# CVEs published 2025-07-08

438 CVEs were published on July 8, 2025: 28 critical, 211 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2025-7206](https://cve.now/CVE-2025-7206.md): D-Link DIR-825 httpd switch\_language.cgi sub\_410DDC stack-based overflow (CVSS 9.3, D-Link DIR-825)
- [CVE-2025-4855](https://cve.now/CVE-2025-4855.md): Support Board \<= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key (CVSS 9.8, Schiocco Support Board)
- [CVE-2025-4828](https://cve.now/CVE-2025-4828.md): Support Board \<= 3.8.0 - Unauthenticated Arbitrary File Deletion (CVSS 9.8, Schiocco Support Board)
- [CVE-2025-3780](https://cve.now/CVE-2025-3780.md): WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible \<= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification (CVSS 6.5, wclovers WCFM – Frontend Manager for WooCommerce)
- [CVE-2025-7200](https://cve.now/CVE-2025-7200.md): krishna9772 Pharmacy Management System quantity\_upd.php sql injection (CVSS 5.3, krishna9772 Pharmacy Management System)
- [CVE-2024-56468](https://cve.now/CVE-2024-56468.md): IBM InfoSphere Data Replication VSAM for z/OS Remote Source denial of service (CVSS 7.5, IBM InfoSphere Data Replication VSAM for z/OS Remote Source)
- [CVE-2025-7199](https://cve.now/CVE-2025-7199.md): code-projects Library System notapprove.php sql injection (CVSS 6.9, code-projects Library System)
- [CVE-2025-47098](https://cve.now/CVE-2025-47098.md): InCopy | Access of Uninitialized Pointer (CWE-824) (CVSS 7.8, Adobe InCopy)
- [CVE-2025-47097](https://cve.now/CVE-2025-47097.md): InCopy | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe InCopy)
- [CVE-2025-47099](https://cve.now/CVE-2025-47099.md): InCopy | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe InCopy)
- [CVE-2025-47120](https://cve.now/CVE-2025-47120.md): Adobe Framemaker | Stack-based Buffer Overflow (CWE-121) (CVSS 5.5, Adobe Framemaker)
- [CVE-2025-47126](https://cve.now/CVE-2025-47126.md): Adobe Framemaker | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-47128](https://cve.now/CVE-2025-47128.md): Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-47131](https://cve.now/CVE-2025-47131.md): Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-47122](https://cve.now/CVE-2025-47122.md): Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-47130](https://cve.now/CVE-2025-47130.md): Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-47133](https://cve.now/CVE-2025-47133.md): Adobe Framemaker | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-47121](https://cve.now/CVE-2025-47121.md): Adobe Framemaker | Access of Uninitialized Pointer (CWE-824) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-47124](https://cve.now/CVE-2025-47124.md): Adobe Framemaker | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-47127](https://cve.now/CVE-2025-47127.md): Adobe Framemaker | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-47129](https://cve.now/CVE-2025-47129.md): Adobe Framemaker | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-47119](https://cve.now/CVE-2025-47119.md): Adobe Framemaker | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Framemaker)
- [CVE-2025-47125](https://cve.now/CVE-2025-47125.md): Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-47123](https://cve.now/CVE-2025-47123.md): Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-47132](https://cve.now/CVE-2025-47132.md): Adobe Framemaker | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Framemaker)
- [CVE-2025-7198](https://cve.now/CVE-2025-7198.md): code-projects Jonnys Liquor admin-area.php sql injection (CVSS 6.9, code-projects Jonnys Liquor)
- [CVE-2025-49524](https://cve.now/CVE-2025-49524.md): Illustrator | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Illustrator)
- [CVE-2025-49528](https://cve.now/CVE-2025-49528.md): Illustrator | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-49531](https://cve.now/CVE-2025-49531.md): Illustrator | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-49527](https://cve.now/CVE-2025-49527.md): Illustrator | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-49532](https://cve.now/CVE-2025-49532.md): Illustrator | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-49525](https://cve.now/CVE-2025-49525.md): Illustrator | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Illustrator)
- [CVE-2025-49529](https://cve.now/CVE-2025-49529.md): Illustrator | Access of Uninitialized Pointer (CWE-824) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-49530](https://cve.now/CVE-2025-49530.md): Illustrator | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-49526](https://cve.now/CVE-2025-49526.md): Illustrator | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-30313](https://cve.now/CVE-2025-30313.md): Illustrator | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Illustrator)
- [CVE-2025-43591](https://cve.now/CVE-2025-43591.md): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-43592](https://cve.now/CVE-2025-43592.md): InDesign Desktop | Access of Uninitialized Pointer (CWE-824) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-43594](https://cve.now/CVE-2025-43594.md): InDesign Desktop | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-47134](https://cve.now/CVE-2025-47134.md): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-47136](https://cve.now/CVE-2025-47136.md): InDesign Desktop | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-47103](https://cve.now/CVE-2025-47103.md): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-6759](https://cve.now/CVE-2025-6759.md): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (CVSS 7.3, Windows Virtual Delivery Agent for CVAD and Citrix DaaS)
- [CVE-2025-49547](https://cve.now/CVE-2025-49547.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-49534](https://cve.now/CVE-2025-49534.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-53547](https://cve.now/CVE-2025-53547.md): Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution (CVSS 8.5, helm · helm.sh/helm/v3)
- [CVE-2025-49533](https://cve.now/CVE-2025-49533.md): Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502) (CVSS 9.8, Adobe Experience Manager)
- [CVE-2025-7197](https://cve.now/CVE-2025-7197.md): code-projects Jonnys Liquor delete-row.php sql injection (CVSS 6.9, code-projects Jonnys Liquor)
- [CVE-2025-27203](https://cve.now/CVE-2025-27203.md): Adobe Connect | Deserialization of Untrusted Data (CWE-502) (CVSS 9.6, Adobe Connect)
- [CVE-2025-27165](https://cve.now/CVE-2025-27165.md): Substance3D - Stager | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2025-43584](https://cve.now/CVE-2025-43584.md): Substance3D - Viewer | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance3D - Viewer)
- [CVE-2025-43583](https://cve.now/CVE-2025-43583.md): Substance3D - Viewer | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Substance3D - Viewer)
- [CVE-2025-43582](https://cve.now/CVE-2025-43582.md): Substance3D - Viewer | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Viewer)
- [CVE-2025-7196](https://cve.now/CVE-2025-7196.md): code-projects Jonnys Liquor browse.php sql injection (CVSS 6.9, code-projects Jonnys Liquor)
- [CVE-2025-7031](https://cve.now/CVE-2025-7031.md): Config Pages Viewer - Critical - Access bypass - SA-CONTRIB-2025-086 (CVSS 5.3, Drupal Config Pages Viewer · drupal/config\_pages\_viewer)
- [CVE-2025-7030](https://cve.now/CVE-2025-7030.md): Two-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-085 (CVSS 6.5, Drupal Two-factor Authentication · drupal/tfa)
- [CVE-2025-49542](https://cve.now/CVE-2025-49542.md): ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.2, Adobe ColdFusion)
- [CVE-2025-49535](https://cve.now/CVE-2025-49535.md): ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (CVSS 9.3, Adobe ColdFusion)
- [CVE-2025-49536](https://cve.now/CVE-2025-49536.md): ColdFusion | Incorrect Authorization (CWE-863) (CVSS 7.3, Adobe ColdFusion)
- [CVE-2025-49539](https://cve.now/CVE-2025-49539.md): ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (CVSS 4.5, Adobe ColdFusion)
- [CVE-2025-49545](https://cve.now/CVE-2025-49545.md): ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 6.2, Adobe ColdFusion)
