# CVEs published 2025-07-07 175 CVEs were published on July 7, 2025: 22 critical, 40 high. Days are UTC. - [CVE-2025-7152](https://cve.now/CVE-2025-7152.md): Campcodes Advanced Online Voting System candidates\_add.php unrestricted upload (CVSS 5.3, Campcodes Advanced Online Voting System) - [CVE-2025-7151](https://cve.now/CVE-2025-7151.md): Campcodes Advanced Online Voting System voters\_add.php unrestricted upload (CVSS 5.3, Campcodes Advanced Online Voting System) - [CVE-2025-7150](https://cve.now/CVE-2025-7150.md): Campcodes Advanced Online Voting System voters\_delete.php sql injection (CVSS 5.3, Campcodes Advanced Online Voting System) - [CVE-2025-7149](https://cve.now/CVE-2025-7149.md): Campcodes Advanced Online Voting System candidates\_delete.php sql injection (CVSS 5.3, Campcodes Advanced Online Voting System) - [CVE-2025-7148](https://cve.now/CVE-2025-7148.md): CodeAstro Simple Hospital Management System POST Parameter patient.html cross site scripting (CVSS 5.1, CodeAstro Simple Hospital Management System) - [CVE-2025-7147](https://cve.now/CVE-2025-7147.md): CodeAstro Patient Record Management System login.php sql injection (CVSS 6.9, CodeAstro Patient Record Management System) - [CVE-2025-7144](https://cve.now/CVE-2025-7144.md): SourceCodester Best Salon Management System Admin Profile Page admin-profile.php cross site scripting (CVSS 4.8, SourceCodester Best Salon Management System) - [CVE-2025-7143](https://cve.now/CVE-2025-7143.md): SourceCodester Best Salon Management System Update Tax Page edit-tax.php cross site scripting (CVSS 4.8, SourceCodester Best Salon Management System) - [CVE-2025-53543](https://cve.now/CVE-2025-53543.md): Kestra allows Stored XSS before 0.22 (CVSS 4.2, kestra-io kestra) - [CVE-2025-7142](https://cve.now/CVE-2025-7142.md): SourceCodester Best Salon Management System search-appointment.php cross site scripting (CVSS 4.8, SourceCodester Best Salon Management System) - [CVE-2025-53540](https://cve.now/CVE-2025-53540.md): CSRF Vulnerability in Firmware Update Endpoints Allows Remote Code Execution (CVSS 8.7, espressif arduino-esp32) - [CVE-2025-53539](https://cve.now/CVE-2025-53539.md): ReDoS in fastapi-guard's penetration attempts detector (CVSS 6.9, rennf93 fastapi-guard · fastapi-guard) - [CVE-2025-53496](https://cve.now/CVE-2025-53496.md): Stored XSS in MediaSearch (CVSS 5.4, Wikimedia Foundation Mediawiki - MediaSearch Extension) - [CVE-2025-7141](https://cve.now/CVE-2025-7141.md): SourceCodester Best Salon Management System Update Staff Page edit\_plan.php cross site scripting (CVSS 4.8, SourceCodester Best Salon Management System) - [CVE-2025-6044](https://cve.now/CVE-2025-6044.md): An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices a (CVSS 6.1, Google ChromeOS) - [CVE-2025-53488](https://cve.now/CVE-2025-53488.md): Stored XSS in WikiHiero (CVSS 6.1, Wikimedia Foundation Mediawiki - WikiHiero Extension) - [CVE-2025-53498](https://cve.now/CVE-2025-53498.md): Lack of Audit Logging in AbuseFilter (CVSS 5.3, Wikimedia Foundation Mediawiki - AbuseFilter Extension) - [CVE-2025-53499](https://cve.now/CVE-2025-53499.md): Unauthorized Inspection of Protected Variables in AbuseFilter (CVSS 9.1, Wikimedia Foundation Mediawiki - AbuseFilter Extension) - [CVE-2025-7140](https://cve.now/CVE-2025-7140.md): SourceCodester Best Salon Management System Update Staff Page edit-staff.php cross site scripting (CVSS 4.8, SourceCodester Best Salon Management System) - [CVE-2025-53495](https://cve.now/CVE-2025-53495.md): Unauthorized Disclosure of IP Reputation in AbuseFilter (CVSS 9.1, Wikimedia Foundation Mediawiki - AbuseFilter Extension) - [CVE-2025-53478](https://cve.now/CVE-2025-53478.md): CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate via unsanitized i18n messages (CVSS 5.4, Wikimedia Foundation Mediawiki - CheckUser extension) - [CVE-2025-7139](https://cve.now/CVE-2025-7139.md): SourceCodester Best Salon Management System Update Customer Details Page edit-customer-detailed.php cross site scripting (CVSS 4.8, SourceCodester Best Salon Management System) - [CVE-2025-53536](https://cve.now/CVE-2025-53536.md): Roo Code allows Potential Remote Code Execution via .vscode/settings.json (CVSS 8.1, RooCodeInc Roo-Code) - [CVE-2025-20322](https://cve.now/CVE-2025-20322.md): Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise (CVSS 4.3, Splunk Enterprise) - [CVE-2025-20323](https://cve.now/CVE-2025-20323.md): Missing Access Control of Saved Searches in the Splunk Archiver app (CVSS 4.3, Splunk Enterprise) - [CVE-2025-20321](https://cve.now/CVE-2025-20321.md): Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise (CVSS 6.5, Splunk Enterprise) - [CVE-2025-20325](https://cve.now/CVE-2025-20325.md): Sensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments in Splunk Enterprise (CVSS 3.1, Splunk Enterprise · Splunk Cloud Platform) - [CVE-2025-20319](https://cve.now/CVE-2025-20319.md): Remote Command Execution through Scripted Input Files in Splunk Enterprise (CVSS 6.8, Splunk Enterprise) - [CVE-2025-20324](https://cve.now/CVE-2025-20324.md): Improper Access Control in System Source Types Configuration in Splunk Enterprise (CVSS 5.4, Splunk Enterprise) - [CVE-2025-20320](https://cve.now/CVE-2025-20320.md): Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Enterprise (CVSS 6.3, Splunk Enterprise) - [CVE-2025-20300](https://cve.now/CVE-2025-20300.md): Improper Access Control Lets Low-Privilege Users Suppress Read-Only Alerts in Splunk Enterprise (CVSS 4.3, Splunk Enterprise · Splunk Cloud Platform) - [CVE-2024-43190](https://cve.now/CVE-2024-43190.md): IBM Engineering Requirements Management DOORS weak authentication (CVSS 5.9, IBM Engineering Requirements Management DOORS) - [CVE-2025-7138](https://cve.now/CVE-2025-7138.md): SourceCodester Best Salon Management System admin-profile.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System) - [CVE-2025-53535](https://cve.now/CVE-2025-53535.md): Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes (CVSS 2.1, better-auth) - [CVE-2025-53532](https://cve.now/CVE-2025-53532.md): giscus allows unauthorized discussion creation (CVSS 5.3, giscus) - [CVE-2025-53531](https://cve.now/CVE-2025-53531.md): WeGIA allows Uncontrolled Resource Consumption via the fid parameter (CVSS 8.7, LabRedesCefetRJ WeGIA) - [CVE-2025-7137](https://cve.now/CVE-2025-7137.md): SourceCodester Best Salon Management System schedule-staff.php sql injection (CVSS 5.3, SourceCodester Best Salon Management System) - [CVE-2025-53530](https://cve.now/CVE-2025-53530.md): WeGIA allows Uncontrolled Resource Consumption via the errorstr parameter (CVSS 8.7, LabRedesCefetRJ WeGIA) - [CVE-2025-53529](https://cve.now/CVE-2025-53529.md): WeGIA allows SQL Injection in html/funcionario/profile\_funcionario.php (id\_funcionario parameter) (CVSS 9.8, LabRedesCefetRJ WeGIA) - [CVE-2025-53527](https://cve.now/CVE-2025-53527.md): WeGIA allows Time-Based Blind SQL Injection in the relatorio\_geracao.php endpoint (CVSS 8.3, LabRedesCefetRJ WeGIA) - [CVE-2025-1351](https://cve.now/CVE-2025-1351.md): IBM Storage Virtualize privilege escalation (CVSS 6.7, IBM Storage Virtualize) - [CVE-2025-53526](https://cve.now/CVE-2025-53526.md): WeGIA allows Stored XSS