CVEs published July 9, 2025
110 CVEs were published on July 9, 2025: 10 critical, 24 high.
- Published
- 110
- Critical
- 10
- High
- 24
- Medium
- 61
- Low
- 2
- Unrated
- 13
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- Linux
- 26
- Radiflow iSAP Smart Collector
- 5
- Campcodes Payroll Management System
- 4
- FNKvision FNK-GU2
- 3
- Jenkins Project Jenkins Applitools Eyes Plugin · org.jenkin…
- 3
- netweblogic Events Manager – Calendar, Bookings, Tickets, a…
- 3
- 9fans plan9port
- 2
- ASUSTOR ADM
- 2
- brainstormforce SureForms – Drag and Drop Form Builder for…
- 2
- Jenkins Project Jenkins Apica Loadtest Plugin · com.apica:A…
- 2
Critical 10
- CVE-2025-53624docusaurus-plugin-content-gists Exposes GitHub Personal Access Tokenwebbertakken docusaurus-plugin-content-gists · docusaurus-p…
- CVE-2025-53620Crashing any Qwik ServerQwikDev qwik · @builder.io/qwik-city
- CVE-2025-53546Folo allows secrets exfiltration via `pull_request_target`RSSNext Folo
- CVE-2025-6514OS command injection in mcp-remote when connecting to untrusted MCP serversmcp-remote
- CVE-2025-38264nvme-tcp: sanitize request list handlingLinux
- CVE-2025-38246bnxt: properly flush XDP redirect listsLinux
- CVE-2025-3499Unauthenticated execution of arbitrary commands in Radiflow iSAP Smart CollectorRadiflow iSAP Smart Collector
- CVE-2025-3498Unauthenticated modification of Radiflow iSAP Smart Collector configurationRadiflow iSAP Smart Collector
- CVE-2025-4606Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeoveruxper Sala - Startup & SaaS WordPress Theme
- CVE-2025-34077WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCEGenetech Solutions WordPress Pie Register Plugin
High 24
- CVE-2025-0141GlobalProtect App: Privilege Escalation (PE) VulnerabilityPalo Alto Networks GlobalProtect App · Palo Alto Networks G…
- CVE-2025-6970Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameternetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2025-6376Arena® Simulation Out-Of-Bounds Write Remote Code Execution VulnerabilityRockwell Automation Arena®
- CVE-2025-6377Arena® Simulation Out-Of-Bounds Write Remote Code Execution VulnerabilityRockwell Automation Arena®
- CVE-2025-53548@clerk/backend Performs Insufficient Verification of Data Authenticityclerk javascript · @clerk/backend +8
- CVE-2025-53652Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches oJenkins Project Jenkins Git Parameter Plugin · org.jenkins-…
- CVE-2025-53650Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present Jenkins Project Jenkins Credentials Binding Plugin · org.je…
- CVE-2025-38262tty: serial: uartlite: register uart driver in initLinux
- CVE-2025-38261riscv: save the SR_SUM status over switchesLinux
- CVE-2025-38257s390/pkey: Prevent overflow in size calculation for memdup_user()Linux
- CVE-2025-38253HID: wacom: fix crash in wacom_aes_battery_handler()Linux
- CVE-2025-38252cxl/ras: Fix CPER handler device confusionLinux
- CVE-2025-38250Bluetooth: hci_core: Fix use-after-free in vhci_flush()Linux
- CVE-2025-38248bridge: mcast: Fix use-after-free during router port configurationLinux
- CVE-2025-38244smb: client: fix potential deadlock when reconnecting channelsLinux
- CVE-2025-38242mm: userfaultfd: fix race of userfaultfd_move and swap cacheLinux
- CVE-2025-38239scsi: megaraid_sas: Fix invalid node indexLinux
- CVE-2025-38238scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times outLinux
- CVE-2025-3497Radiflow iSAP Smart Collector Linux distribution unmaintainedRadiflow iSAP Smart Collector
- CVE-2025-6691SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletionbrainstormforce SureForms – Drag and Drop Form Builder for…
- CVE-2025-6742SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletionbrainstormforce SureForms – Drag and Drop Form Builder for…
- CVE-2025-44177A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endp
- CVE-2025-52364Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service (telnetd) by default at boot via the initi
- CVE-2025-53645Zimbra Collaboration (ZCS) before 9.0.0 Patch 46, 10.0.x before 10.0.15, and 10.1.x before 10.1.9 is vulnerable to a denial of service condi
Medium, low and unrated 76
- CVE-2025-0140GlobalProtect App: Non Admin User Can Disable the GlobalProtect AppPalo Alto Networks GlobalProtect App · Palo Alto Networks G…
- CVE-2025-0139Autonomous Digital Experience Manager: Privilege Escalation (PE) VulnerabilityPalo Alto Networks Autonomous Digital Experience Manager
