead to RCE7.3 Highgithub.com/lf-edge/ekuiperGo,github.com/lf-edge/ekuiper/v2Go +1 moreLF Edge eKuiper vulnerable to File Path Traversal leading to file replacement8.5 Highgrub2-commonTuxCare,grub2-efi-aa64-modulesTuxCare,grub2-efi-x64TuxCare +10 more +12 moreUpdate of grub2No scorenssTuxCare,nsprTuxCare,nspr-develTuxCare +10 more +12 moreUpdate of nssNo scorenettleTuxCare,nettle-develTuxCare +1 moreUpdate of nettleNo scorelibkcapiTuxCare,libkcapi-develTuxCare,libkcapi-docTuxCare +5 more +7 moreUpdate of libkcapiNo score- wpvivid migration\, backup\, staging, wpvividplugins wpvivid — backup, migration & staging +1 moreMigration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
- jkdevstudio jkdevkitJKDEVKIT <= 1.9.4 - Authenticated (Subscriber+) Arbitrary File Deletion8.8 High
- denis-de-bernardy auto thickbox, smub photo gallery, sliders, proofing and themes – nextgen gallery, wpdevart youtube embed, playlist and popup by wpdevart +2 moreMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library6.4 Medium
- n8nn8n Vulnerable to Denial of Service via Malformed Binary Data Requests4.9 Medium
- Show moreLoading…