CVEs published July 10, 2025
214 CVEs were published on July 10, 2025: 12 critical, 76 high. 2 are now in CISA KEV.
- Published
- 214
- Critical
- 12
- High
- 76
- Medium
- 59
- Low
- 6
- Unrated
- 61
- Now in CISA KEV
- 2
- Fix available
- 101
Most affected products
- Linux
- 84
- Advantech iView
- 10
- Apache Software Foundation Apache HTTP Server
- 8
- Tenda O3V2
- 7
- Emerson ValveLink SOLO · Emerson ValveLink DTM +2
- 5
- GitLab
- 4
- Honeywell C300 PCNT02 · Honeywell C300 PCNT05 +8
- 4
- IBM Analytics Content Hub
- 4
- wftpserver Wing FTP Server
- 4
- Apache Software Foundation Apache Tomcat · org.apache.to… +1
- 3
Critical 12
- CVE-2025-52579Emerson ValveLink Products Cleartext Storage of Sensitive Information in MemoryEmerson ValveLink SOLO · Emerson ValveLink DTM +2
- CVE-2025-2523Lack of buffer clearing before reuse may result in incorrect system behavior.Honeywell C300 PCNT02 · Honeywell C300 PCNT05 +8
- CVE-2025-34100BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File UploadBuilderEngine CMS
- CVE-2025-34102CryptoLog Unauthenticated RCE via SQL Injection and Command InjectionCrypttech CryptoLog
- CVE-2025-34096Easy File Sharing HTTP Server 7.2 Buffer Overflow via POST to /sendemail.ghpEFS Software Easy File Sharing HTTP Server
- CVE-2025-34095Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lspReal Time Logic Mako Server
- CVE-2025-34101Serviio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO ParameterServiio Media Server
- CVE-2025-34099VICIdial vicidial_sales_viewer.php Unauthenticated Command Injection via Basic Auth PasswordVICIdial Group VICIdial
- CVE-2025-53371DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLsmiraheze DiscordNotifications
- CVE-2025-23048Apache HTTP Server: mod_ssl access control bypass with session resumptionApache Software Foundation Apache HTTP Server
- CVE-2025-38325ksmbd: add free_transport ops in ksmbd connectionLinux
- CVE-2025-47812In Wing FTP Server before 7.4.4.wftpserver Wing FTP Server
High 76
- CVE-2025-46358Emerson ValveLink Products Protection Mechanism FailureEmerson ValveLink SOLO · Emerson ValveLink DTM +2
- CVE-2025-50109Emerson ValveLink Products Cleartext Storage of Sensitive Information in MemoryEmerson ValveLink SOLO · Emerson ValveLink DTM +2
- CVE-2025-7420Tenda O3V2 httpd setWrlBasicInfo formWifiBasicSet stack-based overflowTenda O3V2
- CVE-2025-53515Advantech iView SQL InjectionAdvantech iView
- CVE-2025-52577Advantech iView SQL InjectionAdvantech iView
- CVE-2025-53475Advantech iView SQL InjectionAdvantech iView
- CVE-2025-48891Advantech iView SQL InjectionAdvantech iView
- CVE-2025-7419Tenda O3V2 httpd setRateTest fromSpeedTestSet stack-based overflowTenda O3V2
- CVE-2025-1727End-of-Train and Head-of-Train Remote Linking Protocol Weak AuthenticationEnd-of-Train and Head-of-Train remote linking protocol
- CVE-2025-7418Tenda O3V2 httpd setPing fromPingResultGet stack-based overflowTenda O3V2
- CVE-2025-7417Tenda O3V2 httpd setPingInfo fromNetToolGet stack-based overflowTenda O3V2
- CVE-2025-7416Tenda O3V2 httpd setSysTimeInfo fromSysToolTime stack-based overflowTenda O3V2
- CVE-2025-3947Integer underflow during processing of short network packets in CDA FTEB responderHoneywell C300 PCNT02 · Honeywell C300 PCNT05 +7
- CVE-2025-3946Incorrect response generation during FTEB protocol processingHoneywell C300 PCNT02 · Honeywell C300 PCNT05 +8
- CVE-2025-2521Lack of indexes’ validation against buffer borders leads to remote code execution.Honeywell C300 PCNT02 · Honeywell C300 PCNT05 +8
- CVE-2025-2520Dereferencing of an uninitialized pointer leads to denial of service.Honeywell C300 PCNT02 · Honeywell EHB +8
- CVE-2025-53629cpp-httplib Unbounded Memory Allocation in Chunked/No-Length Requests Vulnerabilityyhirose cpp-httplib
- CVE-2025-53634Chall-Manager's HTTP Gateway have no header check timeout leading to potential slow loris attacksctfer-io chall-manager · github.com/ctfer-io/chall-manager
- CVE-2025-53633Chall-Manager's scenario decoding process does not check for zip bombsctfer-io chall-manager · github.com/ctfer-io/chall-manager
- CVE-2025-53632Chall-Manager's scenario decoding process does not check for zip slipsctfer-io chall-manager · github.com/ctfer-io/chall-manager
