# CVEs published 2025-07-10

214 CVEs were published on July 10, 2025: 12 critical, 76 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2025-53471](https://cve.now/CVE-2025-53471.md): Emerson ValveLink Products Improper Input Validation (CVSS 5.1, Emerson ValveLink SOLO · Emerson ValveLink DTM +2)
- [CVE-2025-48496](https://cve.now/CVE-2025-48496.md): Emerson ValveLink Products Uncontrolled Search Path Element (CVSS 5.1, Emerson ValveLink SOLO · Emerson ValveLink DTM +2)
- [CVE-2025-46358](https://cve.now/CVE-2025-46358.md): Emerson ValveLink Products Protection Mechanism Failure (CVSS 7.7, Emerson ValveLink SOLO · Emerson ValveLink DTM +2)
- [CVE-2025-50109](https://cve.now/CVE-2025-50109.md): Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory (CVSS 7.7, Emerson ValveLink SOLO · Emerson ValveLink DTM +2)
- [CVE-2025-52579](https://cve.now/CVE-2025-52579.md): Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory (CVSS 9.4, Emerson ValveLink SOLO · Emerson ValveLink DTM +2)
- [CVE-2025-7420](https://cve.now/CVE-2025-7420.md): Tenda O3V2 httpd setWrlBasicInfo formWifiBasicSet stack-based overflow (CVSS 8.7, Tenda O3V2)
- [CVE-2025-53509](https://cve.now/CVE-2025-53509.md): Advantech iView Argument Injection (CVSS 6.5, Advantech iView)
- [CVE-2025-52459](https://cve.now/CVE-2025-52459.md): Advantech iView Argument Injection (CVSS 6.5, Advantech iView)
- [CVE-2025-53515](https://cve.now/CVE-2025-53515.md): Advantech iView SQL Injection (CVSS 8.8, Advantech iView)
- [CVE-2025-52577](https://cve.now/CVE-2025-52577.md): Advantech iView SQL Injection (CVSS 8.8, Advantech iView)
- [CVE-2025-53475](https://cve.now/CVE-2025-53475.md): Advantech iView SQL Injection (CVSS 8.8, Advantech iView)
- [CVE-2025-46704](https://cve.now/CVE-2025-46704.md): Advantech iView Path Traversal (CVSS 4.3, Advantech iView)
- [CVE-2025-48891](https://cve.now/CVE-2025-48891.md): Advantech iView SQL Injection (CVSS 7.6, Advantech iView)
- [CVE-2025-41442](https://cve.now/CVE-2025-41442.md): Advantech iView Cross-site Scripting (CVSS 5.4, Advantech iView)
- [CVE-2025-53519](https://cve.now/CVE-2025-53519.md): Advantech iView Cross-site Scripting (CVSS 5.4, Advantech iView)
- [CVE-2025-53397](https://cve.now/CVE-2025-53397.md): Advantech iView Cross-site Scripting (CVSS 5.4, Advantech iView)
- [CVE-2025-7419](https://cve.now/CVE-2025-7419.md): Tenda O3V2 httpd setRateTest fromSpeedTestSet stack-based overflow (CVSS 8.7, Tenda O3V2)
- [CVE-2025-1727](https://cve.now/CVE-2025-1727.md): End-of-Train and Head-of-Train Remote Linking Protocol Weak Authentication (CVSS 8.1, End-of-Train and Head-of-Train remote linking protocol)
- [CVE-2025-7418](https://cve.now/CVE-2025-7418.md): Tenda O3V2 httpd setPing fromPingResultGet stack-based overflow (CVSS 8.7, Tenda O3V2)
- [CVE-2025-31267](https://cve.now/CVE-2025-31267.md): An authentication issue was addressed with improved state management. (CVSS 4.6, Apple App Store Connect)
- [CVE-2025-7417](https://cve.now/CVE-2025-7417.md): Tenda O3V2 httpd setPingInfo fromNetToolGet stack-based overflow (CVSS 8.7, Tenda O3V2)
- [CVE-2025-7416](https://cve.now/CVE-2025-7416.md): Tenda O3V2 httpd setSysTimeInfo fromSysToolTime stack-based overflow (CVSS 8.7, Tenda O3V2)
- [CVE-2025-53637](https://cve.now/CVE-2025-53637.md): Meshtastic allows Command Injection in GitHub Action (CVSS 4.1, meshtastic firmware)
- [CVE-2025-24798](https://cve.now/CVE-2025-24798.md): Meshtastic crashes via an unimplemented routing module reply (CVSS 4.3, meshtastic firmware)
- [CVE-2025-6392](https://cve.now/CVE-2025-6392.md): Daily Data Dump Collector logs database password in cleartext when running docker exec commands (CVE-2025-6392) (CVSS 6.7, Broadcom Brocade SANnav)
- [CVE-2025-6390](https://cve.now/CVE-2025-6390.md): Cleartext storage of sensitive information in Brocade SANnav server audit logs. (CVSS 5.1, Broadcom Brocade SANnav)
