CVEs published July 2, 2025
84 CVEs were published on July 2, 2025: 13 critical, 25 high.
- Published
- 84
- Critical
- 13
- High
- 25
- Medium
- 37
- Low
- 7
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- Nokia Single RAN
- 7
- Infinera G42
- 6
- scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertisi…
- 6
- GFI Software Kerio Control
- 3
- Linux
- 3
- Delinea Secret Server
- 2
- Laundry
- 2
- modelcontextprotocol servers · @modelcontextprotocol/server…
- 2
- NSClient++
- 2
- QUALITIA CO. Active! mail
- 2
Critical 13
- CVE-2025-34074Lucee Admin Interface Authenticated Remote Code Execution via Scheduled Job File WriteLucee Association Switzerland Lucee
- CVE-2025-20309Cisco Unified Communications Manager Static SSH Credentials VulnerabilityCisco Unified Communications Manager
- CVE-2025-34073stamparm/maltrail <=0.54 Remote Command ExecutionStamparm Maltrail
- CVE-2025-34072Anthropic Slack MCP Server Data Exfiltration via Link UnfurlingAnthropic Slack MCP Server
- CVE-2025-34071GFI Kerio Control Unsigned System Image Upload Root Code ExecutionGFI Software Kerio Control
- CVE-2025-34070GFI Kerio Control GFIAgent Missing Authentication on Administrative InterfacesGFI Software Kerio Control
- CVE-2025-34069GFI Kerio Control GFIAgent Authentication Bypass via Proxy ForwardingGFI Software Kerio Control
- CVE-2025-34067Hikvision Integrated Security Management Platform Remote Command Execution via applyCT FastjsonHikvision Integrated Security Management Platform
- CVE-2024-13786Education Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object InjectionThemeREX Education Center | LMS & Online Courses WordPress…
- CVE-2025-5746Drag and Drop Multiple File Upload (Pro) - WooCommerce <= 1.7.1 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File UploadCodeDropz Drag and Drop Multiple File Upload (Pro) - WooCom…
- CVE-2025-4689Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion to Remote Code Executionscripteo Ads Pro Plugin - Multi-Purpose WordPress Advertisi…
- CVE-2025-45813ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials.
- CVE-2025-45814Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attac
High 25
- CVE-2025-34079NSClient++ Authenticated Remote Code Execution via ExternalScripts APINSClient++
- CVE-2025-34078NSClient++ 0.5.2.35 Local Privilege Escalation via ExternalScripts and Web InterfaceNSClient++
- CVE-2025-49713Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2025-52841Laundry 2.3.0 - Account Takeover via CSRFLaundry
- CVE-2025-38092ksmbd: use list_first_entry_or_null for opinfo_get_list()Linux
- CVE-2025-53109Model Context Protocol Servers Vulnerable to Path Validation Bypass via Prefix Matching and Symlink Handlingmodelcontextprotocol servers · @modelcontextprotocol/server…
- CVE-2025-53110Model Context Protocol Servers Vulnerable to Path Validation Bypass via Colliding Path Prefixmodelcontextprotocol servers · @modelcontextprotocol/server…
- CVE-2025-53006Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerabilitydataease
- CVE-2025-49588Linkwarden Local File Inclusion Vulnerabilitylinkwarden
- CVE-2025-34057Ruijie NBR Router Administrative Credential DisclosureRuijie NBR Router
- CVE-2025-53106Graylog vulnerable to privilege escalation through API tokensgraylog2-server · org.graylog2:graylog2-server
- CVE-2025-27025Improper File Access in Infinera G42Infinera G42
- CVE-2025-4946Vikinger <= 1.9.32 - Authenticated (Subscriber+) Arbitrary File Deletion via vikinger_delete_activity_media_ajax FunctionOdin_Design Vikinger
- CVE-2025-27022Path Traversal Vulnerability in Infinera G42Infinera G42
- CVE-2025-27021Operating System Misconfiguration in Infinera G42Infinera G42
- CVE-2025-24332Authenticated admin user can connect baseband internally from one board to another without needing to re-authenticationNokia Single RAN AirScale
- CVE-2025-6464Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletionwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2025-6463Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletionwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2025-5339Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Time-Based SQL Injection via ‘bsa_pro_id'scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertisi…
- CVE-2025-5014Home Villas | Real Estate WordPress Theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File DeletionChimp Group Home Villas | Real Estate WordPress Theme
- CVE-2025-6437Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injection via oidscripteo Ads Pro Plugin - Multi-Purpose WordPress Advertisi…
- CVE-2025-5817Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgerysuhailahmad64 Amazon Products to WooCommerce
- CVE-2025-4380Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusionscripteo Ads Pro Plugin - Multi-Purpose WordPress Advertisi…
- CVE-2025-6459Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplatescripteo Ads Pro Plugin - Multi-Purpose WordPress Advertisi…
- CVE-2025-4381Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injectionscripteo Ads Pro Plugin - Multi-Purpose WordPress Advertisi…