- CVE-2025-53630Integer Overflow in GGUF Parser can lead to Heap Out-of-Bounds Read/Write in ggufggml-org llama.cpp
- CVE-2025-53506Apache Tomcat: DoS via excessive h2 streams at connection startApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2025-34093Polycom HDX Series Telnet Command Injection via lan traceroutePolycom HDX Series
- CVE-2025-34097ProcessMaker < 3.5.4 Authenticated Plugin Upload RCEProcessMaker
- CVE-2025-34098Riverbed SteelHead VCX Authenticated Arbitrary File Read via Log Filter InjectionRiverbed Technology SteelHead VCX
- CVE-2025-52520Apache Tomcat: DoS via integer overflow in multipart file uploadApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2025-52434Apache Tomcat: APR/Native Connector crash leading to DoSApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2025-53503Trend Micro Cleaner One Pro is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally deletTrend Micro Cleaner One Pro
- CVE-2025-53378A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthenticaTrend Micro Worry-Free Business Security Services
- CVE-2025-52837Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability thTrend Micro Password Manager
- CVE-2025-52521Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attTrend Micro Security
- CVE-2025-53625DynamicPageList3 exposes hidden/suppressed usernamesUniversal-Omega DynamicPageList3 · universal-omega/dynamic-…
- CVE-2025-53542Kubernetes Headlamp Allows Arbitrary Command Injection in macOS Process headlamp@codeSignkubernetes-sigs headlamp
- CVE-2025-53020Apache HTTP Server: HTTP/2 DoS by Memory IncreaseApache Software Foundation Apache HTTP Server
- CVE-2025-49812Apache HTTP Server: mod_ssl TLS upgrade attackApache Software Foundation Apache HTTP Server
- CVE-2025-49630Apache HTTP Server: mod_proxy_http2 denial of serviceApache Software Foundation Apache HTTP Server
- CVE-2024-43394Apache HTTP Server: SSRF on Windows due to UNC pathsApache Software Foundation Apache HTTP Server
- CVE-2024-47252Apache HTTP Server: mod_ssl error log variable escapingApache Software Foundation Apache HTTP Server
- CVE-2024-43204Apache HTTP Server: SSRF with mod_headers setting Content-Type headerApache Software Foundation Apache HTTP Server
- CVE-2024-42516Apache HTTP Server: HTTP response splittingApache Software Foundation Apache HTTP Server
- CVE-2025-46788Zoom Workplace for Linux - Improper Certificate ValidationZoom Communications Zoom Workplace for Linux
- CVE-2025-46835Git GUI can create and overwrite files for which the user has write permissionj6t git-gui
- CVE-2025-46334Git GUI malicious command injection on Windowsj6t git-gui
- CVE-2025-27614Gitk allows arbitrary command executionj6t gitk
- CVE-2025-7365Keycloak: phishing attack via email verification step in first login flowkeycloak · Red Hat build of Keycloak +1
- CVE-2025-7424Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodesGNOME libxslt · Red Hat Enterprise Linux +5
- CVE-2025-7425Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptrGNOME libxml2 · Red Hat Enterprise Linux +14
- CVE-2025-5040RTE File Parsing Heap-Based Overflow VulnerabilityAutodesk Revit
- CVE-2025-5037RFA File Parsing Memory Corruption VulnerabilityAutodesk Revit
- CVE-2025-5023Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versiMitsubishi Electric PV-DR004J · Mitsubishi Electric PV-DR00…
- CVE-2025-6948Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-38346ftrace: Fix UAF when lookup kallsym after ftrace disabledLinux
- CVE-2025-38343wifi: mt76: mt7996: drop fragments with multicast or broadcast RALinux
- CVE-2025-38342software node: Correct a OOB check in software_node_get_reference_args()Linux
- CVE-2025-38341eth: fbnic: avoid double free when failing to DMA-map FW msgLinux
- CVE-2025-38339powerpc/bpf: fix JIT code size calculation of bpf trampolineLinux
- CVE-2025-38333f2fs: fix to bail out in get_new_segment()Linux
- CVE-2025-38331net: ethernet: cortina: Use TOE/TSO on all TCPLinux
- CVE-2025-38321smb: Log an error when close_all_cached_dirs failsLinux
- CVE-2025-38317wifi: ath12k: Fix buffer overflow in debugfsLinux