- [CVE-2025-7415](https://cve.now/CVE-2025-7415.md): Tenda O3V2 httpd getTraceroute fromTraceroutGet command injection (CVSS 5.3, Tenda O3V2)
- [CVE-2025-4662](https://cve.now/CVE-2025-4662.md): Plaintext security passwords are logged in the audit logs while executing openssl cmd (CVSS 5.1, Broadcom Brocade SANnav)
- [CVE-2025-7414](https://cve.now/CVE-2025-7414.md): Tenda O3V2 httpd setPingInfo fromNetToolGet os command injection (CVSS 5.3, Tenda O3V2)
- [CVE-2025-3947](https://cve.now/CVE-2025-3947.md): Integer underflow during processing of short network packets in CDA FTEB responder (CVSS 8.2, Honeywell C300 PCNT02 · Honeywell C300 PCNT05 +7)
- [CVE-2025-3946](https://cve.now/CVE-2025-3946.md): Incorrect response generation during FTEB protocol processing (CVSS 8.2, Honeywell C300 PCNT02 · Honeywell C300 PCNT05 +8)
- [CVE-2025-2523](https://cve.now/CVE-2025-2523.md): Lack of buffer clearing before reuse may result in incorrect system behavior. (CVSS 9.4, Honeywell C300 PCNT02 · Honeywell C300 PCNT05 +8)
- [CVE-2025-2522](https://cve.now/CVE-2025-2522.md): Lack of buffer clearing before reuse may result in incorrect system behavior. (CVSS 6.5, Honeywell C300 PCNT02 · Honeywell C300 PCNT05 +8)
- [CVE-2025-2521](https://cve.now/CVE-2025-2521.md): Lack of indexes’ validation against buffer borders leads to remote code execution. (CVSS 8.6, Honeywell C300 PCNT02 · Honeywell C300 PCNT05 +8)
- [CVE-2025-7413](https://cve.now/CVE-2025-7413.md): code-projects Library System profile.php unrestricted upload (CVSS 5.3, code-projects Library System)
- [CVE-2025-2520](https://cve.now/CVE-2025-2520.md): Dereferencing of an uninitialized pointer leads to denial of service. (CVSS 7.5, Honeywell C300 PCNT02 · Honeywell EHB +8)
- [CVE-2025-53629](https://cve.now/CVE-2025-53629.md): cpp-httplib Unbounded Memory Allocation in Chunked/No-Length Requests Vulnerability (CVSS 7.5, yhirose cpp-httplib)
- [CVE-2025-53628](https://cve.now/CVE-2025-53628.md): cpp-httplib does not limit the length of a line (CVSS 6.3, yhirose cpp-httplib)
- [CVE-2025-53634](https://cve.now/CVE-2025-53634.md): Chall-Manager's HTTP Gateway have no header check timeout leading to potential slow loris attacks (CVSS 8.7, ctfer-io chall-manager · github.com/ctfer-io/chall-manager)
- [CVE-2025-53633](https://cve.now/CVE-2025-53633.md): Chall-Manager's scenario decoding process does not check for zip bombs (CVSS 8.7, ctfer-io chall-manager · github.com/ctfer-io/chall-manager)
- [CVE-2025-53632](https://cve.now/CVE-2025-53632.md): Chall-Manager's scenario decoding process does not check for zip slips (CVSS 8.8, ctfer-io chall-manager · github.com/ctfer-io/chall-manager)
- [CVE-2025-53630](https://cve.now/CVE-2025-53630.md): Integer Overflow in GGUF Parser can lead to Heap Out-of-Bounds Read/Write in gguf (CVSS 8.9, ggml-org llama.cpp)
- [CVE-2025-7412](https://cve.now/CVE-2025-7412.md): code-projects Library System profile.php unrestricted upload (CVSS 5.3, code-projects Library System)
- [CVE-2025-34100](https://cve.now/CVE-2025-34100.md): BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Upload (CVSS 9.3, BuilderEngine CMS)
- [CVE-2025-34102](https://cve.now/CVE-2025-34102.md): CryptoLog Unauthenticated RCE via SQL Injection and Command Injection (CVSS 9.3, Crypttech CryptoLog)
- [CVE-2025-34096](https://cve.now/CVE-2025-34096.md): Easy File Sharing HTTP Server 7.2 Buffer Overflow via POST to /sendemail.ghp (CVSS 9.3, EFS Software Easy File Sharing HTTP Server)
- [CVE-2025-34095](https://cve.now/CVE-2025-34095.md): Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lsp (CVSS 9.3, Real Time Logic Mako Server)
- [CVE-2025-53506](https://cve.now/CVE-2025-53506.md): Apache Tomcat: DoS via excessive h2 streams at connection start (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2025-34093](https://cve.now/CVE-2025-34093.md): Polycom HDX Series Telnet Command Injection via lan traceroute (CVSS 7.5, Polycom HDX Series)