- CVE-2025-6976Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodesnetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2025-6975Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameternetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2025-36599Dell PowerFlex Manager VM, versions prior to 4.6.2.1, contains an Insertion of Sensitive Information into Log File vulnerability.Dell PowerFlex Manager VM
- CVE-2025-53743Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the Jenkins Project Jenkins Applitools Eyes Plugin · org.jenkin…
- CVE-2025-53742Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, Jenkins Project Jenkins Applitools Eyes Plugin · org.jenkin…
- CVE-2025-53678Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins contJenkins Project Jenkins User1st uTester Plugin · io.jenkins…
- CVE-2025-53677Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential forJenkins Project Jenkins Xooa Plugin · io.jenkins.plugins:xo…
- CVE-2025-53676Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controlleJenkins Project Jenkins Xooa Plugin · io.jenkins.plugins:xo…
- CVE-2025-53675Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they Jenkins Project Jenkins Warrior Framework Plugin · org.jenk…
- CVE-2025-53674Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, inJenkins Project Jenkins Sensedia Api Platform tools Plugin…
- CVE-2025-53673Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration filJenkins Project Jenkins Sensedia Api Platform tools Plugin…
- CVE-2025-53672Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controllJenkins Project Jenkins Kryptowire Plugin · io.jenkins.plug…
- CVE-2025-53671Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job confJenkins Project Jenkins Nouvola DiveCloud Plugin · org.jenk…
- CVE-2025-53670Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml fiJenkins Project Jenkins Nouvola DiveCloud Plugin · org.jenk…
- CVE-2025-53669Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential fJenkins Project Jenkins VAddy Plugin · org.jenkins-ci.plugi…
- CVE-2025-53668Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they Jenkins Project Jenkins VAddy Plugin · org.jenkins-ci.plugi…
- CVE-2025-53667Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potentiaJenkins Project Jenkins Dead Man's Snitch Plugin · org.jenk…
- CVE-2025-53666Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where thJenkins Project Jenkins Dead Man's Snitch Plugin · org.jenk…
- CVE-2025-53665Jenkins Apica Loadtest Plugin 1.10 and earlier does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration forJenkins Project Jenkins Apica Loadtest Plugin · com.apica:A…
- CVE-2025-53664Jenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the JeJenkins Project Jenkins Apica Loadtest Plugin · com.apica:A…
- CVE-2025-53663Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the JenkinsJenkins Project Jenkins IBM Cloud DevOps Plugin · com.ibm.d…
- CVE-2025-53662Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins contrJenkins Project Jenkins IFTTT Build Notifier Plugin · org.j…
- CVE-2025-53661Jenkins Testsigma Test Plan run Plugin 1.6 and earlier does not mask Testsigma API keys displayed on the job configuration form, increasing Jenkins Project Jenkins Testsigma Test Plan run Plugin · io…
- CVE-2025-53660Jenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job configuration form, incJenkins Project Jenkins QMetry Test Management Plugin · org…
- CVE-2025-53659Jenkins QMetry Test Management Plugin 1.13 and earlier stores Qmetry Automation API Keys unencrypted in job config.xml files on the Jenkins Jenkins Project Jenkins QMetry Test Management Plugin · org…
- CVE-2025-53658Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page, resulting in a stored cross-site scrJenkins Project Jenkins Applitools Eyes Plugin · org.jenkin…
- CVE-2025-53657Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier does not mask SLM License Access Keys, client secrets, and passwords displayed oJenkins Project Jenkins ReadyAPI Functional Testing Plugin…
- CVE-2025-53656Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in jobJenkins Project Jenkins ReadyAPI Functional Testing Plugin…
- CVE-2025-53655Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potenJenkins Project Jenkins Statistics Gatherer Plugin · org.je…
- CVE-2025-53654Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins cJenkins Project Jenkins Statistics Gatherer Plugin · org.je…
