CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- debian linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 morebpf: Avoid __bpf_prog_ret0_warn when jit fails7.8 High
- linux, linux kernel +1 morebpf: Do not include stack ptr register in precision backtracking bookkeeping7.8 High
- linux, linux kernel +1 moreocteontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback7.8 High
- debian linux, linux kernel +1 moremtd: nand: ecc-mxic: Fix use of uninitialized variable ret5.5 Medium
- linux, linux kernel +1 morefs/dax: Fix "don't skip locked entries when scanning entries"7.8 High
- debian linux, linux kernel +1 morephy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug5.5 Medium
- linux, linux kernel +1 morefpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt()5.5 Medium
- debian linux, linux kernel +1 morenet: tipc: fix refcount warning in tipc_aead_encrypt7.8 High
- linux, linux kernel +1 morenet: dsa: b53: do not enable EEE on bcm63xx5.5 Medium
- linux, linux kernel +1 morenet: prevent a NULL deref in rtnl_create_link()5.5 Medium
- linux, linux kernel +1 morenet: drv: netdevsim: don't napi_complete() from netpoll7.8 High
- linux, linux kernel +1 morebtrfs: exit after state insertion failure at btrfs_convert_extent_bit()5.5 Medium
- linux, linux kernel +1 moreusb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work5.5 Medium
- linux, linux kernel +1 morering-buffer: Do not trigger WARN_ON() due to a commit_overrun7.8 High
- linux, linux kernel +1 morepinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms5.5 Medium
- linux, linux kernel +1 moreserial: jsm: fix NPE during jsm_uart_port_init5.5 Medium
- kibokolabs hostelHostel < 1.1.5.9 - Admin+ Stored XSS4.8 Medium
- kibokolabs hostelHostel < 1.1.5.8 - Reflected XSS6.1 Medium
- lanacodes lana downloads managerLana Downloads Manager <= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting5.5 Medium
- gallagher command centre serverA Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a...5.6 Medium
- gallagher t-series readersMissing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader...4.3 Medium
- gallagher controller 7000Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could...6.5 Medium
- mpol gwolle guestbookGwolle Guestbook <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting via `gwolle_gb_content` Parameter6.1 Medium
- tomdever wpforo forumwpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar5.4 Medium
cupsOSS-FuzzUse-of-uninitialized-value in httpEncode64_3No score- wftpserver wing ftp server, wing ftp server ftp server +1 moreloginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the...4.3 Medium
- wftpserver wing ftp server, wing ftp server ftp server +1 moreIn Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes,...10.0 Critical
- wftpserver wing ftp server, wing ftp server ftp server +1 moreIn Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port...4.1 Medium
- nnproject mpgram webA cross-site scripting (XSS) vulnerability in the component /master/login.php of mpgram-web...6.1 Medium
- No product listedEcovacs Deebot T10 1.7.2 transmits Wi-Fi credentials in cleartext during the pairing process.7.5 High
- alteryx serverCross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers...6.1 Medium
- alteryx serverInsecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows...8.8 High
- alteryx serverAn issue in Alteryx Server v.2023.1.1.460 allows HTML injection via a crafted script to the pages...8.0 High
- wftpserver wing ftp server, wing ftp server ftp server +1 moreWing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the...3.4 Low
- No product listedA cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9...6.1 Medium
- dradisframework dradisIn Dradis before 4.11.0, the Output Console shows a job queue that may contain information about...3.5 Low
- palo alto networks globalprotect app, globalprotect uwp app +1 moreGlobalProtect App: Privilege Escalation (PE) Vulnerability8.4 High
- palo alto networks globalprotect app, globalprotect uwp app +1 moreGlobalProtect App: Non Admin User Can Disable the GlobalProtect App6.8 Medium
- palo alto networks autonomous digital experience managerAutonomous Digital Experience Manager: Privilege Escalation (PE) Vulnerability6.3 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!, pixelite events manager +1 moreEvents Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes6.4 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!, pixelite events manager +1 moreEvent Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter6.1 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!, pixelite events manager +1 moreEvents Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter7.5 High
- webbertakken docusaurus-plugin-content-gistsdocusaurus-plugin-content-gists Exposes GitHub Personal Access Token10.0 Critical
- rockwell automation arena®, rockwellautomation arena +1 moreArena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability7.1 High
- rockwell automation arena®, rockwellautomation arena +1 moreArena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability7.1 High
tzdataTuxCare,tzdata-javaTuxCare +1 moreUpdate of tzdataNo scoretzdataTuxCare,tzdata-javaTuxCare +1 moreUpdate of tzdataNo scoretzdataTuxCare,tzdata-javaTuxCare +1 moreUpdate of tzdataNo scoretzdataTuxCare,tzdata-javaTuxCare +1 moreUpdate of tzdataNo scoretzdataTuxCare,tzdata-javaTuxCare +1 moreUpdate of tzdataNo score- Show moreLoading…