# CVEs published 2025-07-15

155 CVEs were published on July 15, 2025: 20 critical, 53 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-53906](https://cve.now/CVE-2025-53906.md): Vim has path traversal issue with zip.vim and special crafted zip archives (CVSS 4.1, vim)
- [CVE-2025-30761](https://cve.now/CVE-2025-30761.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). (CVSS 5.9, Oracle Java SE · Oracle GraalVM Enterprise Edition)
- [CVE-2025-53905](https://cve.now/CVE-2025-53905.md): Vim has path traversial issue with tar.vim and special crafted tar files (CVSS 4.1, vim)
- [CVE-2025-6981](https://cve.now/CVE-2025-6981.md): Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only access (CVSS 5.3, GitHub Enterprise Server)
- [CVE-2025-49841](https://cve.now/CVE-2025-49841.md): GHSL-2025-053: GPT-SoVITS Deserialization of Untrusted Data vulnerability (CVSS 8.9, RVC-Boss GPT-SoVITS)
- [CVE-2025-49840](https://cve.now/CVE-2025-49840.md): GHSL-2025-052: GPT-SoVITS Deserialization of Untrusted Data vulnerability (CVSS 8.9, RVC-Boss GPT-SoVITS)
- [CVE-2025-49839](https://cve.now/CVE-2025-49839.md): GHSL-2025-051: GPT-SoVITS Deserialization of Untrusted Data vulnerability (CVSS 8.9, RVC-Boss GPT-SoVITS)
- [CVE-2025-49838](https://cve.now/CVE-2025-49838.md): GHSL-2025-050: GPT-SoVITS Deserialization of Untrusted Data vulnerability (CVSS 8.9, RVC-Boss GPT-SoVITS)
- [CVE-2025-49837](https://cve.now/CVE-2025-49837.md): GHSL-2025-049: GPT-SoVITS Deserialization of Untrusted Data vulnerability (CVSS 8.9, RVC-Boss GPT-SoVITS)
- [CVE-2025-49836](https://cve.now/CVE-2025-49836.md): GHSL-2025-048: GPT-SoVITS Command Injection vulnerability (CVSS 8.9, RVC-Boss GPT-SoVITS)
- [CVE-2025-49835](https://cve.now/CVE-2025-49835.md): GHSL-2025-047: GPT-SoVITS Command Injection vulnerability (CVSS 8.9, RVC-Boss GPT-SoVITS)
- [CVE-2025-49834](https://cve.now/CVE-2025-49834.md): GHSL-2025-046: GPT-SoVITS Command Injection vulnerability (CVSS 8.9, RVC-Boss GPT-SoVITS)
- [CVE-2025-49833](https://cve.now/CVE-2025-49833.md): GHSL-2025-045: GPT-SoVITS Command Injection vulnerability (CVSS 8.9, RVC-Boss GPT-SoVITS)
- [CVE-2025-49831](https://cve.now/CVE-2025-49831.md): Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to IAM Authenticator Bypass via Mis-configured Network Device (CVSS 9.1, cyberark conjur)
- [CVE-2025-49830](https://cve.now/CVE-2025-49830.md): Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to path traversal and file disclosure (CVSS 7.1, cyberark conjur)
- [CVE-2025-49829](https://cve.now/CVE-2025-49829.md): Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) missing validations (CVSS 6.0, cyberark conjur)
- [CVE-2025-49828](https://cve.now/CVE-2025-49828.md): Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Remote Code Execution (CVSS 8.6, cyberark conjur)
- [CVE-2025-53032](https://cve.now/CVE-2025-53032.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-53031](https://cve.now/CVE-2025-53031.md): Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (com (CVSS 5.3, Oracle Financial Services Analytical Applications Infrastru…)
- [CVE-2025-53030](https://cve.now/CVE-2025-53030.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2025-53029](https://cve.now/CVE-2025-53029.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 2.3, Oracle VM VirtualBox)
- [CVE-2025-53028](https://cve.now/CVE-2025-53028.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2025-53027](https://cve.now/CVE-2025-53027.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2025-53026](https://cve.now/CVE-2025-53026.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2025-53025](https://cve.now/CVE-2025-53025.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2025-53024](https://cve.now/CVE-2025-53024.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2025-53023](https://cve.now/CVE-2025-53023.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). (CVSS 4.9, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2025-50108](https://cve.now/CVE-2025-50108.md): Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Workspace). (CVSS 5.4, Oracle Hyperion Financial Reporting)