- [CVE-2025-49541](https://cve.now/CVE-2025-49541.md): ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.3, Adobe ColdFusion)
- [CVE-2025-49537](https://cve.now/CVE-2025-49537.md): ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) (CVSS 7.9, Adobe ColdFusion)
- [CVE-2025-49551](https://cve.now/CVE-2025-49551.md): ColdFusion | Use of Hard-coded Credentials (CWE-798) (CVSS 8.8, Adobe ColdFusion)
- [CVE-2025-49546](https://cve.now/CVE-2025-49546.md): ColdFusion | Improper Access Control (CWE-284) (CVSS 2.4, Adobe ColdFusion)
- [CVE-2025-49544](https://cve.now/CVE-2025-49544.md): ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (CVSS 6.8, Adobe ColdFusion)
- [CVE-2025-49543](https://cve.now/CVE-2025-49543.md): ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.3, Adobe ColdFusion)
- [CVE-2025-49540](https://cve.now/CVE-2025-49540.md): ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.3, Adobe ColdFusion)
- [CVE-2025-49538](https://cve.now/CVE-2025-49538.md): ColdFusion | XML Injection (aka Blind XPath Injection) (CWE-91) (CVSS 7.4, Adobe ColdFusion)
- [CVE-2025-7194](https://cve.now/CVE-2025-7194.md): D-Link DI-500WF jhttpd ip\_position.asp sprintf stack-based overflow (CVSS 8.7, D-Link DI-500WF)
- [CVE-2025-7193](https://cve.now/CVE-2025-7193.md): itsourcecode Agri-Trading Online Shopping System suppliercontroller.php sql injection (CVSS 6.9, itsourcecode Agri-Trading Online Shopping System)
- [CVE-2025-53355](https://cve.now/CVE-2025-53355.md): mcp-server-kubernetes vulnerable to command injection in several tools (CVSS 7.5, Flux159 mcp-server-kubernetes · mcp-server-kubernetes)
- [CVE-2025-7192](https://cve.now/CVE-2025-7192.md): D-Link DIR-645 ssdpcgi cgibin ssdpcgi\_main command injection (CVSS 5.3, D-Link DIR-645)
- [CVE-2025-37103](https://cve.now/CVE-2025-37103.md): Hardcoded Credential Exposure Allows Unauthorized Access in Web Interface (CVSS 9.8, Hewlett Packard Enterprise (HPE) HPE Networking Instant On)
- [CVE-2025-37102](https://cve.now/CVE-2025-37102.md): Authenticated Command Injection Vulnerability In Instant On Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Networking Instant On)
- [CVE-2025-7191](https://cve.now/CVE-2025-7191.md): code-projects Student Enrollment System login.php sql injection (CVSS 6.9, code-projects Student Enrollment System)
- [CVE-2025-27369](https://cve.now/CVE-2025-27369.md): IBM OpenPages with Watson information disclosure (CVSS 4.3, IBM OpenPages with Watson)
- [CVE-2025-27367](https://cve.now/CVE-2025-27367.md): IBM OpenPages with Watson improper input validation (CVSS 5.3, IBM OpenPages with Watson)
- [CVE-2024-49783](https://cve.now/CVE-2024-49783.md): IBM OpenPages with Watson information disclosure (CVSS 5.3, IBM OpenPages with Watson)
- [CVE-2024-49784](https://cve.now/CVE-2024-49784.md): IBM OpenPages with Watson information disclosure (CVSS 5.3, IBM OpenPages with Watson)
- [CVE-2025-7190](https://cve.now/CVE-2025-7190.md): code-projects Library Management System student\_edit\_photo.php unrestricted upload (CVSS 5.3, code-projects Library Management System)
- [CVE-2023-43039](https://cve.now/CVE-2023-43039.md): IBM OpenPages with Watson cross-site scripting (CVSS 6.1, IBM OpenPages with Watson)
- [CVE-2025-48384](https://cve.now/CVE-2025-48384.md): Git allows arbitrary code execution through broken config quoting (CVSS 8.1, KEV, git)
- [CVE-2025-48385](https://cve.now/CVE-2025-48385.md): Git alllows arbitrary file writes via bundle-uri parameter injection (CVSS 8.6, git)
- [CVE-2025-48386](https://cve.now/CVE-2025-48386.md): Git allows a buffer overflow in 'wincred' credential helper (CVSS 6.3, git)
- [CVE-2025-7189](https://cve.now/CVE-2025-7189.md): code-projects Chat System send\_message.php sql injection (CVSS 5.3, code-projects Chat System)
- [CVE-2025-4663](https://cve.now/CVE-2025-4663.md): Denial-of-Service (DoS) after Unusual or Exceptional Conditions vulnerability (CVSS 6.8, Broadcom Brocade Fabric OS)
- [CVE-2025-7188](https://cve.now/CVE-2025-7188.md): code-projects Chat System addmember.php sql injection (CVSS 5.3, code-projects Chat System)
- [CVE-2025-30312](https://cve.now/CVE-2025-30312.md): Dimension | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Dimension)
- [CVE-2025-47135](https://cve.now/CVE-2025-47135.md): Dimension | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Dimension)
- [CVE-2025-7363](https://cve.now/CVE-2025-7363.md): TitleIcon: Stored Cross-Site Scripting (XSS) via #titleicon\_unicode parser function (CVSS 5.4, Wikimedia Foundation Mediawiki - TitleIcon extension)
- [CVE-2025-7362](https://cve.now/CVE-2025-7362.md): MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message (CVSS 5.4, Wikimedia Foundation Mediawiki - MsUpload extension)
- [CVE-2025-0928](https://cve.now/CVE-2025-0928.md): Arbitrary executable upload via authenticated endpoint (CVSS 8.8, Canonical Juju · github.com/juju/juju)
- [CVE-2025-53479](https://cve.now/CVE-2025-53479.md): CheckUser: Reflected Cross-Site Scripting (XSS) in Special:CheckUser via unsanitized internationalized message (CVSS 5.4, Wikimedia Foundation Mediawiki - CheckUser extension)
- [CVE-2025-7187](https://cve.now/CVE-2025-7187.md): code-projects Chat System fetch\_member.php sql injection (CVSS 5.3, code-projects Chat System)
- [CVE-2024-36357](https://cve.now/CVE-2024-36357.md): A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in th (CVSS 5.6, AMD EPYC™ 7003 Series Processors · AMD EPYC™ 9004 Serie… +21)
- [CVE-2025-47988](https://cve.now/CVE-2025-47988.md): Azure Monitor Agent Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Azure Monitor)
- [CVE-2025-49744](https://cve.now/CVE-2025-49744.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-49742](https://cve.now/CVE-2025-49742.md): Windows Graphics Component Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49740](https://cve.now/CVE-2025-49740.md): Windows SmartScreen Security Feature Bypass Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-49739](https://cve.now/CVE-2025-49739.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Visual Studio 2015 Update · Microsoft Visual Stud…)
- [CVE-2025-49738](https://cve.now/CVE-2025-49738.md): Microsoft PC Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft PC Manager)
- [CVE-2025-49737](https://cve.now/CVE-2025-49737.md): Microsoft Teams Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Teams for Mac, New Edition)
- [CVE-2025-47999](https://cve.now/CVE-2025-47999.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2025-49733](https://cve.now/CVE-2025-49733.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49732](https://cve.now/CVE-2025-49732.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49730](https://cve.now/CVE-2025-49730.md): Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49729](https://cve.now/CVE-2025-49729.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-49727](https://cve.now/CVE-2025-49727.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-49725](https://cve.now/CVE-2025-49725.md): Windows Notification Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49724](https://cve.now/CVE-2025-49724.md): Windows Connected Devices Platform Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-49722](https://cve.now/CVE-2025-49722.md): Windows Print Spooler Denial of Service Vulnerability (CVSS 5.7, Microsoft Windows)
- [CVE-2025-49718](https://cve.now/CVE-2025-49718.md): Microsoft SQL Server Information Disclosure Vulnerability (CVSS 7.5, Microsoft SQL Server)
- [CVE-2025-49714](https://cve.now/CVE-2025-49714.md): Visual Studio Code Python Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Python extension for Visual Studio Code)
