CVEs published in August 2025
3,709 vulnerabilities, 421 critical, 13 exploited.
- portabilis i-educarPortabilis i-Educar public_distrito_cad.php cross site scripting4.8 Medium
- portabilis i-educarPortabilis i-Educar novo cross site scripting4.8 Medium
- axiomatic bento4Axiomatic Bento4 mp4decrypt Mp4Decrypt.cpp SetDataSize allocation of resources6.3 Medium
- espocrmEspoCRM is vulnerable to access denial through double slash in URI corrupting router cache4.5 Medium
- triliumnext triliumTrilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed Retrieval7.5 High
- anysphere cursorCursor Agent is vulnerable prompt injection via Editor Special Files7.5 High
- anysphere cursorCursor Agent is vulnerable to prompt injection via MCP Special Files8.6 High
openexrOSS-FuzzHeap-buffer-overflow in generic_unpackNo score- cconard96 glpi-screenshot-pluginglpi-screenshot-plugin exposes local files in /ajax/screenshot.php7.7 High
- ftb-gamepedia tilesheetsTilesheets MediaWiki Extension is Vulnerable to Potential SQL Injection7.3 High
- electroncapture electron capture, steveseguin electroncapture +1 moreElectron Capture is Vulnerable to TCC Bypass via Misconfigured Node Fuses (macOS)5.5 Medium
- leakingmemory vtun-ngVTun-ng's failure to initialize encryption modules may cause reversion to plaintext8.7 High
- cronoh nanovaultcronoh NanoVault xrb URL main.js executeJavaScript cross site scripting5.1 Medium
- sscmsAn issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to...6.5 Medium
- No product listedFile upload vulnerability in Writebot AI Content Generator SaaS React Template thru 4.0.0,...6.5 Medium
- No product listedThe reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before...6.1 Medium
- No product listedInsecure Direct Object Reference (IDOR) vulnerability in PdfHandler component in Agenzia Impresa...7.5 High
- No product listedIncorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows...6.5 Medium
- shopwareA stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface...6.1 Medium
- cpuid cpuz.sysAn issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the...6.5 Medium
- thinkphpAn issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index...9.8 Critical
- thinkphpThinkPHP Path Traversal Vulnerability9.8 Critical
- twistedmatrix twistedwebA command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input...6.5 Medium
- seacmsCross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js...5.4 Medium
- No product listedAn Authentication Bypass vulnerability in Blue Access' Cobalt X1 thru 02.000.187 allows an...6.5 Medium
- 4cstrategies exonautAn issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. There are verbose error...9.8 Critical
- denx u-bootA lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U...6.5 Medium
- bluestacksA lack of SSL certificate validation in BlueStacks v5.20 allows attackers to execute a man-it-the...3.9 Low
- No product listedAn issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN. They enable the SSH...6.5 Medium
- No product listedAn issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN that allows authenticated...7.4 High
- No product listedJointelli 5G CPE 21H01 firmware JY_21H01_A3_v1.36 devices allow (blind) OS command injection....7.4 High
- No product listedA vulnerability affecting the scanning module in Emsisoft Anti-Malware prior to 2024.12 allows...7.5 High
- libtifflibtiff tiff2ps tiff2ps.c PS_Lvl2page null pointer dereference2.0 Low
- eladminelunez eladmin Druid application-prod.yml default credentials6.9 Medium
- cloudfavorites favorites-webcloudfavorites favorites-web CollectController.java getCollectLogoUrl server-side request forgery5.3 Medium
- ubiquiti inc unifi access g2 reader pro, unifi access g3 intercom, unifi access g3 reader pro +3 more +5 moreAn Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a...9.8 Critical
- ubiquiti inc edgemax edgeswitchAn Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a...7.5 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal CAPTCHA Bypass for Gogo Shell6.9 Medium
- exrick xbootExrick xboot getMenuList sensitive information in a cookie6.3 Medium
- wolfssl inc. wolftpmwolfTPM library wrapper function `wolfTPM2_RsaKey_TpmToWolf` copies external data to a fixed-size stack buffer without length validation potentially causing stack-based buffer overflow1.0 Low
- exrick xbootExrick xboot Swagger SecurityController.java server-side request forgery5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreThe fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP...2.0 Low
- exrick xbootExrick xboot UploadController.java upload unrestricted upload5.3 Medium
- convoypanel panelRatPanel can perform remote command execution without authorization7.7 High
- exrick xbootExrick xboot Spring Boot Admin/Spring Actuator information disclosure6.9 Medium
- eugeny russh, warpgate project warpgate +1 moreRussh is missing an overflow check during channel windows adjust6.5 Medium
nssTuxCare,nss-develTuxCare,nss-pkcs11-develTuxCare +8 more +10 moreUpdate of nssNo score- boquan dotwallet appBoquan DotWallet App com.boquanhash.dotwallet AndroidManifest.xml improper export of android application components4.8 Medium
nssTuxCare,nss-develTuxCare,nss-pkcs11-develTuxCare +8 more +10 moreUpdate of nssNo score- riderlike fruit crush-brain appRiderLike Fruit Crush-Brain App com.fruitcrush.fun AndroidManifest.xml improper export of android application components4.8 Medium
- Show moreLoading…