- [CVE-2025-50107](https://cve.now/CVE-2025-50107.md): Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Request handling). (CVSS 6.1, Oracle Universal Work Queue)
- [CVE-2025-50106](https://cve.now/CVE-2025-50106.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). (CVSS 8.1, Oracle Java SE · Oracle GraalVM for JDK +1)
- [CVE-2025-50105](https://cve.now/CVE-2025-50105.md): Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). (CVSS 8.1, Oracle Universal Work Queue)
- [CVE-2025-50104](https://cve.now/CVE-2025-50104.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 2.7, Oracle MySQL Server)
- [CVE-2025-50103](https://cve.now/CVE-2025-50103.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2025-50102](https://cve.now/CVE-2025-50102.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50101](https://cve.now/CVE-2025-50101.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50100](https://cve.now/CVE-2025-50100.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). (CVSS 2.2, Oracle MySQL Server)
- [CVE-2025-50099](https://cve.now/CVE-2025-50099.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50098](https://cve.now/CVE-2025-50098.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 2.7, Oracle MySQL Server)
- [CVE-2025-50097](https://cve.now/CVE-2025-50097.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50096](https://cve.now/CVE-2025-50096.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2025-50095](https://cve.now/CVE-2025-50095.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50094](https://cve.now/CVE-2025-50094.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50093](https://cve.now/CVE-2025-50093.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50092](https://cve.now/CVE-2025-50092.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50091](https://cve.now/CVE-2025-50091.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50090](https://cve.now/CVE-2025-50090.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 5.4, Oracle Applications Framework)
- [CVE-2025-50089](https://cve.now/CVE-2025-50089.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50088](https://cve.now/CVE-2025-50088.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50087](https://cve.now/CVE-2025-50087.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2025-50086](https://cve.now/CVE-2025-50086.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50085](https://cve.now/CVE-2025-50085.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2025-50084](https://cve.now/CVE-2025-50084.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50083](https://cve.now/CVE-2025-50083.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2025-50082](https://cve.now/CVE-2025-50082.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2025-50081](https://cve.now/CVE-2025-50081.md): Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). (CVSS 3.1, Oracle MySQL Cluster · Oracle MySQL Client)
- [CVE-2025-50080](https://cve.now/CVE-2025-50080.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50079](https://cve.now/CVE-2025-50079.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2025-50078](https://cve.now/CVE-2025-50078.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2025-50077](https://cve.now/CVE-2025-50077.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2025-50076](https://cve.now/CVE-2025-50076.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2025-50073](https://cve.now/CVE-2025-50073.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). (CVSS 6.1, Oracle WebLogic Server)
- [CVE-2025-50072](https://cve.now/CVE-2025-50072.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 4.0, Oracle WebLogic Server)