- [CVE-2025-49706](https://cve.now/CVE-2025-49706.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 6.5, KEV, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-49705](https://cve.now/CVE-2025-49705.md): Microsoft PowerPoint Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2025-49704](https://cve.now/CVE-2025-49704.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 8.8, KEV, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-49703](https://cve.now/CVE-2025-49703.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2025-49702](https://cve.now/CVE-2025-49702.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-49701](https://cve.now/CVE-2025-49701.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2025-49700](https://cve.now/CVE-2025-49700.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2025-49699](https://cve.now/CVE-2025-49699.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.0, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2025-49698](https://cve.now/CVE-2025-49698.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2025-49697](https://cve.now/CVE-2025-49697.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 8.4, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-49696](https://cve.now/CVE-2025-49696.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 8.4, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-49695](https://cve.now/CVE-2025-49695.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 8.4, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-49693](https://cve.now/CVE-2025-49693.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49685](https://cve.now/CVE-2025-49685.md): Windows Search Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-49684](https://cve.now/CVE-2025-49684.md): Windows Storage Port Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-49683](https://cve.now/CVE-2025-49683.md): Microsoft Virtual Hard Disk Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49682](https://cve.now/CVE-2025-49682.md): Windows Media Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2025-49681](https://cve.now/CVE-2025-49681.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-49680](https://cve.now/CVE-2025-49680.md): Windows Performance Recorder (WPR) Denial of Service Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2025-49679](https://cve.now/CVE-2025-49679.md): Windows Shell Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49678](https://cve.now/CVE-2025-49678.md): NTFS Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-49675](https://cve.now/CVE-2025-49675.md): Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49673](https://cve.now/CVE-2025-49673.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-49669](https://cve.now/CVE-2025-49669.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-49668](https://cve.now/CVE-2025-49668.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-49667](https://cve.now/CVE-2025-49667.md): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49666](https://cve.now/CVE-2025-49666.md): Windows Server Setup and Boot Event Collection Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2025-49665](https://cve.now/CVE-2025-49665.md): Workspace Broker Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49664](https://cve.now/CVE-2025-49664.md): Windows User-Mode Driver Framework Host Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-49663](https://cve.now/CVE-2025-49663.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-49660](https://cve.now/CVE-2025-49660.md): Windows Event Tracing Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49659](https://cve.now/CVE-2025-49659.md): Windows Transport Driver Interface (TDI) Translation Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-48823](https://cve.now/CVE-2025-48823.md): Windows Cryptographic Services Information Disclosure Vulnerability (CVSS 5.9, Microsoft Windows)
- [CVE-2025-48822](https://cve.now/CVE-2025-48822.md): Windows Hyper-V Discrete Device Assignment (DDA) Remote Code Execution Vulnerability (CVSS 8.6, Microsoft Windows)
- [CVE-2025-48821](https://cve.now/CVE-2025-48821.md): Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2025-48820](https://cve.now/CVE-2025-48820.md): Windows AppX Deployment Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-48819](https://cve.now/CVE-2025-48819.md): Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2025-48818](https://cve.now/CVE-2025-48818.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2025-48817](https://cve.now/CVE-2025-48817.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Remote Desktop client for Windows Desktop · Micro…)
- [CVE-2025-48816](https://cve.now/CVE-2025-48816.md): HID Class Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-48815](https://cve.now/CVE-2025-48815.md): Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-48814](https://cve.now/CVE-2025-48814.md): Remote Desktop Licensing Service Security Feature Bypass Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-48811](https://cve.now/CVE-2025-48811.md): Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2025-48810](https://cve.now/CVE-2025-48810.md): Windows Secure Kernel Mode Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-48809](https://cve.now/CVE-2025-48809.md): Windows Secure Kernel Mode Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-48808](https://cve.now/CVE-2025-48808.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-48806](https://cve.now/CVE-2025-48806.md): Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-48805](https://cve.now/CVE-2025-48805.md): Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-48804](https://cve.now/CVE-2025-48804.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2025-48803](https://cve.now/CVE-2025-48803.md): Windows Virtualization-Based Security (VBS) Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2025-48802](https://cve.now/CVE-2025-48802.md): Windows SMB Server Spoofing Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-48800](https://cve.now/CVE-2025-48800.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2025-48799](https://cve.now/CVE-2025-48799.md): Windows Update Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-48003](https://cve.now/CVE-2025-48003.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2025-48002](https://cve.now/CVE-2025-48002.md): Windows Hyper-V Information Disclosure Vulnerability (CVSS 5.7, Microsoft Windows)
- [CVE-2025-48001](https://cve.now/CVE-2025-48001.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2025-48000](https://cve.now/CVE-2025-48000.md): Windows Connected Devices Platform Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-47998](https://cve.now/CVE-2025-47998.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-47996](https://cve.now/CVE-2025-47996.md): Windows MBT Transport Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-47982](https://cve.now/CVE-2025-47982.md): Windows Storage VSP Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-47981](https://cve.now/CVE-2025-47981.md): SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2025-47980](https://cve.now/CVE-2025-47980.md): Windows Imaging Component Information Disclosure Vulnerability (CVSS 6.2, Microsoft Windows)
- [CVE-2025-47978](https://cve.now/CVE-2025-47978.md): Windows Kerberos Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2025-47975](https://cve.now/CVE-2025-47975.md): Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-47973](https://cve.now/CVE-2025-47973.md): Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49760](https://cve.now/CVE-2025-49760.md): Windows Storage Spoofing Vulnerability (CVSS 3.5, Microsoft Windows)
- [CVE-2025-49756](https://cve.now/CVE-2025-49756.md): Office Developer Platform Security Feature Bypass Vulnerability (CVSS 3.3, Microsoft 365 Apps for Enterprise)
- [CVE-2025-49753](https://cve.now/CVE-2025-49753.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-47178](https://cve.now/CVE-2025-47178.md): Microsoft Configuration Manager Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Configuration Manager)
- [CVE-2025-49735](https://cve.now/CVE-2025-49735.md): Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2025-49731](https://cve.now/CVE-2025-49731.md): Microsoft Teams Elevation of Privilege Vulnerability (CVSS 3.1, Microsoft Teams for Android · Microsoft Teams for Desktop +1)
