CVEs published in August 2025
3,709 vulnerabilities, 421 critical, 13 exploited.
- ipfireThe Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly...6.5 Medium
- abantecartDirectory traversal vulnerability in AbanteCart version 1.4.2 allows unauthenticated attackers to...7.5 High
- No product listedMitrastar GPT-2741GNAC-N2 devices are provided with access through ssh into a restricted default...8.4 High
- maharaMahara before 24.04.9 exposes database connection information if the database becomes unreachable...7.5 High
- kapsch ris-9160 firmware, ris-9260 firmware +1 moreKapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4...6.8 Medium
- kapsch ris-9160 firmware, ris-9260 firmware +1 moreKapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were...6.8 Medium
- kapsch ris-9160 firmware, ris-9260 firmware +1 moreKapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4...4.6 Medium
- kapsch ris-9160 firmware, ris-9260 firmware +1 moreKapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4...6.8 Medium
- kapsch ris-9160 firmware, ris-9260 firmware +1 moreIncorrect access control in the SPI Flash Chip of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside...3.5 Low
- kapsch ris-9160 firmware, ris-9260 firmware +1 moreIncorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260...6.8 Medium
- maharaAn issue was discovered in Mahara 23.04.8 and 24.04.4. Attackers may utilize escalation of...8.8 High
- maharaAn issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL...5.3 Medium
- maharaIn Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML...6.1 Medium
- maharaSupported versions of Mahara 24.04 before 24.04.1 and 23.04 before 23.04.6 are vulnerable to...9.1 Critical
- maharaMahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with...6.1 Medium
- mtons mblogmtons mblog Post submit cross site scripting5.1 Medium
- itsourcecode online tour and travel management system, mayurik online tour \& travel management system +1 moreitsourcecode Online Tour and Travel Management System package.php sql injection6.9 Medium
- itsourcecode online tour and travel management system, mayurik online tour \& travel management system +1 moreitsourcecode Online Tour and Travel Management System enquiry.php sql injection6.9 Medium
- ruijie ws7204-a, ws7204-a firmware +1 moreRuijie WS7204-A branch_import.php os command injection5.1 Medium
- campcodes online water billing systemCampcodes Online Water Billing System editecex.php sql injection6.9 Medium
- oitcode samariumoitcode samarium Team Image team cross site scripting4.8 Medium
- admerc apartment management systemitsourcecode Apartment Management System addcomplain.php sql injection6.9 Medium
- azu request-filtering-agentrequest-filtering-agent SSRF Bypass via HTTPS Requests5.5 Medium
- admerc apartment management systemitsourcecode Apartment Management System addfloor.php sql injection6.9 Medium
- tp-link systems inc. kp303 (us) smartplug, tp-link kp303 firmware +1 moreUnauthenticated Protocol Commands on TP-Link KP3038.7 High
- the-scratch-channel tsc-web-clientThe Scratch Channel's Publish Articles POST Request Can Upload Articles Without Validation8.7 High
- admerc apartment management systemitsourcecode Apartment Management System addunit.php sql injection6.9 Medium
mitmproxyPyPImitmproxy binaries embed a vulnerable python-hyper/h2 dependency6.9 Medium- python-hyper h2h2 allows HTTP Request Smuggling due to illegal characters in headers6.9 Medium
- mlc-ai xgrammarXGrammar affected by Denial of Service by infinite recursion grammars7.7 High
- admerc apartment management systemitsourcecode Apartment Management System addowner.php sql injection6.9 Medium
- arista networks eosOn affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing Echo Reply. This can result in unexpecte…7.5 High
- arista networks eosOn affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and proto…3.8 Low
- admerc apartment management systemitsourcecode Apartment Management System addemployee.php sql injection5.3 Medium
- oitcode samariumoitcode samarium Pages Image webpage cross site scripting4.8 Medium
- njtech greencmsGreenCMS index.php unrestricted upload5.3 Medium
- kalcaddle kodboxkalcaddle kodbox Download from Link serverDownload server-side request forgery5.1 Medium
- lostvip ruoyi-golostvip-com ruoyi-go system_router.go SelectListByPage sql injection5.3 Medium
- craftcms cms, craft cms +1 moreCraft Potential Remote Code Execution via Twig SSTI6.1 Medium
- airlinklabs daemonAirlink's Daemon Symlink Vulnerability8.7 High
- lostvip ruoyi-golostvip-com ruoyi-go DictDataDao.go SelectListByPage sql injection5.3 Medium
- lostvip ruoyi-golostvip-com ruoyi-go LoginInforService.go SelectPageList sql injection5.3 Medium
- dataeaseDataease H2 JDBC RCE Bypass8.2 High
- dataeaseDataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability8.2 High
- lostvip ruoyi-golostvip-com ruoyi-go GenTableDao.go SelectListByPage sql injection5.3 Medium
- langflowLangflow Vulnerable to Privilege Escalation via CLI Superuser Creation8.8 High
- securden unified pamSecurden Unified PAM Shared SSH Key and Cloud Infrastructure7.2 High
- securden unified pamSecurden Unified PAM Path Traversal In File Upload9.4 Critical
- securden unified pamSecurden Unified PAM Unauthenticated Unrestricted File Upload7.5 High
- securden unified pamSecurden Unified PAM Authentication Bypass9.8 Critical
- Show moreLoading…