# CVEs published 2025-07-03

147 CVEs were published on July 3, 2025: 9 critical, 55 high. Days are UTC.

- [CVE-2025-5322](https://cve.now/CVE-2025-5322.md): VikRentCar Car Rental Management System \<= 1.4.3 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2, e4jvikwp VikRentCar Car Rental Management System)
- [CVE-2025-53367](https://cve.now/CVE-2025-53367.md): DjVuLibre OOB-Write Vulnerability in MMRDecoder (CVSS 8.4, DjvuNet DjVuLibre)
- [CVE-2025-49826](https://cve.now/CVE-2025-49826.md): Next.js DoS vulnerability via cache poisoning (CVSS 7.5, vercel next.js · next)
- [CVE-2025-49005](https://cve.now/CVE-2025-49005.md): Next.js cache poisoning due to omission of Vary header (CVSS 3.7, vercel next.js · next)
- [CVE-2025-52554](https://cve.now/CVE-2025-52554.md): n8n Improper Authorization in Workflow Execution Stop Endpoint Allows Terminating Other Users’ Workflows (CVSS 4.9, n8n-io n8n · n8n)
- [CVE-2025-53369](https://cve.now/CVE-2025-53369.md): Citizen Short Description stored XSS vulnerability through wikitext (CVSS 8.6, StarCitizenTools mediawiki-extensions-ShortDescription · st…)
- [CVE-2025-34089](https://cve.now/CVE-2025-34089.md): Remote for Mac Unauthenticated Remote Code Execution via AppleScript Injection (CVSS 9.3, Aexol Studio Remote for Mac)
- [CVE-2025-34087](https://cve.now/CVE-2025-34087.md): Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution (CVSS 9.0, Pi-hole Web)
- [CVE-2025-34088](https://cve.now/CVE-2025-34088.md): Pandora FMS Authenticated Remote Code Execution via Ping Module (CVSS 8.6, Artica ST Pandora FMS)
- [CVE-2025-34082](https://cve.now/CVE-2025-34082.md): IGEL OS Secure Terminal and Secure Shadow Remote Code Execution (CVSS 9.3, IGEL Technology OS)
- [CVE-2025-34086](https://cve.now/CVE-2025-34086.md): Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename (CVSS 7.5, Bolt CMS · bolt/bolt)
- [CVE-2025-34061](https://cve.now/CVE-2025-34061.md): PHPStudy 2016-2018 Backdoor Remote Code Execution Vulnerability (CVSS 9.3, Henan Xiaopi Security Technology Co. PHPStudy)
- [CVE-2025-53370](https://cve.now/CVE-2025-53370.md): Citizen stored XSS vulnerability through short descriptions (CVSS 8.6, StarCitizenTools mediawiki-skins-Citizen · starcitizentools…)
- [CVE-2025-53368](https://cve.now/CVE-2025-53368.md): Citizen is vulnerable to stored XSS attack in the legacy search bar (CVSS 8.6, StarCitizenTools mediawiki-skins-Citizen · starcitizentools…)
- [CVE-2025-23968](https://cve.now/CVE-2025-23968.md): WordPress AiBud WP plugin \<= 1.9 - Arbitrary File Upload vulnerability (CVSS 9.1, WebFactory AiBud WP)
- [CVE-2025-6071](https://cve.now/CVE-2025-6071.md): Hard Coded Key used for AES encryption (CVSS 6.3, ABB RMC-100)
- [CVE-2025-6072](https://cve.now/CVE-2025-6072.md): Stack Buffer Overflow in MQTTCore (CVSS 8.2, ABB RMC-100)
- [CVE-2025-6073](https://cve.now/CVE-2025-6073.md): Stack Buffer Overflow in MQTTCore (CVSS 8.2, ABB RMC-100)
- [CVE-2025-6074](https://cve.now/CVE-2025-6074.md): Authentication Bypass to the MQTT configuration Web Interface (CVSS 6.3, ABB RMC-100)
- [CVE-2025-49846](https://cve.now/CVE-2025-49846.md): wire-ios accidentally logs message contents (CVSS 4.1, wireapp wire-ios)
- [CVE-2025-48939](https://cve.now/CVE-2025-48939.md): tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript (CVSS 4.2, AmauriC tarteaucitron.js · tarteaucitronjs)
- [CVE-2025-6926](https://cve.now/CVE-2025-6926.md): Security Authentication Bypass in CentralAuth (CVSS 8.8, Wikimedia Foundation Mediawiki - CentralAuth Extension)