- [CVE-2025-49726](https://cve.now/CVE-2025-49726.md): Windows Notification Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49723](https://cve.now/CVE-2025-49723.md): Windows StateRepository API Server file Tampering Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-49721](https://cve.now/CVE-2025-49721.md): Windows Fast FAT File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49719](https://cve.now/CVE-2025-49719.md): Microsoft SQL Server Information Disclosure Vulnerability (CVSS 7.5, Microsoft SQL Server 2016 for Service Pack · Microsoft S… +1)
- [CVE-2025-49717](https://cve.now/CVE-2025-49717.md): Microsoft SQL Server Remote Code Execution Vulnerability (CVSS 8.5, Microsoft SQL Server)
- [CVE-2025-49716](https://cve.now/CVE-2025-49716.md): Windows Netlogon Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-49711](https://cve.now/CVE-2025-49711.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-48812](https://cve.now/CVE-2025-48812.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-47994](https://cve.now/CVE-2025-47994.md): Microsoft Office Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-47993](https://cve.now/CVE-2025-47993.md): Microsoft PC Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-47991](https://cve.now/CVE-2025-47991.md): Windows Input Method Editor (IME) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49694](https://cve.now/CVE-2025-49694.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49691](https://cve.now/CVE-2025-49691.md): Windows Miracast Wireless Display Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2025-49690](https://cve.now/CVE-2025-49690.md): Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2025-49689](https://cve.now/CVE-2025-49689.md): Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49688](https://cve.now/CVE-2025-49688.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2025-49687](https://cve.now/CVE-2025-49687.md): Windows Input Method Editor (IME) Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-49686](https://cve.now/CVE-2025-49686.md): Windows TCP/IP Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49677](https://cve.now/CVE-2025-49677.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2025-49676](https://cve.now/CVE-2025-49676.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-49674](https://cve.now/CVE-2025-49674.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-49672](https://cve.now/CVE-2025-49672.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-49671](https://cve.now/CVE-2025-49671.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-49670](https://cve.now/CVE-2025-49670.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-49661](https://cve.now/CVE-2025-49661.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-49658](https://cve.now/CVE-2025-49658.md): Windows Transport Driver Interface (TDI) Translation Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-49657](https://cve.now/CVE-2025-49657.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-48824](https://cve.now/CVE-2025-48824.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-47987](https://cve.now/CVE-2025-47987.md): Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-53513](https://cve.now/CVE-2025-53513.md): Zip slip vulnerability in Juju (CVSS 8.8, Canonical Juju · github.com/juju/juju)
- [CVE-2025-47986](https://cve.now/CVE-2025-47986.md): Universal Print Management Service Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-47985](https://cve.now/CVE-2025-47985.md): Windows Event Tracing Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-47984](https://cve.now/CVE-2025-47984.md): Windows GDI Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2025-47976](https://cve.now/CVE-2025-47976.md): Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-47972](https://cve.now/CVE-2025-47972.md): Windows Input Method Editor (IME) Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2025-47971](https://cve.now/CVE-2025-47971.md): Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-21195](https://cve.now/CVE-2025-21195.md): Azure Service Fabric Runtime Elevation of Privilege Vulnerability (CVSS 6.0, Microsoft Service Fabric)
- [CVE-2025-47159](https://cve.now/CVE-2025-47159.md): Windows Virtualization-Based Security (VBS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-33054](https://cve.now/CVE-2025-33054.md): Remote Desktop Spoofing Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2025-26636](https://cve.now/CVE-2025-26636.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-36350](https://cve.now/CVE-2024-36350.md): A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting i (CVSS 5.6, AMD EPYC™ 7003 Series Processors · AMD EPYC™ 9004 Serie… +21)
- [CVE-2025-53512](https://cve.now/CVE-2025-53512.md): Sensitive log retrieval in Juju (CVSS 6.5, Canonical Juju · github.com/juju/juju)
- [CVE-2024-36348](https://cve.now/CVE-2024-36348.md): A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMI (CVSS 3.8, AMD EPYC™ 7002 Series Processors · AMD EPYC™ 7003 Serie… +30)
- [CVE-2024-36349](https://cve.now/CVE-2024-36349.md): A transient execution vulnerability in some AMD processors may allow a user process to infer TSC\_AUX even when such a read is disabled, pote (CVSS 3.8, AMD EPYC™ 7002 Series Processors · AMD EPYC™ 7003 Serie… +36)
- [CVE-2025-21168](https://cve.now/CVE-2025-21168.md): Substance3D - Designer | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance3D - Designer)
- [CVE-2025-21165](https://cve.now/CVE-2025-21165.md): Substance3D - Designer | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2025-21166](https://cve.now/CVE-2025-21166.md): Substance3D - Designer | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2025-21167](https://cve.now/CVE-2025-21167.md): Substance3D - Designer | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance3D - Designer)
- [CVE-2025-21164](https://cve.now/CVE-2025-21164.md): Substance3D - Designer | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2025-7186](https://cve.now/CVE-2025-7186.md): code-projects Chat System fetch\_chat.php sql injection (CVSS 5.3, code-projects Chat System)
- [CVE-2025-43580](https://cve.now/CVE-2025-43580.md): Audition | Access of Memory Location After End of Buffer (CWE-788) (CVSS 5.5, Adobe Audition)
- [CVE-2025-43587](https://cve.now/CVE-2025-43587.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe After Effects)
- [CVE-2025-47109](https://cve.now/CVE-2025-47109.md): After Effects | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe After Effects)
- [CVE-2025-3648](https://cve.now/CVE-2025-3648.md): Data Inference in Now Platform via Conditional ACLs (CVSS 8.2, ServiceNow Now Platform)
- [CVE-2025-7185](https://cve.now/CVE-2025-7185.md): code-projects Library System approve.php sql injection (CVSS 6.9, code-projects Library System)
- [CVE-2025-6771](https://cve.now/CVE-2025-6771.md): OS command injection in Ivanti Endpoint Manager (CVSS 7.2, Ivanti Endpoint Manager Mobile)
- [CVE-2025-0292](https://cve.now/CVE-2025-0292.md): SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacke (CVSS 5.5, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2025-0293](https://cve.now/CVE-2025-0293.md): CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticat (CVSS 6.6, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2025-5464](https://cve.now/CVE-2025-5464.md): Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to (CVSS 6.5, Ivanti Connect Secure)
- [CVE-2025-7184](https://cve.now/CVE-2025-7184.md): code-projects Library System books.php sql injection (CVSS 6.9, code-projects Library System)
- [CVE-2025-43019](https://cve.now/CVE-2025-43019.md): HP Support Assistant – Potential Escalation of Privilege (CVSS 5.8, HP Support Assistant)
- [CVE-2025-6770](https://cve.now/CVE-2025-6770.md): OS command injection in Ivanti Endpoint Manager (CVSS 7.2, Ivanti Endpoint Manager Mobile)
- [CVE-2025-5463](https://cve.now/CVE-2025-5463.md): Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version (CVSS 5.5, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2025-53545](https://cve.now/CVE-2025-53545.md): Press has a potential 2FA bypass (CVSS 6.9, frappe press)
