CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 1418.8 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 1418.8 High
- mozilla firefox, thunderbird +1 moreSearch terms persisted in URL bar8.1 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 1418.8 High
- mozilla firefox, thunderbird +1 moreIncorrect JavaScript state machine for generators6.5 Medium
- mozilla firefox, thunderbird +1 moreCSP frame-src was not correctly enforced for paths9.8 Critical
- mozilla firefox, thunderbird +1 moreXSLT documents could bypass CSP8.1 High
- mozilla firefox, thunderbird +1 moreIncorrect URL stripping in CSP reports9.8 Critical
- mozilla firefox, thunderbird +1 moreNameless cookies shadow secure cookies9.1 Critical
- mozilla firefox, thunderbird +1 moreDNS rebinding circumvents CORS8.1 High
- mozilla firefox, thunderbird +1 morePotential user-assisted code execution in “Copy as cURL” command8.1 High
- mozilla firefox, thunderbird +1 morejavascript: URLs executed on object and embed tags8.1 High
- mozilla firefox, thunderbird +1 moreLarge branch table could lead to truncated instruction9.8 Critical
- mozilla firefox, thunderbird +1 moreJavaScript engine only wrote partial return value to stack6.5 Medium
- tp-link systems inc. vigi nvr1104h-4p v1, vigi nvr2016h-16mp v2 +1 moreUnauthenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V28.7 High
- tp-link systems inc. vigi nvr1104h-4p v1, vigi nvr2016h-16mp v2 +1 moreAuthenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V28.5 High
- ibm qradar network threat analytics, security qradar network threat analytics +1 moreIBM Security QRadar Network Threat Analytics denial of service4.5 Medium
- devolutions serverImproper access control in secure message component in Devolutions Server allows an authenticated...7.1 High
- devolutions serverUse of weak credentials in emergency authentication component in Devolutions Server allows an...9.5 Critical
- autodesk revit, revit lt +1 moreRFA File Parsing Out-of-Bounds Read Vulnerability7.8 High
- okta on-premises provisioning agentOkta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated...6.8 Medium
- shenzhen libituo technology lbt-t300-t310, szlbt lbt-t300-t310 firmware +1 moreShenzhen Libituo Technology LBT-T300-T310 appy.cgi sub_40B6F0 buffer overflow8.7 High
- bloomberg comdb2A null pointer dereference vulnerability exists in the net_connectmsg Protocol Buffer Message...7.5 High
- bloomberg comdb2A denial of service vulnerability exists in the Distributed Transaction Commit/Abort Operation...7.5 High
- bloomberg comdb2A null pointer dereference vulnerability exists in the Distributed Transaction component of...7.5 High
- bloomberg comdb2A denial of service vulnerability exists in the Bloomberg Comdb2 8.1 database when handling a...7.5 High
- bloomberg comdb2A null pointer dereference vulnerability exists in the CDB2SQLQUERY protocol buffer message...7.5 High
- gn themes wp shortcodes plugin — shortcodes ultimateShortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link6.4 Medium
- carmelo food ordering review systemcode-projects Food Ordering Review System reservation_page.php sql injection5.3 Medium
- goauthentik authentikauthentik has an insufficient check for account active status during OAuth/SAML authentication7.1 High
- kyvernoKyverno's Improper JMESPath Variable Evaluation Leads to Denial of Service7.7 High
- hotelrunner b2bHost Header Injection in HotelRunner's B2B4.6 Medium
- hotelrunner b2bXSS in HotelRunner's B2B4.8 Medium
- tenda ac7, ac7 firmware +1 moreTenda AC7 httpd setMacFilterCfg formSetMacFilterCfg stack-based overflow8.7 High
- connekthq ajax load moreAjax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion8.8 High
- etq reliance cg (legacy)ETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`5.1 Medium
- etq reliance cg (legacy), reliance nxg (saas) +1 moreETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI Suffix8.7 High
- etq reliance cg (legacy)ETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML Handler6.9 Medium
- etq reliance cg (legacy)ETQ Reliance CG Authentication Bypass via Trailing Space RCE9.3 Critical
- abb switch actuator 4 du-83330, switch actuator, door/light 4 du -83330-500 +1 moreAuthentication bypass due to compatibility mode enabled by default8.6 High
- rolantis information technologies agentisReflected XSS in Rolantis Information Technologies' Agentis6.1 Medium
- rolantis information technologies agentisSQLi in Rolantis Information Technologies' Agentis10.0 Critical
- typo3 extension "femanager", typo3 +1 moreInsecure Direct Object Reference in extension "femanager" (femanager)5.3 Medium
- typo3 extension "powermail"Insecure Direct Object Reference in extension "powermail" (powermail)6.0 Medium
- arm development studioUncontrolled Search Path Element in Arm Development Studio before 20255.9 Medium
- elecom co.,ltd. wrc-be36qs-b, wrc-w701-b +1 moreHidden functionality issue exists in WRC-BE36QS-B and WRC-W701-B. If exploited, the product's...6.9 Medium
- elecom co.,ltd. wrc-be36qs-b, wrc-w701-b +1 moreWRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS...8.6 High
- psauxit nginx cache purge preloadNginx Cache Purge Preload <= 2.1.1 - Authenticated (Administrator+) Remote Code Execution7.2 High
- bsecuretech bsecure – your universal checkoutbSecure 1.3.7 - 1.7.9 - Missing Authorization to Unauthenticated Privilege Escalation via order_info REST Endpoint9.8 Critical
- sflack like & share my siteLike & Share My Site <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- Show moreLoading…