CVEs published July 11, 2025
94 CVEs were published on July 11, 2025: 6 critical, 27 high.
- Published
- 94
- Critical
- 6
- High
- 27
- Medium
- 56
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 48
Most affected products
- Juniper Networks Junos OS
- 21
- Schneider Electric EcoStruxure™ IT Data Center Expert
- 6
- Campcodes Online Movie Theater Seat Reservation System
- 4
- Microsoft Edge
- 3
- Tenda O3V2
- 3
- apos37 Broken Link Notifier
- 2
- GIGABYTE UEFI-GenericComponentSmmEntry
- 2
- Juniper Networks Junos OS Evolved
- 2
- Red Hat Ansible Automation Platform
- 2
- aa-team Premium Age Verification / Restriction for WordPress
- 1
Critical 6
- CVE-2025-7503An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with undocumented, defaulShenzhen Liandian Communication Technology V380 IP Camera /…
- CVE-2025-52950Juniper Security Director: Insufficient authorization for multiple endpoints in web interfaceJuniper Networks Juniper Security Director
- CVE-2025-50121A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause uSchneider Electric EcoStruxure™ IT Data Center Expert
- CVE-2025-5392GB Forms DB <= 1.0.2 - Unauthenticated Remote Code Executiongb-plugins GB Forms DB
- CVE-2025-30023The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execuAxis Communications AB AXIS Camera Station Pro · Axis Co… +1
- CVE-2025-7401Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Read and Write via remote_tunnel.phpaa-team Premium Age Verification / Restriction for WordPress
High 27
- CVE-2025-5199LPE on Multipass for macOSCanonical Multipass
- CVE-2025-7460TOTOLINK T6 HTTP POST Request cstecgi.cgi setWiFiAclRules buffer overflowTOTOLINK T6
- CVE-2025-30403A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session.Facebook mvfst
- CVE-2025-30402A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execMeta Platforms ExecuTorch · executorch +2
- CVE-2025-53641Postiz allows header mutation in middleware facilitates resulting in SSRFgitroomhq postiz-app
- CVE-2025-43856immich allows account hijacking through oauth2immich-app immich
- CVE-2025-7026SMM Arbitrary Write via Unchecked RBX Pointer in CommandRcx0GIGABYTE UEFI-GenericComponentSmmEntry
- CVE-2025-7028SMM Arbitrary Memory Access via Flash Handler with Unchecked FuncBlock PointerGIGABYTE UEFI-SmiFlash
- CVE-2025-7027SMM Arbitrary Write via Dual-Controlled Pointers in CommandRcx1GIGABYTE UEFI-GenericComponentSmmEntry
- CVE-2025-7029SMM Arbitrary Write via Unchecked OcHeader Buffer in Platform Configuration HandlerGIGABYTE UEFI-OverClockSmiHandler
- CVE-2025-52983Junos OS: After removing ssh public key authentication root can still log inJuniper Networks Junos OS
- CVE-2025-52981Junos OS: SRX Series: Sequence of specific PIM packets causes a flowd crashJuniper Networks Junos OS
- CVE-2025-52980Junos OS: SRX300 Series: rpd will crash upon receiving a specific, valid BGP UPDATE messageJuniper Networks Junos OS
- CVE-2025-52954Junos OS Evolved: A low-privileged user can execute arbitrary Junos commands and modify the configuration, thereby compromising the systemJuniper Networks Junos OS Evolved
- CVE-2025-52946Junos OS and Junos OS Evolved: With traceoptions enabled, receipt of malformed AS PATH causes RPD crashJuniper Networks Junos OS
- CVE-2025-30661Junos OS: Low-privileged user can cause script to run as root, leading to privilege escalationJuniper Networks Junos OS
- CVE-2025-50124A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a prSchneider Electric EcoStruxure™ IT Data Center Expert
- CVE-2025-50123A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote command execution by a priSchneider Electric EcoStruxure™ IT Data Center Expert
- CVE-2025-50122A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reveSchneider Electric EcoStruxure™ IT Data Center Expert
- CVE-2025-6851Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgeryapos37 Broken Link Notifier
- CVE-2025-7442WPGYM - Wordpress Gym Management System < 67.8.0 - Unauthenticated SQL Injectiondasinfomedia WPGYM - Wordpress Gym Management System