- [CVE-2025-7183](https://cve.now/CVE-2025-7183.md): Campcodes Sales and Inventory System customer\_account.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-5451](https://cve.now/CVE-2025-5451.md): A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a rem (CVSS 4.9, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2025-2827](https://cve.now/CVE-2025-2827.md): IBM Sterling File Gateway information disclosure (CVSS 4.3, IBM Sterling File Gateway)
- [CVE-2025-5450](https://cve.now/CVE-2025-5450.md): Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure be (CVSS 6.3, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2025-2793](https://cve.now/CVE-2025-2793.md): IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting (CVSS 5.4, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2025-53480](https://cve.now/CVE-2025-53480.md): CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate (Account information tab) via unsanitized i18n messages (CVSS 5.4, Wikimedia Foundation Mediawiki - CheckUser extension)
- [CVE-2025-7037](https://cve.now/CVE-2025-7037.md): SQL injection in Ivanti Endpoint Manager (CVSS 7.2, Ivanti Endpoint Manager)
- [CVE-2025-53372](https://cve.now/CVE-2025-53372.md): node-code-sandbox-mcp has a Sandbox Escape via Command Injection (CVSS 7.5, alfonsograziano node-code-sandbox-mcp · node-code-sandbox-m…)
- [CVE-2025-3630](https://cve.now/CVE-2025-3630.md): IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting (CVSS 6.4, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2025-6996](https://cve.now/CVE-2025-6996.md): Improper Encryption in Ivanti Endpoint Manager (CVSS 8.4, Ivanti Endpoint Manager)
- [CVE-2025-6995](https://cve.now/CVE-2025-6995.md): Improper Encryption in Ivanti Endpoint Manager (CVSS 8.4, Ivanti Endpoint Manager)
- [CVE-2024-52965](https://cve.now/CVE-2024-52965.md): A missing critical step in authentication vulnerability \[CWE-304\] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2. (CVSS 6.8, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2025-24474](https://cve.now/CVE-2025-24474.md): An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability \[CWE-89\] in FortiManager 7.6.0 through (CVSS 2.6, Fortinet FortiManager · Fortinet FortiAnalyzer)
- [CVE-2024-55599](https://cve.now/CVE-2024-55599.md): An Improperly Implemented Security Check for Standard vulnerability \[CWE-358\] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all ver (CVSS 4.9, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2025-7182](https://cve.now/CVE-2025-7182.md): itsourcecode Student Transcript Processing System edit.php cross site scripting (CVSS 5.3, itsourcecode Student Transcript Processing System)
- [CVE-2025-7326](https://cve.now/CVE-2025-7326.md): EOL ASP.NET Core Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft ASP.NET Core · Microsoft.AspNetCore.Identity +12)
- [CVE-2025-36600](https://cve.now/CVE-2025-36600.md): Dell Client Platform BIOS contains an Improper Access Control Applied to Mirrored or Aliased Memory Regions vulnerability in an externally d (CVSS 8.2, Dell Client Platform BIOS)
- [CVE-2025-7181](https://cve.now/CVE-2025-7181.md): code-projects Staff Audit System test.php unrestricted upload (CVSS 5.3, code-projects Staff Audit System)
- [CVE-2025-7345](https://cve.now/CVE-2025-7345.md): Gdk‑pixbuf: heap‑buffer‑overflow in gdk‑pixbuf (CVSS 7.5, gdk-pixbuf · Red Hat Enterprise Linux)
- [CVE-2025-7180](https://cve.now/CVE-2025-7180.md): code-projects Staff Audit System login.php sql injection (CVSS 6.9, code-projects Staff Audit System)
- [CVE-2025-7179](https://cve.now/CVE-2025-7179.md): code-projects Library System add-teacher.php sql injection (CVSS 6.9, code-projects Library System)
- [CVE-2025-50130](https://cve.now/CVE-2025-50130.md): A heap-based buffer overflow vulnerability exists in VS6Sim.exe contained in V-SFT and TELLUS provided by FUJI ELECTRIC CO., LTD. (CVSS 7.8, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT-6 · F…)
- [CVE-2025-27061](https://cve.now/CVE-2025-27061.md): Out-of-bounds Write in Video (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27058](https://cve.now/CVE-2025-27058.md): Buffer Copy Without Checking Size of Input in Computer Vision (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27057](https://cve.now/CVE-2025-27057.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-27056](https://cve.now/CVE-2025-27056.md): Use After Free in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27055](https://cve.now/CVE-2025-27055.md): Buffer Over-read in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27052](https://cve.now/CVE-2025-27052.md): Buffer Copy Without Checking Size of Input in Core Services (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27051](https://cve.now/CVE-2025-27051.md): Double Free in Windows WLAN Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27050](https://cve.now/CVE-2025-27050.md): Use After Free in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27047](https://cve.now/CVE-2025-27047.md): Use After Free in Display (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27046](https://cve.now/CVE-2025-27046.md): Double Free in Display (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27044](https://cve.now/CVE-2025-27044.md): Out-of-bounds Write in Video (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27043](https://cve.now/CVE-2025-27043.md): Buffer Copy Without Checking Size of Input in Video (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27042](https://cve.now/CVE-2025-27042.md): Incorrect Calculation of Buffer Size in Video (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21466](https://cve.now/CVE-2025-21466.md): Use After Free in Display (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21454](https://cve.now/CVE-2025-21454.md): Buffer Over-read in WLAN Embedded SW (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-21450](https://cve.now/CVE-2025-21450.md): Improper Authentication in GPS\_GNSS (CVSS 9.1, Qualcomm Snapdragon)
- [CVE-2025-21449](https://cve.now/CVE-2025-21449.md): Buffer Over-read in WLAN Embedded SW (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-21446](https://cve.now/CVE-2025-21446.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-21445](https://cve.now/CVE-2025-21445.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Data HLOS - QX (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21444](https://cve.now/CVE-2025-21444.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Data HLOS - QX (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21433](https://cve.now/CVE-2025-21433.md): NULL Pointer Dereference in SPS-HLOS (CVSS 6.2, Qualcomm Snapdragon)
- [CVE-2025-21432](https://cve.now/CVE-2025-21432.md): Double Free in SPS-HLOS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21427](https://cve.now/CVE-2025-21427.md): Buffer Over-read in Data HLOS - LNX (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2025-21426](https://cve.now/CVE-2025-21426.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Camera\_Linux (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2025-21422](https://cve.now/CVE-2025-21422.md): Cryptographic Issues in Automotive (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2024-53009](https://cve.now/CVE-2024-53009.md): Improper Validation of Array Index in Automotive Autonomy (CVSS 5.3, Qualcomm Snapdragon)
- [CVE-2025-7178](https://cve.now/CVE-2025-7178.md): code-projects Food Distributor Site login.php sql injection (CVSS 6.9, code-projects Food Distributor Site)
- [CVE-2025-7177](https://cve.now/CVE-2025-7177.md): PHPGurukul Car Washing Management System editcar-washpoint.php sql injection (CVSS 5.1, PHPGurukul Car Washing Management System)
- [CVE-2025-40721](https://cve.now/CVE-2025-40721.md): Reflected Cross-site Scripting (XSS) vulnerability in Quiter Gateway (CVSS 5.1, Quiter Gateway)
- [CVE-2025-40720](https://cve.now/CVE-2025-40720.md): Reflected Cross-site Scripting (XSS) vulnerability in Quiter Gateway (CVSS 5.1, Quiter Gateway)
- [CVE-2025-40719](https://cve.now/CVE-2025-40719.md): Reflected Cross-site Scripting (XSS) vulnerability in Quiter Gateway (CVSS 5.1, Quiter Gateway)
- [CVE-2025-40718](https://cve.now/CVE-2025-40718.md): Improper error handling vulnerability in Quiter Gateway (CVSS 6.9, Quiter Gateway)
