CVEs published July 17, 2025
88 CVEs were published on July 17, 2025: 17 critical, 30 high. 2 are now in CISA KEV.
- Published
- 88
- Critical
- 17
- High
- 30
- Medium
- 39
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 39
Most affected products
- code-projects Online Appointment Booking System
- 7
- LabRedesCefetRJ WeGIA
- 5
- Open Source Robotics Foundation Robot Operating System
- 5
- Broadcom Brocade ASCG
- 3
- Lenovo Vantage · Lenovo Commercial Vantage
- 3
- 1Panel-dev MaxKB
- 2
- ipavlov 7-Zip
- 2
- Scada-LTS
- 2
- thinkgem JeeSite
- 2
- Bearsthemes Bears Backup
- 1
Critical 17
- CVE-2025-6185Leviton AcquiSuite and Energy Monitoring Hub Cross-site ScriptingLeviton AcquiSuite · Leviton Energy Monitoring Hub
- CVE-2025-23266NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could NVIDIA Container Toolkit · github.com/NVIDIA/gpu-operator +3
- CVE-2025-54068Livewire vulnerable to remote command execution during property update hydrationlivewire · livewire/livewire
- CVE-2025-25257An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet ForFortinet FortiWeb
- CVE-2025-54062WeGIA SQL Injection (Blind Time-Based) Vulnerability in id_dependente Parameter on profile_dependente.php EndpointLabRedesCefetRJ WeGIA
- CVE-2025-54061WeGIASQL Injection (Blind Time-Based) Vulnerability in idatendido_familiares Parameter on dependente_editarDoc.php EndpointLabRedesCefetRJ WeGIA
- CVE-2025-54060WeGIA SQL Injection (Blind Time-Based) Vulnerability in idatendido_familiares Parameter on dependente_editarInfoPessoal.php EndpointLabRedesCefetRJ WeGIA
- CVE-2025-54058WeGIA SQL Injection (Blind Time-Based) Vulnerability in idatendido_familiares Parameter on dependente_editarEndereco.php EndpointLabRedesCefetRJ WeGIA
- CVE-2025-53946WeGIA vulnerable to SQL Injection in endpoint profile_paciente.php parameter id_fichamedicaLabRedesCefetRJ WeGIA
- CVE-2025-53909mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Templatemailcow-dockerized
- CVE-2025-7712Madara - Core <= 2.2.3 - Unauthenticated Arbitrary File DeletionMangaBooth Madara - Core
- CVE-2025-5396Bears Backup <= 2.0.0 - Unauthenticated Remote Code ExecutionBearsthemes Bears Backup
- CVE-2025-50240nbcio-boot v1.0.3 was discovered to contain a SQL injection vulnerability via the userIds parameter at /sys/user/deleteRecycleBin.
- CVE-2025-51630TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a buffer overflow via the ePort parameter in the function setIpPortFilterRu
- CVE-2025-52046Totolink A3300R V17.0.0cu.596_B20250515 was found to contain a command injection vulnerability in the sub_4197C0 function via the mac and de
- CVE-2025-53867Island Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL.
- CVE-2025-53964GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying files when a user adds a crafted dictionary and
High 30
- CVE-2025-6391JSON Web Token (JWT) Exposure in Log FilesBroadcom Brocade ASCG
- CVE-2025-7762D-Link DI-8100 HTTP Request menu_nat_more.asp stack-based overflowD-Link DI-8100
- CVE-2025-7398Medium Strength Cipher Suites detected on port on ports 9000 and 8036Broadcom Brocade ASCG
- CVE-2025-7758TOTOLINK T6 HTTP POST Request cstecgi.cgi setDiagnosisCfg buffer overflowTOTOLINK T6
- CVE-2025-23270NVIDIA Jetson Linux contains a vulnerability in UEFI Management mode, where an unprivileged local attacker may cause exposure of sensitive iNVIDIA Jetson Orin, IGX Orin and Xavier Devices
- CVE-2025-23267NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link followiNVIDIA Container Toolkit · github.com/NVIDIA/nvidia-cont… +3
- CVE-2025-4657A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, LenLenovo PC Manager · Lenovo Browser +1
- CVE-2025-6249An authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with elevated permissions Lenovo FileZ Client
- CVE-2025-6248A cross-site scripting (XSS) vulnerability was reported in the Lenovo Browser that could allow an attacker to obtain sensitive information iLenovo Browser
- CVE-2025-6232An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute coLenovo Vantage · Lenovo Commercial Vantage
- CVE-2025-6231An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute coLenovo Vantage · Lenovo Commercial Vantage
- CVE-2025-1700A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attaMotorola Software Fix
- CVE-2025-0886An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to escLenovo Elliptic Virtual Lock Sensor Service For ThinkPa… +26
- CVE-2025-3753Unsafe use of eval() method in rosbag toolOpen Source Robotics Foundation Robot Operating System
- CVE-2024-41921Unsafe use of eval() method in rostopic echo toolOpen Source Robotics Foundation Robot Operating System
- CVE-2024-41148Unsafe use of eval() method in rostopic hz toolOpen Source Robotics Foundation Robot Operating System
- CVE-2024-39835Unsafe use of eval() method in roslaunch toolOpen Source Robotics Foundation Robot Operating System
- CVE-2024-39289Unsafe use of eval() method in rosparam toolOpen Source Robotics Foundation Robot Operating System
- CVE-2025-7433A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrarSophos Intercept X for Windows
- CVE-2024-13972A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a loSophos Intercept X for Windows Core Agent
- CVE-2025-7472A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining systSophos Intercept X for Windows Installer
- CVE-2025-23263NVIDIA DOCA-Host and Mellanox OFED contain a vulnerability in the VGT+ feature, where an attacker on a VM might cause escalation of privilegNVIDIA DOCA-Host and Mellanox OFED
- CVE-2025-7747Tenda FH451 POST Request WizardHandle fromWizardHandle buffer overflowTenda FH451
- CVE-2025-7338Multer vulnerable to Denial of Service via unhandled exception from malformed requestexpressjs multer · multer
- CVE-2025-1713deadlock potential with VT-d and legacy PCI device pass-throughXen
- CVE-2025-5344Exposed AIDL service allowing for tampering of system secure settings in Bluebird kiosk applicationcom.bluebird.kiosk.launcher
- CVE-2025-7735UNIMAX｜Hospital Information System - SQL InjectionUNIMAX Hospital Information System
- CVE-2023-41566OA EKP v16 was discovered to contain an arbitrary download vulnerability via the component /ui/sys_ui_extend/sysUiExtend.do.