attacks in novo\_memorando.php (CVSS 2.0, LabRedesCefetRJ WeGIA) - [CVE-2025-7136](https://cve.now/CVE-2025-7136.md): Campcodes Online Recruitment Management System view\_vacancy.php sql injection (CVSS 6.9, Campcodes Online Recruitment Management System) - [CVE-2025-53525](https://cve.now/CVE-2025-53525.md): WebGia allows Cross-Site Scripting (XSS) in profile\_familiar.php via the id\_dependente parameter (CVSS 2.0, LabRedesCefetRJ WeGIA) - [CVE-2025-53497](https://cve.now/CVE-2025-53497.md): Stored XSS in RelatedArticles (CVSS 5.4, Wikimedia Foundation Mediawiki - RelatedArticles Extension) - [CVE-2025-53377](https://cve.now/CVE-2025-53377.md): WebGia allows Cross-Site Scripting (XSS) in cadastro\_dependente\_pessoa\_nova.php via the id\_funcionario parameter (CVSS 2.0, LabRedesCefetRJ WeGIA) - [CVE-2025-53491](https://cve.now/CVE-2025-53491.md): XSS in FlaggedRevs (CVSS 5.4, Wikimedia Foundation Mediawiki - FlaggedRevs Extension) - [CVE-2025-36014](https://cve.now/CVE-2025-36014.md): IBM Integration Bus for z/OS code injection (CVSS 8.2, IBM Integration Bus) - [CVE-2025-7135](https://cve.now/CVE-2025-7135.md): Campcodes Online Recruitment Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Recruitment Management System) - [CVE-2025-53375](https://cve.now/CVE-2025-53375.md): Dokploy allows attackers to read any file that the Traefik process user can access (CVSS 4.9, dokploy) - [CVE-2025-7259](https://cve.now/CVE-2025-7259.md): Certain Queries with Duplicate \_id Fields May Cause MongoDB Server to Crash (CVSS 6.5, MongoDB Server) - [CVE-2025-53376](https://cve.now/CVE-2025-53376.md): Dokploy allows attackers to run arbitrary OS commands on the Dokploy host. (CVSS 6.3, dokploy) - [CVE-2025-53374](https://cve.now/CVE-2025-53374.md): Dokploy Improperly Discloses User Information via user.one Endpoint (CVSS 1.3, dokploy) - [CVE-2025-53373](https://cve.now/CVE-2025-53373.md): Natours has a 1 Click Account take over on reset password via Host Header injection (CVSS 8.9, ahmed-elgaml11 Natours) - [CVE-2025-7134](https://cve.now/CVE-2025-7134.md): Campcodes Online Recruitment Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Recruitment Management System) - [CVE-2025-48367](https://cve.now/CVE-2025-48367.md): Redis DoS Vulnerability due to bad connection error handling (CVSS 7.5, redis) - [CVE-2025-32023](https://cve.now/CVE-2025-32023.md): Redis allows out of bounds writes in hyperloglog commands leading to RCE (CVSS 7.0, redis) - [CVE-2025-53487](https://cve.now/CVE-2025-53487.md): ApprovedRevs: Stored Cross-Site Scripting (XSS) via unsanitized system messages (CVSS 5.4, Wikimedia Foundation Mediawiki - ApprovedRevs extension) - [CVE-2025-7057](https://cve.now/CVE-2025-7057.md): Stored XSS in Quiz (CVSS 5.4, Wikimedia Foundation Mediawiki - Quiz Extension) - [CVE-2025-53486](https://cve.now/CVE-2025-53486.md): WikiCategoryTagCloud: Reflected Cross-Site Scripting (XSS) via linkstyle attribute in parser function (CVSS 5.4, Wikimedia Foundation Mediawiki - WikiCategoryTagCloud exten…) - [CVE-2025-7133](https://cve.now/CVE-2025-7133.md): CodeAstro Online Movie Ticket Booking System cross-site request forgery (CVSS 5.3, CodeAstro Online Movie Ticket Booking System) - [CVE-2025-6663](https://cve.now/CVE-2025-6663.md): GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GStreamer) - [CVE-2025-6811](https://cve.now/CVE-2025-6811.md): Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 9.8, Mescius ActiveReports.NET) - [CVE-2025-6810](https://cve.now/CVE-2025-6810.md): Mescius ActiveReports.NET ReadValue Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 