- [CVE-2025-53500](https://cve.now/CVE-2025-53500.md): Stored XSS in MassEditRegex (CVSS 5.6, Wikimedia Foundation Mediawiki - MassEditRegex Extension)
- [CVE-2025-53501](https://cve.now/CVE-2025-53501.md): Content Access Bypass in Scribunto (CVSS 8.8, Wikimedia Foundation Mediawiki - Scribunto Extension)
- [CVE-2025-53502](https://cve.now/CVE-2025-53502.md): HTML injection in FeaturedFeeds (CVSS 6.5, Wikimedia Foundation Mediawiki - FeaturedFeeds Extension)
- [CVE-2025-53489](https://cve.now/CVE-2025-53489.md): XSS in GoogleDocs4MW (CVSS 5.6, Wikimedia Foundation Mediawiki - GoogleDocs4MW Extension)
- [CVE-2025-53490](https://cve.now/CVE-2025-53490.md): Multiple XSS in CampaignEvents (CVSS 5.6, Wikimedia Foundation Mediawiki - CampaignEvents Extension)
- [CVE-2025-5961](https://cve.now/CVE-2025-5961.md): Migration, Backup, Staging – WPvivid Backup & Migration \<= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2, wpvividplugins WPvivid — Backup, Migration & Staging)
- [CVE-2025-2932](https://cve.now/CVE-2025-2932.md): JKDEVKIT \<= 1.9.4 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.8, jkdevstudio JKDEVKIT)
- [CVE-2025-2537](https://cve.now/CVE-2025-2537.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library (CVSS 6.4, YouTube Embed, Playlist and Popup by WpDevArt · denis-de… +1)
- [CVE-2025-49595](https://cve.now/CVE-2025-49595.md): n8n Vulnerable to Denial of Service via Malformed Binary Data Requests (CVSS 4.9, n8n-io n8n · n8n)
- [CVE-2025-3702](https://cve.now/CVE-2025-3702.md): WordPress Melapress File Monitor plugin \< 2.2.0 - Broken Access Control vulnerability (CVSS 5.4, Melapress File Monitor)
- [CVE-2025-49032](https://cve.now/CVE-2025-49032.md): WordPress Gutenberg Blocks plugin \<= 3.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PublishPress Gutenberg Blocks)
- [CVE-2025-40723](https://cve.now/CVE-2025-40723.md): Stored Cross-Site Scripting (XSS) vulnerability on Flatboard (CVSS 5.1, Flatboard Pro Flatboard)
- [CVE-2025-40722](https://cve.now/CVE-2025-40722.md): Stored Cross-Site Scripting (XSS) vulnerability on Flatboard (CVSS 5.1, Flatboard Pro Flatboard)
- [CVE-2025-27461](https://cve.now/CVE-2025-27461.md): CVE-2025-27461 (CVSS 7.6, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-27460](https://cve.now/CVE-2025-27460.md): CVE-2025-27460 (CVSS 7.6, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-27459](https://cve.now/CVE-2025-27459.md): CVE-2025-27459 (CVSS 4.4, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-27458](https://cve.now/CVE-2025-27458.md): CVE-2025-27458 (CVSS 6.5, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-27457](https://cve.now/CVE-2025-27457.md): CVE-2025-27457 (CVSS 6.5, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-27456](https://cve.now/CVE-2025-27456.md): CVE-2025-27456 (CVSS 7.5, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-27455](https://cve.now/CVE-2025-27455.md): CVE-2025-27455 (CVSS 4.3, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-27454](https://cve.now/CVE-2025-27454.md): CVE-2025-27454 (CVSS 4.3, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-27453](https://cve.now/CVE-2025-27453.md): CVE-2025-27453 (CVSS 5.3, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-27452](https://cve.now/CVE-2025-27452.md): CVE-2025-27452 (CVSS 5.3, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-27451](https://cve.now/CVE-2025-27451.md): CVE-2025-27451 (CVSS 