- [CVE-2025-50071](https://cve.now/CVE-2025-50071.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). (CVSS 6.4, Oracle Applications Framework)
- [CVE-2025-50070](https://cve.now/CVE-2025-50070.md): Vulnerability in the JDBC component of Oracle Database Server. (CVSS 5.3, Oracle JDBC)
- [CVE-2025-50069](https://cve.now/CVE-2025-50069.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 7.7, Oracle Database Server)
- [CVE-2025-50068](https://cve.now/CVE-2025-50068.md): Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). (CVSS 6.7, Oracle MySQL Cluster)
- [CVE-2025-50067](https://cve.now/CVE-2025-50067.md): Vulnerability in Oracle Application Express (component: Strategic Planner Starter App). (CVSS 9.0, Oracle Application Express)
- [CVE-2025-50066](https://cve.now/CVE-2025-50066.md): Vulnerability in the Oracle Database Materialized View component of Oracle Database Server. (CVSS 2.7, Oracle Database Server)
- [CVE-2025-50065](https://cve.now/CVE-2025-50065.md): Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Native Image). (CVSS 3.7, Oracle GraalVM for JDK)
- [CVE-2025-50064](https://cve.now/CVE-2025-50064.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 4.8, Oracle WebLogic Server)
- [CVE-2025-50063](https://cve.now/CVE-2025-50063.md): Vulnerability in Oracle Java SE (component: Install). (CVSS 7.3, Oracle Java SE)
- [CVE-2025-50062](https://cve.now/CVE-2025-50062.md): Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payroll for Core). (CVSS 8.1, Oracle PeopleSoft Enterprise HCM Global Payroll Core)
- [CVE-2025-50061](https://cve.now/CVE-2025-50061.md): Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Acc (CVSS 5.4, Oracle Primavera P6 Enterprise Project Portfolio Management)
- [CVE-2025-50060](https://cve.now/CVE-2025-50060.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). (CVSS 8.1, Oracle BI Publisher)
- [CVE-2025-50059](https://cve.now/CVE-2025-50059.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Network (CVSS 8.6, Oracle Java SE · Oracle GraalVM for JDK +1)
- [CVE-2025-30762](https://cve.now/CVE-2025-30762.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2025-30760](https://cve.now/CVE-2025-30760.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 5.4, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2025-30759](https://cve.now/CVE-2025-30759.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 6.1, Oracle Business Intelligence Enterprise Edition)
- [CVE-2025-30758](https://cve.now/CVE-2025-30758.md): Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: User Interface). (CVSS 5.3, Oracle Siebel CRM End User)
- [CVE-2025-30756](https://cve.now/CVE-2025-30756.md): Vulnerability in Oracle REST Data Services (component: General). (CVSS 6.1, Oracle REST Data Services)
- [CVE-2025-30754](https://cve.now/CVE-2025-30754.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). (CVSS 4.8, Oracle Java SE · Oracle GraalVM for JDK +1)
- [CVE-2025-30753](https://cve.now/CVE-2025-30753.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 6.5, Oracle WebLogic Server)
- [CVE-2025-30752](https://cve.now/CVE-2025-30752.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Compiler). (CVSS 3.7, Oracle Java SE · Oracle GraalVM for JDK)
- [CVE-2025-30751](https://cve.now/CVE-2025-30751.md): Vulnerability in the Oracle Database component of Oracle Database Server. (CVSS 8.8, Oracle Database Server)
- [CVE-2025-30750](https://cve.now/CVE-2025-30750.md): Vulnerability in the Unified Audit component of Oracle Database Server. (CVSS 2.4, Oracle Database Server)
- [CVE-2025-30749](https://cve.now/CVE-2025-30749.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). (CVSS 8.1, Oracle Java SE · Oracle GraalVM for JDK +1)
- [CVE-2025-30748](https://cve.now/CVE-2025-30748.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). (CVSS 6.1, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2025-30747](https://cve.now/CVE-2025-30747.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). (CVSS 4.3, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2025-30746](https://cve.now/CVE-2025-30746.md): Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). (CVSS 6.1, Oracle iStore)
