CVEs published July 1, 2025
89 CVEs were published on July 1, 2025: 16 critical, 22 high.
- Published
- 89
- Critical
- 16
- High
- 22
- Medium
- 51
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 42
Most affected products
- ASR Falcon_Linux、Kestrel、Lapwing_Linux
- 10
- Campcodes Employee Management System
- 10
- AVTECH IP camera, DVR, and NVR Devices
- 4
- code-projects Simple Pizza Ordering System
- 3
- Hewlett Packard Enterprise Insight Remote Support
- 3
- One Identity OneLogin Active Directory Connector
- 3
- AVTECH IP cameras · AVTECH DVR devices +1
- 2
- bitcoinjs tiny-secp256k1 · tiny-secp256k1
- 2
- Contec Co. CONPROSYS HMI System
- 2
- electron
- 2
Critical 16
- CVE-2025-53104gluestack-ui Command Injection Vulnerability via discussion-to-slack GitHub Action Workflowgluestack-ui
- CVE-2025-37099A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.Hewlett Packard Enterprise Insight Remote Support
- CVE-2025-34064OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data LeakageOne Identity OneLogin Active Directory Connector
- CVE-2025-34063OneLogin AD Connector JWT Authentication Bypass via Exposed Signing KeyOne Identity OneLogin Active Directory Connector
- CVE-2025-34060Monero Forum Remote Code Execution via Arbitrary File Read and Cookie ForgeryMonero Project Forum
- CVE-2025-34056AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command ExecutionAVTECH IP camera, DVR, and NVR Devices
- CVE-2025-34055AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command ExecutionAVTECH IP camera, DVR, and NVR Devices
- CVE-2025-34054AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command InjectionAVTECH IP camera, DVR, and NVR Devices
- CVE-2025-49029WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerabilitybitto.kazi Custom Login And Signup Widget
- CVE-2025-41648Pilz: Authentication Bypass in IndustrialPI WebstatusPilz IndustrialPI 4 with IndustrialPI webstatus
- CVE-2025-41656Pilz: Missing Authentication in Node-RED integrationPilz IndustrialPI 4 with Firmware Bullseye
- CVE-2025-6934Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'wpopal Opal Estate Pro – Property Management and Submission
- CVE-2025-53095Sunshine application-wide CSRF in the UI leads to command injection as AdministratorLizardByte Sunshine
- CVE-2025-45006Improper mstatus.SUM bit retention (non-zero) in Open-Source RISC-V Processor commit f517abb violates privileged spec constraints, enabling
- CVE-2025-45872zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter.
- CVE-2025-52101linjiashop <=0.9 is vulnerable to Incorrect Access Control.
High 22
- CVE-2025-36630Local Privilege EscalationTenable Nessus
- CVE-2025-49741Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2025-48379Pillow Vulnerable to Write Buffer Overflow on BCn encodingpython-pillow Pillow · pillow
- CVE-2025-53107@cyanheads/git-mcp-server vulnerable to command injection in several toolscyanheads git-mcp-server · @cyanheads/git-mcp-server
- CVE-2025-53100RestDB's Codehooks.io MCP Server Vulnerable to Command InjectionRestDB codehooks-mcp-server
- CVE-2025-6297dpkg-deb: Fix cleanup for control member with restricted directoriesDebian dpkg
- CVE-2025-34059Dahua Smart Cloud Gateway Registration Management Platform SQL InjectionZhejiang Dahua Technology Co. Smart Cloud Gateway Registrat…
- CVE-2025-34058Hikvision Streaming Media Management Server Default Credentials and Authenticated Arbitrary File ReadHangzhou Hikvision System Technology Streaming Media Manage…
- CVE-2025-34066AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information DisclosureAVTECH IP cameras · AVTECH DVR devices +1
