CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- anisha online appointment booking systemcode-projects Online Appointment Booking System adddoctorclinic.php sql injection6.9 Medium
- sophos intercept x for windows installerA local privilege escalation vulnerability in the Intercept X for Windows installer prior version...7.5 High
- openzeppelin openzeppelin-contractsOpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers6.9 Medium
- laravel livewireLivewire vulnerable to remote command execution during property update hydration9.2 Critical
- 7-zipGHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStream5.5 Medium
- 7-zipGHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder5.5 Medium
- anisha online appointment booking systemcode-projects Online Appointment Booking System getmanagerregion.php sql injection6.9 Medium
- opencvOpenCV contains a use after free buffer write due to an uninitialized pointer6.6 Medium
- vectorized soladySolady lacks extcodesize validation on implementation in ERC4337Factory6.9 Medium
- No product listedZCMS Create Article Page cross site scripting5.1 Medium
- nvidia doca-host and mellanox ofedNVIDIA DOCA-Host and Mellanox OFED contain a vulnerability in the VGT+ feature, where an attacker...7.6 High
- tenda fh451, fh451 firmware +1 moreTenda FH451 POST Request WizardHandle fromWizardHandle buffer overflow8.7 High
- jshttp on-headerson-headers vulnerable to http response header manipulation3.4 Low
- expressjs multerMulter vulnerable to Denial of Service via unhandled exception from malformed request7.5 High
- fortinet fortiwebAn improper neutralization of special elements used in an SQL command ('SQL Injection')...9.6 Critical
- diracgrid diracx-webDiracX-Web login page has Open Redirect vulnerability4.7 Medium
- rucio helm-chartsrucio-server, rucio-ui, and rucio-webui vulnerable to insertion of X-Rucio-Auth-Token in apache access logfiles6.9 Medium
- labredescefetrj wegiaWeGIA SQL Injection (Blind Time-Based) Vulnerability in id_dependente Parameter on profile_dependente.php Endpoint9.4 Critical
- labredescefetrj wegiaWeGIASQL Injection (Blind Time-Based) Vulnerability in idatendido_familiares Parameter on dependente_editarDoc.php Endpoint9.4 Critical
- labredescefetrj wegiaWeGIA SQL Injection (Blind Time-Based) Vulnerability in idatendido_familiares Parameter on dependente_editarInfoPessoal.php Endpoint9.4 Critical
- labredescefetrj wegiaWeGIA SQL Injection (Blind Time-Based) Vulnerability in idatendido_familiares Parameter on dependente_editarEndereco.php Endpoint9.4 Critical
- labredescefetrj wegiaWeGIA vulnerable to SQL Injection in endpoint profile_paciente.php parameter id_fichamedica9.4 Critical
- fedify-dev holloHollo renders posts received with form elements and allows submission6.1 Medium
- 1panel-dev maxkbMaxKB has RCE in MCP call4.6 Medium
- 1panel-dev maxkbMaxKB sandbox bypass4.6 Medium
- mailcow mailcow-dockerized, mailcow\ +1 moremailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template9.1 Critical
- haarg catalyst::plugin::sessionCatalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely6.5 Medium
- bluebird kr.co.bluebird.android.bbsettingsFile removal via path traversal in unsecured broadcast receiver in Bluebird barcode scanner application5.1 Medium
- bluebird com.bluebird.kiosk.launcherExposed AIDL service allowing for tampering of system secure settings in Bluebird kiosk application8.5 High
- bluebird com.bluebird.filemanagersExposed AIDL service allowing to read and delete files with system-level privileges in Bluebird filemanager application6.3 Medium
static_cellcrates.ioConstStaticCell could have been used to pass non-Send values to another threadNo score- fullworksplugins stop user enumerationStop User Enumeration < 1.7.3 - Protection Bypass5.3 Medium
- unimax hospital information systemUNIMAX｜Hospital Information System - SQL Injection8.7 High
- mangabooth madara - coreMadara - Core <= 2.2.3 - Unauthenticated Arbitrary File Deletion9.1 Critical
- scada-ltsScada-LTS usersProfiles.shtm cross site scripting5.1 Medium
- bearsthemes bears backupBears Backup <= 2.0.0 - Unauthenticated Remote Code Execution9.8 Critical
- scada-ltsScada-LTS users.shtm cross site scripting5.1 Medium
- goldendictGoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying...9.6 Critical
- No product listedIsland Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL.9.8 Critical
- totolink a3300r firmwareTotolink A3300R V17.0.0cu.596_B20250515 was found to contain a command injection vulnerability in...9.8 Critical
- totolink n350rt firmwareTOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a buffer overflow via the ePort...9.8 Critical
- adguard for safariAn issue was discovered in AdGuard plugin before 1.11.22 for Safari on MacOS. AdGaurd verbosely...5.5 Medium
- No product listednbcio-boot v1.0.3 was discovered to contain a SQL injection vulnerability via the userIds...9.8 Critical
- No product listedNetwrix Directory Manager through 2025-05-01 allows XSS.6.1 Medium
- beakon learning management system sharable content object reference modelCross Site Scripting vulnerability in Beakon Software Beakon Learning Management System Sharable...5.4 Medium
- No product listedSQL Injection vulnerability in cnhcit.com Haichang OA v.1.0.0 allows a remote attacker to obtain...8.1 High
- No product listedMingyu Security Gateway before v3.0-5.3p was discovered to contain a remote command execution ...8.8 High
- No product listedOA EKP v16 was discovered to contain an arbitrary download vulnerability via the component /ui...8.1 High
- merit lilin dvr firmwareLILIN DVR Command Injection via NTPUpdate in dvr_box9.3 Critical
- merit lilin dvr firmwareLILIN DVR Arbitrary File Read via net_html.cgi8.7 High
- Show moreLoading…