- [CVE-2025-34097](https://cve.now/CVE-2025-34097.md): ProcessMaker \< 3.5.4 Authenticated Plugin Upload RCE (CVSS 8.6, ProcessMaker)
- [CVE-2025-34098](https://cve.now/CVE-2025-34098.md): Riverbed SteelHead VCX Authenticated Arbitrary File Read via Log Filter Injection (CVSS 7.1, Riverbed Technology SteelHead VCX)
- [CVE-2025-34101](https://cve.now/CVE-2025-34101.md): Serviio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO Parameter (CVSS 9.3, Serviio Media Server)
- [CVE-2025-34099](https://cve.now/CVE-2025-34099.md): VICIdial vicidial\_sales\_viewer.php Unauthenticated Command Injection via Basic Auth Password (CVSS 9.3, VICIdial Group VICIdial)
- [CVE-2025-7021](https://cve.now/CVE-2025-7021.md): OpenAI Operator - API Spoofing through Locking Operator on FullScreen (CVSS 6.9, OpenAI Operator)
- [CVE-2025-52520](https://cve.now/CVE-2025-52520.md): Apache Tomcat: DoS via integer overflow in multipart file upload (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2025-52434](https://cve.now/CVE-2025-52434.md): Apache Tomcat: APR/Native Connector crash leading to DoS (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2025-7411](https://cve.now/CVE-2025-7411.md): code-projects LifeStyle Store success.php sql injection (CVSS 6.9, code-projects LifeStyle Store)
- [CVE-2025-53503](https://cve.now/CVE-2025-53503.md): Trend Micro Cleaner One Pro is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delet (CVSS 7.8, Trend Micro Cleaner One Pro)
- [CVE-2025-53378](https://cve.now/CVE-2025-53378.md): A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthentica (CVSS 7.6, Trend Micro Worry-Free Business Security Services)
- [CVE-2025-52837](https://cve.now/CVE-2025-52837.md): Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability th (CVSS 7.8, Trend Micro Password Manager)
- [CVE-2025-52521](https://cve.now/CVE-2025-52521.md): Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local att (CVSS 7.8, Trend Micro Security)
- [CVE-2025-53626](https://cve.now/CVE-2025-53626.md): pdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluation (CVSS 6.1, pdfme · @pdfme/common)
- [CVE-2025-52473](https://cve.now/CVE-2025-52473.md): liboqs secret-dependent branching in HQC reference implementation when compiled with Clang 17-20 (CVSS 5.9, open-quantum-safe liboqs)
- [CVE-2025-53709](https://cve.now/CVE-2025-53709.md): Access control issues impacting secure-upload service (CVSS 5.4, com.palantir.secupload:secure-upload)
- [CVE-2025-53625](https://cve.now/CVE-2025-53625.md): DynamicPageList3 exposes hidden/suppressed usernames (CVSS 8.7, Universal-Omega DynamicPageList3 · universal-omega/dynamic-…)
- [CVE-2025-53549](https://cve.now/CVE-2025-53549.md): Matrix Rust SDK allows SQL injection in the EventCache implementation (CVSS 5.2, matrix-org matrix-rust-sdk · matrix-sdk +1)
- [CVE-2025-53542](https://cve.now/CVE-2025-53542.md): Kubernetes Headlamp Allows Arbitrary Command Injection in macOS Process headlamp@codeSign (CVSS 7.8, kubernetes-sigs headlamp)
- [CVE-2025-53371](https://cve.now/CVE-2025-53371.md): DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs (CVSS 9.1, miraheze DiscordNotifications)
- [CVE-2025-7410](https://cve.now/CVE-2025-7410.md): code-projects LifeStyle Store cart\_remove.php sql injection (CVSS 6.9, code-projects LifeStyle Store)
- [CVE-2025-53020](https://cve.now/CVE-2025-53020.md): Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-49812](https://cve.now/CVE-2025-49812.md): Apache HTTP Server: mod\_ssl TLS upgrade attack (CVSS 7.4, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-49630](https://cve.now/CVE-2025-49630.md): Apache HTTP Server: mod\_proxy\_http2 denial of service (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-23048](https://cve.now/CVE-2025-23048.md): Apache HTTP Server: mod\_ssl access control bypass with session resumption (CVSS 9.1, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-43394](https://cve.now/CVE-2024-43394.md): Apache