- [CVE-2025-40717](https://cve.now/CVE-2025-40717.md): SQL injection vulnerability in Quiter Gateway (CVSS 9.3, Quiter Gateway)
- [CVE-2025-40716](https://cve.now/CVE-2025-40716.md): SQL injection vulnerability in Quiter Gateway (CVSS 9.3, Quiter Gateway)
- [CVE-2025-40715](https://cve.now/CVE-2025-40715.md): SQL injection vulnerability in Quiter Gateway (CVSS 9.3, Quiter Gateway)
- [CVE-2025-40714](https://cve.now/CVE-2025-40714.md): SQL injection vulnerability in Quiter Gateway (CVSS 9.3, Quiter Gateway)
- [CVE-2025-40713](https://cve.now/CVE-2025-40713.md): SQL injection vulnerability in Quiter Gateway (CVSS 9.3, Quiter Gateway)
- [CVE-2025-40712](https://cve.now/CVE-2025-40712.md): SQL injection vulnerability in Quiter Gateway (CVSS 9.3, Quiter Gateway)
- [CVE-2025-40711](https://cve.now/CVE-2025-40711.md): SQL injection vulnerability in Quiter Gateway (CVSS 9.3, Quiter Gateway)
- [CVE-2025-7176](https://cve.now/CVE-2025-7176.md): PHPGurukul Hospital Management System view-medhistory.php sql injection (CVSS 6.9, PHPGurukul Hospital Management System)
- [CVE-2025-7175](https://cve.now/CVE-2025-7175.md): code-projects E-Commerce Site users\_photo.php unrestricted upload (CVSS 5.3, code-projects E-Commerce Site)
- [CVE-2025-41224](https://cve.now/CVE-2025-41224.md): A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions \< V5.10.0), RUGGEDCOM RMC8388NC V5.X (All versions \< V5.10.0), R (CVSS 8.8, Siemens RUGGEDCOM RMC8388 V5.X · Siemens RUGGEDCOM RMC8… +32)
- [CVE-2025-41223](https://cve.now/CVE-2025-41223.md): A vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (All versions), RUGGEDCO (CVSS 4.8, Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i801 +64)
- [CVE-2025-41222](https://cve.now/CVE-2025-41222.md): A vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (All versions), RUGGEDCO (CVSS 5.3, Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i801 +64)
- [CVE-2025-40742](https://cve.now/CVE-2025-40742.md): A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions \< V11.0), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 (CVSS 5.3, Siemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +36)
- [CVE-2025-40741](https://cve.now/CVE-2025-40741.md): A vulnerability has been identified in Solid Edge SE2025 (All versions \< V225.0 Update 5). (CVSS 7.8, Siemens Solid Edge SE2025)
- [CVE-2025-40740](https://cve.now/CVE-2025-40740.md): A vulnerability has been identified in Solid Edge SE2025 (All versions \< V225.0 Update 5). (CVSS 7.8, Siemens Solid Edge SE2025)
- [CVE-2025-40739](https://cve.now/CVE-2025-40739.md): A vulnerability has been identified in Solid Edge SE2025 (All versions \< V225.0 Update 5). (CVSS 7.8, Siemens Solid Edge SE2025)
- [CVE-2025-40738](https://cve.now/CVE-2025-40738.md): A vulnerability has been identified in SINEC NMS (All versions \< V4.0). (CVSS 8.8, Siemens SINEC NMS)
- [CVE-2025-40737](https://cve.now/CVE-2025-40737.md): A vulnerability has been identified in SINEC NMS (All versions \< V4.0). (CVSS 8.8, Siemens SINEC NMS)
- [CVE-2025-40736](https://cve.now/CVE-2025-40736.md): A vulnerability has been identified in SINEC NMS (All versions \< V4.0). (CVSS 9.8, Siemens SINEC NMS)
- [CVE-2025-40735](https://cve.now/CVE-2025-40735.md): A vulnerability has been identified in SINEC NMS (All versions \< V4.0). (CVSS 8.8, Siemens SINEC NMS)
- [CVE-2025-40593](https://cve.now/CVE-2025-40593.md): A vulnerability has been identified in SIMATIC CN 4100 (All versions \< V4.0). (CVSS 6.5, Siemens SIMATIC CN)
- [CVE-2025-21009](https://cve.now/CVE-2025-21009.md): Out-of-bounds read in decoding malformed frame header in libsavsvc.so prior to Android 15 allows local attackers to cause memory corruption. (CVSS 5.5, Samsung Mobile libsavsvc.so)
- [CVE-2025-21008](https://cve.now/CVE-2025-21008.md): Out-of-bounds read in decoding frame header in libsavsvc.so prior to Android 15 allows local attackers to cause memory corruption. (CVSS 5.5, Samsung Mobile libsavsvc.so)
- [CVE-2025-21007](https://cve.now/CVE-2025-21007.md): Out-of-bounds write in accessing uninitialized memory in libsavsvc.so prior to Android 15 allows local attackers to cause memory corruption. (CVSS 5.5, Samsung Mobile libsavsvc.so)
- [CVE-2025-21006](https://cve.now/CVE-2025-21006.md): Out-of-bounds write in handling of macro blocks for MPEG4 codec in libsavsvc.so prior to Android 15 allows local attackers to write out-of-b (CVSS 7.0, Samsung Mobile libsavsvc.so)
- [CVE-2025-21005](https://cve.now/CVE-2025-21005.md): Improper access control in isemtelephony prior to Android 15 allows local attackers to access sensitive information. (CVSS 5.5, Samsung Mobile isemtelephony)
- [CVE-2025-21004](https://cve.now/CVE-2025-21004.md): Improper verification of intent by broadcast receiver in System UI for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers t (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2025-21003](https://cve.now/CVE-2025-21003.md): Insecure storage of sensitive information in Emergency SOS prior to SMR Jul-2025 Release 1 allows local attackers to access sensitive inform (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21002](https://cve.now/CVE-2025-21002.md): Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to manipulate broadcasting Auracast. (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2025-27127](https://cve.now/CVE-2025-27127.md): A vulnerability has been identified in TIA Project-Server (All versions \< V2.1.1), TIA Project-Server V17 (All versions), Totally Integrated (CVSS 4.3, Siemens TIA Project-Server · Siemens Totally Integrated Aut…)
- [CVE-2025-21001](https://cve.now/CVE-2025-21001.md): Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to stop broadcasting Auracast. (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2025-23365](https://cve.now/CVE-2025-23365.md): A vulnerability has been identified in TIA Administrator (All versions \< V3.0.6). (CVSS 7.8, Siemens TIA Administrator)
- [CVE-2025-21000](https://cve.now/CVE-2025-21000.md): Improper privilege management in Bluetooth prior to SMR Jul-2025 Release 1 allows local attackers to enable Bluetooth. (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2025-20999](https://cve.now/CVE-2025-20999.md): Improper authorization in accessing saved Wi-Fi password for Galaxy Tablet prior to SMR Jul-2025 Release 1 allows secondary users to access (CVSS 4.1, Samsung Mobile Devices)
- [CVE-2025-23364](https://cve.now/CVE-2025-23364.md): A vulnerability has been identified in TIA Administrator (All versions \< V3.0.6). (CVSS 6.2, Siemens TIA Administrator)
- [CVE-2025-20998](https://cve.now/CVE-2025-20998.md): Improper access control in SamsungAccount for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to access phone number. (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-20997](https://cve.now/CVE-2025-20997.md): Incorrect default permission in Framework for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to reset some configuratio (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-31854](https://cve.now/CVE-2024-31854.md): A vulnerability has been identified in SICAM TOOLBOX II (All versions \< V07.11). (CVSS 8.1, Siemens SICAM TOOLBOX II)
- [CVE-2024-31853](https://cve.now/CVE-2024-31853.md): A vulnerability has been identified in SICAM TOOLBOX II (All versions \< V07.11). (CVSS 8.1, Siemens SICAM TOOLBOX II)
- [CVE-2025-20983](https://cve.now/CVE-2025-20983.md): Out-of-bounds write in checking auth secret in KnoxVault trustlet prior to SMR Jul-2025 Release 1 allows local privileged attackers to write (CVSS 6.4, Samsung Mobile Devices)
- [CVE-2025-20982](https://cve.now/CVE-2025-20982.md): Out-of-bounds write in setting auth secret in KnoxVault trustlet prior to SMR Jul-2025 Release 1 allows local privileged attackers to write (CVSS 6.4, Samsung Mobile Devices)
- [CVE-2023-52236](https://cve.now/CVE-2023-52236.md): A vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (All versions), RUGGEDCO (CVSS 7.0, Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i801 +64)