- CVE-2025-37098A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.Hewlett Packard Enterprise Insight Remote Support
- CVE-2025-37097A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of serviceHewlett Packard Enterprise Insight Remote Support
- CVE-2025-6953TOTOLINK A3002RU HTTP POST Request formParentControl buffer overflowTOTOLINK A3002RU
- CVE-2025-49480Out-of-bounds access in lte-telephonyASR Falcon_Linux、Kestrel、Lapwing_Linux
- CVE-2025-49492Out-of-bounds write in lte-telephonyASR Falcon_Linux、Kestrel、Lapwing_Linux
- CVE-2025-6940TOTOLINK A702R HTTP POST Request formParentControl buffer overflowTOTOLINK A702R
- CVE-2024-49364tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environmentbitcoinjs tiny-secp256k1 · tiny-secp256k1
- CVE-2024-49365tiny-secp256k1 allows for verify() bypass when running in bundled environmentbitcoinjs tiny-secp256k1 · tiny-secp256k1
- CVE-2025-6939TOTOLINK A3002RU HTTP POST Request formWlSiteSurvey buffer overflowTOTOLINK A3002RU
- CVE-2024-46992Electron ASAR Integrity bypass by just modifying the contentelectron
- CVE-2025-53003Janssen Config API returns results without scope verificationJanssenProject jans · io.jans:jans-config-api-server
- CVE-2025-53005Dataease PostgreSQL Data Source JDBC Connection Parameters Bypass Vulnerabilitydataease
- CVE-2025-45081Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data.
Medium, low and unrated 51
- CVE-2025-46259WordPress The Plus Addons for Elementor - Pro Plugin < 6.3.7 - Broken Access Control vulnerabilityPOSIMYTH Innovation The Plus Addons for Elementor Pro
- CVE-2025-6600GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search APIGitHub Enterprise Server
- CVE-2025-27153Escalade GLPI Plugin Vulnerable to Improper Access ControlpluginsGLPI escalade
- CVE-2025-53103JUnit OpenTestReportGeneratingListener can leak Git credentialsjunit-team junit-framework · org.junit.platform:junit-platf…
- CVE-2025-34081CONPROSYS HMI System (CHS) < 3.7.7 Exposed PHP Debug InfoContec Co. CONPROSYS HMI System
- CVE-2025-34080CONPROSYS HMI System (CHS) < 3.7.7 Reflected Cross-Site ScriptingContec Co. CONPROSYS HMI System
- CVE-2025-6963Campcodes Employee Management System myprofile.php sql injectionCampcodes Employee Management System
- CVE-2025-6962Campcodes Employee Management System myprofileup.php sql injectionCampcodes Employee Management System
- CVE-2025-6961Campcodes Employee Management System mark.php sql injectionCampcodes Employee Management System
- CVE-2025-6960Campcodes Employee Management System empproject.php sql injectionCampcodes Employee Management System
- CVE-2025-6959Campcodes Employee Management System eloginwel.php sql injectionCampcodes Employee Management System
- CVE-2025-53099Sentry Missing Invalidation of Authorization Codes During OAuth Exchange and Revocationgetsentry sentry
- CVE-2025-34062OneLogin AD Connector API Credential and Signing Key ExposureOne Identity OneLogin Active Directory Connector
- CVE-2025-34065AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via /nobody URL PathAVTECH IP camera, DVR, and NVR Devices
- CVE-2025-34053AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via .cab Path ManipulationAVTECH IP camera, DVR, and NVR devices
- CVE-2025-34051AVTECH DVR Devices Server-Side Request ForgeryAVTECH DVR devices
- CVE-2025-34050AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request ForgeryAVTECH IP cameras · AVTECH DVR devices +1
- CVE-2025-6958Campcodes Employee Management System edit.php sql injectionCampcodes Employee Management System
- CVE-2025-6957Campcodes Employee Management System eprocess.php sql injectionCampcodes Employee Management System