HTTP Server: SSRF on Windows due to UNC paths (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-47252](https://cve.now/CVE-2024-47252.md): Apache HTTP Server: mod\_ssl error log variable escaping (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-43204](https://cve.now/CVE-2024-43204.md): Apache HTTP Server: SSRF with mod\_headers setting Content-Type header (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-42516](https://cve.now/CVE-2024-42516.md): Apache HTTP Server: HTTP response splitting (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-49464](https://cve.now/CVE-2025-49464.md): Zoom Clients for Windows- Classic Buffer Overflow (CVSS 6.5, Zoom Communications Zoom Clients for Windows)
- [CVE-2025-7409](https://cve.now/CVE-2025-7409.md): code-projects Mobile Shop LoginAsAdmin.php sql injection (CVSS 6.9, code-projects Mobile Shop)
- [CVE-2025-49463](https://cve.now/CVE-2025-49463.md): Zoom Clients for iOS - Insufficient Control Flow Management (CVSS 6.5, Zoom Communications Zoom Clients for iOS)
- [CVE-2025-49462](https://cve.now/CVE-2025-49462.md): Zoom Clients - Cross-site Scripting (CVSS 3.5, Zoom Communications Zoom Clients)
- [CVE-2025-46789](https://cve.now/CVE-2025-46789.md): Zoom Clients for Windows - Classic Buffer Overflow (CVSS 6.5, Zoom Communications Zoom Clients for Windows)
- [CVE-2025-46788](https://cve.now/CVE-2025-46788.md): Zoom Workplace for Linux - Improper Certificate Validation (CVSS 7.4, Zoom Communications Zoom Workplace for Linux)
- [CVE-2025-6395](https://cve.now/CVE-2025-6395.md): Gnutls: null pointer dereference in \_gnutls\_figure\_common\_ciphersuite() (CVSS 6.5, libgnutls · Red Hat Enterprise Linux +4)
- [CVE-2025-53364](https://cve.now/CVE-2025-53364.md): Parse Server exposes the data schema via GraphQL API (CVSS 5.3, parse-community parse-server · parse-server)
- [CVE-2025-46835](https://cve.now/CVE-2025-46835.md): Git GUI can create and overwrite files for which the user has write permission (CVSS 8.5, j6t git-gui)
- [CVE-2025-46334](https://cve.now/CVE-2025-46334.md): Git GUI malicious command injection on Windows (CVSS 8.6, j6t git-gui)
- [CVE-2025-27614](https://cve.now/CVE-2025-27614.md): Gitk allows arbitrary command execution (CVSS 8.6, j6t gitk)
- [CVE-2025-27613](https://cve.now/CVE-2025-27613.md): Gitk can create and truncate files in the user's home directory (CVSS 3.6, j6t gitk)
- [CVE-2025-7408](https://cve.now/CVE-2025-7408.md): SourceCodester Zoo Management System animal\_form\_template.php cross site scripting (CVSS 5.1, SourceCodester Zoo Management System)
- [CVE-2025-7365](https://cve.now/CVE-2025-7365.md): Keycloak: phishing attack via email verification step in first login flow (CVSS 7.1, keycloak · Red Hat build of Keycloak +1)
- [CVE-2024-39752](https://cve.now/CVE-2024-39752.md): IBM Analytics Content Hub file upload (CVSS 6.8, IBM Analytics Content Hub)
- [CVE-2024-38327](https://cve.now/CVE-2024-38327.md): IBM Analytics Content Hub information disclosure (CVSS 6.8, IBM Analytics Content Hub)
- [CVE-2025-36090](https://cve.now/CVE-2025-36090.md): IBM Analytics Content Hub information disclosure (CVSS 4.3, IBM Analytics Content Hub)
- [CVE-2024-37524](https://cve.now/CVE-2024-37524.md): IBM Analytics Content Hub information disclosure (CVSS 5.3, IBM Analytics Content Hub)
- [CVE-2025-7424](https://cve.now/CVE-2025-7424.md): Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes (CVSS 7.5, GNOME libxslt · Red Hat Enterprise Linux +5)
- [CVE-2025-7425](https://cve.now/CVE-2025-7425.md): Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr (CVSS 7.8, GNOME libxml2 · Red Hat Enterprise Linux +14)
- [CVE-2025-7407](https://cve.now/CVE-2025-7407.md): Netgear D6400 diag.cgi os command injection (CVSS 5.3, Netgear D6400)
- [CVE-2025-6211](https://cve.now/CVE-2025-6211.md): MD5 Hash Collision in run-llama/llama\_index (CVSS 6.5, run-llama/llama\_index · llama-index-readers-docugami +1)