- [CVE-2025-7174](https://cve.now/CVE-2025-7174.md): code-projects Library System teacher-issue-book.php sql injection (CVSS 6.9, code-projects Library System)
- [CVE-2025-7173](https://cve.now/CVE-2025-7173.md): code-projects Library System add-student.php sql injection (CVSS 6.9, code-projects Library System)
- [CVE-2025-7172](https://cve.now/CVE-2025-7172.md): code-projects Crime Reporting System headlogin.php sql injection (CVSS 6.9, code-projects Crime Reporting System)
- [CVE-2025-6744](https://cve.now/CVE-2025-6744.md): Woodmart \<= 8.2.3 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, xTemos Woodmart)
- [CVE-2025-7171](https://cve.now/CVE-2025-7171.md): code-projects Crime Reporting System policelogin.php sql injection (CVSS 6.9, code-projects Crime Reporting System)
- [CVE-2025-7170](https://cve.now/CVE-2025-7170.md): code-projects Crime Reporting System registration.php sql injection (CVSS 6.9, code-projects Crime Reporting System)
- [CVE-2025-7169](https://cve.now/CVE-2025-7169.md): code-projects Crime Reporting System complainer\_page.php sql injection (CVSS 6.9, code-projects Crime Reporting System)
- [CVE-2025-38237](https://cve.now/CVE-2025-38237.md): media: platform: exynos4-is: Add hardware sync wait to fimc\_is\_hw\_change\_mode() (no CVSS, Linux)
- [CVE-2025-38236](https://cve.now/CVE-2025-38236.md): af\_unix: Don't leave consecutive consumed OOB skbs. (CVSS 7.8, Linux · :linux\_kernel:)
- [CVE-2025-7168](https://cve.now/CVE-2025-7168.md): code-projects Crime Reporting System userlogin.php sql injection (CVSS 6.9, code-projects Crime Reporting System)
- [CVE-2025-7346](https://cve.now/CVE-2025-7346.md): Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages (CVSS 8.7, Pyload · pyload-ng)
- [CVE-2025-41668](https://cve.now/CVE-2025-41668.md): Phoenix Contact: File access due to the replacement of a critical file used by the service security-profile (CVSS 8.8, PHOENIX CONTACT AXC F · PHOENIX CONTACT BPC +1)
- [CVE-2025-41667](https://cve.now/CVE-2025-41667.md): Phoenix Contact: File access due to the replacement of a critical file used by the arp-preinit script (CVSS 8.8, PHOENIX CONTACT AXC F · PHOENIX CONTACT BPC +1)
- [CVE-2025-41666](https://cve.now/CVE-2025-41666.md): Phoenix Contact: File access due to the replacement of a critical file used by the watchdog (CVSS 8.8, PHOENIX CONTACT AXC F · PHOENIX CONTACT BPC +1)
- [CVE-2025-41665](https://cve.now/CVE-2025-41665.md): Phoenix Contact: DoS of the PLC due to incorrect default permissions possible (CVSS 6.5, PHOENIX CONTACT AXC F · PHOENIX CONTACT BPC +1)
- [CVE-2025-7167](https://cve.now/CVE-2025-7167.md): code-projects Responsive Blog Site category.php sql injection (CVSS 5.3, code-projects Responsive Blog Site)
- [CVE-2025-25271](https://cve.now/CVE-2025-25271.md): OCPP Backend Configuration via Insecure Defaults (CVSS 8.8, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2025-25270](https://cve.now/CVE-2025-25270.md): Remote Code Execution via Unauthenticated Configuration Manipulation (CVSS 9.8, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2025-25269](https://cve.now/CVE-2025-25269.md): Local Privilege Escalation via Unauthenticated Command Injection (CVSS 8.4, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2025-25268](https://cve.now/CVE-2025-25268.md): Unauthenticated Configuration Access via Exposed API Endpoint (CVSS 8.8, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2025-24006](https://cve.now/CVE-2025-24006.md): Privilege Escalation via Insecure SSH Permissions (CVSS 7.8, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2025-24005](https://cve.now/CVE-2025-24005.md): Local Privilege Escalation via Vulnerable SSH Script (CVSS 7.8, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2025-24004](https://cve.now/CVE-2025-24004.md): USB-C Buffer Overflow via Display Interface in EV Charging Stations (CVSS 5.2, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2025-24003](https://cve.now/CVE-2025-24003.md): MQTT OOB Write Vulnerability in EichrechtAgents of German EV Charging Stations (CVSS 8.2, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2025-24002](https://cve.now/CVE-2025-24002.md): MQTT DoS Vulnerability in German EV Charging Stations (CVSS 5.3, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2025-42956](https://cve.now/CVE-2025-42956.md): Multiple vulnerabilities in SAP NetWeaver Application Server ABAP (CVSS 6.1, SAP SE SAP NetWeaver Application Server ABAP)
- [CVE-2025-6746](https://cve.now/CVE-2025-6746.md): WoodMart \<= 8.2.3 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, xTemos Woodmart)
- [CVE-2025-6743](https://cve.now/CVE-2025-6743.md): WoodMart \<= 8.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, xTemos Woodmart)
- [CVE-2025-7166](https://cve.now/CVE-2025-7166.md): code-projects Responsive Blog Site single.php sql injection (CVSS 5.3, code-projects Responsive Blog Site)
- [CVE-2025-7165](https://cve.now/CVE-2025-7165.md): PHPGurukul/Campcodes Cyber Cafe Management System forgot-password.php sql injection (CVSS 6.9, PHPGurukul Cyber Cafe Management System · Campcodes Cyber C…)
- [CVE-2025-7164](https://cve.now/CVE-2025-7164.md): PHPGurukul/Campcodes Cyber Cafe Management System index.php sql injection (CVSS 6.9, PHPGurukul Cyber Cafe Management System · Campcodes Cyber C…)
- [CVE-2025-7327](https://cve.now/CVE-2025-7327.md): Widget for Google Reviews \<= 1.0.15 - Authenticated (Subscriber+) Directory Traversal to Local File Inclusion (CVSS 8.8, techlabpro1 Widget for Google Reviews)
- [CVE-2025-7163](https://cve.now/CVE-2025-7163.md): PHPGurukul Zoo Management System add-animals.php sql injection (CVSS 5.3, PHPGurukul Zoo Management System)
- [CVE-2025-7162](https://cve.now/CVE-2025-7162.md): PHPGurukul Zoo Management System add-foreigners-ticket.php sql injection (CVSS 5.3, PHPGurukul Zoo Management System)
- [CVE-2025-5957](https://cve.now/CVE-2025-5957.md): Guest Support – Complete customer support ticket system for WordPress \<= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion (CVSS 5.3, rcatheme Guest Support)
- [CVE-2025-5537](https://cve.now/CVE-2025-5537.md): Lightbox & Modal Popup WordPress Plugin – FooBox \<= 2.7.34 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox)
- [CVE-2025-7161](https://cve.now/CVE-2025-7161.md): PHPGurukul Zoo Management System add-normal-ticket.php sql injection (CVSS 5.3, PHPGurukul Zoo Management System)
- [CVE-2025-7160](https://cve.now/CVE-2025-7160.md): PHPGurukul Zoo Management System index.php sql injection (CVSS 6.9, PHPGurukul Zoo Management System)
- [CVE-2025-7159](https://cve.now/CVE-2025-7159.md): PHPGurukul Zoo Management System manage-animals.php sql injection (CVSS 5.3, PHPGurukul Zoo Management System)
- [CVE-2025-7158](https://cve.now/CVE-2025-7158.md): PHPGurukul Zoo Management System manage-normal-ticket.php sql injection (CVSS 5.3, PHPGurukul Zoo Management System)
- [CVE-2025-7157](https://cve.now/CVE-2025-7157.md): code-projects Online Note Sharing login.php sql injection (CVSS 6.9, code-projects Online Note Sharing)
- [CVE-2025-20695](https://cve.now/CVE-2025-20695.md): In Bluetooth FW, there is a possible system crash due to an uncaught exception. (CVSS 6.5, MediaTek MT6639, MT6653, MT6985, MT6989, MT6990, MT6991, MT…)
- [CVE-2025-20694](https://cve.now/CVE-2025-20694.md): In Bluetooth FW, there is a possible system crash due to an uncaught exception. (CVSS 6.5, MediaTek MT2718, MT6639, MT6653, MT6985, MT6989, MT6990, MT…)
- [CVE-2025-20693](https://cve.now/CVE-2025-20693.md): In wlan STA driver, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 6.5, MediaTek MT2737, MT6835, MT6878, MT6886, MT6897, MT6899, MT…)
- [CVE-2025-20692](https://cve.now/CVE-2025-20692.md): In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 5.5, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT…)
- [CVE-2025-20691](https://cve.now/CVE-2025-20691.md): In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 5.5, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT…)
- [CVE-2025-20690](https://cve.now/CVE-2025-20690.md): In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 5.5, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT…)
