CVEs published in August 2025
3,709 vulnerabilities, 421 critical, 13 exploited.
- vllmvLLM API endpoints vulnerable to Denial of Service Attacks7.5 High
- phpgurukul user management systemPHPGurukul User Management System signup.php sql injection6.9 Medium
- plex media serverPlex Media Server (PMS) versions 1.41.7.x through 1.42.0.x are affected by an unspecified...8.5 High
cmakeAlpaquita,cmake3openSUSE,cmake3-fullopenSUSE +3 more +5 morecmake cmForEachCommand.cxx ReplayItems assertion4.8 Medium- saitoha libsixelsaitoha libsixel img2sixel encoder.c sixel_debug_print_palette stack-based overflow4.8 Medium
- tenda m3, m3 firmware +1 moreTenda M3 getMasterPassengerAnalyseData formGetMasterPassengerAnalyseData stack-based overflow8.7 High
- tenda m3, m3 firmware +1 moreTenda M3 QuickIndex formQuickIndex stack-based overflow8.7 High
- tenda i22, i22 firmware +1 moreTenda i22 wxportalauth formWeixinAuthInfoGet stack-based overflow8.7 High
- emlogEmlog Pro blogger.php unrestricted upload5.1 Medium
- aicwebtech bible supersearchBible SuperSearch <= 6.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via selector_height Parameter6.4 Medium
- mattermost, mattermost server +1 moreTeam invite ID leaked to team admin with no member invite privileges4.3 Medium
- mattermost, mattermost server +1 moreMattermost Shared Channel Upload Type Validation Bypass6.8 Medium
- mattermost, mattermost server +1 morePath Traversal in Template Upload Allows Uploading Files Outside Target Directory6.8 Medium
- mattermost, mattermost server +1 moreChannel and Team Membership APIs inadvertently allow loss of Member privileges.3.8 Low
- mattermost, mattermost server +1 moreAI plugin APIs can be triggered using post actions3.5 Low
- cozmoslabs wp webhooks – automate repetitive tasks by creating powerful automation workflows directly within wordpressWP Webhooks <= 3.3.5 - Unauthenticated Arbitrary File Copy9.8 Critical
- mattermost, mattermost server +1 moreThread summarization allows persistent access to channel3.5 Low
- mattermost, mattermost server +1 moreImport Path Traversal Enables Unauthorized Unsigned Plugin Installation6.8 Medium
- softing edgeaggregator, edgeconnector, opc ua c++ sdk +2 moreBypass the client certificate trust check of an opc.https server while only secure communication is allowed9.1 Critical
- amans2k slingblocks – gutenberg blocks by funnelkit (formerly woofunnels)SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update4.3 Medium
- wpzoom inspiroInspiro <= 2.1.2 - Cross-Site Request Forgery to Arbitrary Plugin Installation8.1 High
- intermesh bv group-office, group-office group office +1 moreGroup-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a...5.3 Medium
- intermesh bv group-office, group-office group office +1 moreGroup-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a...4.8 Medium
- provesource ltd social proofWordPress ProveSource Social Proof plugin <= 3.1.2 - Sensitive Data Exposure vulnerability5.3 Medium
- apple ipados, macos, ios and ipados +2 more +4 moreAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in...10.0 Critical
- ubiquiti inc edgemax edgeswitchAn Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a...7.5 High
- ubiquiti inc uisp applicationA Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with...9.1 Critical
- ubiquiti inc uisp applicationMultiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a...8.8 High
- ubiquiti inc unifi connect display cast, unifi connect display cast lite, unifi connect display cast pro +2 moreAn Improper Access Control could allow a malicious actor authenticated in the API of certain...8.1 High
- ubiquiti inc unifi connect ev station proA Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro...9.8 Critical
- ubiquiti inc unifi connect display, unifi connect display cast, unifi connect display cast lite +2 more +4 moreAn Improper Access Control could allow a malicious actor authenticated in the API of certain...4.9 Medium
- ubiquiti inc unifi connect ev station liteMultiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a...9.8 Critical
- tenda ac15 firmwareTenda AC15 v15.03.05.19_multi_TD01 has a stack overflow via the list parameter in the...7.5 High
- agent-zeroInsecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via...7.3 High
- agent-zeroAn issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows attackers to...3.5 Low
- akauntingCross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18...6.5 Medium
- akauntingAn issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated...6.5 Medium
- foxcmsA Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6....8.8 High
- No product listedMoss before v0.15 has a file upload vulnerability. The "upload" function configuration allows...8.6 High
- jishenghua jsherpIncorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows...5.3 Medium
- jishenghua jsherpIncorrect access control in the component \controller\ResourceController.java of jshERP v3.5...8.8 High
- jishenghua jsherpIncorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows...8.8 High
- jishenghua jsherpIncorrect access control in the component \controller\SupplierController.java of jshERP v3.5...5.3 Medium
- jishenghua jsherpIncorrect access control in the component \controller\UserController.java of jshERP v3.5 allows...5.3 Medium
- No product listedAn issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the...9.8 Critical
- No product listedAikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user...9.8 Critical
- No product listedAikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users...8.8 High
- libsndfile project libsndfileA buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier...7.5 High
- No product listedHTML injection vulnerability in the registration interface in Evolution Consulting Kft. HRmaster...7.0 High
- Show moreLoading…