- [CVE-2025-5040](https://cve.now/CVE-2025-5040.md): RTE File Parsing Heap-Based Overflow Vulnerability (CVSS 7.8, Autodesk Revit)
- [CVE-2025-5037](https://cve.now/CVE-2025-5037.md): RFA File Parsing Memory Corruption Vulnerability (CVSS 7.8, Autodesk Revit)
- [CVE-2024-7650](https://cve.now/CVE-2024-7650.md): Remote code execution vulnerability discovered in OpenText™ Directory Services CE 23.4 (CVSS 6.3, OpenText™ Directory Services)
- [CVE-2025-32990](https://cve.now/CVE-2025-32990.md): Gnutls: vulnerability in gnutls certtool template parsing (CVSS 6.5, libgnutls · Red Hat Enterprise Linux +5)
- [CVE-2025-5023](https://cve.now/CVE-2025-5023.md): Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versi (CVSS 7.1, Mitsubishi Electric PV-DR004J · Mitsubishi Electric PV-DR00…)
- [CVE-2025-5022](https://cve.now/CVE-2025-5022.md): Weak Password Requirements vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions (CVSS 6.5, Mitsubishi Electric PV-DR004J · Mitsubishi Electric PV-DR00…)
- [CVE-2025-3396](https://cve.now/CVE-2025-3396.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-4972](https://cve.now/CVE-2025-4972.md): Incorrect Authorization in GitLab (CVSS 2.7, GitLab)
- [CVE-2025-6168](https://cve.now/CVE-2025-6168.md): Incorrect Authorization in GitLab (CVSS 2.7, GitLab)
- [CVE-2025-6948](https://cve.now/CVE-2025-6948.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-38348](https://cve.now/CVE-2025-38348.md): wifi: p54: prevent buffer-overflow in p54\_rx\_eeprom\_readback() (no CVSS, Linux)
- [CVE-2025-38347](https://cve.now/CVE-2025-38347.md): f2fs: fix to do sanity check on ino and xnid (no CVSS, Linux)
- [CVE-2025-38346](https://cve.now/CVE-2025-38346.md): ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVSS 7.8, Linux)
- [CVE-2025-38345](https://cve.now/CVE-2025-38345.md): ACPICA: fix acpi operand cache leak in dswstate.c (no CVSS, Linux)
- [CVE-2025-38344](https://cve.now/CVE-2025-38344.md): ACPICA: fix acpi parse and parseext cache leaks (no CVSS, Linux)
- [CVE-2025-38343](https://cve.now/CVE-2025-38343.md): wifi: mt76: mt7996: drop fragments with multicast or broadcast RA (CVSS 8.3, Linux)
- [CVE-2025-38342](https://cve.now/CVE-2025-38342.md): software node: Correct a OOB check in software\_node\_get\_reference\_args() (CVSS 7.0, Linux)
- [CVE-2025-38341](https://cve.now/CVE-2025-38341.md): eth: fbnic: avoid double free when failing to DMA-map FW msg (CVSS 7.8, Linux)
- [CVE-2025-38340](https://cve.now/CVE-2025-38340.md): firmware: cs\_dsp: Fix OOB memory read access in KUnit test (no CVSS, Linux)
- [CVE-2025-38339](https://cve.now/CVE-2025-38339.md): powerpc/bpf: fix JIT code size calculation of bpf trampoline (CVSS 7.8, Linux)
- [CVE-2025-38338](https://cve.now/CVE-2025-38338.md): fs/nfs/read: fix double-unlock bug in nfs\_return\_empty\_folio() (no CVSS, Linux)
- [CVE-2025-38337](https://cve.now/CVE-2025-38337.md): jbd2: fix data-race and null-ptr-deref in jbd2\_journal\_dirty\_metadata() (no CVSS, Linux)
- [CVE-2025-38336](https://cve.now/CVE-2025-38336.md): ata: pata\_via: Force PIO for ATAPI devices on VT6415/VT6330 (no CVSS, Linux)
- [CVE-2025-38335](https://cve.now/CVE-2025-38335.md): Input: gpio-keys - fix a sleep while atomic with PREEMPT\_RT (no CVSS, Linux)
- [CVE-2025-38334](https://cve.now/CVE-2025-38334.md): x86/sgx: Prevent attempts to reclaim poisoned pages (no CVSS, Linux)
- [CVE-2025-38333](https://cve.now/CVE-2025-38333.md): f2fs: fix to bail out in get\_new\_segment() (CVSS 7.8, Linux)
- [CVE-2025-38332](https://cve.now/CVE-2025-38332.md): scsi: lpfc: Use memcpy() for BIOS version (no CVSS, Linux)
- [CVE-2025-38331](https://cve.now/CVE-2025-38331.md): net: ethernet: cortina: Use TOE/TSO on all TCP (CVSS 7.5, Linux)
- [CVE-2025-38330](https://cve.now/CVE-2025-38330.md): firmware: cs\_dsp: Fix OOB memory read access in KUnit test (ctl cache) (no CVSS, Linux)
