CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- boldthemes bold page builderWordPress Bold Page Builder plugin <= 5.4.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- favethemes houzezWordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerability4.3 Medium
- crocoblock jetsearchWordPress JetSearch plugin <= 3.5.10.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- crocoblock jetpopupWordPress JetPopup plugin <= 2.0.15.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- crocoblock jetpopupWordPress JetPopup plugin <= 2.0.15 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- crocoblock jettricksWordPress JetTricks plugin <= 1.5.4.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- jetmonsters jetformbuilderWordPress JetFormBuilder plugin <= 3.5.1.2 - PHP Object Injection Vulnerability7.2 High
- crocoblock jetblocks for elementorWordPress JetBlocks For Elementor plugin <= 1.3.19 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- themeisle hestiaWordPress Hestia theme <= 3.2.10 - Broken Access Control Vulnerability5.3 Medium
- crocoblock jettabsWordPress JetTabs plugin <= 2.2.9 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- crocoblock jetelements for elementorWordPress JetElements For Elementor plugin <= 2.7.7 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- eclipse glassfishEclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts6.3 Medium
- asustor admAn improper access control vulnerability was found in the EZ Sync Manager of ADM7.1 High
- vmware reactor nettyCVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client6.1 Medium
- scati vision webSQL Injection in SCATI Vision Web8.3 High
- pharmacy pos php script pos php scriptStored Cross-Site Scripting (XSS) in Pharmacy POS PHP Script5.1 Medium
- david lingren media library assistantMedia Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes6.4 Medium
- rustaurius ultimate wp mailUltimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function7.5 High
- litonice13 master addons for elementor – widgets, extensions, theme builder, popup builder & template kitsMaster Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- tecno tech.palm.idAuthentication vulnerability in the mobile application（tech.palm.id）may lead to the risk of...3.1 Low
- zyxel vmg8825-t50k firmware, emg3525-t50b firmware, emg5523-t50b firmware +21 more +23 moreA buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K...9.8 Critical
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- malcure malware shield — removal, repair, monitorMalcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion8.1 High
- wpchop affiliate reviewsAffiliate Reviews <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via numColumns Parameter6.4 Medium
- danielriera counter live visitors for woocommerceCounter live visitors for WooCommerce <= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block8.2 High
- brandfolder – digital asset management simplified.Brandfolder <= 5.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter6.4 Medium
- alcatel-lucent omniaccess stellar productsCommand Injection Vulnerability in the OmniAccess Stellar over UDP Service8.1 High
- alcatel-lucent omniaccess stellar productsWeak Session ID Check in the OmniAccess Stellar Web Management Interface9.8 Critical
- alcatel-lucent omniaccess stellar productsCommand Injection Vulnerability in the OmniAccess Stellar Web Management Interface9.8 Critical
- alcatel-lucent omniaccess stellarJavaScript Injection Vulnerability in the OmniAccess Stellar Web Management Interface2.4 Low
- wp-eventmanager wp event manager, wpeventmanager wp event manager – events calendar, registrations, sell tickets with woocommerce +1 moreWP Event Manager <= 3.1.49 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- wp-eventmanager wp event manager, wpeventmanager wp event manager – events calendar, registrations, sell tickets with woocommerce +1 moreWP Event Manager <= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name'7.2 High
- zexelon co., ltd. zwx-2000cs2-hn, zwx-2000csw2-hn +1 moreUse of hard-coded credentials issue exists in ZWX-2000CSW2-HN prior to 0.3.19 and ZWX-2000CS2-HN...6.8 Medium
- metagauss profilegrid, profilegrid – user profiles, groups and communities +1 moreProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function6.1 Medium
harfbuzzOSS-FuzzUse-of-uninitialized-value in CFF::cff2_cs_opset_t<cff2_cs_opset_subr_subset_t, CFF::subr_subset_param_t, CFF:No score- isc bind 9A possible assertion failure when 'stale-answer-client-timeout' is set to '0'7.5 High
- No product listedAn issue was discovered in Kaseya Rapid Fire Tools Network Detective through 2.0.16.0. A...7.5 High
- No product listedKaseya Rapid Fire Tools Network Detective 2.0.16.0 has Unencrypted Credentials (for privileged...8.2 High
- No product listedA cross-site scripting (XSS) vulnerability in META-INF Kft. Email This Issue (Data Center) before...5.4 Medium
- vimVim has path traversal issue with zip.vim and special crafted zip archives4.1 Medium
- oracle graalvm, oracle corporation graalvm enterprise edition, java se +2 more +4 moreVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...5.9 Medium
- vimVim has path traversial issue with tar.vim and special crafted tar files4.1 Medium
- github enterprise serverIncorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only access5.3 Medium
- rvc-boss gpt-sovits, gpt-sovits-webui +1 moreGHSL-2025-053: GPT-SoVITS Deserialization of Untrusted Data vulnerability8.9 High
- rvc-boss gpt-sovits, gpt-sovits-webui +1 moreGHSL-2025-052: GPT-SoVITS Deserialization of Untrusted Data vulnerability8.9 High
- rvc-boss gpt-sovits, gpt-sovits-webui +1 moreGHSL-2025-051: GPT-SoVITS Deserialization of Untrusted Data vulnerability8.9 High
- rvc-boss gpt-sovits, gpt-sovits-webui +1 moreGHSL-2025-050: GPT-SoVITS Deserialization of Untrusted Data vulnerability8.9 High
- rvc-boss gpt-sovits, gpt-sovits-webui +1 moreGHSL-2025-049: GPT-SoVITS Deserialization of Untrusted Data vulnerability8.9 High
- rvc-boss gpt-sovits, gpt-sovits-webui +1 moreGHSL-2025-048: GPT-SoVITS Command Injection vulnerability8.9 High
- rvc-boss gpt-sovits, gpt-sovits-webui +1 moreGHSL-2025-047: GPT-SoVITS Command Injection vulnerability8.9 High
- Show moreLoading…