CVEs published in July 2025
3,846 vulnerabilities, 397 critical, 14 exploited.
- finos gitproxy, git-proxy +1 moreGitProxy is vulnerable to a packfile parsing exploit7.0 High
- finos gitproxy, git-proxy +1 moreGitProxy bypasses approvals when pushing multiple branches8.3 High
- 0x676e67 vproxyvproxy is vulnerable to a divide by zero DoS attack7.5 High
- drupal googletag manager, googletag manager project manager +1 moreGoogleTag Manager - Moderately critical - Cross-site scripting - SA-CONTRIB-2025-0946.1 Medium
- config pages project pages, drupal config pages +1 moreConfig Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-0937.6 High
- dell encryption, security management server +1 moreDell Encryption and Dell Security Management Server, versions prior to 11.11.0, contain an...7.3 High
- devolutions serverDeadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain...7.1 High
- devolutions serverUI synchronization issue in the Just-in-Time (JIT) access request approval interface in...5.9 Medium
- apache struts extrasApache Struts Extras: Improper Output Neutralization for Logs6.5 Medium
- cvat-ai cvat, cvat computer vision annotation tool +1 moreCVAT vulnerable to email verification bypass by use of basic authentication4.3 Medium
- hp, inc. certain hp laserjet pro printers, hp w1a28a firmware, w1a29a firmware +15 more +17 moreCertain HP LaserJet Pro Printers – Potential Information Disclosure6.9 Medium
- agpt autogpt platform, significant-gravitas autogpt +1 moreAutoGPT Platform Exposes Graph Execution Results via Authorization Gap7.7 High
- glpi-project glpiGLPI permits reservation modification by unauthorized users5.4 Medium
- glpi-project glpiGLPI technicians can access unauthorized information through external links2.7 Low
- glpi-project glpiGLPI's incomprehensive permission checks can lead to data removal from allowed users4.3 Medium
- glpi-project glpiGLPI exposes data to non-allowed users6.5 Medium
- glpi-project glpiGLPI's MailCollector Receiver is vulnerable to credential exfiltration6.5 Medium
- glpi-project glpiGLPI is vulnerable to XSS and open redirection attacks through planning feature6.5 Medium
- glpi-project glpiGLPI has overly permissive URL verification3.5 Low
- dedupeio dedupededupe is vulnerable to secret exfiltration via `issue_comment`9.1 Critical
- sixlabors imagesharpImageSharp Triggers an Infinite Loop in its GIF Decoder When Skipping Malformed Comment Extension Blocks5.3 Medium
- saml-toolkits ruby-samlRuby SAML DOS vulnerability with large SAML response6.9 Medium
pyload-ngPyPIPyload log Injection via API /json/add_package in add_name parameter4.3 Medium- code-projects exam form submissioncode-projects Exam Form Submission delete_s7.php sql injection6.9 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameter4.9 Medium
- silabs.com zigbee stackDenial of Service (DoS) vulnerabilitiey in Zigbee library5.9 Medium
- silabs.com zigbeeDoS in Zigbee device due to heavy traffic5.9 Medium
- debian linux, linux kernel, siemens ruggedcom rst2428p +18 more +20 moredo_change_type(): refuse to operate on unmounted/not ours mounts7.8 High
- ventem e-schoolVentem｜e-School - Arbitrary File Upload8.7 High
- ventem e-schoolVentem｜e-School - Missing Authorization8.7 High
- tesla wall connector, wall connector firmware +1 moreTesla Wall Connector Content-Length Header Improper Input Validation Remote Code Execution Vulnerability8.8 High
- tesla wall connector, wall connector firmware +1 moreTesla Wall Connector Firmware Downgrade Vulnerability6.8 Medium
- insyde software insydeh2oSetupAutomationSmm : SMRAM memory contents leak / information disclosure vulnerability in SMM module6.0 Medium
- insyde software insydeh2oSetupAutomationSmm: Stack overflow vulnerability in SMI handler8.2 High
- insyde software insydeh2oSetupAutomationSmm : Arbitrary calls to SmmSetVariable with unsanitised arguments in SMI handler6.0 Medium
- insyde software insydeh2oSetupAutomationSmm:Vulnerability in the SMM module allow attacker to write arbitrary code and lead to memory corruption8.2 High
- insyde software insydeh2oEfiSmiServices : EfiPcdProtocol, SMM memory corruption vulnerabilities in SMM module8.2 High
- insyde software insydeh2oEfiSmiServices: gEfiSmmCpuProtocol, SMM memory corruption vulnerabilities in SMM module8.2 High
- amazon q developer vs code extensionInert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension5.1 Medium
- elastic beatsBeats Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer7.0 High
- elastic apm serverAPM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer7.0 High
- google chromeUse after free in Media Stream in Google Chrome prior to 138.0.7204.183 allowed a remote attacker...8.8 High
arm-trusted-firmwareUbuntuTrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2...8.6 High- getprojects create school management systemGetProjectsIdea Create School Management System 1.0 is vulnerable to Cross Site Scripting (XSS)...8.2 High
- electronhub ai playgroundplayground.electronhub.ai v1.1.9 was discovered to contain a cross-site scripting (XSS)...6.1 Medium
- andisearchandisearch v0.5.249 was discovered to contain a cross-site scripting (XSS) vulnerability.6.1 Medium
- aziot 2mp full hd smart wi-fi cctv home security camera firmwareThe firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02)...7.8 High
- linuxserver docker-heimdallLinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP...9.8 Critical
- iptime nas firmwareA buffer overflow vulnerability exists in the upload.cgi module of the iptime NAS firmware v1.5...6.5 Medium
- Show moreLoading…