CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- solarwinds web help deskSolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability5.3 Medium
- samsung electronics data management server, samsung data management server firmware +1 moreAn 'Arbitrary File Deletion' in Samsung DMS(Data Management Server) allows attackers to delete...6.1 Medium
- samsung electronics data management server, samsung data management server firmware +1 moreAn 'Arbitrary File Creation' in Samsung DMS(Data Management Server) allows attackers to create...6.4 Medium
- samsung electronics data management server, samsung data management server firmware +1 moreImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Samsung DMS...7.1 High
- samsung electronics data management server, samsung data management server firmware +1 moreAbsolute Path Traversal in Samsung DMS(Data Management Server) allows authenticated attacker ...4.9 Medium
- samsung electronics data management server, samsung data management server firmware +1 moreDeserialization of Untrusted Data in Samsung DMS(Data Management Server) allows attackers to...8.0 High
- samsung electronics dms(data management server), samsung data management server firmware +1 moreAn execution after redirect in Samsung DMS(Data Management Server) allows attackers to execute...6.5 Medium
z-pushUbuntu,z-push/z-push-devPackagist +1 morez-push/z-push-dev SQL Injection Vulnerability9.1 Critical- switchbot app for ios/android"SwitchBot" App for iOS/Android contains an insertion of sensitive information into log file...5.9 Medium
- brizy, themefusecom brizy – page builder +1 moreBrizy <= 2.6.20 - Missing Authorization to Unauthenticated Limited File Upload5.3 Medium
- elemntor elementor website builder – more than just a page builderElementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget6.4 Medium
- elementor website builder, elemntor elementor website builder – more than just a page builder +1 moreElementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bricks builder bricksBricks Builder <= 1.12.4 - Unauthenticated SQL Injection via `p` Parameter7.5 High
- streamweasels youtube integrationStreamWeasels YouTube Integration <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- streamweasels kick integrationStreamWeasels Kick Integration <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
- streamweasels twitch integrationStreamWeasels Twitch Integration <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
assimpOSS-FuzzUNKNOWN READ in signed char Assimp::StreamReader<false, false>::Get<signed char>No score- couchbase sync gatewayCouchbase Sync Gateway shows cleartext passwords in redacted and unredacted output7.3 High
- vivaldigroup icontrol\+ server, vivaldi domotica icontrol firmware +1 moreA cross-site scripting vulnerability in Vivaldi United Group iCONTROL+ Server including Firmware...6.3 Medium
- totolink x6000r firmwareTotolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in...6.5 Medium
- puneethreddyhc online shopping system advancedA SQL Injection vulnerability exists in the action.php endpoint of PuneethReddyHC Online Shopping...7.7 High
- phpgurukul pre-school enrollment systemPhpgurukul Pre-School Enrollment System 1.0 contains a SQL injection vulnerability in the /admin...6.5 Medium
- phpgurukul nipah virus testing management systemphpgurukul Nipah virus (NiV) Testing Management System 1.0 contains a SQL injection vulnerability...6.5 Medium
- usememos memosMemos has Cross-Site Scripting (XSS) Vulnerability in Image URLs9.8 Critical
- No product listedlangchain-ai v0.3.51 was discovered to contain an indirect prompt injection vulnerability in the...9.8 Critical
- bacula bacula-webBacula-web SQL Injection Vulnerability8.1 High
- maptiler tileserver phpMapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within...8.2 High
- maptiler tileserver phpMapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter ...9.8 Critical
- grandstream ucm6510 firmwareGrandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of...6.5 Medium
- grandstream ucm6510 firmwareAn issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain...6.5 Medium
- grandstream gxp1628 firmwareGrandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is...7.6 High
- piwigoPiwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and...6.4 Medium
- emqx nanomqAn access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and...8.8 High
- emqx nanomqNanoMQ v0.17.9 was discovered to contain a heap use-after-free vulnerability via the component...7.5 High
- flashmqAn issue in FlashMQ v1.14.0 allows attackers to cause an assertion failure via sending a crafted...7.5 High
- flashmqFlashMQ v1.14.0 was discovered to contain an assertion failure in the function PublishCopyFactory...7.5 High
- xorux lpar2rrdKL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal8.8 High
- xorux lpar2rrdKL-001-2025-015: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information5.3 Medium
- xorux lpar2rrdKL-001-2025-014: Xorux LPAR2RRD Read Only User Denial of Service6.5 Medium
- xorux xormon, xormon-ng +1 moreKL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator5.3 Medium
- xorux xormon, xormon-ng +1 moreKL-001-2025-012: Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensitive Information5.3 Medium
- polkadot-evm frontierPolkadot Frontier's constructing smart contract can bypass precompile address bounding6.9 Medium
- musombi123 revelacode-backendRevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak)9.8 Critical
- polkadot-evm frontierPolkadot Frontier contains missing `check_inherent` for `note_min_gas_price_target` inflates gas price6.9 Medium
- polkadot-evm frontierPolkadot Frontier contains silent failure in Curve25519 arithmetic precompiles with malformed points9.9 Critical
- node-samlNode-SAML Contains SAML Signature Verification Vulnerability10.0 Critical
- python software foundation cpythonTarfile infinite loop during parsing with negative member offset7.5 High
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +3 more +5 moreNetavark: podman: netavark may resolve hostnames to unexpected hosts3.7 Low
- hp linux imaging and printing, hp, inc. hp linux imaging and printing software +1 moreHP Linux Imaging and Printing Software - Use of DSA Key5.9 Medium
- nobossextensions.com no boss testimonials component for joomlaExtension - nobossextensions.com - Stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla9.4 Critical
- Show moreLoading…