- CVE-2025-38314virtio-pci: Fix result size returned for the admin command completionLinux
- CVE-2025-38306fs/fhandle.c: fix a race in call of has_locked_children()Linux
- CVE-2025-38303Bluetooth: eir: Fix possible crashes on eir_create_adv_dataLinux
- CVE-2025-38293wifi: ath11k: fix node corruption in ar->arvifs listLinux
- CVE-2025-38292wifi: ath12k: fix invalid access to memoryLinux
- CVE-2025-38291wifi: ath12k: Prevent sending WMI commands to firmware during firmware crashLinux
- CVE-2025-38290wifi: ath12k: fix node corruption in ar->arvifs listLinux
- CVE-2025-38287IB/cm: Drop lockdep assert and WARN when freeing old msgLinux
- CVE-2025-38283hisi_acc_vfio_pci: bugfix live migration function without VF device driverLinux
- CVE-2025-38278octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callbackLinux
- CVE-2025-38276fs/dax: Fix "don't skip locked entries when scanning entries"Linux
- CVE-2025-38273net: tipc: fix refcount warning in tipc_aead_encryptLinux
- CVE-2025-38270net: drv: netdevsim: don't napi_complete() from netpollLinux
- CVE-2025-28243An issue in Alteryx Server v.2023.1.1.460 allows HTML injection via a crafted script to the pages component.
- CVE-2025-28244Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session
- CVE-2025-44251Ecovacs Deebot T10 1.7.2 transmits Wi-Fi credentials in cleartext during the pairing process.
Medium, low and unrated 126
- CVE-2025-53471Emerson ValveLink Products Improper Input ValidationEmerson ValveLink SOLO · Emerson ValveLink DTM +2
- CVE-2025-48496Emerson ValveLink Products Uncontrolled Search Path ElementEmerson ValveLink SOLO · Emerson ValveLink DTM +2
- CVE-2025-53509Advantech iView Argument InjectionAdvantech iView
- CVE-2025-52459Advantech iView Argument InjectionAdvantech iView
- CVE-2025-46704Advantech iView Path TraversalAdvantech iView
- CVE-2025-41442Advantech iView Cross-site ScriptingAdvantech iView
- CVE-2025-53519Advantech iView Cross-site ScriptingAdvantech iView
- CVE-2025-53397Advantech iView Cross-site ScriptingAdvantech iView
- CVE-2025-31267An authentication issue was addressed with improved state management.Apple App Store Connect
- CVE-2025-53637Meshtastic allows Command Injection in GitHub Actionmeshtastic firmware
- CVE-2025-24798Meshtastic crashes via an unimplemented routing module replymeshtastic firmware
- CVE-2025-6392Daily Data Dump Collector logs database password in cleartext when running docker exec commands (CVE-2025-6392)Broadcom Brocade SANnav
- CVE-2025-6390Cleartext storage of sensitive information in Brocade SANnav server audit logs.Broadcom Brocade SANnav
- CVE-2025-7415Tenda O3V2 httpd getTraceroute fromTraceroutGet command injectionTenda O3V2
- CVE-2025-4662Plaintext security passwords are logged in the audit logs while executing openssl cmdBroadcom Brocade SANnav
- CVE-2025-7414Tenda O3V2 httpd setPingInfo fromNetToolGet os command injectionTenda O3V2
- CVE-2025-2522Lack of buffer clearing before reuse may result in incorrect system behavior.Honeywell C300 PCNT02 · Honeywell C300 PCNT05 +8
- CVE-2025-7413code-projects Library System profile.php unrestricted uploadcode-projects Library System
- CVE-2025-53628cpp-httplib does not limit the length of a lineyhirose cpp-httplib
- CVE-2025-7412code-projects Library System profile.php unrestricted uploadcode-projects Library System
- CVE-2025-7021OpenAI Operator - API Spoofing through Locking Operator on FullScreenOpenAI Operator
- CVE-2025-7411code-projects LifeStyle Store success.php sql injectioncode-projects LifeStyle Store
- CVE-2025-53626pdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluationpdfme · @pdfme/common
- CVE-2025-52473liboqs secret-dependent branching in HQC reference implementation when compiled with Clang 17-20open-quantum-safe liboqs
- CVE-2025-53709Access control issues impacting secure-upload servicecom.palantir.secupload:secure-upload
- CVE-2025-53549Matrix Rust SDK allows SQL injection in the EventCache implementationmatrix-org matrix-rust-sdk · matrix-sdk +1
- CVE-2025-7410code-projects LifeStyle Store cart_remove.php sql injectioncode-projects LifeStyle Store
- CVE-2025-49464Zoom Clients for Windows- Classic Buffer OverflowZoom Communications Zoom Clients for Windows