9.8, Mescius ActiveReports.NET) - [CVE-2025-6802](https://cve.now/CVE-2025-6802.md): Marvell QConvergeConsole getFileFromURL Unrestricted File Upload Remote Code Execution Vulnerability (CVSS 9.8, Marvell QConvergeConsole) - [CVE-2025-6806](https://cve.now/CVE-2025-6806.md): Marvell QConvergeConsole decryptFile Directory Traversal Arbitrary File Write Vulnerability (CVSS 8.2, Marvell QConvergeConsole) - [CVE-2025-6807](https://cve.now/CVE-2025-6807.md): Marvell QConvergeConsole getDriverTmpPath Directory Traversal Information Disclosure Vulnerability (CVSS 5.3, Marvell QConvergeConsole) - [CVE-2025-6795](https://cve.now/CVE-2025-6795.md): Marvell QConvergeConsole getFileUploadSize Directory Traversal Information Disclosure Vulnerability (CVSS 5.3, Marvell QConvergeConsole) - [CVE-2025-6794](https://cve.now/CVE-2025-6794.md): Marvell QConvergeConsole saveAsText Directory Traversal Remote Code Execution Vulnerability (CVSS 9.8, Marvell QConvergeConsole) - [CVE-2025-6801](https://cve.now/CVE-2025-6801.md): Marvell QConvergeConsole saveNICParamsToFile Directory Traversal Arbitrary File Write Vulnerability (CVSS 8.2, Marvell QConvergeConsole) - [CVE-2025-6800](https://cve.now/CVE-2025-6800.md): Marvell QConvergeConsole restoreESwitchConfig Directory Traversal Information Disclosure Vulnerability (CVSS 7.5, Marvell QConvergeConsole) - [CVE-2025-6799](https://cve.now/CVE-2025-6799.md): Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability (CVSS 7.5, Marvell QConvergeConsole) - [CVE-2025-6798](https://cve.now/CVE-2025-6798.md): Marvell QConvergeConsole deleteAppFile Directory Traversal Arbitrary File Deletion Vulnerability (CVSS 8.2, Marvell QConvergeConsole) - [CVE-2025-6797](https://cve.now/CVE-2025-6797.md): Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability (CVSS 7.5, Marvell QConvergeConsole) - [CVE-2025-6805](https://cve.now/CVE-2025-6805.md): Marvell QConvergeConsole deleteEventLogFile Directory Traversal Arbitrary File Deletion Vulnerability (CVSS 8.2, Marvell QConvergeConsole) - [CVE-2025-6796](https://cve.now/CVE-2025-6796.md): Marvell QConvergeConsole getAppFileBytes Directory Traversal Information Disclosure Vulnerability (CVSS 7.5, Marvell QConvergeConsole) - [CVE-2025-6793](https://cve.now/CVE-2025-6793.md): Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability (CVSS 9.4, Marvell QConvergeConsole) - [CVE-2025-6804](https://cve.now/CVE-2025-6804.md): Marvell QConvergeConsole compressFirmwareDumpFiles Directory Traversal Information Disclosure Vulnerability (CVSS 7.5, Marvell QConvergeConsole) - [CVE-2025-6803](https://cve.now/CVE-2025-6803.md): Marvell QConvergeConsole compressDriverFiles Directory Traversal Information Disclosure Vulnerability (CVSS 7.5, Marvell QConvergeConsole) - [CVE-2025-6714](https://cve.now/CVE-2025-6714.md): Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections (CVSS 7.5, MongoDB Server) - [CVE-2025-6713](https://cve.now/CVE-2025-6713.md): MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage (CVSS 7.7, MongoDB Server) - [CVE-2025-6712](https://cve.now/CVE-2025-6712.md): MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation (CVSS 6.5, MongoDB Server) - [CVE-2025-6711](https://cve.now/CVE-2025-6711.md): Incomplete Redaction of Sensitive Information in MongoDB Server Logs (CVSS 4.4, MongoDB Server) - [CVE-2025-7132](https://cve.now/CVE-2025-7132.md): Campcodes Payroll Management System ajax.php sql injection (CVSS 6.9, Campcodes Payroll Management System) - [CVE-2025-5987](https://cve.now/CVE-2025-5987.md): Libssh: invalid return code for chacha20 poly1305 with openssl backend (CVSS 