- [CVE-2025-20689](https://cve.now/CVE-2025-20689.md): In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 5.5, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT…)
- [CVE-2025-20688](https://cve.now/CVE-2025-20688.md): In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 5.5, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT…)
- [CVE-2025-20687](https://cve.now/CVE-2025-20687.md): In Bluetooth driver, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 5.5, MediaTek MT7902, MT7920, MT7921, MT7922, MT7925, MT7927)
- [CVE-2025-20686](https://cve.now/CVE-2025-20686.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 8.8, MediaTek MT6890, MT7915, MT7916, MT7981, MT7986)
- [CVE-2025-20685](https://cve.now/CVE-2025-20685.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 8.8, MediaTek MT6890, MT7915, MT7916, MT7981, MT7986)
- [CVE-2025-20684](https://cve.now/CVE-2025-20684.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 9.8, MediaTek MT7615, MT7622, MT7663)
- [CVE-2025-20683](https://cve.now/CVE-2025-20683.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 9.8, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT…)
- [CVE-2025-20682](https://cve.now/CVE-2025-20682.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 9.8, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915, MT7916, MT…)
- [CVE-2025-20681](https://cve.now/CVE-2025-20681.md): In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 9.8, MediaTek MT6890, MT7615, MT7622, MT7663, MT7915)
- [CVE-2025-20680](https://cve.now/CVE-2025-20680.md): In Bluetooth driver, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 9.8, MediaTek MT7902, MT7920, MT7921, MT7922, MT7925, MT7927)
- [CVE-2025-5570](https://cve.now/CVE-2025-5570.md): AI Engine \<= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \`mwai\_chatbot\` Shortcode \`id\` Parameter (CVSS 5.4, tigroumeow AI Engine – The Chatbot, AI Framework & MCP for…)
- [CVE-2025-6244](https://cve.now/CVE-2025-6244.md): Essential Addons for Elementor – Popular Elementor Templates and Widgets \<= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via \`Calendar\` And \`Business Reviews\` Widgets (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2025-7156](https://cve.now/CVE-2025-7156.md): hitsz-ids airda completions execute sql injection (CVSS 5.3, hitsz-ids airda)
- [CVE-2025-7146](https://cve.now/CVE-2025-7146.md): Jhenggao iPublish System - Arbitrary File Reading through Path Traversal (CVSS 7.5, Jhenggao iPublish System)
- [CVE-2025-7155](https://cve.now/CVE-2025-7155.md): PHPGurukul Online Notes Sharing System Cookie Dashboard sql injection (CVSS 6.9, PHPGurukul Online Notes Sharing System)
- [CVE-2025-43001](https://cve.now/CVE-2025-43001.md): Multiple Privilege Escalation Vulnerabilities in SAPCAR (CVSS 6.9, SAP\_SE SAPCAR)
- [CVE-2025-42992](https://cve.now/CVE-2025-42992.md): Multiple Privilege Escalation Vulnerabilities in SAPCAR (CVSS 6.9, SAP\_SE SAPCAR)
- [CVE-2025-42986](https://cve.now/CVE-2025-42986.md): Missing Authorization check in SAP NetWeaver and ABAP Platform (CVSS 4.3, SAP\_SE SAP NetWeaver and ABAP Platform)
- [CVE-2025-42985](https://cve.now/CVE-2025-42985.md): Open Redirect vulnerability in SAP BusinessObjects Content Administrator workbench (CVSS 6.1, SAP\_SE SAP BusinessObjects Content Administrator workbench)
- [CVE-2025-42981](https://cve.now/CVE-2025-42981.md): Multiple vulnerabilities in SAP NetWeaver Application Server ABAP (CVSS 6.1, SAP\_SE SAP NetWeaver Application Server ABAP)
- [CVE-2025-42980](https://cve.now/CVE-2025-42980.md): Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network (CVSS 9.1, SAP\_SE SAP NetWeaver Enterprise Portal Federated Portal Net…)
- [CVE-2025-42979](https://cve.now/CVE-2025-42979.md): Insecure Key & Secret Management vulnerability in SAP GUI for Windows (CVSS 5.6, SAP\_SE SAP GUI for Windows)
- [CVE-2025-42978](https://cve.now/CVE-2025-42978.md): Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java (CVSS 3.5, SAP\_SE SAP NetWeaver Application Server Java)
- [CVE-2025-42974](https://cve.now/CVE-2025-42974.md): Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) (CVSS 4.3, SAP\_SE SAP NetWeaver and ABAP Platform)
- [CVE-2025-42973](https://cve.now/CVE-2025-42973.md): Cross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report) (CVSS 5.4, SAP\_SE SAP Data Services)
- [CVE-2025-42971](https://cve.now/CVE-2025-42971.md): Memory Corruption vulnerability in SAPCAR (CVSS 4.0, SAP\_SE SAPCAR)
- [CVE-2025-42970](https://cve.now/CVE-2025-42970.md): Directory Traversal vulnerability in SAPCAR (CVSS 5.8, SAP\_SE SAPCAR)
- [CVE-2025-42969](https://cve.now/CVE-2025-42969.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform (CVSS 6.1, SAP\_SE SAP NetWeaver Application Server ABAP and ABAP Platf…)
- [CVE-2025-42968](https://cve.now/CVE-2025-42968.md): Missing Authorization check in SAP NetWeaver (RFC enabled function module) (CVSS 5.0, SAP\_SE SAP NetWeaver)
- [CVE-2025-42967](https://cve.now/CVE-2025-42967.md): Code Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation) (CVSS 9.9, SAP\_SE SAP S/4HANA and SAP SCM)
- [CVE-2025-42966](https://cve.now/CVE-2025-42966.md): Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service) (CVSS 9.1, SAP\_SE SAP NetWeaver)
- [CVE-2025-42965](https://cve.now/CVE-2025-42965.md): Server Side Request Forgery(SSRF) vulnerability in SAP BusinessObjects BI Platform Central Management Console Promotion Management Application (CVSS 4.1, SAP\_SE SAP BusinessObjects BI Platform Central Management C…)
- [CVE-2025-42964](https://cve.now/CVE-2025-42964.md): Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration (CVSS 9.1, SAP\_SE SAP NetWeaver Enterprise Portal Administration)
- [CVE-2025-42963](https://cve.now/CVE-2025-42963.md): Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer ) (CVSS 9.1, SAP\_SE SAP NetWeaver Application Server for Java)
- [CVE-2025-42962](https://cve.now/CVE-2025-42962.md): Cross-Site Scripting (XSS) vulnerability in SAP Business Warehouse (Business Explorer Web 3.5 loading animation) (CVSS 6.1, SAP\_SE SAP Business Warehouse)
- [CVE-2025-42961](https://cve.now/CVE-2025-42961.md): Missing Authorization check in SAP NetWeaver Application Server for ABAP (CVSS 4.9, SAP\_SE SAP NetWeaver Application Server for ABAP)
- [CVE-2025-42960](https://cve.now/CVE-2025-42960.md): Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA BEx Tools (CVSS 4.3, SAP\_SE SAP Business Warehouse and SAP BW/4HANA BEx Tools)
- [CVE-2025-42959](https://cve.now/CVE-2025-42959.md): Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476 (CVSS 8.1, SAP\_SE SAP NetWeaver ABAP Server and ABAP Platform)
- [CVE-2025-42954](https://cve.now/CVE-2025-42954.md): Denial of service (DOS) in SAP NetWeaver Business Warehouse (CCAW application) (CVSS 2.7, SAP\_SE SAP NetWeaver Business Warehouse)
- [CVE-2025-42953](https://cve.now/CVE-2025-42953.md): Missing Authorization check in SAP NetWeaver Application Server for ABAP (CVSS 8.1, SAP\_SE SAP NetWeaver Application Server for ABAP)
- [CVE-2025-42952](https://cve.now/CVE-2025-42952.md): Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis (CVSS 7.7, SAP\_SE SAP Business Warehouse and SAP Plug-In Basis)
- [CVE-2025-31326](https://cve.now/CVE-2025-31326.md): HTML Injection vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) (CVSS 4.1, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2025-7154](https://cve.now/CVE-2025-7154.md): TOTOLINK N200RE cstecgi.cgi sub\_41A0F8 os command injection (CVSS 5.3, TOTOLINK N200RE)
- [CVE-2025-7153](https://cve.now/CVE-2025-7153.md): CodeAstro Simple Hospital Management System POST Parameter doctor.html cross site scripting (CVSS 5.1, CodeAstro Simple Hospital Management System)
- [CVE-2025-29267](https://cve.now/CVE-2025-29267.md): SQL Injection vulnerability in Abis, Inc Adjutant Core Accounting ERP build v.PreBeta250F allows a remote attacker to obtain a sensitive inf (CVSS 6.5)
- [CVE-2025-47422](https://cve.now/CVE-2025-47422.md): Advanced Installer before 22.6 has an uncontrolled search path element local privilege escalation vulnerability. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.