# CVEs published 2025-07-06

28 CVEs were published on July 6, 2025: 3 critical, 13 high. Days are UTC.

- [CVE-2025-7099](https://cve.now/CVE-2025-7099.md): BoyunCMS Installation install2.php deserialization (CVSS 6.3, BoyunCMS)
- [CVE-2025-7098](https://cve.now/CVE-2025-7098.md): Comodo Internet Security Premium File Name path traversal (CVSS 6.3, Comodo Internet Security Premium)
- [CVE-2025-3108](https://cve.now/CVE-2025-3108.md): Unsafe Deserialization in JsonPickleSerializer Enables Remote Code Execution in run-llama/llama\_index (CVSS 5.0, run-llama/llama\_index · llama-index +1)
- [CVE-2025-7097](https://cve.now/CVE-2025-7097.md): Comodo Internet Security Premium Manifest File cis\_update\_x64.xml os command injection (CVSS 9.2, Comodo Internet Security Premium)
- [CVE-2025-7096](https://cve.now/CVE-2025-7096.md): Comodo Internet Security Premium Manifest File cis\_update\_x64.xml integrity check (CVSS 9.2, Comodo Internet Security Premium)
- [CVE-2025-7095](https://cve.now/CVE-2025-7095.md): Comodo Internet Security Premium Update certificate validation (CVSS 6.3, Comodo Internet Security Premium)
- [CVE-2025-7094](https://cve.now/CVE-2025-7094.md): Belkin F9K1122 webs formBSSetSitesurvey stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2025-7093](https://cve.now/CVE-2025-7093.md): Belkin F9K1122 webs formSetLanguage stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2025-7092](https://cve.now/CVE-2025-7092.md): Belkin F9K1122 webs formWlanSetupWPS stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2025-7091](https://cve.now/CVE-2025-7091.md): Belkin F9K1122 webs formWlanMP stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2025-7090](https://cve.now/CVE-2025-7090.md): Belkin F9K1122 webs formConnectionSetting stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2025-7089](https://cve.now/CVE-2025-7089.md): Belkin F9K1122 webs formWanTcpipSetup stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2025-7088](https://cve.now/CVE-2025-7088.md): Belkin F9K1122 webs formPPPoESetup stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2025-7087](https://cve.now/CVE-2025-7087.md): Belkin F9K1122 webs formL2TPSetup stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2025-7086](https://cve.now/CVE-2025-7086.md): Belkin F9K1122 webs formPPTPSetup stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2025-7085](https://cve.now/CVE-2025-7085.md): Belkin F9K1122 webs formiNICWpsStart stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2025-7084](https://cve.now/CVE-2025-7084.md): Belkin F9K1122 webs formWpsStart stack-based overflow (CVSS 8.7, Belkin F9K1122)
- [CVE-2025-7083](https://cve.now/CVE-2025-7083.md): Belkin F9K1122 webs mp os command injection (CVSS 5.3, Belkin F9K1122)
- [CVE-2025-7082](https://cve.now/CVE-2025-7082.md): Belkin F9K1122 webs formBSSetSitesurvey os command injection (CVSS 5.3, Belkin F9K1122)
- [CVE-2025-5333](https://cve.now/CVE-2025-5333.md): Unauthenticated Remote Code Execution in IT Management Suite (CVSS 9.5, Broadcom Symantec IT Management Suite)
- [CVE-2025-7081](https://cve.now/CVE-2025-7081.md): Belkin F9K1122 webs formSetWanStatic os command injection (CVSS 5.3, Belkin F9K1122)
- [CVE-2025-7080](https://cve.now/CVE-2025-7080.md): Done-0 Jank JWT Token jwt\_utils.go hard-coded password (CVSS 6.3, Done-0 Jank)
- [CVE-2025-7079](https://cve.now/CVE-2025-7079.md): mao888 bluebell-plus JWT Token jwt.go hard-coded password (CVSS 6.3, mao888 bluebell-plus)
- [CVE-2025-38235](https://cve.now/CVE-2025-38235.md): HID: appletb-kbd: fix "appletb\_backlight" backlight device reference counting (no CVSS, Linux)
- [CVE-2025-7078](https://cve.now/CVE-2025-7078.md): 07FLYCMS/07FLY-CMS/07FlyCRM cross-site request forgery (CVSS 5.3, 07FLYCMS · 07FLY-CMS +1)
- [CVE-2025-7077](https://cve.now/CVE-2025-7077.md): Shenzhen Libituo Technology LBT-T300-T310 appy.cgi config\_3g\_para buffer overflow (CVSS 8.7, Shenzhen Libituo Technology LBT-T300-T310)
- [CVE-2025-27446](https://cve.now/CVE-2025-27446.md): Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges (CVSS 7.8, Apache Software Foundation Apache APISIX Java Plugin Runner)
- [CVE-2025-7076](https://cve.now/CVE-2025-7076.md): BlackVue Dashcam 590X Configuration upload.cgi access control (CVSS 5.3, BlackVue Dashcam)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.