8.1, libssh · Red Hat Enterprise Linux +1) - [CVE-2025-7131](https://cve.now/CVE-2025-7131.md): Campcodes Payroll Management System ajax.php sql injection (CVSS 6.9, Campcodes Payroll Management System) - [CVE-2025-7056](https://cve.now/CVE-2025-7056.md): Stored XSS in UrlShortener (CVSS 6.3, Wikimedia Foundation Mediawiki - UrlShortener Extension) - [CVE-2025-7130](https://cve.now/CVE-2025-7130.md): Campcodes Payroll Management System ajax.php sql injection (CVSS 6.9, Campcodes Payroll Management System) - [CVE-2025-7129](https://cve.now/CVE-2025-7129.md): Campcodes Payroll Management System ajax.php sql injection (CVSS 6.9, Campcodes Payroll Management System) - [CVE-2025-7128](https://cve.now/CVE-2025-7128.md): Campcodes Payroll Management System ajax.php sql injection (CVSS 6.9, Campcodes Payroll Management System) - [CVE-2025-6209](https://cve.now/CVE-2025-6209.md): Arbitrary File Read through Path Traversal in run-llama/llama\_index (CVSS 7.5, run-llama/llama\_index · llama-index-core +1) - [CVE-2025-7127](https://cve.now/CVE-2025-7127.md): itsourcecode Employee Management System changepassword.php sql injection (CVSS 5.1, itsourcecode Employee Management System) - [CVE-2025-7126](https://cve.now/CVE-2025-7126.md): itsourcecode Employee Management System adminprofile.php sql injection (CVSS 5.3, itsourcecode Employee Management System) - [CVE-2025-7125](https://cve.now/CVE-2025-7125.md): itsourcecode Employee Management System editempeducation.php sql injection (CVSS 5.3, itsourcecode Employee Management System) - [CVE-2025-7124](https://cve.now/CVE-2025-7124.md): code-projects Online Note Sharing Profile Image userprofile.php unrestricted upload (CVSS 5.3, code-projects Online Note Sharing) - [CVE-2025-7123](https://cve.now/CVE-2025-7123.md): Campcodes Complaint Management System complaint-details.php sql injection (CVSS 5.1, Campcodes Complaint Management System) - [CVE-2025-3467](https://cve.now/CVE-2025-3467.md): XSS Vulnerability in langgenius/dify (CVSS 8.0, langgenius/dify) - [CVE-2025-5472](https://cve.now/CVE-2025-5472.md): Denial of Service via Uncontrolled Recursive JSON Parsing in JSONReader in run-llama/llama\_index (CVSS 6.5, run-llama/llama\_index · llama-index +1) - [CVE-2025-6210](https://cve.now/CVE-2025-6210.md): Hardlink-Based Path Traversal in run-llama/llama\_index (CVSS 6.2, run-llama/llama\_index · llama-index-readers-obsidian +1) - [CVE-2025-3777](https://cve.now/CVE-2025-3777.md): Improper Input Validation in huggingface/transformers (CVSS 3.5, huggingface/transformers · transformers) - [CVE-2025-3466](https://cve.now/CVE-2025-3466.md): Unsanitized Input in langgenius/dify (CVSS 9.8, langgenius/dify) - [CVE-2025-6386](https://cve.now/CVE-2025-6386.md): Timing Attack Vulnerability in parisneo/lollms (CVSS 7.5, parisneo/lollms · lollms) - [CVE-2025-3264](https://cve.now/CVE-2025-3264.md): Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 5.3, huggingface/transformers · transformers) - [CVE-2025-3263](https://cve.now/CVE-2025-3263.md): Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 5.3, huggingface/transformers · transformers) - [CVE-2025-3046](https://cve.now/CVE-2025-3046.md): Path Traversal via Symbolic Links in run-llama/llama\_index (CVSS 7.5, run-llama/llama\_index · llama-index +1) - [CVE-2025-3262](https://cve.now/CVE-2025-3262.md): Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 5.3, huggingface/transformers · transformers) - [CVE-2025-3044](https://cve.now/CVE-2025-3044.md): MD5 Hash Collision in run-llama/llama\_index (CVSS 5.3, run-llama/llama\_index · llama-index-readers-papers +1) - [CVE-2025-3225](https://cve.now/CVE-2025-3225.md): XML Entity Expansion vulnerability in run-llama/llama\_index (CVSS 7.5, run-llama/llama\_index · llama-index-readers-papers +1) - [CVE-2024-43334](https://cve.now/CVE-2024-43334.md): WordPress Zilom theme \< 1.4.