- [CVE-2025-30745](https://cve.now/CVE-2025-30745.md): Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Device Integration). (CVSS 6.1, Oracle MES for Process Manufacturing)
- [CVE-2025-30744](https://cve.now/CVE-2025-30744.md): Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Multiplatform Sync Errors). (CVSS 8.1, Oracle Mobile Field Service)
- [CVE-2025-30743](https://cve.now/CVE-2025-30743.md): Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Lease and Finance Management)
- [CVE-2025-49827](https://cve.now/CVE-2025-49827.md): Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Bypass of IAM Authenticator (CVSS 9.1, cyberark conjur)
- [CVE-2025-30739](https://cve.now/CVE-2025-30739.md): Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). (CVSS 5.5, Oracle CRM Technical Foundation)
- [CVE-2025-41239](https://cve.now/CVE-2025-41239.md): vSockets information-disclosure vulnerability (CVSS 7.1, VMware ESXi · VMware Cloud Foundation +5)
- [CVE-2025-41238](https://cve.now/CVE-2025-41238.md): PVSCSI heap-overflow vulnerability (CVSS 9.3, VMware ESXi · VMware Cloud Foundation +4)
- [CVE-2025-41237](https://cve.now/CVE-2025-41237.md): VMCI integer-underflow vulnerability (CVSS 9.3, VMware Cloud Foundation · VMware vSphere Foundation +5)
- [CVE-2025-41236](https://cve.now/CVE-2025-41236.md): VMXNET3 integer-overflow vulnerability (CVSS 9.3, VMware ESXi · VMware Cloud Foundation +4)
- [CVE-2025-53903](https://cve.now/CVE-2025-53903.md): The Scratch Channel Has Potential Cross-Site Scripting (XSS) Vulnerability (CVSS 1.3, the-scratch-channel.github.io)
- [CVE-2025-7657](https://cve.now/CVE-2025-7657.md): Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2025-6558](https://cve.now/CVE-2025-6558.md): Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentiall (CVSS 8.8, KEV, Google Chrome)
- [CVE-2025-7656](https://cve.now/CVE-2025-7656.md): Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, Google Chrome)
- [CVE-2025-53826](https://cve.now/CVE-2025-53826.md): FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout (CVSS 7.7, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2025-53893](https://cve.now/CVE-2025-53893.md): File Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File Processing (CVSS 7.7, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2025-53895](https://cve.now/CVE-2025-53895.md): ZITADEL has broken authN and authZ in session API and resulting session tokens (CVSS 7.7, zitadel)
- [CVE-2025-53959](https://cve.now/CVE-2025-53959.md): In JetBrains YouTrack before 2025.2.86069, 2024.3.85077, 2025.1.86199 email spoofing via an administrative API was possible (CVSS 7.6, JetBrains YouTrack)
- [CVE-2025-7042](https://cve.now/CVE-2025-7042.md): Use After Free vulnerability exists in the IPT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 (CVSS 7.8, Dassault Systèmes SOLIDWORKS eDrawings)
- [CVE-2025-6974](https://cve.now/CVE-2025-6974.md): Use of Uninitialized Variable vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 (CVSS 7.8, Dassault Systèmes SOLIDWORKS eDrawings)
- [CVE-2025-6973](https://cve.now/CVE-2025-6973.md): Use After Free vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 (CVSS 7.8, Dassault Systèmes SOLIDWORKS eDrawings)
- [CVE-2025-6972](https://cve.now/CVE-2025-6972.md): Use After Free vulnerability exists in the CATPRODUCT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 (CVSS 7.8, Dassault Systèmes SOLIDWORKS eDrawings)
- [CVE-2025-6971](https://cve.now/CVE-2025-6971.md): Use After Free vulnerability exists in the CATPRODUCT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 (CVSS 7.8, Dassault Systèmes SOLIDWORKS eDrawings)
