CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- onlyoffice docsONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function9.8 Critical
- zohaib167 get youtube subsGet Youtube Subs <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via subscribe_link_att Function6.4 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions6.5 Medium
- tobias conrad webinarignition – live, automated & evergreen webinars for woocommerceWebinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition <= 4.03.32 - Unauthenticated Login Token Generation to Authentication Bypass9.8 Critical
- den-media hiweb export postshiWeb Export Posts <= 0.9.0.0 - Cross-Site Request Forgery to Arbitrary File Deletion8.1 High
- addonmaster post grid master, mdshuvo post grid master — post grids & ajax filters +1 morePost Grid Master <= 3.4.13 - Reflected Cross-Site Scripting via argsArray['read_more_text']6.1 Medium
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation Vulnerability7.8 High
- cleverplugins security ninja – wordpress security plugin & firewallSecurity Ninja – Secure Firewall & Secure Malware Scanner - 5.201 - 5.242 - Authenticated (Administrator+) Arbitrary File Read4.9 Medium
- ob oceanbase serverIn OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve...6.3 Medium
- abb ac500 v2Modbus TCP buffer overread6.9 Medium
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabExposure of Sensitive Information Due to Incompatible Policies in GitLab4.3 Medium
- gitlabInsufficient Granularity of Access Control in GitLab4.3 Medium
- motovnet ebook storeEbook Store <= 5.8012 - Unauthenticated Arbitrary File Upload9.8 Critical
- iqonicdesign wpbookitWPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function9.8 Critical
- wpbakery page builderWPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements6.4 Medium
- medtronic mycarelink patient monitor 24950, mycarelink patient monitor 24952 +1 moreMedtronic MyCareLink Patient Monitor Empty Password Vulnerability6.8 Medium
- medtronic mycarelink patient monitor 24950, mycarelink patient monitor 24952 +1 moreMedtronic MyCareLink Patient Monitor Unencrypted Filesystem Vulnerability6.8 Medium
- medtronic mycarelink patient monitor 24950, mycarelink patient monitor 24952 +1 moreMedtronic MyCareLink Patient Monitor Deserialization Vulnerability6.5 Medium
- tenda ac8 firmwareTenda AC8V4 V16.03.34.06` was discovered to contain heap overflow at /goform/GetParentControlInfo...6.5 Medium
- tenda ac8 firmwareTenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/WifiGuestSet. The...5.3 Medium
- tenda ac8 firmwareTenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform...8.6 High
- tenda ac8 firmwareTenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/SetSysTimeCfg. The...5.3 Medium
- tenda ac8 firmwareTenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform...5.3 Medium
- 2fauthA group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned...6.5 Medium
- softperfect connection quality monitorSoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in...6.5 Medium
- kaltura video platformKaltura < 11.1.0-2 PHP Object Injection RCE9.3 Critical
- roocode roo code, roocodeinc roo-code +1 moreRoo Code Lacks Line Break Validation in its Command Execution Tool7.8 High
- oisf libhtpLibHTP's memory leak with lzma can lead to resource starvation7.5 High
- the gnu c library glibcThe regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free...5.9 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab7.7 High
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- cookies consent management project consent management, drupal cookies consent management +1 moreCOOKiES Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-0927.6 High
- ni labviewOut of Bounds Read Vulnerability in NI LabVIEW when building font map7.3 High
- ni labviewOut of Bounds Read Vulnerability in NI LabVIEW when loading fonts7.3 High
github.com/goharbor/harborGo,govulncheck-vulndbopenSUSE +1 morePossible ORM Leak Vulnerability in the Harbor4.9 Medium- aws client vpnLocal Privilege Escalation Vulnerability in AWS Client VPN Windows Client7.3 High
- rennf93 fastapi-guard, fastapi-guard fastapi guard +1 morefastapi-guard patch contains bypassable RegEx7.8 High
- sonicwall sma 100 series, sma 210 firmware, sma 410 firmware +1 more +3 moreA Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface,...6.1 Medium
- ibm engineering systems design rhapsodyIBM Engineering Systems Design Rhapsody code execution8.8 High
- ibm engineering systems design rhapsodyIBM Engineering Systems Design Rhapsody code execution8.8 High
- sonicwall sma 100 series, sma 210 firmware, sma 410 firmware +1 more +3 moreA Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote,...7.5 High
- ibm engineering systems design rhapsodyIBM Engineering Systems Design Rhapsody information disclosure5.9 Medium
- sonicwall sma 100 series, sma 210 firmware, sma 410 firmware +1 more +3 moreA Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote,...7.3 High
- goharbor harborHarbor's repository description page allows for XSS4.1 Medium
- ibm db2 mirror for iIBM Db2 Mirror for i session fixation6.3 Medium
- ibm db2 mirror for iIBM Db2 Mirror for i cross-site websocket hijacking6.3 Medium
- vmware bitnamicharts/appsmith, bitnamicharts/drupal, bitnamicharts/wordpress +2 moreMounted Kubernetes Secrets under a predictable path located within the web server document root10.0 Critical
- japheth httpdasmhttpdASM 0.92 Path Traversal8.7 High
- Show moreLoading…