5.3, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-27450](https://cve.now/CVE-2025-27450.md): CVE-2025-27450 (CVSS 6.5, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-27449](https://cve.now/CVE-2025-27449.md): CVE-2025-27449 (CVSS 7.5, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-27448](https://cve.now/CVE-2025-27448.md): CVE-2025-27448 (CVSS 6.8, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-27447](https://cve.now/CVE-2025-27447.md): CVE-2025-27447 (CVSS 7.4, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-1711](https://cve.now/CVE-2025-1711.md): CVE-2025-1711 (CVSS 4.3, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-1710](https://cve.now/CVE-2025-1710.md): CVE-2025-1710 (CVSS 7.5, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-1709](https://cve.now/CVE-2025-1709.md): CVE-2025-1709 (CVSS 6.5, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-2540](https://cve.now/CVE-2025-2540.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library (CVSS 6.4, nayon46 Awesome Wp Image Gallery · raihancse Awesome Gal… +3)
- [CVE-2025-6563](https://cve.now/CVE-2025-6563.md): Cross-site scripting via dst parameter in RouterOS WiFi hotspot (CVSS 4.8, MikroTik RouterOS)
- [CVE-2025-1708](https://cve.now/CVE-2025-1708.md): CVE-2025-1708 (CVSS 8.6, Endress+Hauser MEAC300-FNADE4)
- [CVE-2025-6587](https://cve.now/CVE-2025-6587.md): Exposure of system environment variables in Docker Desktop diagnostic logs (CVSS 5.2, Docker Desktop)
- [CVE-2025-0885](https://cve.now/CVE-2025-0885.md): Incorrect Authorization vulnerability affects OpenText™ GroupWise (CVSS 1.8, OpenText™ GroupWise)
- [CVE-2024-5647](https://cve.now/CVE-2024-5647.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library (CVSS 6.4, BlossomThemes Social Feed · sayful Carousel Slider +12)
- [CVE-2025-38173](https://cve.now/CVE-2025-38173.md): crypto: marvell/cesa - Handle zero-length skcipher requests (CVSS 7.8, Linux)
- [CVE-2025-38172](https://cve.now/CVE-2025-38172.md): erofs: avoid using multiple devices with different type (CVSS 7.8, Linux)
- [CVE-2025-38171](https://cve.now/CVE-2025-38171.md): power: supply: max77705: Fix workqueue error handling in probe (no CVSS, Linux)
- [CVE-2025-38170](https://cve.now/CVE-2025-38170.md): arm64/fpsimd: Discard stale CPU state when handling SME traps (no CVSS, Linux)
- [CVE-2025-38169](https://cve.now/CVE-2025-38169.md): arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP (CVSS 7.8, Linux)
- [CVE-2025-38168](https://cve.now/CVE-2025-38168.md): perf: arm-ni: Unregister PMUs on probe failure (CVSS 7.8, Linux)
- [CVE-2025-38167](https://cve.now/CVE-2025-38167.md): fs/ntfs3: handle hdr\_first\_de() return value (no CVSS, Linux)
- [CVE-2025-38166](https://cve.now/CVE-2025-38166.md): bpf: fix ktls panic with sockmap (CVSS 7.8, Linux)
- [CVE-2025-38165](https://cve.now/CVE-2025-38165.md): bpf, sockmap: Fix panic when calling skb\_linearize (CVSS 7.5, Linux)
- [CVE-2025-38164](https://cve.now/CVE-2025-38164.md): f2fs: zone: fix to avoid inconsistence in between SIT and SSA (CVSS 7.1, Linux)
- [CVE-2025-38163](https://cve.now/CVE-2025-38163.md): f2fs: fix to do sanity check on sbi-\>total\_valid\_block\_count (no CVSS, Linux)
- [CVE-2025-38162](https://cve.now/CVE-2025-38162.md): netfilter: nft\_set\_pipapo: prevent overflow in lookup table allocation (CVSS 7.8, Linux)
- [CVE-2025-38161](https://cve.now/CVE-2025-38161.md): RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (CVSS 7.8, Linux)
