CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- rsjoomla.com rsblog! component for joomlaExtension - rsjoomla.com - Stored XSS vulnerability RSBlog! component 1.11.6-1.14.5 for Joomla5.3 Medium
- rsjoomla.com rsdirectory! component for joomlaExtension - rsjoomla.com - Stored XSS vulnerability in RSDirectory! component 1.16.3-1.17.7 for Joomla5.1 Medium
- rsjoomla.com rsfiles! component for joomlaExtension - rsjoomla.com - DOS vulnerability RSFiles! component 1.16.3-1.17.7 for Joomla6.9 Medium
- rsjoomla.com rsmail! component for joomlaExtension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.28 for Joomla5.1 Medium
- balbooa.com balbooa forms component for joomlaExtension - balbooa.com - SQL injection in Balbooa Forms component version 1.0.0 - 2.3.1.1 for Joomla8.6 High
- balbooa.com balbooa gallery component for joomlaExtension - balbooa.com - Stored XSS in Balbooa Gallery component version 1.0.0 - 2.4.0 for Joomla8.6 High
- eset safe server, small business security, eset, spol. s r.o. eset endpoint antivirus for windows +10 more +12 moreTOCTOU race condition vulnerability in ESET products on Windows5.1 Medium
- mattermost, mattermost server +1 moreArbitrary file read by system admin via path traversal6.8 Medium
- mattermost, mattermost server +1 moreIDOR in CreatePost API allows for timeboxed message disclosure6.5 Medium
- loginpress proLoginPress Pro <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider9.8 Critical
- fortinet fortiisolatorAn improper access control vulnerability [CWE-284] in FortiIsolator version 2.4.4, version 2.4.3,...4.0 Medium
- fortinet fortiisolator, fortisandbox +1 moreAn insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4...6.3 Medium
- linux, linux kernel +1 moreeventpoll: don't decrement ep refcount while still holding the ep mutex7.8 High
- grafanaAn open redirect vulnerability has been identified in Grafana OSS organization switching...4.2 Medium
- grafanaGrafana is vulnerable to XSS attacks through open redirects and path traversal7.6 High
- joomcar.net articles calendar extension for joomlaExtension - joomcar.net - SQL injection in Articles Calendar 1.0.0 - 1.0.1.0007 for Joomla9.8 Critical
- joomcar.net articles good search extension for joomlaExtension - joomcar.net - SQL injection in Articles Good Search 1.0.0 - 1.2.4.0011 for Joomla9.8 Critical
- stylemixthemes masterstudy lms proMasterStudy LMS – Online Courses, eLearning PRO Plus <= 4.7.9 - Authenticated (Subscriber+) Arbitrary File Upload7.5 High
- malcure malware shield — removal, repair, monitorMalcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 16.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read6.5 Medium
- milanmk listly: listicles for wordpressListly: Listicles For WordPress <= 2.7 - Unauthenticated Arbitrary Transient Deletion5.3 Medium
- juiiee8487 testimonial post typeTestimonial Post type <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play Parameter6.4 Medium
- gopiplus vertical scroll image slideshow galleryVertical scroll image slideshow gallery <= 11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter6.4 Medium
- vladimir statsenko terms descriptionsTerms descriptions <= 3.4.8 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- b1accounting site.pro for woocommerceB1.lt for WooCommerce <= 2.2.56 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- wpwham crowdfunding for woocommerceCrowdfunding for WooCommerce <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter6.4 Medium
- aaroncampbell attachment managerAttachment Manager <= 2.1.2 - Unauthenticated Arbitrary File Deletion9.1 Critical
- krasenslavov block editor gallery slider for wordpress – image slider, gallery carousel & lightbox pluginBlock Editor Gallery Slider <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Limited Post Meta Update4.3 Medium
- b1accounting site.pro for woocommerceB1.lt for WooCommerce <= 2.2.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Injection8.8 High
- bbc000tommy useful tab block – responsive & amp-compatibleUseful Tab Block – Responsive & AMP-Compatible <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter6.4 Medium
- wp swings woocommerce refund and exchange with rma - warranty management, refund policy, manage user walletWooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet <= 3.2.6 - Unauthenticated Arbitrary File Upload9.8 Critical
- ryanfaber copymatic – ai content writer & generatorCopymatic – AI Content Writer & Generator <= 2.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- lewisking0072 map my locationsMap My Locations <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bogdansilivestru zuppler online orderingZuppler Online Ordering <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter4.9 Medium
- biteship plugin pengiriman woocommerce kurir reguler, instan, kargo – biteshipPlugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship <= 3.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) View Order Tracking Details4.3 Medium
- aapanel wp toolkitaapanel WP Toolkit 1.0 - 1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via auto_login() Function8.8 High
- dasinfomedia school management system for wordpressSchool Management System for Wordpress <= 93.1.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update8.8 High
- ruven-themes ruven themes: shortcodesRuven Themes: Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- ajay knowledge baseKnowledge Base <= 2.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Slug4.4 Medium
- phpgurukul art gallery management systemPHPGurukul Art Gallery Management System edit-art-medium-detail.php cross site scripting5.1 Medium
ffmpegDebian,libavUbuntu,ffmpeg-4openSUSE +1 more +3 moreFfmpeg: null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c)5.3 Medium- qbittorrentqBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL...4.0 Medium
- crushftpCrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used,...9.0 Critical
- No product listedagorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain a reflected...7.1 High
- No product listedIncorrect access control in the dynawebservice component of agorum Software GmbH Agorum core open...6.5 Medium
- No product listedIncorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows...6.5 Medium
- No product listedSoftware GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext.8.2 High
- No product listedA Server-Side Request Forgery (SSRF) in the component TunnelServlet of agorum Software GmbH...6.5 Medium
- No product listedagorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML...6.5 Medium
- No product listedAn issue in Perplexity AI GPT-4 v.2.51.0 allows a remote attacker to obtain sensitive information...7.5 High
- Show moreLoading…