CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
private-ipnpmprivate-ip vulnerable to Server-Side Request Forgery8.8 High- synck graphica real-time bus tracking systemImproper validation of specified quantity in input issue exists in Real-time Bus Tracking System...5.3 Medium
- synology router manager, router manager (srm) +1 moreImproper neutralization of input during web page generation ('Cross-site Scripting')...5.9 Medium
- synology router manager, router manager (srm) +1 moreImproper neutralization of input during web page generation ('Cross-site Scripting')...5.9 Medium
- synology router manager, router manager (srm) +1 moreImproper neutralization of special elements used in an OS command ('OS Command Injection')...7.2 High
- sap se fica odn frameworkCode Injection vulnerability in SAP FICA ODN framework5.5 Medium
- steverio social streamsSocial Streams <= 1.2.1 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- omnishop – mobile shop apps complementing your woocommerce webshopOmnishop <= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint6.5 Medium
- reallaunch commercial real estate valuation calculatorValuation Calculator <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter6.4 Medium
- fleetwire fleet managementFleetwire Fleet Management Plugin <= 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via fleetwire_list Shortcode6.4 Medium
- nootheme realty portal – agentRealty Portal – Agent <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() Function8.8 High
- krasenslavov featured image plus – bulk edit featured images, unsplash & alt text managerFeatured Image Plus – Quick & Bulk Edit with Unsplash <= 1.6.6 - Authenticated (Admin+) Server-Side Request Forgery5.5 Medium
- omnishop – mobile shop apps complementing your woocommerce webshopOmnishop <= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint5.3 Medium
- stratosg yanewsflashYANewsflash <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- tenda ac23, ac23 firmware +1 moreTenda AC23 httpd setMacFilterCfg sub_46C940 stack-based overflow8.7 High
checkstyleOSS-FuzzSecurity exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.exprNo score- pcl-community pcl2-cePCL Community Edition exposes login credentials in logs9.3 Critical
- mozilla firefoxSandboxed iframe could start downloads9.8 Critical
- mozilla firefoxIncorrect URL truncation in Firefox for Android5.3 Medium
- mozilla firefox, firefox for ios +1 moreScanning a malicious URL utilizing Firefox's open-text scheme with the QR code scanner could load arbitrary websites9.1 Critical
- mozilla firefox, firefox for ios +1 moreInternal Firefox open-text URL scheme allowed loading of arbitrary URLs5.4 Medium
- mozilla firefox, firefox for ios +1 moreSandboxed iframes could allow local downloads despite sandbox restrictions9.8 Critical
- jupo mezzanineMezzanine CMS vulnerable to Cross-site Scripting4.8 Medium
- No product listedA URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker...5.4 Medium
- No product listedA vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the...7.5 High
- redisRedis through 7.4.3 allows memory consumption via a multi-bulk command composed of many bulks,...3.5 Low
- vbulletinvBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist...5.4 Medium
- pluck-cms pluckIn Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under...7.2 High
- No product listedA URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker...5.4 Medium
- hp poly clariti managerPoly Clariti Manager - Multiple Security Vulnerabilities2.0 Low
- hp poly clariti managerPoly Clariti Manager - Multiple Security Vulnerabilities2.0 Low
- hp poly clariti managerPoly Clariti Manager - Multiple Security Vulnerabilities6.9 Medium
- hp poly clariti managerPoly Clariti Manager - Multiple Security Vulnerabilities5.7 Medium
- hp poly clariti managerPoly Clariti Manager - Multiple Security Vulnerabilities5.7 Medium
- hp poly clariti managerPoly Clariti Manager - Multiple Security Vulnerabilities6.0 Medium
- hp poly clariti managerPoly Clariti Manager - Multiple Security Vulnerabilities5.9 Medium
- hp poly clariti managerPoly Clariti Manager - Multiple Security Vulnerabilities7.3 High
- hp poly clariti managerPoly Clariti Manager - Multiple Security Vulnerabilities5.9 Medium
- hp poly clariti managerPoly Clariti Manager - Multiple Security Vulnerabilities5.7 Medium
- lantronix provisioning managerLantronix Provisioning Manager Improper Restriction of XML External Entity Reference8.6 High
- duracomm corporation spm-500 dp-10in-100-muDuraComm DP-10iN-100-MU Cross-site Scripting7.2 High
- oisf suricataSuricata's mishandling of data on HTTP2 stream 0 can lead to resource starvation7.5 High
- duracomm corporation spm-500 dp-10in-100-muDuraComm DP-10iN-100-MU Missing Authentication for Critical Function8.7 High
- viewvcViewVC's standalone server exposes arbitrary server filesystem content7.5 High
- yt-dlpyt-dlp allows `--exec` command injection when using placeholder on Windows7.5 High
- duracomm corporation spm-500 dp-10in-100-muDuraComm DP-10iN-100-MU Cleartext Transmission of Sensitive Information8.7 High
- google chromeType Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to...8.8 High
- google chromeType Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to...8.8 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 141 and Thunderbird 1419.8 Critical
- mozilla firefox, thunderbird +1 moreIncorrect URL truncation9.8 Critical
- Show moreLoading…