- CVE-2025-7434Tenda FH451 POST Request addressNat fromAddressNat stack-based overflowTenda FH451
- CVE-2025-7423Tenda O3V2 httpd setWrlFilterList formWifiMacFilterSet stack-based overflowTenda O3V2
- CVE-2025-7422Tenda O3V2 httpd setNetworkService setAutoReboot stack-based overflowTenda O3V2
- CVE-2025-7421Tenda O3V2 httpd operateMacFilter fromMacFilterModify stack-based overflowTenda O3V2
- CVE-2013-3307Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metLinksys E1000 · Linksys E1200 +1
- CVE-2025-52089A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to ex
Medium, low and unrated 61
- CVE-2025-53636Open OnDemand Shell App closed websocket DoSOSC ondemand
- CVE-2025-7459code-projects Mobile Shop EditMobile.php sql injectioncode-projects Mobile Shop
- CVE-2025-7457Campcodes Online Movie Theater Seat Reservation System manage_movie.php sql injectionCampcodes Online Movie Theater Seat Reservation System
- CVE-2025-7456Campcodes Online Movie Theater Seat Reservation System reserve.php sql injectionCampcodes Online Movie Theater Seat Reservation System
- CVE-2025-7455Campcodes Online Movie Theater Seat Reservation System manage_reserve.php sql injectionCampcodes Online Movie Theater Seat Reservation System
- CVE-2025-7454Campcodes Online Movie Theater Seat Reservation System manage_theater.php sql injectionCampcodes Online Movie Theater Seat Reservation System
- CVE-2025-3631IBM MQ denial of serviceIBM MQ
- CVE-2025-7453saltbo zpan JSON Web Token token.go NewToken hard-coded passwordsaltbo zpan · github.com/saltbo/zpan
- CVE-2025-53642haxcms-nodejs and haxcms-php Improperly Terminate Sessionshaxtheweb issues
- CVE-2025-7452kone-net go-chat Endpoint file_controller.go GetFile path traversalkone-net go-chat
- CVE-2025-7450letseeqiji gorobbs API user.go ResetUserAvatar path traversalletseeqiji gorobbs
- CVE-2024-47065Traceroute_APP responses are not rate-limited.meshtastic firmware
- CVE-2025-47963Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2025-47964Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2025-47182Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2025-52988Junos OS and Junos OS Evolved: Privilege escalation to root via CLI command 'request system logout'Juniper Networks Junos OS
- CVE-2025-6549Junos OS: SRX Series: J-Web can be exposed on additional interfacesJuniper Networks Junos OS
- CVE-2025-52989Junos OS and Junos OS Evolved: Annotate configuration command can be used to change the configurationJuniper Networks Junos OS
- CVE-2025-52986Junos OS and Junos OS Evolved: When RIB sharding is configured each time a show command is executed RPD memory leaksJuniper Networks Junos OS
- CVE-2025-52985Junos OS Evolved: When a control-plane firewall filter refers to a prefix-list with more than 10 entries it's not matchingJuniper Networks Junos OS Evolved
- CVE-2025-52984Junos OS and Junos OS Evolved: When a static route points to a reject next-hop and a gNMI query for this route is processed, RPD crashesJuniper Networks Junos OS
- CVE-2025-52982Junos OS: MX Series: When specific SIP packets are processed the MS-MPC will crashJuniper Networks Junos OS
- CVE-2025-52964Junos OS and Junos OS Evolved: Receipt of a specific BGP UPDATE causes an rpd crash on devices with BGP multipath configuredJuniper Networks Junos OS
- CVE-2025-52963Junos OS: A low-privileged user can disable an interfaceJuniper Networks Junos OS
- CVE-2025-52953Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker sending a valid BGP UPDATE packet forces a BGP session resetJuniper Networks Junos OS
- CVE-2025-52952Junos OS: MX Series with MPC-BUILTIN, MPC 1 through MPC 9: Receipt and processing of a malformed packet causes one or more FPCs to crashJuniper Networks Junos OS
- CVE-2025-48924Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputsApache Software Foundation Apache Commons Lang · org.apa… +1
- CVE-2025-52958Junos OS and Junos OS Evolved: When route validation is enabled, BGP connection establishment failure causes RPD crashJuniper Networks Junos OS
