CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- dell ecs, objectscale, elastic cloud storage +2 moreDell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0 contains an Insertion of...5.5 Medium
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM cross-site scripting6.4 Medium
- apache cxfApache CXF: Denial of Service and sensitive data exposure in logs5.6 Medium
- sqlite, apple ipados, iphone os +7 more +9 moreInteger Truncation on SQLite7.2 High
- labf winaxe ftp clientWinaXe 7.7 FTP Client Remote Buffer Overflow8.7 High
- wepresent (barco) wipg-1000WePresent WiPG-1000 Unauthenticated Command Injection in via rdfs.cgi9.3 Critical
- tiki software community association wiki cms groupware, tiki tikiwiki cms\/groupware +1 moreTiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCE9.3 Critical
- tiki software community association wiki cms groupwareTiki Wiki CMS Authenticated Command Injection in Calendar Module8.7 High
- samsung electronics wlan ap wea453eSamsung WLAN AP WEA453e < 5.2.4.T1 Unauthenticated RCE via command1 and command2 Parameters9.3 Critical
- riverbed technology steelcentral netprofiler, steelcentral netexpress +1 moreRiverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCE10.0 Critical
- piwik (now matomo) web analytics platformPiwik Authenticated RCE via Custom Plugin Upload9.4 Critical
- burnaware pdf shaperPDF Shaper v3.5/3.6 Buffer Overflow via Convert to Image Feature8.4 High
- panda security antivirus pro 2016, global protection 2016, internet security 2016 +1 more +3 morePanda Security PSEvents.exe Insecure DLL Loading Privilege Escalation8.5 High
- itrs group op5 monitorOP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.php8.7 High
- ipfire project ipfireIPFire < 2.19 Core Update 101 proxy.cgi RCE8.7 High
- flexense diskboss enterpriseDiskBoss Enterprise Stack-Based Buffer Overflow RCE10.0 Critical
- flexense disk pulse enterpriseDisk Pulse Enterprise 9.0.34 Login Stack Buffer Overflow8.6 High
- coloradoftp serverColoradoFTP Server <= 1.3 Build 8 Path Traversal Information Disclosure9.3 Critical
- josxha restrict file accessRestrict File Access <= 1.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion8.1 High
- papin companion auto updateCompanion Auto Update <= 3.9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via update_delay_days parameter5.5 Medium
- fortinet fortiosA heap-based buffer overflow in Fortinet FortiOS versions 7.6.0 through 7.6.2, 7.4.0 through 7.4...4.0 Medium
- jiransoft crosseditor4Stored-XSS possibility in Namo CrossEditor42.3 Low
- protns actadurRemote Code Execution in ProTNS ActADUR9.4 Critical
- hasthemes download contact form 7 widget for elementor page builder \& gutenberg blocks, htplugins ht contact form – drag & drop form builder for wordpress +1 moreHT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload9.8 Critical
- wpchill strong testimonialsStrong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields6.4 Medium
- hasthemes download contact form 7 widget for elementor page builder \& gutenberg blocks, htplugins ht contact form – drag & drop form builder for wordpress +1 moreHT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move9.1 Critical
- hasthemes download contact form 7 widget for elementor page builder \& gutenberg blocks, htplugins ht contact form – drag & drop form builder for wordpress +1 moreHT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion9.1 Critical
- bearsthemes alone – charity multipurpose non-profit wordpress themeAlone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation9.8 Critical
- bearsthemes alone – charity multipurpose non-profit wordpress themeAlone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Deletion9.1 Critical
- zyxel nwa50ax pro firmware, nwa110ax firmware, nwa1123ac pro firmware +20 more +22 moreA path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware...7.2 High
fastjson2OSS-FuzzSecurity exception in com.alibaba.fastjson2.JSONReader.readArrayNo score- timelineofficial time-line-TIME LINE has Improper File Validation in Upload Section4.3 Medium
- suse opensuse tumbleweedThe logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess4.8 Medium
- No product listedNexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below contains an authenticated...5.4 Medium
- No product listedCross-Site Scripting (XSS) vulnerability in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2...5.4 Medium
- No product listedCommand injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and...5.4 Medium
- No product listedAn authentication bypass vulnerability in the /web/um_open_telnet.cgi endpoint in Nexxt Solutions...9.8 Critical
- netgear xr300 firmwareIn Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow exists in the HTTPD service...6.5 Medium
- netgear xr300 firmwareIn Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the...6.5 Medium
- netgear xr300 firmwareIn Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the...6.5 Medium
- No product listedDirectory traversal vulnerability in beiyuouo arxiv-daily thru 2025-05-06 (commit fad168770b0e68aef3e5acfa16bb2e7a7765d687) when parsing the the topic.yml file in the generation logic in daily_arxiv.p…7.1 High
- oracle graalvm, graalvm for jdk, jdk +3 more +5 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...8.1 High
- oracle graalvm, graalvm for jdk, jdk +3 more +5 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...8.6 High
- oracle graalvm, graalvm for jdk, jdk +3 more +5 moreVulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are...4.8 Medium
- oracle graalvm, graalvm for jdk, jdk +3 more +5 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...8.1 High
- os4ed opensisSQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code...8.1 High
- emqx nanomqNanoMQ 0.17.5 was discovered to contain a segmentation fault via the component /nanomq...7.5 High
- pyloadpyLoad vulnerable to remote code execution through js2py onCaptchaResult9.8 Critical
- directusDirectus missing permission checks for manual trigger Flows6.5 Medium
- directusDirectus's exact version number is exposed by the OpenAPI Spec5.3 Medium
- Show moreLoading…