- [CVE-2025-38160](https://cve.now/CVE-2025-38160.md): clk: bcm: rpi: Add NULL check in raspberrypi\_clk\_register() (no CVSS, Linux)
- [CVE-2025-38159](https://cve.now/CVE-2025-38159.md): wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (no CVSS, Linux)
- [CVE-2025-38158](https://cve.now/CVE-2025-38158.md): hisi\_acc\_vfio\_pci: fix XQE dma address error (no CVSS, Linux)
- [CVE-2025-38157](https://cve.now/CVE-2025-38157.md): wifi: ath9k\_htc: Abort software beacon handling if disabled (no CVSS, Linux)
- [CVE-2025-38156](https://cve.now/CVE-2025-38156.md): wifi: mt76: mt7996: Fix null-ptr-deref in mt7996\_mmio\_wed\_init() (no CVSS, Linux)
- [CVE-2025-38155](https://cve.now/CVE-2025-38155.md): wifi: mt76: mt7915: Fix null-ptr-deref in mt7915\_mmio\_wed\_init() (no CVSS, Linux)
- [CVE-2025-38154](https://cve.now/CVE-2025-38154.md): bpf, sockmap: Avoid using sk\_socket after free when sending (CVSS 7.8, Linux)
- [CVE-2025-38153](https://cve.now/CVE-2025-38153.md): net: usb: aqc111: fix error handling of usbnet read calls (no CVSS, Linux)
- [CVE-2025-38151](https://cve.now/CVE-2025-38151.md): RDMA/cma: Fix hang when cma\_netevent\_callback fails to queue\_work (no CVSS, Linux)
- [CVE-2025-38150](https://cve.now/CVE-2025-38150.md): af\_packet: move notifier's packet\_dev\_mc out of rcu critical section (CVSS 7.8, Linux)
- [CVE-2025-38149](https://cve.now/CVE-2025-38149.md): net: phy: clear phydev-\>devlink when the link is deleted (no CVSS, Linux)
- [CVE-2025-38148](https://cve.now/CVE-2025-38148.md): net: phy: mscc: Fix memory leak when using one step timestamping (no CVSS, Linux)
- [CVE-2025-38147](https://cve.now/CVE-2025-38147.md): calipso: Don't call calipso functions for AF\_INET sk. (no CVSS, Linux)
- [CVE-2025-38146](https://cve.now/CVE-2025-38146.md): net: openvswitch: Fix the dead loop of MPLS parse (CVSS 9.4, Linux)
- [CVE-2025-38145](https://cve.now/CVE-2025-38145.md): soc: aspeed: Add NULL check in aspeed\_lpc\_enable\_snoop() (no CVSS, Linux)
- [CVE-2025-38144](https://cve.now/CVE-2025-38144.md): watchdog: lenovo\_se30\_wdt: Fix possible devm\_ioremap() NULL pointer dereference in lenovo\_se30\_wdt\_probe() (no CVSS, Linux)
- [CVE-2025-38143](https://cve.now/CVE-2025-38143.md): backlight: pm8941: Add NULL check in wled\_configure() (no CVSS, Linux)
- [CVE-2025-38142](https://cve.now/CVE-2025-38142.md): hwmon: (asus-ec-sensors) check sensor index in read\_string() (no CVSS, Linux)
- [CVE-2025-38141](https://cve.now/CVE-2025-38141.md): dm: fix dm\_blk\_report\_zones (CVSS 7.8, Linux)
- [CVE-2025-38140](https://cve.now/CVE-2025-38140.md): dm: limit swapping tables for devices with zone write plugs (no CVSS, Linux)
- [CVE-2025-38139](https://cve.now/CVE-2025-38139.md): netfs: Fix oops in write-retry from mis-resetting the subreq iterator (CVSS 9.8, Linux)
- [CVE-2025-38138](https://cve.now/CVE-2025-38138.md): dmaengine: ti: Add NULL check in udma\_probe() (no CVSS, Linux)
- [CVE-2025-38137](https://cve.now/CVE-2025-38137.md): PCI/pwrctrl: Cancel outstanding rescan work when unregistering (no CVSS, Linux)
- [CVE-2025-38136](https://cve.now/CVE-2025-38136.md): usb: renesas\_usbhs: Reorder clock handling and power management in probe (no CVSS, Linux)
- [CVE-2025-38135](https://cve.now/CVE-2025-38135.md): serial: Fix potential null-ptr-deref in mlb\_usio\_probe() (no CVSS, Linux)
- [CVE-2025-38134](https://cve.now/CVE-2025-38134.md): usb: acpi: Prevent null pointer dereference in usb\_acpi\_add\_usb4\_devlink() (no CVSS, Linux)
