CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- lg innotek camera model lnv5110rAuthentication Bypass in LG Innotek Camera8.3 High
- hcl software iem, hcltech intelliops event management +1 moreHCL IEM is affected by an authorization token sent in cookie vulnerability2.2 Low
- hcl software iem, hcltech intelliops event management +1 moreHCL IEM is affected by an improper invalidation of access or JWT token vulnerability3.3 Low
- node-samlNode-SAML SAML Authentication Bypass9.3 Critical
- atlassian sourcetree, sourcetree for mac +1 moreThis Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8...5.9 Medium
- tryquiet quietQuiet uses insecure, inconsistent verification on local backend token8.5 High
- wpmet elementskit elementor addons, roxnor elementskit elementor addons – advanced widgets & templates addons for elementor +1 moreElementsKit Elementor Addons and Templates <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Widget6.4 Medium
- deerwms deer-wms-2deerwms deer-wms-2 edit sql injection5.3 Medium
- hcl software iautomate, hcltech dryice iautomate +1 moreHCL iAutomate is affected by an insufficient session expiration7.1 High
- hcl software iautomate, hcltech dryice iautomate +1 moreHCL iAutomate is affected by a sensitive data exposure vulnerability7.6 High
- network thermostat x-series wifi thermostatsNetwork Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function9.3 Critical
- autocaliweb, calibre web web, janeczku calibre-web +2 moreCalibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C5.9 Medium
- hcl software iautomate, hcltech dryice iautomate +1 moreHCL iAutomate is affected by hardcoded credentials7.1 High
- autocaliweb, calibre web web +1 moreCalibre Web 0.6.24 & Autocaliweb 0.7.0 - ReDoS8.7 High
- phpgurukul taxi stand management system, auto\/taxi stand management system +1 morePHPGurukul Taxi Stand Management System new-autoortaxi-entry-form.php cross site scripting5.1 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter9.3 Critical
- autodesk 3ds max, autocad, autocad lt +7 more +9 morePrivilege Ecalation due to Untrusted Search Path Vulnerability7.8 High
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- wwbn avideoA cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId...9.6 Critical
- wwbn avideoA cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality...9.0 Critical
- wwbn avideoA cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter...9.6 Critical
- wwbn avideoA cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri...8.3 High
- wwbn avideoA cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter...9.6 Critical
- wwbn avideoA race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN...8.8 High
- wwbn avideoAn incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit...7.3 High
- ibm iIBM i privilege escalation7.5 High
- ibm mq operator, supplied mq advanced container images +1 moreIBM MQ Operator information disclosure6.2 Medium
- ibm mq operator, supplied mq advanced container images +1 moreIBM MQ Operator information disclosure5.9 Medium
- lf-edge ekuipereKuiper API endpoints handling SQL queries with user-controlled table names.8.9 High
- libssh, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibssh: null pointer dereference in libssh kex session id calculation4.7 Medium
- moderec tourtellaSQLi in Moderec's Tourtella9.8 Critical
- bayraktar solar energies scadawatt otopilotSQLi in Bayraktar Solar Energies' ScadaWatt Otopilot9.8 Critical
- smg software information portalArbitrary File Upload in SMG Software's Information Portal10.0 Critical
- capillary io capillaryscopeEncryption of sensitive data in CapillaryScope missing6.9 Medium
- marviorocha station pro – advanced audio streaming & player for wordpressStation Pro <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height Parameters6.4 Medium
- mindnl affiliate plusAffiliate Plus <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- gerkin ithoughts advanced code editoriThoughts Advanced Code Editor <= 1.2.10 - Cross-Site Request Forgery to Settings Update4.3 Medium
- alexacrm dataverse integrationDataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route8.8 High
- funnelcockpitFunnelCockpit <= 1.4.3 - Reflected Cross-Site Scripting via `error` Parameter6.1 Medium
- minutemedia voltax video playerVoltax Video Player <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter6.4 Medium
- taeggie feedTaeggie Feed <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Attribute6.4 Medium
- gorbo structured content (json-ld) #wpscStructured Content <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcode6.4 Medium
- jonsisk wp get the tableWP Get The Table <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter6.4 Medium
- museai skiv video embeddingmuse.ai video embedding <= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via muse-ai Shortcode6.4 Medium
- ullakalim8 supreme addons for beaver builder –Supreme Addons for Beaver Builder <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb Shortcode6.4 Medium
- alexalouit wp wallcreeperWP Wallcreeper <= 1.6.1 - Missing Authorization to Authenticated (Susbcriber+) Cache Enable/Disable4.3 Medium
- ejointjp wp applinkWP Applink <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter6.4 Medium
- 995525477-1 mine cloudvod lmsMine CloudVod <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via audio Parameter6.4 Medium
- Show moreLoading…