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, gavias Zilom) - [CVE-2025-4779](https://cve.now/CVE-2025-4779.md): Stored Cross-site Scripting (XSS) in lunary-ai/lunary (CVSS 9.1, lunary-ai/lunary) - [CVE-2025-7122](https://cve.now/CVE-2025-7122.md): Campcodes Complaint Management System index.php sql injection (CVSS 6.9, Campcodes Complaint Management System) - [CVE-2025-3705](https://cve.now/CVE-2025-3705.md): OS Command Injection via USB Config Load (CVSS 6.8, Frauscher FDS102 · Frauscher FDS101 +1) - [CVE-2025-3626](https://cve.now/CVE-2025-3626.md): OS Command Injection via Config Upload in WebUI (CVSS 9.1, Frauscher FDS102) - [CVE-2025-7121](https://cve.now/CVE-2025-7121.md): Campcodes Complaint Management System complaint-details.php sql injection (CVSS 5.3, Campcodes Complaint Management System) - [CVE-2025-7120](https://cve.now/CVE-2025-7120.md): Campcodes Complaint Management System check\_availability.php sql injection (CVSS 6.9, Campcodes Complaint Management System) - [CVE-2025-3920](https://cve.now/CVE-2025-3920.md): Hard-coded Password in SUR-FBD CMMS (CVSS 8.5, SUR-FBD CMMS) - [CVE-2025-7119](https://cve.now/CVE-2025-7119.md): Campcodes Complaint Management System index.php sql injection (CVSS 6.9, Campcodes Complaint Management System) - [CVE-2025-7118](https://cve.now/CVE-2025-7118.md): UTT HiPER 840G formPictureUrl buffer overflow (CVSS 8.7, UTT HiPER) - [CVE-2025-7117](https://cve.now/CVE-2025-7117.md): UTT HiPER 840G websWhiteList buffer overflow (CVSS 8.7, UTT HiPER) - [CVE-2025-7116](https://cve.now/CVE-2025-7116.md): UTT 进取 750W Fast\_wireless\_conf buffer overflow (CVSS 8.7, UTT 进取) - [CVE-2025-41672](https://cve.now/CVE-2025-41672.md): WAGO: Vulnerability in WAGO Device Sphere (CVSS 10.0, Wago Device Sphere) - [CVE-2025-7115](https://cve.now/CVE-2025-7115.md): rowboatlabs rowboat Session route.ts PUT missing authentication (CVSS 6.9, rowboatlabs rowboat) - [CVE-2025-7114](https://cve.now/CVE-2025-7114.md): SimStudioAI sim Session route.ts POST missing authentication (CVSS 6.9, SimStudioAI sim) - [CVE-2025-7113](https://cve.now/CVE-2025-7113.md): Portabilis i-Educar Curricular Components Module edit cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2025-24508](https://cve.now/CVE-2025-24508.md): Offline Extraction of Account Connectivity Credentials (ACCs) in IT Management Suite (CVSS 6.4, Broadcom Symantec IT Management Suite) - [CVE-2025-53473](https://cve.now/CVE-2025-53473.md): Server-side request forgery (SSRF) vulnerability exists n multiple versions of Nimesa Backup and Recovery, If this vulnerability is exploite (CVSS 7.3, Nimesa Backup and Recovery) - [CVE-2025-48501](https://cve.now/CVE-2025-48501.md): An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. (CVSS 9.8, Nimesa Backup and Recovery) - [CVE-2025-7112](https://cve.now/CVE-2025-7112.md): Portabilis i-Educar Function Management Module educar\_funcao\_det.php cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2025-7111](https://cve.now/CVE-2025-7111.md): Portabilis i-Educar Course Module educar\_curso\_det.php cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2025-7110](https://cve.now/CVE-2025-7110.md): Portabilis i-Educar School Module educar\_escola\_lst.php cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2025-7109](https://cve.now/CVE-2025-7109.md): Portabilis i-Educar Student Benefits