- [CVE-2025-0831](https://cve.now/CVE-2025-0831.md): Out-Of-Bounds Read vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 (CVSS 7.8, Dassault Systèmes SOLIDWORKS eDrawings)
- [CVE-2025-53622](https://cve.now/CVE-2025-53622.md): DSpace has path traversal vulnerability in Simple Archive Format (SAF) package import via contents file (CVSS 5.2, DSpace · org.dspace:dspace-api)
- [CVE-2025-53621](https://cve.now/CVE-2025-53621.md): DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources (CVSS 6.9, DSpace · org.dspace:dspace-api)
- [CVE-2025-30483](https://cve.now/CVE-2025-30483.md): Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0 contains an Insertion of Sensitive Information into Log File vulnerability. (CVSS 5.5, Dell ECS · Dell ObjectScale)
- [CVE-2025-33097](https://cve.now/CVE-2025-33097.md): IBM QRadar SIEM cross-site scripting (CVSS 6.4, IBM QRadar SIEM)
- [CVE-2025-48795](https://cve.now/CVE-2025-48795.md): Apache CXF: Denial of Service and sensitive data exposure in logs (CVSS 5.6, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2025-6965](https://cve.now/CVE-2025-6965.md): Integer Truncation on SQLite (CVSS 7.2, SQLite · SQLitePCLRaw.lib.e\_sqlite3 +2)
- [CVE-2025-34107](https://cve.now/CVE-2025-34107.md): WinaXe 7.7 FTP Client Remote Buffer Overflow (CVSS 8.7, LabF WinaXe FTP Client)
- [CVE-2025-34103](https://cve.now/CVE-2025-34103.md): WePresent WiPG-1000 Unauthenticated Command Injection in via rdfs.cgi (CVSS 9.3, WePresent (Barco) WiPG-1000)
- [CVE-2025-34111](https://cve.now/CVE-2025-34111.md): Tiki Wiki \<= 15.1 ELFinder Unauthenticated File Upload RCE (CVSS 9.3, Tiki Software Community Association Wiki CMS Groupware)
- [CVE-2025-34113](https://cve.now/CVE-2025-34113.md): Tiki Wiki CMS Authenticated Command Injection in Calendar Module (CVSS 8.7, Tiki Software Community Association Wiki CMS Groupware)
- [CVE-2025-34068](https://cve.now/CVE-2025-34068.md): Samsung WLAN AP WEA453e \< 5.2.4.T1 Unauthenticated RCE via command1 and command2 Parameters (CVSS 9.3, Samsung Electronics WLAN AP WEA453e)
- [CVE-2025-34112](https://cve.now/CVE-2025-34112.md): Riverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCE (CVSS 10.0, Riverbed Technology SteelCentral NetExpress · Riverbed Tech…)
- [CVE-2025-34104](https://cve.now/CVE-2025-34104.md): Piwik Authenticated RCE via Custom Plugin Upload (CVSS 9.4, Piwik (now Matomo) Web Analytics Platform)
- [CVE-2025-34106](https://cve.now/CVE-2025-34106.md): PDF Shaper v3.5/3.6 Buffer Overflow via Convert to Image Feature (CVSS 8.4, Burnaware PDF Shaper)
- [CVE-2025-34109](https://cve.now/CVE-2025-34109.md): Panda Security PSEvents.exe Insecure DLL Loading Privilege Escalation (CVSS 8.5, Panda Security Panda Global Protection · Panda Security… +2)
- [CVE-2025-34115](https://cve.now/CVE-2025-34115.md): OP5 Monitor \<= 7.1.9 Authenticated Command Execution via command\_test.php (CVSS 8.7, ITRS Group OP5 Monitor)
- [CVE-2025-34116](https://cve.now/CVE-2025-34116.md): IPFire \< 2.19 Core Update 101 proxy.cgi RCE (CVSS 8.7, IPFire Project IPFire)
- [CVE-2025-34105](https://cve.now/CVE-2025-34105.md): DiskBoss Enterprise Stack-Based Buffer Overflow RCE (CVSS 10.0, Flexense DiskBoss Enterprise)
- [CVE-2025-34108](https://cve.now/CVE-2025-34108.md): Disk Pulse Enterprise 9.0.34 Login Stack Buffer Overflow (CVSS 8.6, Flexense Disk Pulse Enterprise)
- [CVE-2025-34110](https://cve.now/CVE-2025-34110.md): ColoradoFTP Server \<= 1.3 Build 8 Path Traversal Information Disclosure (CVSS 9.3, ColoradoFTP Server)
- [CVE-2025-7667](https://cve.now/CVE-2025-7667.md): Restrict File Access \<= 1.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion (CVSS 8.1, josxha Restrict File Access)
- [CVE-2025-4369](https://cve.now/CVE-2025-4369.md): Companion Auto Update \<= 3.9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via update\_delay\_days parameter (CVSS 5.5, papin Companion Auto Update)
- [CVE-2025-24477](https://cve.now/CVE-2025-24477.md): A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.4 through 7.2.1 (CVSS 4.0, Fortinet FortiOS)