- [CVE-2025-38329](https://cve.now/CVE-2025-38329.md): firmware: cs\_dsp: Fix OOB memory read access in KUnit test (wmfw info) (no CVSS, Linux)
- [CVE-2025-38328](https://cve.now/CVE-2025-38328.md): jffs2: check jffs2\_prealloc\_raw\_node\_refs() result in few other places (no CVSS, Linux)
- [CVE-2025-38327](https://cve.now/CVE-2025-38327.md): fgraph: Do not enable function\_graph tracer when setting funcgraph-args (no CVSS, Linux)
- [CVE-2025-38326](https://cve.now/CVE-2025-38326.md): aoe: clean device rq\_list in aoedev\_downdev() (no CVSS, Linux)
- [CVE-2025-38325](https://cve.now/CVE-2025-38325.md): ksmbd: add free\_transport ops in ksmbd connection (CVSS 9.8, Linux)
- [CVE-2025-38324](https://cve.now/CVE-2025-38324.md): mpls: Use rcu\_dereference\_rtnl() in mpls\_route\_input\_rcu(). (no CVSS, Linux)
- [CVE-2025-38323](https://cve.now/CVE-2025-38323.md): net: atm: add lec\_mutex (no CVSS, Linux)
- [CVE-2025-38322](https://cve.now/CVE-2025-38322.md): perf/x86/intel: Fix crash in icl\_update\_topdown\_event() (no CVSS, Linux)
- [CVE-2025-38321](https://cve.now/CVE-2025-38321.md): smb: Log an error when close\_all\_cached\_dirs fails (CVSS 7.8, Linux)
- [CVE-2025-38320](https://cve.now/CVE-2025-38320.md): arm64/ptrace: Fix stack-out-of-bounds read in regs\_get\_kernel\_stack\_nth() (no CVSS, Linux)
- [CVE-2025-32989](https://cve.now/CVE-2025-32989.md): Gnutls: vulnerability in gnutls sct extension parsing (CVSS 5.3, libgnutls · Red Hat Enterprise Linux +5)
- [CVE-2025-32988](https://cve.now/CVE-2025-32988.md): Gnutls: vulnerability in gnutls othername san export (CVSS 6.5, libgnutls · Red Hat Enterprise Linux +5)
- [CVE-2025-38319](https://cve.now/CVE-2025-38319.md): drm/amd/pp: Fix potential NULL pointer dereference in atomctrl\_initialize\_mc\_reg\_table (no CVSS, Linux)
- [CVE-2025-38318](https://cve.now/CVE-2025-38318.md): perf: arm-ni: Fix missing platform\_set\_drvdata() (no CVSS, Linux)
- [CVE-2025-38317](https://cve.now/CVE-2025-38317.md): wifi: ath12k: Fix buffer overflow in debugfs (CVSS 7.8, Linux)
- [CVE-2025-38316](https://cve.now/CVE-2025-38316.md): wifi: mt76: mt7996: avoid NULL pointer dereference in mt7996\_set\_monitor() (no CVSS, Linux)
- [CVE-2025-38315](https://cve.now/CVE-2025-38315.md): Bluetooth: btintel: Check dsbr size from EFI variable (no CVSS, Linux)
- [CVE-2025-38314](https://cve.now/CVE-2025-38314.md): virtio-pci: Fix result size returned for the admin command completion (CVSS 7.3, Linux)
- [CVE-2025-38313](https://cve.now/CVE-2025-38313.md): bus: fsl-mc: fix double-free on mc\_dev (no CVSS, Linux)
- [CVE-2025-38312](https://cve.now/CVE-2025-38312.md): fbdev: core: fbcvt: avoid division by 0 in fb\_cvt\_hperiod() (no CVSS, Linux)
- [CVE-2025-38311](https://cve.now/CVE-2025-38311.md): iavf: get rid of the crit lock (no CVSS, Linux)
- [CVE-2025-38310](https://cve.now/CVE-2025-38310.md): seg6: Fix validation of nexthop addresses (no CVSS, Linux)
- [CVE-2025-38309](https://cve.now/CVE-2025-38309.md): drm/xe/vm: move xe\_svm\_init() earlier (no CVSS, Linux)
- [CVE-2025-38308](https://cve.now/CVE-2025-38308.md): ASoC: Intel: avs: Fix possible null-ptr-deref when initing hw (no CVSS, Linux)
- [CVE-2025-38307](https://cve.now/CVE-2025-38307.md): ASoC: Intel: avs: Verify content returned by parse\_int\_array() (no CVSS, Linux)
- [CVE-2025-38306](https://cve.now/CVE-2025-38306.md): fs/fhandle.c: fix a race in call of has\_locked\_children() (CVSS 7.8, Linux)
- [CVE-2025-38305](https://cve.now/CVE-2025-38305.md): ptp: remove ptp-\>n\_vclocks check logic in ptp\_vclock\_in\_use() (no CVSS, Linux)
- [CVE-2025-38304](https://cve.now/CVE-2025-38304.md): Bluetooth: Fix NULL pointer deference on eir\_get\_service\_data (no CVSS, Linux)
- [CVE-2025-38303](https://cve.now/CVE-2025-38303.md): Bluetooth: eir: Fix possible crashes on eir\_create\_adv\_data (CVSS 7.8, Linux)
- [CVE-2025-38302](https://cve.now/CVE-2025-38302.md): block: don't use submit\_bio\_noacct\_nocheck in blk\_zone\_wplug\_bio\_work (no CVSS, Linux)
