CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- rssnext foloFolo allows secrets exfiltration via `pull_request_target`9.1 Critical
mcp-remotenpmOS command injection in mcp-remote when connecting to untrusted MCP servers9.6 Criticalca-certificatesTuxCareUpdate of ca-certificatesNo scoreca-certificatesTuxCareUpdate of ca-certificatesNo score- linux, linux kernel +1 morenvme-tcp: sanitize request list handling9.8 Critical
- debian linux, linux kernel +1 morebcache: fix NULL pointer in cache_set_flush()5.5 Medium
- debian linux, linux kernel +1 moretty: serial: uartlite: register uart driver in init7.8 High
- linux, linux kernel +1 moreriscv: save the SR_SUM status over switches7.8 High
- debian linux, linux kernel +1 morebtrfs: handle csum tree error with rescue=ibadroots correctly5.5 Medium
- debian linux, linux kernel +1 moreASoC: codecs: wcd9335: Fix missing free of regulator supplies7.8 High
- linux, linux kernel +1 moremm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write5.5 Medium
- debian linux, linux kernel +1 mores390/pkey: Prevent overflow in size calculation for memdup_user()7.3 High
- linux, linux kernel +1 moreio_uring/rsrc: fix folio unpinning5.5 Medium
- linux, linux kernel +1 morelib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()5.5 Medium
- linux, linux kernel +1 moredrm/amd/display: Add sanity checks for drm_edid_raw()5.5 Medium
- linux, linux kernel +1 moreHID: wacom: fix crash in wacom_aes_battery_handler()8.8 High
- linux, linux kernel +1 morecxl/ras: Fix CPER handler device confusion7.8 High
- debian linux, linux kernel +1 moreatm: clip: prevent NULL deref in clip_push()5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreBluetooth: hci_core: Fix use-after-free in vhci_flush()7.8 High
- debian linux, linux kernel +1 moreALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()7.1 High
- linux, linux kernel +1 morebridge: mcast: Fix use-after-free during router port configuration7.8 High
- linux, linux kernel +1 moreuserns and mnt_idmap leak in open_tree_attr(2)5.5 Medium
- linux, linux kernel +1 morebnxt: properly flush XDP redirect lists9.8 Critical
- debian linux, linux kernel +1 moreatm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().7.8 High
- linux, linux kernel +1 moresmb: client: fix potential deadlock when reconnecting channels7.5 High
- linux, linux kernel +1 morebtrfs: fix invalid inode pointer dereferences during log replay5.5 Medium
- linux, linux kernel +1 moremm: userfaultfd: fix race of userfaultfd_move and swap cache7.8 High
- linux, linux kernel +1 moremm/shmem, swap: fix softlockup with mTHP swapin5.5 Medium
- debian linux, linux kernel +1 morescsi: megaraid_sas: Fix invalid node index7.3 High
- linux, linux kernel +1 morescsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out8.8 High
- radiflow isap smart collectorUnauthenticated execution of arbitrary commands in Radiflow iSAP Smart Collector10.0 Critical
- radiflow isap smart collectorUnauthenticated modification of Radiflow iSAP Smart Collector configuration9.9 Critical
- radiflow isap smart collectorRadiflow iSAP Smart Collector Linux distribution unmaintained8.7 High
- radiflow isap smart collectorRead access of deprivileged Radiflow iSAP Smart Collector user6.8 Medium
- radiflow isap smart collectorRestricted shell evasion in Radiflow iSAP Smart Collector4.1 Medium
- asustor admA security bypass vulnerability was found in DataSync Center installed on ADM5.2 Medium
- asustor admAn improper input validation vulnerability was found on manipulating configuration of ADM6.0 Medium
- campcodes payroll management systemCampcodes Payroll Management System ajax.php sql injection6.9 Medium
- campcodes payroll management systemCampcodes Payroll Management System ajax.php sql injection6.9 Medium
- campcodes payroll management systemCampcodes Payroll Management System ajax.php sql injection6.9 Medium
- brainstormforce sureforms, sureforms – drag and drop form builder for wordpress +1 moreSureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion7.5 High
- brainstormforce sureforms, sureforms – drag and drop form builder for wordpress +1 moreSureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion8.1 High
- campcodes payroll management systemCampcodes Payroll Management System ajax.php sql injection6.9 Medium
- lty628 aidigulty628 Aidigu PHP Object common.php checkUserCookie deserialization6.9 Medium
- fnkvision fnk-gu2FNKvision FNK-GU2 wpa_supplicant.conf cleartext storage1.0 Low
- fnkvision fnk-gu2FNKvision FNK-GU2 MD5 shadow risky encryption1.0 Low
- uxper sala - startup & saas wordpress themeSala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover9.8 Critical
- jdegayojr simple featured imageSimple Featured Image <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via slideshow Parameter6.4 Medium
- fnkvision fnk-gu2FNKvision FNK-GU2 UART Interface on-chip debug and test interface with improper access control5.4 Medium
- angeljudesuarez insurance management systemitsourcecode Insurance Management System insertAgent.php sql injection5.3 Medium
- Show moreLoading…