CVEs published in August 2025
3,709 vulnerabilities, 421 critical, 13 exploited.
- packet power eg, emx +1 morePacket Power EMX and EG Missing Authentication for Critical Function9.3 Critical
- dreame technology dreamehome android app, dreamehome ios app, movahome ios app +2 moreDreame Technology iOS and Android Mobile Applications Improper Certificate Validation8.5 High
- eg4 electronics 12000xp, 12kpv, 18kpv +4 more +6 moreEG4 Electronics EG4 Inverters Improper Restriction of Excessive Authentication Attempts9.2 Critical
- eg4 electronics 12000xp, 12kpv, 18kpv +4 more +6 moreEG4 Electronics EG4 Inverters Observable Discrepancy6.9 Medium
- eg4 electronics 12000xp, 12kpv, 18kpv +4 more +6 moreEG4 Electronics EG4 Inverters Download of Code Without Integrity Check8.6 High
- eg4 electronics 12000xp, 12kpv, 18kpv +4 more +6 moreEG4 Electronics EG4 Inverters Cleartext Transmission of Sensitive Information7.5 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Reflected XSS in blogs-web6.9 Medium
- xerox freeflow corePath Traversal leading to RCE9.8 Critical
- trendnet ti-g160i, ti-pg102i, tpl-430ap +2 moreTRENDnet TI-G160i/TI-PG102i/TPL-430AP SSH Service default credentials9.3 Critical
- xerox freeflow coreXXE leading to SSRF7.5 High
- openbaoOpenBao LDAP MFA Enforcement Bypass When Using Username As Alias6.5 Medium
- ibm cloud pak for business automationIBM Cloud Pak for Business Automation security bypass6.5 Medium
- openbaoOpenBao Login MFA Bypasses Rate Limiting and TOTP Token Reuse5.7 Medium
- openbaoOpenBao TOTP Secrets Engine Enables Code Reuse6.5 Medium
- openbaoOpenBao: Timing Side-Channel in Userpass Auth Method3.7 Low
- openbaoOpenBao Userpass and LDAP User Lockout Bypass5.3 Medium
- openbaoOpenBao: Privileged Operator May Execute Code on the Underlying Host9.1 Critical
- openbaoOpenBao Root Namespace Operator May Elevate Token Privileges7.2 High
- belkin f9k1009, f9k1010 +1 moreBelkin F9K1009/F9K1010 Web Interface hard-coded credentials9.3 Critical
- @fedify fedify@fedify/fedify: Improper Authentication and Incorrect Authorization8.7 High
- ibm iIBM i authentication bypass7.1 High
- migoxlab lmeterxMigoXLab LMeterX upload_service.py process_cert_files path traversal5.3 Medium
- mobile industrial robots mir robotsPath traversal vulnerability in MiR robot software via API requests6.5 Medium
- rarlab winrar, dtsearch +1 morePath traversal vulnerability in WinRAR8.4 High
- mobile industrial robots mir fleet, mir robots +1 moreOS command injection in MiR robots and MiR fleet via crafted HTTP requests8.8 High
- apache seata, apache software foundation seata (incubating) +1 moreApache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server9.8 Critical
- apache cxfApache CXF: Untrusted JMS configuration can lead to RCE9.8 Critical
- No product listedSecurity update for nginxNo score
- unknown openstreetmap for gutenberg and wpbakery page builder (formerly visual composer)OpenStreetMap for Gutenberg and WPBakery Page Builder <= 1.2.0 - Contributor+ Stored XSS5.9 Medium
- mubit co.,ltd. powered blue 870Powered BLUE 870 versions 0.20130927 and prior contain an OS command injection vulnerability. If...5.3 Medium
- mubit co.,ltd. powered blue 870Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability. If this...5.3 Medium
- tassos.gr advanced custom fieldsAn HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4...4.6 Medium
- huawei enzoh-w5611t, enzoh-w5611t firmware +1 moreEnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability...5.0 Medium
- huawei enzoh-w5611t, enzoh-w5611t firmware +1 moreEnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability...5.7 Medium
- huawei enzoh-w5611t, enzoh-w5611t firmware +1 moreEnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability...4.5 Medium
- antabot white-jotterAntabot White-Jotter com.gm.wj.config.ShiroConfiguration ShiroConfiguration.java CookieRememberMeManager deserialization2.3 Low
- huuge box app, huuugegames huuge box +1 moreHuuge Box App com.huuge.game.zjbox AndroidManifest.xml improper export of android application components4.8 Medium
- wanzhou woes intelligent optimization energy saving systemWanzhou WOES Intelligent Optimization Energy Saving System Energy Overview Module CreateFunctionLog sql injection5.3 Medium
- wanzhou woes intelligent optimization energy saving systemWanzhou WOES Intelligent Optimization Energy Saving System Energy Overview Module GetTargetConfig sql injection5.3 Medium
- wanzhou woes intelligent optimization energy saving systemWanzhou WOES Intelligent Optimization Energy Saving System Analysis Conclusion Query Module GetAlarmResultProcessList sql injection5.3 Medium
- wanzhou woes intelligent optimization energy saving systemWanzhou WOES Intelligent Optimization Energy Saving System Environmental Real-Time Data Module GetAreaTrendChartData sql injection5.3 Medium
- fumiki takahashi gianismWordPress Gianism plugin <= 6.0.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- 7-zip7-Zip before 25.01 does not always properly handle symbolic links during extraction.3.6 Low
- mitel micollabA vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1...8.8 High
- No product listedA vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8...9.8 Critical
- ehcp easy hosting control panelEasy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection...4.8 Medium
- ehcp easy hosting control panelA reflected cross-site scripting (XSS) vulnerability in the List All FTP User Function in EHCP...6.3 Medium
- open-metadata openmetadataOpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the...6.5 Medium
- open-metadata openmetadataOpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the...6.5 Medium
- open-metadata openmetadataOpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the...7.1 High
- Show moreLoading…