# CVEs published 2025-07-05

8 CVEs were published on July 5, 2025: 0 critical, 2 high. Days are UTC.

- [CVE-2025-7075](https://cve.now/CVE-2025-7075.md): BlackVue Dashcam 590X HTTP Endpoint upload.cgi unrestricted upload (CVSS 5.3, BlackVue Dashcam)
- [CVE-2025-7074](https://cve.now/CVE-2025-7074.md): vercel hyper rimraf-standalone.js ignoreMap redos (CVSS 5.3, vercel hyper)
- [CVE-2023-50786](https://cve.now/CVE-2023-50786.md): Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images. (CVSS 4.1, dradisframework Dradis)
- [CVE-2025-47227](https://cve.now/CVE-2025-47227.md): In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandle (CVSS 7.5, ScriptCase)
- [CVE-2025-47228](https://cve.now/CVE-2025-47228.md): In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows a (CVSS 6.7, ScriptCase)
- [CVE-2025-53603](https://cve.now/CVE-2025-53603.md): In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request (CVSS 7.5, Alinto SOPE)
- [CVE-2025-53604](https://cve.now/CVE-2025-53604.md): The web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a C (CVSS 4.0, pimeys web-push · web-push)
- [CVE-2025-53605](https://cve.now/CVE-2025-53605.md): The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded\_input\_stream::CodedInputStream::skip\_group par (CVSS 5.9, stepancheg protobuf · protobuf)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.