- [CVE-2025-38301](https://cve.now/CVE-2025-38301.md): nvmem: zynqmp\_nvmem: unbreak driver after cleanup (no CVSS, Linux)
- [CVE-2025-38300](https://cve.now/CVE-2025-38300.md): crypto: sun8i-ce-cipher - fix error handling in sun8i\_ce\_cipher\_prepare() (no CVSS, Linux)
- [CVE-2025-38299](https://cve.now/CVE-2025-38299.md): ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP\_DUMMY() (no CVSS, Linux)
- [CVE-2025-38298](https://cve.now/CVE-2025-38298.md): EDAC/skx\_common: Fix general protection fault (no CVSS, Linux)
- [CVE-2025-38297](https://cve.now/CVE-2025-38297.md): PM: EM: Fix potential division-by-zero error in em\_compute\_costs() (no CVSS, Linux)
- [CVE-2025-38296](https://cve.now/CVE-2025-38296.md): ACPI: platform\_profile: Avoid initializing on non-ACPI platforms (no CVSS, Linux)
- [CVE-2025-38295](https://cve.now/CVE-2025-38295.md): perf/amlogic: Replace smp\_processor\_id() with raw\_smp\_processor\_id() in meson\_ddr\_pmu\_create() (no CVSS, Linux)
- [CVE-2025-38294](https://cve.now/CVE-2025-38294.md): wifi: ath12k: fix NULL access in assign channel context handler (no CVSS, Linux)
- [CVE-2025-38293](https://cve.now/CVE-2025-38293.md): wifi: ath11k: fix node corruption in ar-\>arvifs list (CVSS 8.8, Linux)
- [CVE-2025-38292](https://cve.now/CVE-2025-38292.md): wifi: ath12k: fix invalid access to memory (CVSS 8.8, Linux)
- [CVE-2025-38291](https://cve.now/CVE-2025-38291.md): wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash (CVSS 8.8, Linux)
- [CVE-2025-38290](https://cve.now/CVE-2025-38290.md): wifi: ath12k: fix node corruption in ar-\>arvifs list (CVSS 8.8, Linux)
- [CVE-2025-38289](https://cve.now/CVE-2025-38289.md): scsi: lpfc: Avoid potential ndlp use-after-free in dev\_loss\_tmo\_callbk (no CVSS, Linux)
- [CVE-2025-38288](https://cve.now/CVE-2025-38288.md): scsi: smartpqi: Fix smp\_processor\_id() call trace for preemptible kernels (no CVSS, Linux)
- [CVE-2025-38287](https://cve.now/CVE-2025-38287.md): IB/cm: Drop lockdep assert and WARN when freeing old msg (CVSS 7.5, Linux)
- [CVE-2025-38286](https://cve.now/CVE-2025-38286.md): pinctrl: at91: Fix possible out-of-boundary access (no CVSS, Linux)
- [CVE-2025-38285](https://cve.now/CVE-2025-38285.md): bpf: Fix WARN() in get\_bpf\_raw\_tp\_regs (no CVSS, Linux)
- [CVE-2025-38284](https://cve.now/CVE-2025-38284.md): wifi: rtw89: pci: configure manual DAC mode via PCI config API only (no CVSS, Linux)
- [CVE-2025-38283](https://cve.now/CVE-2025-38283.md): hisi\_acc\_vfio\_pci: bugfix live migration function without VF device driver (CVSS 8.8, Linux)
- [CVE-2025-38282](https://cve.now/CVE-2025-38282.md): kernfs: Relax constraint in draining guard (no CVSS, Linux)
- [CVE-2025-38281](https://cve.now/CVE-2025-38281.md): wifi: mt76: mt7996: Add NULL check in mt7996\_thermal\_init (no CVSS, Linux)
- [CVE-2025-38280](https://cve.now/CVE-2025-38280.md): bpf: Avoid \_\_bpf\_prog\_ret0\_warn when jit fails (no CVSS, Linux)
- [CVE-2025-38279](https://cve.now/CVE-2025-38279.md): bpf: Do not include stack ptr register in precision backtracking bookkeeping (no CVSS, Linux)
- [CVE-2025-38278](https://cve.now/CVE-2025-38278.md): octeontx2-pf: QOS: Refactor TC\_HTB\_LEAF\_DEL\_LAST callback (CVSS 7.8, Linux)
- [CVE-2025-38277](https://cve.now/CVE-2025-38277.md): mtd: nand: ecc-mxic: Fix use of uninitialized variable ret (no CVSS, Linux)
- [CVE-2025-38276](https://cve.now/CVE-2025-38276.md): fs/dax: Fix "don't skip locked entries when scanning entries" (CVSS 7.8, Linux)
- [CVE-2025-38275](https://cve.now/CVE-2025-38275.md): phy: qcom-qmp-usb: Fix an NULL vs IS\_ERR() bug (no CVSS, Linux)
- [CVE-2025-38274](https://cve.now/CVE-2025-38274.md): fpga: fix potential null pointer deref in fpga\_mgr\_test\_img\_load\_sgt() (no CVSS, Linux)
- [CVE-2025-38273](https://cve.now/CVE-2025-38273.md): net: tipc: fix refcount warning in tipc\_aead\_encrypt (CVSS 7.8, Linux)
