CVEs published in August 2025
3,709 vulnerabilities, 421 critical, 13 exploited.
- sminozzi block bad bots and stop bad bots crawlers and spiders and anti spam protectionBlock Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 11.58 - Insufficient Authorization to Unauthenticated Blocklist Bypass6.5 Medium
- opensolution quickcms, quick.cms +1 moreReflected XSS in QuickCMS5.1 Medium
- opensolution quickcms, quick.cms +1 moreStored XSS in QuickCMS5.3 Medium
- opensolution quickcms, quick.cms +1 moreStored XSS in QuickCMS5.3 Medium
- opensolution quickcms, quick.cms +1 moreSending Password in GET Request6.9 Medium
- opensolution quickcms, quick.cms +1 moreCross-Site Request Forgery in QuickCMS6.9 Medium
- opensolution quickcms, quick.cms +1 moreReflected XSS in QuickCMS5.1 Medium
- acronis cyber protect cloud agentLocal privilege escalation due to improper soft link handling. The following products are...7.3 High
- debian linux, linux kernel, siemens simatic cn 4100 +2 moretls: separate no-async decryption request handling from async9.8 Critical
- dos co., ltd. ss1Use of hard-coded password issue/vulnerability in SS1 Ver.16.0.0.10 and earlier (Media version:16...8.7 High
- dos co., ltd. ss1, ss1 cloud +1 moreImproper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in...8.7 High
- dos co., ltd. ss1, ss1 cloud +1 moreImproper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in...7.1 High
- dos co., ltd. ss1SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated...9.3 Critical
- dos co., ltd. ss1, ss1 cloud +1 moreSS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated...9.3 Critical
- dos co., ltd. ss1, ss1 cloud +1 moreIncorrect permission assignment for critical resource issue exists in SS1 Ver.16.0.0.10 and...7.3 High
- dos co., ltd. ss1, ss1 cloud +1 moreFiles or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier...6.9 Medium
- dos co., ltd. ss1Inadequate encryption strength issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0...8.7 High
- naver mybox explorer, navercorp mybox +1 moreNAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges...7.8 High
- plugincy dynamic ajax product filters for woocommerceDynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter6.4 Medium
- plugincy dynamic ajax product filters for woocommerceDynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter6.4 Medium
- wpdreams ajax search lite – live search & filterAjax Search Lite <= 4.13.1 - Missing Authorization to Unauthenticated Basic Information Exposure via ASL_Query in AJAX Search Handler5.3 Medium
- pbmacintyre ringcentral communications plugin – freeRingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function9.8 Critical
- xagio seo – ai powered seoXagio SEO <= 7.1.0.5 - Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files7.5 High
- mra13 simple download monitorSimple Download Monitor <= 3.9.33 - Simple Download Monitor <= 3.9.33 – Authenticated (Contributor+) SQL Injection via order parameter in Log Export functionality6.5 Medium
- softdiscover file manager, code editor, and backup by managefyFile Manager, Code Editor, and Backup by Managefy <= 1.4.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Download4.9 Medium
- wpdevelop booking calendarBooking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- unitecms unlimited elements for elementorUnlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wp ulike proWP ULike Pro <= 1.9.3 - Unauthenticated Limited Arbitrary File Upload6.1 Medium
- liquidthemes ai hub - startup & technology wordpress theme, archub - architecture and interior design wordpress theme, hub - responsive multi-purpose wordpress theme +2 moreLiquidThemes Themes <= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated4.3 Medium
- ibm security verify governance identity manager, security verify governance +1 moreIBM Security Verify Governance Identity Manager information disclosure7.5 High
- stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wpUsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- fastlinemedia beaver builder, beaverbuilder beaver builder page builder – drag and drop website builder +1 moreBeaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting6.1 Medium
- videowhisper video share vod – turnkey video site builder scriptVideo Share VOD – Turnkey Video Site Builder Script <= 2.7.6 - Cross-Site Request Forgery to Command Injection8.8 High
- pronamic google mapsPronamic Google Maps <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
- storaged-project udisks, red hat enterprise linux 10, enterprise linux 6 +14 more +16 moreUdisks: out-of-bounds read in udisks daemon8.5 High
- tenda ac10 firmwareAn input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10...5.3 Medium
- tenda ac10 firmwareIncorrect access control in the endpoint /goform/ate of Tenda AC10 v4.0 firmware v16.03.10...5.3 Medium
- tenda ac10 firmwareTenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via...5.3 Medium
- tenda ac10 firmwareTenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via...5.3 Medium
- tenda ac10 firmwareTenda AC10 v4.0 firmware v16.03.10.20 was discovered to contain a stack overflow via the function...7.5 High
- formcmsFormCms avatar upload feature has a stored cross-site scripting (XSS) vulnerability6.1 Medium
- dlink dir-868l firmwareD-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command...9.8 Critical
- tenda ac8 firmwareAn issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0...5.3 Medium
- puneethreddyhc online shopping system advancedA SQL Injection vulnerability exists in the login.php of PuneethReddyHC Online Shopping System...6.5 Medium
- puneethreddyhc online shopping system advancedA reflected Cross-Site Scripting (XSS) vulnerability exists in register.php of PuneethReddyHC...5.4 Medium
- puneethreddyhc online shopping system advancedA SQL Injection vulnerability exists in the product.php page of PuneethReddyHC Online Shopping...6.5 Medium
- puneethreddyhc online shopping system advancedA SQL Injection vulnerability exists in the action.php file of PuneethReddyHC Online Shopping...6.5 Medium
- oranbyte school management systemA Reflected Cross-site Scripting (XSS) vulnerability exists in the themeSet.php file of...6.1 Medium
- meitrack t366l-g firmwareMeitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is...2.4 Low
- spimsimulator spimspimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and...6.5 Medium
- Show moreLoading…