- [CVE-2025-38133](https://cve.now/CVE-2025-38133.md): iio: adc: ad4851: fix ad4858 chan pointer handling (CVSS 7.8, Linux)
- [CVE-2025-38132](https://cve.now/CVE-2025-38132.md): coresight: holding cscfg\_csdev\_lock while removing cscfg from csdev (no CVSS, Linux)
- [CVE-2025-38131](https://cve.now/CVE-2025-38131.md): coresight: prevent deactivate active config while enabling the config (no CVSS, Linux)
- [CVE-2025-38130](https://cve.now/CVE-2025-38130.md): drm/connector: only call HDMI audio helper plugged cb if non-null (no CVSS, Linux)
- [CVE-2025-38129](https://cve.now/CVE-2025-38129.md): page\_pool: Fix use-after-free in page\_pool\_recycle\_in\_ring (CVSS 7.8, Linux)
- [CVE-2025-38128](https://cve.now/CVE-2025-38128.md): Bluetooth: MGMT: reject malformed HCI\_CMD\_SYNC commands (no CVSS, Linux)
- [CVE-2025-38127](https://cve.now/CVE-2025-38127.md): ice: fix Tx scheduler error handling in XDP callback (CVSS 7.8, Linux)
- [CVE-2025-38126](https://cve.now/CVE-2025-38126.md): net: stmmac: make sure that ptp\_rate is not 0 before configuring timestamping (no CVSS, Linux)
- [CVE-2025-38125](https://cve.now/CVE-2025-38125.md): net: stmmac: make sure that ptp\_rate is not 0 before configuring EST (no CVSS, Linux)
- [CVE-2025-38124](https://cve.now/CVE-2025-38124.md): net: fix udp gso skb\_segment after pull from frag\_list (CVSS 7.5, Linux)
- [CVE-2025-38123](https://cve.now/CVE-2025-38123.md): net: wwan: t7xx: Fix napi rx poll issue (CVSS 9.8, Linux)
- [CVE-2025-38122](https://cve.now/CVE-2025-38122.md): gve: add missing NULL check for gve\_alloc\_pending\_packet() in TX DQO (no CVSS, Linux)
- [CVE-2025-38121](https://cve.now/CVE-2025-38121.md): wifi: iwlwifi: mld: avoid panic on init failure (no CVSS, Linux)
- [CVE-2025-38120](https://cve.now/CVE-2025-38120.md): netfilter: nf\_set\_pipapo\_avx2: fix initial map fill (CVSS 9.4, Linux)
- [CVE-2025-38119](https://cve.now/CVE-2025-38119.md): scsi: core: ufs: Fix a hang in the error handler (no CVSS, Linux)
- [CVE-2025-38118](https://cve.now/CVE-2025-38118.md): Bluetooth: MGMT: Fix UAF on mgmt\_remove\_adv\_monitor\_complete (CVSS 7.8, Linux)
- [CVE-2025-38117](https://cve.now/CVE-2025-38117.md): Bluetooth: MGMT: Protect mgmt\_pending list with its own lock (CVSS 7.8, Linux)
- [CVE-2025-38116](https://cve.now/CVE-2025-38116.md): wifi: ath12k: fix uaf in ath12k\_core\_init() (CVSS 7.8, Linux)
- [CVE-2025-38115](https://cve.now/CVE-2025-38115.md): net\_sched: sch\_sfq: fix a potential crash on gso\_skb handling (CVSS 7.8, Linux)
- [CVE-2025-38114](https://cve.now/CVE-2025-38114.md): e1000: Move cancel\_work\_sync to avoid deadlock (no CVSS, Linux)
- [CVE-2025-38113](https://cve.now/CVE-2025-38113.md): ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (no CVSS, Linux)
- [CVE-2025-38112](https://cve.now/CVE-2025-38112.md): net: Fix TOCTOU issue in sk\_is\_readable() (no CVSS, Linux)
- [CVE-2025-38111](https://cve.now/CVE-2025-38111.md): net/mdiobus: Fix potential out-of-bounds read/write access (CVSS 7.8, Linux)
- [CVE-2025-38110](https://cve.now/CVE-2025-38110.md): net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVSS 7.8, Linux)
- [CVE-2025-38109](https://cve.now/CVE-2025-38109.md): net/mlx5: Fix ECVF vports unload on shutdown flow (no CVSS, Linux)
- [CVE-2025-38108](https://cve.now/CVE-2025-38108.md): net\_sched: red: fix a race in \_\_red\_change() (CVSS 7.8, Linux)
- [CVE-2025-38107](https://cve.now/CVE-2025-38107.md): net\_sched: ets: fix a race in ets\_qdisc\_change() (CVSS 7.8, Linux)