- [CVE-2025-7672](https://cve.now/CVE-2025-7672.md): Stored-XSS possibility in Namo CrossEditor4 (CVSS 2.3, JiranSoft CrossEditor4)
- [CVE-2025-3621](https://cve.now/CVE-2025-3621.md): Remote Code Execution in ProTNS ActADUR (CVSS 9.4, ProTNS ActADUR)
- [CVE-2025-7340](https://cve.now/CVE-2025-7340.md): HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. \<= 2.2.1 - Unauthenticated Arbitrary File Upload (CVSS 9.8, htplugins HT Contact Form – Drag & Drop Form Builder for Wo…)
- [CVE-2025-7360](https://cve.now/CVE-2025-7360.md): HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. \<= 2.2.1 - Directory Traversal to Arbitrary File Move (CVSS 9.1, htplugins HT Contact Form – Drag & Drop Form Builder for Wo…)
- [CVE-2025-7367](https://cve.now/CVE-2025-7367.md): Strong Testimonials \<= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields (CVSS 6.4, wpchill Strong Testimonials)
- [CVE-2025-7341](https://cve.now/CVE-2025-7341.md): HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. \<= 2.2.1 - Unauthenticated Arbitrary File Deletion (CVSS 9.1, htplugins HT Contact Form – Drag & Drop Form Builder for Wo…)
- [CVE-2025-5394](https://cve.now/CVE-2025-5394.md): Alone – Charity Multipurpose Non-profit WordPress Theme \<= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation (CVSS 9.8, Bearsthemes Alone – Charity Multipurpose Non-profit WordPre…)
- [CVE-2025-5393](https://cve.now/CVE-2025-5393.md): Alone – Charity Multipurpose Non-profit WordPress Theme \<= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Deletion (CVSS 9.1, Bearsthemes Alone – Charity Multipurpose Non-profit WordPre…)
- [CVE-2025-6265](https://cve.now/CVE-2025-6265.md): A path traversal vulnerability in the file\_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow (CVSS 7.2, Zyxel NWA50AX PRO firmware)
- [CVE-2025-53891](https://cve.now/CVE-2025-53891.md): TIME LINE has Improper File Validation in Upload Section (CVSS 4.3, TimeLineOfficial Time-Line-)
- [CVE-2024-42650](https://cve.now/CVE-2024-42650.md): NanoMQ 0.17.5 was discovered to contain a segmentation fault via the component /nanomq/pub\_handler.c. (CVSS 7.5)
- [CVE-2025-26186](https://cve.now/CVE-2025-26186.md): SQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code via the id parameter in Ajax.php (CVSS 8.1)
- [CVE-2025-50819](https://cve.now/CVE-2025-50819.md): Directory traversal vulnerability in beiyuouo arxiv-daily thru 2025-05-06 (commit fad168770b0e68aef3e5acfa16bb2e7a7765d687) when parsing the (CVSS 7.1)
- [CVE-2025-52080](https://cve.now/CVE-2025-52080.md): In Netgear XR300 V1.0.3.38\_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service through the usb\_device.cgi endpo (CVSS 6.5)
- [CVE-2025-52081](https://cve.now/CVE-2025-52081.md): In Netgear XR300 V1.0.3.38\_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service through the usb\_device.cgi endpo (CVSS 6.5)
- [CVE-2025-52082](https://cve.now/CVE-2025-52082.md): In Netgear XR300 V1.0.3.38\_10.3.30, a stack-based buffer overflow exists in the HTTPD service through the usb\_device.cgi endpoint. (CVSS 6.5)
- [CVE-2025-52376](https://cve.now/CVE-2025-52376.md): An authentication bypass vulnerability in the /web/um\_open\_telnet.cgi endpoint in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and (CVSS 9.8)
- [CVE-2025-52377](https://cve.now/CVE-2025-52377.md): Command injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to exe (CVSS 5.4)
- [CVE-2025-52378](https://cve.now/CVE-2025-52378.md): Cross-Site Scripting (XSS) vulnerability in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below allowing attackers to inject Ja (CVSS 5.4)
- [CVE-2025-52379](https://cve.now/CVE-2025-52379.md): Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below contains an authenticated command injection vulnerability in the firmware u (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.