Registration educar\_aluno\_beneficio\_lst.php cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2025-53186](https://cve.now/CVE-2025-53186.md): Vulnerability that allows third-party call apps to send broadcasts without verification in the audio framework module Impact: Successful exp (CVSS 5.9, Huawei HarmonyOS · Huawei EMUI) - [CVE-2025-53185](https://cve.now/CVE-2025-53185.md): Virtual address reuse issue in the memory management module, which can be exploited by non-privileged users to access released memory Impact (CVSS 6.6, Huawei HarmonyOS · Huawei EMUI) - [CVE-2025-53184](https://cve.now/CVE-2025-53184.md): Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function s (CVSS 6.5, Huawei HarmonyOS) - [CVE-2025-7108](https://cve.now/CVE-2025-7108.md): risesoft-y9 Digital-Infrastructure Y9FileController.java deleteFile path traversal (CVSS 5.3, risesoft-y9 Digital-Infrastructure) - [CVE-2025-53183](https://cve.now/CVE-2025-53183.md): Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function s (CVSS 6.5, Huawei HarmonyOS) - [CVE-2025-53182](https://cve.now/CVE-2025-53182.md): Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function s (CVSS 6.5, Huawei HarmonyOS) - [CVE-2025-53181](https://cve.now/CVE-2025-53181.md): Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function s (CVSS 6.5, Huawei HarmonyOS) - [CVE-2025-53180](https://cve.now/CVE-2025-53180.md): Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function s (CVSS 6.5, Huawei HarmonyOS) - [CVE-2025-53179](https://cve.now/CVE-2025-53179.md): Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function s (CVSS 6.5, Huawei HarmonyOS) - [CVE-2025-53178](https://cve.now/CVE-2025-53178.md): Permission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the schedule (CVSS 4.8, Huawei HarmonyOS · Huawei EMUI) - [CVE-2025-7145](https://cve.now/CVE-2025-7145.md): TeamT5｜ThreatSonar Anti-Ransomware - OS Command Injection (CVSS 7.2, TeamT5 ThreatSonar Anti-Ransomware) - [CVE-2025-53177](https://cve.now/CVE-2025-53177.md): Permission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the schedule (CVSS 3.9, Huawei HarmonyOS · Huawei EMUI) - [CVE-2025-53176](https://cve.now/CVE-2025-53176.md): Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the f (CVSS 3.3, Huawei HarmonyOS) - [CVE-2025-53175](https://cve.now/CVE-2025-53175.md): Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the f (CVSS 4.0, Huawei HarmonyOS) - [CVE-2025-53174](https://cve.now/CVE-2025-53174.md): Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the f (CVSS 4.0, Huawei HarmonyOS) - [CVE-2025-53173](https://cve.now/CVE-2025-53173.md): Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the f (CVSS 5.3, Huawei HarmonyOS) - [CVE-2025-53172](https://cve.now/CVE-2025-53172.md): Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the f (CVSS 4.0, Huawei HarmonyOS) - [CVE-2025-53171](https://cve.now/CVE-2025-53171.md): Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the f (CVSS 4.0, Huawei HarmonyOS) - [CVE-2025-7107](https://cve.now/CVE-2025-7107.md): SimStudioAI sim route.ts handleLocalFile path traversal (CVSS 6.9, SimStudioAI sim) - [CVE-2024-58117](https://cve.now/CVE-2024-58117.md): Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the f (CVSS 4.0, Huawei HarmonyOS) - [CVE-2025-53170](https://cve.now/CVE-2025-53170.md): Null pointer dereference vulnerability in the application exit cause module Impact: Successful exploitation of this vulnerability may affect (CVSS 4.0, Huawei HarmonyOS) - [CVE-2025-53169](https://cve.now/CVE-2025-53169.md): Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this (CVSS 