- [CVE-2025-38106](https://cve.now/CVE-2025-38106.md): io\_uring: fix use-after-free of sq-\>thread in \_\_io\_uring\_show\_fdinfo() (CVSS 7.8, Linux)
- [CVE-2025-38105](https://cve.now/CVE-2025-38105.md): ALSA: usb-audio: Kill timer properly at removal (no CVSS, Linux)
- [CVE-2025-38103](https://cve.now/CVE-2025-38103.md): HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid\_parse() (no CVSS, Linux)
- [CVE-2025-38102](https://cve.now/CVE-2025-38102.md): VMCI: fix race between vmci\_host\_setup\_notify and vmci\_ctx\_unset\_notify (CVSS 7.8, Linux)
- [CVE-2025-38101](https://cve.now/CVE-2025-38101.md): ring-buffer: Fix buffer locking in ring\_buffer\_subbuf\_order\_set() (CVSS 7.8, Linux)
- [CVE-2025-38100](https://cve.now/CVE-2025-38100.md): x86/iopl: Cure TIF\_IO\_BITMAP inconsistencies (no CVSS, Linux)
- [CVE-2025-38099](https://cve.now/CVE-2025-38099.md): Bluetooth: Disable SCO support if READ\_VOICE\_SETTING is unsupported/broken (no CVSS, Linux)
- [CVE-2025-38098](https://cve.now/CVE-2025-38098.md): drm/amd/display: Don't treat wb connector as physical in create\_validate\_stream\_for\_sink (CVSS 7.8, Linux)
- [CVE-2025-38097](https://cve.now/CVE-2025-38097.md): espintcp: remove encap socket caching to avoid reference leak (CVSS 7.8, Linux)
- [CVE-2025-38096](https://cve.now/CVE-2025-38096.md): wifi: iwlwifi: don't warn when if there is a FW error (no CVSS, Linux)
- [CVE-2025-38095](https://cve.now/CVE-2025-38095.md): dma-buf: insert memory barrier before updating num\_fences (CVSS 7.8, Linux)
- [CVE-2025-38094](https://cve.now/CVE-2025-38094.md): net: cadence: macb: Fix a possible deadlock in macb\_halt\_tx. (no CVSS, Linux)
- [CVE-2024-9017](https://cve.now/CVE-2024-9017.md): PeepSo Core: Groups \<= 6.4.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Description (CVSS 6.4, PeepSo Core: Groups)
- [CVE-2025-5944](https://cve.now/CVE-2025-5944.md): Element Pack Addons for Elementor \<= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute (CVSS 6.4, bdthemes Element Pack Elementor Addons and Templates)
- [CVE-2025-43713](https://cve.now/CVE-2025-43713.md): ASNA Assist and ASNA Registrar before 2025-03-31 allow deserialization attacks against .NET remoting. (CVSS 6.5)
- [CVE-2025-45809](https://cve.now/CVE-2025-45809.md): SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/k (CVSS 5.4)
- [CVE-2025-45938](https://cve.now/CVE-2025-45938.md): Akeles Out of Office Assistant for Jira 4.0.1 is vulberable to Cross Site Scripting (XSS) via the Jira fullName parameter. (CVSS 5.4)
- [CVE-2025-49618](https://cve.now/CVE-2025-49618.md): In Plesk Obsidian 18.0.69, unauthenticated requests to /login\_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint. (CVSS 5.8, Plesk Obsidian)
- [CVE-2025-50258](https://cve.now/CVE-2025-50258.md): Tenda AC6 v15.03.05.16\_multi is vulnerable to Buffer Overflow in the SetSysTimeCfg function via the time parameter. (CVSS 8.1)
- [CVE-2025-50260](https://cve.now/CVE-2025-50260.md): Tenda AC6 v15.03.05.16\_multi is vulnerable to Buffer Overflow in the formSetFirewallCfg function via the firewallEn parameter. (CVSS 7.5)
- [CVE-2025-50262](https://cve.now/CVE-2025-50262.md): Tenda AC6 v15.03.05.16\_multi is vulnerable to Buffer Overflow in the formSetQosBand function via the list parameter. (CVSS 7.5)
- [CVE-2025-50263](https://cve.now/CVE-2025-50263.md): Tenda AC6 v15.03.05.16\_multi is vulnerable to Buffer Overflow in the fromSetRouteStatic function via the list parameter. (CVSS 8.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.