- CVE-2025-7409code-projects Mobile Shop LoginAsAdmin.php sql injectioncode-projects Mobile Shop
- CVE-2025-49463Zoom Clients for iOS - Insufficient Control Flow ManagementZoom Communications Zoom Clients for iOS
- CVE-2025-49462Zoom Clients - Cross-site ScriptingZoom Communications Zoom Clients
- CVE-2025-46789Zoom Clients for Windows - Classic Buffer OverflowZoom Communications Zoom Clients for Windows
- CVE-2025-6395Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()libgnutls · Red Hat Enterprise Linux +4
- CVE-2025-53364Parse Server exposes the data schema via GraphQL APIparse-community parse-server · parse-server
- CVE-2025-27613Gitk can create and truncate files in the user's home directoryj6t gitk
- CVE-2025-7408SourceCodester Zoo Management System animal_form_template.php cross site scriptingSourceCodester Zoo Management System
- CVE-2024-39752IBM Analytics Content Hub file uploadIBM Analytics Content Hub
- CVE-2024-38327IBM Analytics Content Hub information disclosureIBM Analytics Content Hub
- CVE-2025-36090IBM Analytics Content Hub information disclosureIBM Analytics Content Hub
- CVE-2024-37524IBM Analytics Content Hub information disclosureIBM Analytics Content Hub
- CVE-2025-7407Netgear D6400 diag.cgi os command injectionNetgear D6400
- CVE-2025-6211MD5 Hash Collision in run-llama/llama_indexrun-llama/llama_index · llama-index-readers-docugami +1
- CVE-2024-7650Remote code execution vulnerability discovered in OpenText™ Directory Services CE 23.4OpenText™ Directory Services
- CVE-2025-32990Gnutls: vulnerability in gnutls certtool template parsinglibgnutls · Red Hat Enterprise Linux +5
- CVE-2025-5022Weak Password Requirements vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versionsMitsubishi Electric PV-DR004J · Mitsubishi Electric PV-DR00…
- CVE-2025-3396Incorrect Authorization in GitLabGitLab
- CVE-2025-4972Incorrect Authorization in GitLabGitLab
- CVE-2025-6168Incorrect Authorization in GitLabGitLab
- CVE-2025-38348wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()Linux
- CVE-2025-38347f2fs: fix to do sanity check on ino and xnidLinux
- CVE-2025-38345ACPICA: fix acpi operand cache leak in dswstate.cLinux
- CVE-2025-38344ACPICA: fix acpi parse and parseext cache leaksLinux
- CVE-2025-38340firmware: cs_dsp: Fix OOB memory read access in KUnit testLinux
- CVE-2025-38338fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()Linux
- CVE-2025-38337jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()Linux
- CVE-2025-38336ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330Linux
- CVE-2025-38335Input: gpio-keys - fix a sleep while atomic with PREEMPT_RTLinux
- CVE-2025-38334x86/sgx: Prevent attempts to reclaim poisoned pagesLinux
- CVE-2025-38332scsi: lpfc: Use memcpy() for BIOS versionLinux
- CVE-2025-38330firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache)Linux
- CVE-2025-38329firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info)Linux
- CVE-2025-38328jffs2: check jffs2_prealloc_raw_node_refs() result in few other placesLinux
- CVE-2025-38327fgraph: Do not enable function_graph tracer when setting funcgraph-argsLinux
- CVE-2025-38326aoe: clean device rq_list in aoedev_downdev()Linux
- CVE-2025-38324mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().Linux
- CVE-2025-38323net: atm: add lec_mutexLinux
- CVE-2025-38322perf/x86/intel: Fix crash in icl_update_topdown_event()Linux
- CVE-2025-38320arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()Linux
- CVE-2025-32989Gnutls: vulnerability in gnutls sct extension parsinglibgnutls · Red Hat Enterprise Linux +5
- CVE-2025-32988Gnutls: vulnerability in gnutls othername san exportlibgnutls · Red Hat Enterprise Linux +5
- CVE-2025-38319drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_tableLinux
- CVE-2025-38318perf: arm-ni: Fix missing platform_set_drvdata()Linux
- CVE-2025-38316wifi: mt76: mt7996: avoid NULL pointer dereference in mt7996_set_monitor()Linux
- CVE-2025-38315Bluetooth: btintel: Check dsbr size from EFI variableLinux
- CVE-2025-38313bus: fsl-mc: fix double-free on mc_devLinux
- CVE-2025-38312fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()Linux
- CVE-2025-38311iavf: get rid of the crit lockLinux