7.6, Huawei HarmonyOS) - [CVE-2025-53168](https://cve.now/CVE-2025-53168.md): Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this (CVSS 5.7, Huawei HarmonyOS) - [CVE-2025-53167](https://cve.now/CVE-2025-53167.md): Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this vulnerability may aff (CVSS 6.9, Huawei HarmonyOS) - [CVE-2025-7103](https://cve.now/CVE-2025-7103.md): BoyunCMS curl Index.php server-side request forgery (CVSS 5.3, BoyunCMS) - [CVE-2025-7102](https://cve.now/CVE-2025-7102.md): BoyunCMS Server.php sql injection (CVSS 5.3, BoyunCMS) - [CVE-2025-7101](https://cve.now/CVE-2025-7101.md): BoyunCMS Configuration File install\_ok.php code injection (CVSS 5.3, BoyunCMS) - [CVE-2025-7100](https://cve.now/CVE-2025-7100.md): BoyunCMS Index.php unrestricted upload (CVSS 5.3, BoyunCMS) - [CVE-2023-51232](https://cve.now/CVE-2023-51232.md): Directory Traversal vulnerability in dagster-webserver Dagster thru 1.5.11 allows remote attackers to obtain sensitive information via craft (CVSS 7.5, dagster) - [CVE-2024-25176](https://cve.now/CVE-2024-25176.md): LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj\_strfmt\_wfnum in lj\_strfmt\_num.c. (CVSS 9.8) - [CVE-2024-25177](https://cve.now/CVE-2024-25177.md): LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR\_FSTORE for NULL metatable, which leads to Denial of Se (CVSS 7.5) - [CVE-2024-25178](https://cve.now/CVE-2024-25178.md): LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in lj\_state.c. (CVSS 9.1) - [CVE-2024-37656](https://cve.now/CVE-2024-37656.md): An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL param (CVSS 6.1) - [CVE-2024-37657](https://cve.now/CVE-2024-37657.md): An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component (CVSS 6.1) - [CVE-2024-37658](https://cve.now/CVE-2024-37658.md): An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the bbs/member\_confirm.php (CVSS 6.1) - [CVE-2025-26780](https://cve.now/CVE-2025-26780.md): An issue was discovered in L2 in Samsung Mobile Processor and Modem Exynos 2400 and Modem 5400. (CVSS 7.5) - [CVE-2025-43930](https://cve.now/CVE-2025-43930.md): Hashview 0.8.1 allows account takeover via the password reset feature because SERVER\_NAME is not configured and thus a reset depends on the (CVSS 9.8) - [CVE-2025-43931](https://cve.now/CVE-2025-43931.md): flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER\_NAME is not configured and thus a re (CVSS 9.8) - [CVE-2025-43932](https://cve.now/CVE-2025-43932.md): JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVER\_NAME is not configured and thus a reset depe (CVSS 9.8) - [CVE-2025-43933](https://cve.now/CVE-2025-43933.md): fblog through 983bede allows account takeover via the password reset feature because SERVER\_NAME is not configured and thus a reset depends (CVSS 9.8) - [CVE-2025-45065](https://cve.now/CVE-2025-45065.md): employee record management system in php and mysql v1 was discovered to contain a SQL injection vulnerability via the loginerms.php endpoint (CVSS 9.8) - [CVE-2025-45479](https://cve.now/CVE-2025-45479.md): Insufficient security mechanisms for created containers in educoder challenges v1.0 allow attackers to execute arbitrary code via injecting (CVSS 9.8) - [CVE-2025-47202](https://cve.now/CVE-2025-47202.md): In RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580 (CVSS 9.1) - [CVE-2025-52492](https://cve.now/CVE-2025-52492.md): A vulnerability has been discovered in the firmware of Paxton Paxton10 before 4.6 SR6. (CVSS 7.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-07-07 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.