- [CVE-2025-38272](https://cve.now/CVE-2025-38272.md): net: dsa: b53: do not enable EEE on bcm63xx (no CVSS, Linux)
- [CVE-2025-38271](https://cve.now/CVE-2025-38271.md): net: prevent a NULL deref in rtnl\_create\_link() (no CVSS, Linux)
- [CVE-2025-38270](https://cve.now/CVE-2025-38270.md): net: drv: netdevsim: don't napi\_complete() from netpoll (CVSS 7.8, Linux)
- [CVE-2025-38269](https://cve.now/CVE-2025-38269.md): btrfs: exit after state insertion failure at btrfs\_convert\_extent\_bit() (no CVSS, Linux)
- [CVE-2025-38268](https://cve.now/CVE-2025-38268.md): usb: typec: tcpm: move tcpm\_queue\_vdm\_unlocked to asynchronous work (no CVSS, Linux)
- [CVE-2025-38267](https://cve.now/CVE-2025-38267.md): ring-buffer: Do not trigger WARN\_ON() due to a commit\_overrun (no CVSS, Linux)
- [CVE-2025-38266](https://cve.now/CVE-2025-38266.md): pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms (no CVSS, Linux)
- [CVE-2025-38265](https://cve.now/CVE-2025-38265.md): serial: jsm: fix NPE during jsm\_uart\_port\_init (no CVSS, Linux)
- [CVE-2025-6236](https://cve.now/CVE-2025-6236.md): Hostel \< 1.1.5.9 - Admin+ Stored XSS (CVSS 4.8, Hostel)
- [CVE-2025-6234](https://cve.now/CVE-2025-6234.md): Hostel \< 1.1.5.8 - Reflected XSS (CVSS 6.1, Hostel)
- [CVE-2025-7387](https://cve.now/CVE-2025-7387.md): Lana Downloads Manager \<= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, lanacodes Lana Downloads Manager)
- [CVE-2025-46406](https://cve.now/CVE-2025-46406.md): A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one D (CVSS 5.6, Gallagher Command Centre Server)
- [CVE-2025-44003](https://cve.now/CVE-2025-44003.md): Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to t (CVSS 4.3, Gallagher T-Series Readers)
- [CVE-2025-35983](https://cve.now/CVE-2025-35983.md): Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a li (CVSS 6.5, Gallagher Controller)
- [CVE-2025-5807](https://cve.now/CVE-2025-5807.md): Gwolle Guestbook \<= 4.9.2 - Unauthenticated Stored Cross-Site Scripting via \`gwolle\_gb\_content\` Parameter (CVSS 6.1, mpol Gwolle Guestbook)
- [CVE-2025-4406](https://cve.now/CVE-2025-4406.md): wpForo Forum \<= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar (CVSS 5.4, tomdever wpForo Forum)
- [CVE-2023-50458](https://cve.now/CVE-2023-50458.md): In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs. (CVSS 3.5, dradisframework Dradis)
- [CVE-2024-36697](https://cve.now/CVE-2024-36697.md): A cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to execute arbitrar (CVSS 6.1)
- [CVE-2025-27889](https://cve.now/CVE-2025-27889.md): Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection (CVSS 3.4, wftpserver Wing FTP Server)
- [CVE-2025-28243](https://cve.now/CVE-2025-28243.md): An issue in Alteryx Server v.2023.1.1.460 allows HTML injection via a crafted script to the pages component. (CVSS 8.0)
- [CVE-2025-28244](https://cve.now/CVE-2025-28244.md): Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session (CVSS 8.8)
- [CVE-2025-28245](https://cve.now/CVE-2025-28245.md): Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via t (CVSS 6.1)
- [CVE-2025-44251](https://cve.now/CVE-2025-44251.md): Ecovacs Deebot T10 1.7.2 transmits Wi-Fi credentials in cleartext during the pairing process. (CVSS 7.5)
- [CVE-2025-45662](https://cve.now/CVE-2025-45662.md): A cross-site scripting (XSS) vulnerability in the component /master/login.php of mpgram-web commit 94baadb allows attackers to execute arbit (CVSS 6.1)
- [CVE-2025-47811](https://cve.now/CVE-2025-47811.md): In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. (CVSS 4.1, wftpserver Wing FTP Server)
- [CVE-2025-47812](https://cve.now/CVE-2025-47812.md): In Wing FTP Server before 7.4.4. (CVSS 10.0, KEV, wftpserver Wing FTP Server)
- [CVE-2025-47813](https://cve.now/CVE-2025-47813.md): loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UI (CVSS 4.3, KEV, wftpserver Wing FTP Server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.