- CVE-2025-38310seg6: Fix validation of nexthop addressesLinux
- CVE-2025-38309drm/xe/vm: move xe_svm_init() earlierLinux
- CVE-2025-38308ASoC: Intel: avs: Fix possible null-ptr-deref when initing hwLinux
- CVE-2025-38307ASoC: Intel: avs: Verify content returned by parse_int_array()Linux
- CVE-2025-38305ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()Linux
- CVE-2025-38304Bluetooth: Fix NULL pointer deference on eir_get_service_dataLinux
- CVE-2025-38302block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_workLinux
- CVE-2025-38301nvmem: zynqmp_nvmem: unbreak driver after cleanupLinux
- CVE-2025-38300crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare()Linux
- CVE-2025-38299ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY()Linux
- CVE-2025-38298EDAC/skx_common: Fix general protection faultLinux
- CVE-2025-38297PM: EM: Fix potential division-by-zero error in em_compute_costs()Linux
- CVE-2025-38296ACPI: platform_profile: Avoid initializing on non-ACPI platformsLinux
- CVE-2025-38295perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create()Linux
- CVE-2025-38294wifi: ath12k: fix NULL access in assign channel context handlerLinux
- CVE-2025-38289scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbkLinux
- CVE-2025-38288scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernelsLinux
- CVE-2025-38286pinctrl: at91: Fix possible out-of-boundary accessLinux
- CVE-2025-38285bpf: Fix WARN() in get_bpf_raw_tp_regsLinux
- CVE-2025-38284wifi: rtw89: pci: configure manual DAC mode via PCI config API onlyLinux
- CVE-2025-38282kernfs: Relax constraint in draining guardLinux
- CVE-2025-38281wifi: mt76: mt7996: Add NULL check in mt7996_thermal_initLinux
- CVE-2025-38280bpf: Avoid __bpf_prog_ret0_warn when jit failsLinux
- CVE-2025-38279bpf: Do not include stack ptr register in precision backtracking bookkeepingLinux
- CVE-2025-38277mtd: nand: ecc-mxic: Fix use of uninitialized variable retLinux
- CVE-2025-38275phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bugLinux
- CVE-2025-38274fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt()Linux
- CVE-2025-38272net: dsa: b53: do not enable EEE on bcm63xxLinux
- CVE-2025-38271net: prevent a NULL deref in rtnl_create_link()Linux
- CVE-2025-38269btrfs: exit after state insertion failure at btrfs_convert_extent_bit()Linux
- CVE-2025-38268usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous workLinux
- CVE-2025-38267ring-buffer: Do not trigger WARN_ON() due to a commit_overrunLinux
- CVE-2025-38266pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platformsLinux
- CVE-2025-38265serial: jsm: fix NPE during jsm_uart_port_initLinux
- CVE-2025-6236Hostel < 1.1.5.9 - Admin+ Stored XSSHostel
- CVE-2025-6234Hostel < 1.1.5.8 - Reflected XSSHostel
- CVE-2025-7387Lana Downloads Manager <= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site Scriptinglanacodes Lana Downloads Manager
- CVE-2025-46406A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one DGallagher Command Centre Server
- CVE-2025-44003Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to tGallagher T-Series Readers
- CVE-2025-35983Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a liGallagher Controller
- CVE-2025-5807Gwolle Guestbook <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting via `gwolle_gb_content` Parametermpol Gwolle Guestbook
- CVE-2025-4406wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatartomdever wpForo Forum
- CVE-2023-50458In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs.dradisframework Dradis
- CVE-2024-36697A cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to execute arbitrar
- CVE-2025-27889Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injectionwftpserver Wing FTP Server
- CVE-2025-28245Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via t
- CVE-2025-45662A cross-site scripting (XSS) vulnerability in the component /master/login.php of mpgram-web commit 94baadb allows attackers to execute arbit
- CVE-2025-47811In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default.wftpserver Wing FTP Server
- CVE-2025-47813loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UIwftpserver Wing FTP Server