- CVE-2025-6956Campcodes Employee Management System changepassemp.php sql injectionCampcodes Employee Management System
- CVE-2025-6955Campcodes Employee Management System aprocess.php sql injectionCampcodes Employee Management System
- CVE-2025-6954Campcodes Employee Management System applyleave.php sql injectionCampcodes Employee Management System
- CVE-2025-6920Ai-inference-server: authentication bypass via unprotected inference endpoint in apiRed Hat AI Inference Server
- CVE-2025-36582Dell NetWorker, versions 19.12.0.1 and prior, contains a Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') vulneDell NetWorker
- CVE-2025-6952Open5GS AMF Service amf-sm.c amf_state_operational assertionOpen5GS
- CVE-2025-6951SAFECAM X300 FTP Service default credentialsSAFECAM X300
- CVE-2025-49483Resource leaks in tr069ASR Falcon_Linux、Kestrel、Lapwing_Linux
- CVE-2025-49482Resource leaks in tr069ASR Falcon_Linux、Kestrel、Lapwing_Linux
- CVE-2025-5314Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.65 - DOM-Based Reflected Cross-Site Scripting via 'pdf-source'dearhive Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF emb…
- CVE-2025-49481Resource leaks in routerASR Falcon_Linux、Kestrel、Lapwing_Linux
- CVE-2025-49488Resource leaks in routerASR Falcon_Linux、Kestrel、Lapwing_Linux
- CVE-2025-6224Key leakage in juju/utils certificatesCanonical Juju utils · github.com/juju/utils/v4/cert +4
- CVE-2025-49491Resource leaks in traffic_statASR Falcon_Linux、Kestrel、Lapwing_Linux
- CVE-2025-49490Resource leaks in routerASR Falcon_Linux、Kestrel、Lapwing_Linux
- CVE-2025-49489Resource leaks in cmASR Falcon_Linux、Kestrel、Lapwing_Linux
- CVE-2025-6756Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcodethemefic Ultra Addons for Contact Form
- CVE-2025-5072Resource leaks in cmASR Falcon_Linux、Kestrel、Lapwing_Linux
- CVE-2025-6081Pass-back attack in Konica Minolta bizhub 227 multifunctional printersKonica Minolta bizhub 227 Multifunction printers
- CVE-2025-5967A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan NTrellix Endpoint Security HX
- CVE-2024-46993Electron Vulnerable to Heap Buffer Overflow in NativeImage::CreateFromPathelectron
- CVE-2025-53096Sunshine clickjacking in the UI leads to unauthorized actions being performedLizardByte Sunshine
- CVE-2025-6938code-projects Simple Pizza Ordering System editcus.php sql injectioncode-projects Simple Pizza Ordering System
- CVE-2025-2141IBM System Storage Virtualization Engine TS7700 cross-site scriptingIBM System Storage Virtualization Engine TS7700
- CVE-2025-36056IBM System Storage Virtualization Engine TS7700 cross-site scriptingIBM System Storage Virtualization Engine TS7700
- CVE-2025-6937code-projects Simple Pizza Ordering System large.php sql injectioncode-projects Simple Pizza Ordering System
- CVE-2025-6936code-projects Simple Pizza Ordering System addpro.php sql injectioncode-projects Simple Pizza Ordering System
- CVE-2025-45083Incorrect access control in Ullu (Android version v2.9.929 and IOS version v2.8.0) allows attackers to bypass parental pin feature via unspe
- CVE-2025-50404Intelbras RX1500 Router v2.2.17 and before is vulnerable to Integer Overflow.
- CVE-2025-50405Intelbras RX1500 Router v2.2.17 and before is vulnerable to Incorrect Access Control in the FirmwareUpload function and GetFirmwareValidatio
- CVE-2025-50641Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the addWifiMacFilter function via the parameter deviceId.
- CVE-2025-52294Insufficient validation of the screen lock mechanism in Trust Wallet v8.45 allows physically proximate attackers to bypass the lock screen a