- CVE-2025-53653Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job config.xml files on the JenkinsJenkins Project Jenkins Aqua Security Scanner Plugin · org.…
- CVE-2025-53651Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTMJenkins Project Jenkins HTML Publisher Plugin · org.jenkins…
- CVE-2025-7381Exposure of sensitive PHP information to an unauthorized control sphere in mautic/mautic imagesDocker Mautic
- CVE-2025-7204Exposure of password hashes via API responses in ConnectWise PSAConnectWise PSA
- CVE-2025-1112IBM OpenPages with Watson information disclosureIBM OpenPages with Watson
- CVE-2025-2670IBM OpenPages information disclosureIBM OpenPages
- CVE-2025-38263bcache: fix NULL pointer in cache_set_flush()Linux
- CVE-2025-38260btrfs: handle csum tree error with rescue=ibadroots correctlyLinux
- CVE-2025-38259ASoC: codecs: wcd9335: Fix missing free of regulator suppliesLinux
- CVE-2025-38258mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on writeLinux
- CVE-2025-38256io_uring/rsrc: fix folio unpinningLinux
- CVE-2025-38255lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()Linux
- CVE-2025-38254drm/amd/display: Add sanity checks for drm_edid_raw()Linux
- CVE-2025-38251atm: clip: prevent NULL deref in clip_push()Linux
- CVE-2025-38249ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()Linux
- CVE-2025-38247userns and mnt_idmap leak in open_tree_attr(2)Linux
- CVE-2025-38245atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().Linux
- CVE-2025-38243btrfs: fix invalid inode pointer dereferences during log replayLinux
- CVE-2025-38241mm/shmem, swap: fix softlockup with mTHP swapinLinux
- CVE-2025-27028Read access of deprivileged Radiflow iSAP Smart Collector userRadiflow iSAP Smart Collector
- CVE-2025-27027Restricted shell evasion in Radiflow iSAP Smart CollectorRadiflow iSAP Smart Collector
- CVE-2025-7379A security bypass vulnerability was found in DataSync Center installed on ADMASUSTOR ADM
- CVE-2025-7378An improper input validation vulnerability was found on manipulating configuration of ADMASUSTOR ADM
- CVE-2025-7220Campcodes Payroll Management System ajax.php sql injectionCampcodes Payroll Management System
- CVE-2025-7219Campcodes Payroll Management System ajax.php sql injectionCampcodes Payroll Management System
- CVE-2025-7218Campcodes Payroll Management System ajax.php sql injectionCampcodes Payroll Management System
- CVE-2025-7217Campcodes Payroll Management System ajax.php sql injectionCampcodes Payroll Management System
- CVE-2025-7216lty628 Aidigu PHP Object common.php checkUserCookie deserializationlty628 Aidigu
- CVE-2025-7215FNKvision FNK-GU2 wpa_supplicant.conf cleartext storageFNKvision FNK-GU2
- CVE-2025-7214FNKvision FNK-GU2 MD5 shadow risky encryptionFNKvision FNK-GU2
- CVE-2025-7059Simple Featured Image <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via slideshow Parameterjdegayojr Simple Featured Image
- CVE-2025-7213FNKvision FNK-GU2 UART Interface on-chip debug and test interface with improper access controlFNKvision FNK-GU2
- CVE-2025-7212itsourcecode Insurance Management System insertAgent.php sql injectionitsourcecode Insurance Management System
- CVE-2025-7211code-projects LifeStyle Store cart_add.php sql injectioncode-projects LifeStyle Store
- CVE-2025-5678Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameterstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2025-7210code-projects/Fabian Ros Library Management System profile_update.php unrestricted uploadcode-projects Library Management System · Fabian Ros Librar…
- CVE-2025-72099fans plan9port x509.c value_decode null pointer dereference9fans plan9port
- CVE-2025-72089fans plan9port x509.c edump heap-based overflow9fans plan9port
- CVE-2025-7207mruby nregs codegen.c scope_new heap-based overflowmruby
- CVE-2021-27961evesys 7.1 (2152) through 8.0 (2202) allows Reflected XSS via the indexeva.php action parameter.
- CVE-2025-44525Texas Instruments CC2652RB LaunchPad SimpleLink CC13XX CC26XX SDK 7.41.00.17 was discovered to utilize insufficient permission checks on cri
- CVE-2025-44526Realtek RTL8762EKF-EVB RTL8762E SDK V1.4.0 was discovered to utilize insufficient permission checks on critical fields within Bluetooth Low
- CVE-2025-49604For Realtek AmebaD devices, a heap-based buffer overflow was discovered in Ameba-AIoT ameba-arduino-d before version 3.1.9 and ameba-rtos-d
- CVE-2025-52357Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allow