- CVE-2025-52955Junos OS and Junos OS Evolved: When jflow/sflow is configured continuous logical interface flaps causes rpd crash and restartJuniper Networks Junos OS
- CVE-2025-52951Junos OS: IPv6 firewall filter fails to match payload-protocolJuniper Networks Junos OS
- CVE-2025-52949Junos OS and Junos OS Evolved: In an EVPN environment, receipt of specifically malformed BGP update causes RPD crashJuniper Networks Junos OS
- CVE-2025-52948Junos OS: Specific unknown traffic pattern causes FPC and system to crash when packet capturing is enabledJuniper Networks Junos OS
- CVE-2025-52947Junos OS: ACX Series: When 'hot-standby' mode is configured for an L2 circuit, interface flap causes the FEB to crashJuniper Networks Junos OS
- CVE-2025-53861Aap: sensitive cookie(s) set without security flagsRed Hat Ansible Automation Platform
- CVE-2025-53862Aap: aap-gateway: automation-hub: sensitive information disclosureRed Hat Ansible Automation Platform
- CVE-2025-6788A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providSchneider Electric EcoStruxure™ Power Monitoring Expert · S…
- CVE-2025-50125A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execution when the serverSchneider Electric EcoStruxure™ IT Data Center Expert
- CVE-2025-3933Regular Expression Denial of Service (ReDoS) in huggingface/transformershuggingface/transformers · transformers
- CVE-2025-6438A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API callsSchneider Electric EcoStruxure™ IT Data Center Expert
- CVE-2025-6838Broken Link Notifier <= 1.3.0 - Authenticated (Contributor+) CSV Injectionapos37 Broken Link Notifier
- CVE-2025-6068FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingfooplugins Gallery by FooGallery
- CVE-2025-5530WPC Smart Compare for WooCommerce <= 6.4.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpclever WPC Smart Compare for WooCommerce
- CVE-2025-6745WoodMart <= 8.2.5 - Unauthenticated Post DisclosurexTemos Woodmart
- CVE-2025-4593WP Register Profile With Shortcode <= 3.6.2 - Authenticated (Contributor+) Sensitive Information Exposureavimegladon WP Register Profile With Shortcode
- CVE-2025-5992Passing values outside of expected range to QColorTransferGenericFunction can cause a denial of serviceQt
- CVE-2025-6716Contest Gallery <= 26.0.8 - Authenticated (Author+) Stored Cross-Site Scriptingcontest-gallery Contest Gallery – Upload & Vote Photos, Med…
- CVE-2025-5028Arbitrary file deletion vulnerability in ESET product installersESET, spol. s.r.o ESET NOD32 Antivirus · ESET, spol. s.r… +6
- CVE-2025-30026The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required.Axis Communications AB AXIS Camera Station Pro · Axis Commu…
- CVE-2025-30025The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalatioAxis Communications AB AXIS Device Manager · Axis Commun… +1
- CVE-2025-30024The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack.Axis Communications AB AXIS Device Manager
- CVE-2025-6200GeoDirectory < 2.8.120 - Contributor+ Stored XSSGeoDirectory
- CVE-2025-2942Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title DisclosureOrder Delivery Date
- CVE-2025-7436Campcodes Online Recruitment Management System ajax.php sql injectionCampcodes Online Recruitment Management System
- CVE-2025-7435LiveHelperChat lhc-php-resque Extension List list cross site scriptingLiveHelperChat lhc-php-resque Extension
- CVE-2025-5241Denial-of-Service Vulnerability in MELSEC iQ-F SeriesMitsubishi Electric MELSEC iQ-F Series FX5U-32MT/ES · M… +71
- CVE-2023-38327An issue was discovered in eGroupWare 17.1.20190111.
- CVE-2023-38329An issue was discovered in eGroupWare 17.1.20190111.
- CVE-2025-45582GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process.GNU Tar
- CVE-2025-51591A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via inj
- CVE-2025-52994gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value.phpThumb project phpThumb · james-heinrich/phpthumb
- CVE-2025-53864Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeplConnect2id Nimbus JOSE+JWT · com.nimbusds:nimbus-jose-jwt