Medium, low and unrated 46
- CVE-2025-52842Laundry 2.3.0 - Account Takeover via Reflected XSSLaundry
- CVE-2025-43025HP Universal Print Driver – Potential Denial of ServiceHP Universal Print Driver
- CVE-2025-52559Zulip XSS in digest preview URLzulip
- CVE-2025-34076Microweber CMS Authenticated Local File Inclusion via Backup APIMicroweber CMS · microweber/microweber
- CVE-2025-20307Cisco BroadWorks Application Delivery Platform Cross-Site Scripting VulnerabilityCisco BroadWorks
- CVE-2025-20310Cisco Enterprise Chat and Email Stored Cross-Site Scripting VulnerabilityCisco Enterprise Chat and Email
- CVE-2025-20308Cisco Spaces Connector Privilege Escalation VulnerabilityCisco DNA Spaces Connector
- CVE-2025-53359ethereum does not check transaction malleability for EIP-2930, EIP-1559 and EIP-7702 transactionsrust-ethereum ethereum · ethereum
- CVE-2025-6942The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an initial authorDelinea Secret Server
- CVE-2025-52886Poppler Use After Free Vulnerabilitypoppler
- CVE-2025-6943Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to rDelinea Secret Server
- CVE-2025-53358kotaemon Vulnerable to Path Traversal via Link UploadCinnamon kotaemon
- CVE-2025-52891ModSecurity empty XML tag causes segmentation faultowasp-modsecurity ModSecurity
- CVE-2025-53108HomeBox Missing User Authorizationsysadminsmedia homebox
- CVE-2025-38093arm64: dts: qcom: x1e80100: Add GPU coolingLinux
- CVE-2025-38091drm/amd/display: check stream id dml21 wrapper to get plane_idLinux
- CVE-2025-53492Stored XSS in MintyDocsWikimedia Foundation Mediawiki - MintyDocs Extension
- CVE-2025-6725Cross-Site Scripting (XSS) in PdfViewerProgress Software Kendo UI for jQuery · Progress Softwar… +4
- CVE-2025-53493Stored XSS in MintyDocsWikimedia Foundation Mediawiki - MintyDocs Extension
- CVE-2025-53494Stored XSS in TwoColConflictWikimedia Foundation Mediawiki - TwoColConflict Extension
- CVE-2025-27026Improper Access Control Granularity impacting Infinera G42Infinera G42
- CVE-2024-35164Apache Guacamole: Improper input validation of console codesApache Software Foundation Apache Guacamole
- CVE-2025-46647Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connectApache Software Foundation Apache APISIX
- CVE-2025-39362WordPress Mollie Payments for WooCommerce plugin <= 8.0.2 - Insecure Direct Object References (IDOR) vulnerabilityMollie Payments for WooCommerce
- CVE-2025-27024Improper File Access in Infinera G42Infinera G42
- CVE-2025-2330All-in-One Addons for Elementor – WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via button+modal Widgetshamsbd71 All-in-One Addons for Elementor – WidgetKit
- CVE-2025-27023Improper Input Validation in Infinera G42Infinera G42
- CVE-2025-24335SOAP message input validation fault could in theory cause OAM service resource exhaustionNokia Single RAN
- CVE-2025-24334The Nokia Single RAN baseband reveals its software version through the MNO internal RAN management networkNokia Single RAN
- CVE-2025-24333Administrative user shell input validation faultNokia Single RAN
- CVE-2025-24331Nokia Single RAN baseband OAM service extensive capabilitiesNokia Single RAN
- CVE-2025-24330OAM service path traversal issue caused by a crafted SOAP message PlanId field within the RAN management networkNokia Single RAN
- CVE-2025-24329OAM service path traversal issue caused by a crafted SOAP message archive field within the RAN management networkNokia Single RAN
- CVE-2025-24328OAM service stack overflow caused by crafted SOAP message within the MNO internal RAN management networkNokia Single RAN
- CVE-2025-6017Rhacm: users with clusterreader role can see credentials from managed-clustersocm · Red Hat Advanced Cluster Management for Kubernetes… +1
- CVE-2024-13451Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposurebitpressadmin Bit Form – Custom Contact Form, Multi Step, C…
- CVE-2025-52463Cross-site request forgery vulnerability exists in Active! mail 6 BuildInfo: 6.60.06008562 and earlier.QUALITIA CO. Active! mail
- CVE-2025-52462Cross-site scripting vulnerability exists in Active! mail 6 BuildInfo: 6.30.01004145 to 6.60.06008562.QUALITIA CO. Active! mail
- CVE-2024-11405WP Front-end login and register <= 2.1.0 - Reflected Cross-Site Scriptinghellomohsinkhan WP Front-end login and register
- CVE-2025-4654Soumettre.fr <= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/DeletionSoumettre.fr
- CVE-2025-6686Magic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcoderexdot Magic Buttons for Elementor
- CVE-2025-6687Magic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcoderexdot Magic Buttons for Elementor
- CVE-2025-5692Lead Form Data Collection to CRM <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Many Actionssmackcoders Lead Form Data Collection to CRM
- CVE-2025-45029WINSTAR WN572HP3 v230525 was discovered to contain a heap overflow via the CONTENT_LENGTH variable at /cgi-bin/upload.cgi.
- CVE-2025-45424Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication.
- CVE-2025-52925In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812.OneLogin Active Directory Connector