CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- firecoders.com commentbox component for joomlaExtension - firecoders.com - Stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla9.4 Critical
- 9001 copypartycopyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata5.4 Medium
- silverbucket webfinger.jswebfinger.js is vulnerable to Blind SSRF attacks through localhost6.9 Medium
- microsoft windows 11DLL hijacking of all PE32 executables on Windows 11 for ARM CPUs5.4 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg...5.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots5.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint5.4 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak...5.8 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page4.8 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings...4.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings...4.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows7.7 High
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory...7.5 High
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration3.7 Low
- jetbrains teamcityIn JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow5.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper...6.1 Medium
- beyondtrust privilege management for windowsPrivilege Management for Windows - Elevation of Privilege7.1 High
- beyondtrust privilege management for windowsPrivilege Management for Windows - Elevation of Privilege7.2 High
- ibm informix dynamic serverIBM Informix Dynamic Server HTML injection5.4 Medium
- ibm informix dynamic serverIBM Informix Dynamic Server information disclosure7.5 High
- codeigniter, codeigniter4 +1 moreCodeIgniter4's ImageMagick Handler has Command Injection Vulnerability9.8 Critical
- johnson controls, inc istar ultraiSTAR Ultra performs a firmware verification on boot, however the verification does not inspect...9.3 Critical
- johnson controls, inc istar ultraOS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to...9.4 Critical
- gitlab language serverMissing Authentication for Critical Function in GitLab Language Server8.7 High
- meddream pacs premium, pacs server +1 moreAn incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues...9.3 Critical
- meddream pacs premium, pacs server +1 moreA privilege escalation vulnerability exists in the login.php functionality of meddream MedDream...9.3 Critical
- meddream pacs premium, pacs server +1 moreA reflected cross-site scripting (xss) vulnerability exists in the radiationDoseReport.php...6.1 Medium
- meddream pacs premium, pacs server +1 moreA server-side request forgery vulnerability exists in the cecho.php functionality of MedDream...5.8 Medium
- bsc peru cocktails appbsc Peru Cocktails App bsc.devy.peru_cocktails AndroidManifest.xml improper export of android application components4.8 Medium
- campcodes online recruitment management systemCampcodes Online Recruitment Management System ajax.php sql injection6.9 Medium
- beamsec phishproPrivilege Escalation in Beamsec PhishPro8.8 High
- debian linux, linux kernel +1 moreusb: gadget: configfs: Fix OOB read on empty string write7.1 High
- linux, linux kernel +1 moredm-bufio: fix sched in atomic context5.5 Medium
- debian linux, linux kernel +1 moreHID: core: ensure the allocated report buffer can contain the reserved report ID8.8 High
- debian linux, linux kernel +1 moreHID: core: do not bypass hid_hw_raw_request7.8 High
- linux, linux kernel +1 moretracing/osnoise: Fix crash in timerlat_dump_stack()5.5 Medium
- linux, linux kernel +1 morenetfs: Fix race between cache write completion and ALL_QUEUED being set4.7 Medium
- debian linux, linux kernel, siemens simatic cn 4100 +2 moremptcp: make fallback action and fallback decision atomic8.2 High
- linux, linux kernel +1 morenet: libwx: remove duplicate page_pool_put_full_page()9.8 Critical
- linux, linux kernel +1 mores390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again5.5 Medium
- debian linux, linux kernel +1 moresmb: client: fix use-after-free in crypt_message when using async crypto9.8 Critical
- debian linux, linux kernel +1 moresoc: aspeed: lpc-snoop: Don't disable channels that aren't enabled5.5 Medium
- linux, linux kernel +1 moresoundwire: Revert "soundwire: qcom: Add set_channel_map api support"7.8 High
- debian linux, linux kernel +1 moreiio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush7.8 High
- linux, linux kernel +1 moreiio: backend: fix out-of-bound write7.8 High
- debian linux, linux kernel +1 morecomedi: das16m1: Fix bit shift out of bounds7.1 High
- debian linux, linux kernel +1 morecomedi: das6402: Fix bit shift out of bounds7.1 High
- debian linux, linux kernel +1 morecomedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large5.5 Medium
- debian linux, linux kernel +1 morecomedi: Fix use of uninitialized data in insn_rw_emulate_bits()5.5 Medium
- debian linux, linux kernel +1 morecomedi: Fix initialization of data for instructions that write to subdevice7.8 High
- Show moreLoading…