- CVE-2023-47356Mingyu Security Gateway before v3.0-5.3p was discovered to contain a remote command execution (RCE) vulnerability via the log_type parameter
- CVE-2024-32323SQL Injection vulnerability in cnhcit.com Haichang OA v.1.0.0 allows a remote attacker to obtain sensitive information via the if parameter
Medium, low and unrated 41
- CVE-2025-7765code-projects Online Appointment Booking System addmanagerclinic.php sql injectioncode-projects Online Appointment Booking System
- CVE-2025-7764code-projects Online Appointment Booking System deletedoctorclinic.php sql injectioncode-projects Online Appointment Booking System
- CVE-2025-7763thinkgem JeeSite Site Controller SiteController.java select redirectthinkgem JeeSite
- CVE-2025-7397CLI history displays inline passwordsBroadcom Brocade ASCG
- CVE-2025-7759thinkgem JeeSite UEditor Image Grabber ActionEnter.java server-side request forgerythinkgem JeeSite
- CVE-2025-7757PHPGurukul Land Record System edit-property.php sql injectionPHPGurukul Land Record System
- CVE-2025-7756code-projects E-Commerce Site cross-site request forgerycode-projects E-Commerce Site
- CVE-2025-7755code-projects Online Ordering System edit_product.php unrestricted uploadcode-projects Online Ordering System
- CVE-2025-23269NVIDIA Jetson Linux contains a vulnerability in the kernel where an attacker may cause an exposure of sensitive information due to a shared NVIDIA Jetson Orin and Xavier Devices
- CVE-2025-7754code-projects Patient Record Management System xray_form.php sql injectioncode-projects Patient Record Management System
- CVE-2025-7753code-projects Online Appointment Booking System adddoctor.php sql injectioncode-projects Online Appointment Booking System
- CVE-2025-7752code-projects Online Appointment Booking System deletedoctor.php sql injectioncode-projects Online Appointment Booking System
- CVE-2024-42209HCL Connections is vulnerable to an information disclosure vulnerabilityHCL Software Connections
- CVE-2025-6230A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execuLenovo Vantage · Lenovo Commercial Vantage
- CVE-2025-2818A vulnerability was reported in version 1.0 of the Bluetooth Transmission Alliance protocol adopted by Motorola Smart Connect Android ApplicMotorola Smart Connect Android Application
- CVE-2025-1729A DLL hijacking vulnerability was reported in TrackPoint Quick Menu software that, under certain conditions, could allow a local attacker toLenovo TrackPoint Quick Menu
- CVE-2025-7751code-projects Online Appointment Booking System addclinic.php sql injectioncode-projects Online Appointment Booking System
- CVE-2025-7750code-projects Online Appointment Booking System adddoctorclinic.php sql injectioncode-projects Online Appointment Booking System
- CVE-2025-54070OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffersopenzeppelin-contracts · @openzeppelin/contracts +1
- CVE-2025-53817GHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStreamipavlov 7-Zip
- CVE-2025-53816GHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoderipavlov 7-Zip
- CVE-2025-7749code-projects Online Appointment Booking System getmanagerregion.php sql injectioncode-projects Online Appointment Booking System
- CVE-2025-53644OpenCV contains a use after free buffer write due to an uninitialized pointeropencv
- CVE-2025-53638Solady lacks extcodesize validation on implementation in ERC4337FactoryVectorized solady
- CVE-2025-7748ZCMS Create Article Page cross site scriptingZCMS
- CVE-2025-7339on-headers vulnerable to http response header manipulationjshttp on-headers · on-headers
- CVE-2025-54066DiracX-Web login page has Open Redirect vulnerabilityDIRACGrid diracx-web · @dirac-grid/diracx-web-components
- CVE-2025-54064rucio-server, rucio-ui, and rucio-webui vulnerable to insertion of X-Rucio-Auth-Token in apache access logfilesrucio helm-charts
- CVE-2025-53941Hollo renders posts received with form elements and allows submissionfedify-dev hollo
- CVE-2025-53928MaxKB has RCE in MCP call1Panel-dev MaxKB
- CVE-2025-53927MaxKB sandbox bypass1Panel-dev MaxKB
- CVE-2025-40924Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurelyHAARG Catalyst::Plugin::Session
- CVE-2025-5346File removal via path traversal in unsecured broadcast receiver in Bluebird barcode scanner applicationkr.co.bluebird.android.bbsettings
- CVE-2025-5345Exposed AIDL service allowing to read and delete files with system-level privileges in Bluebird filemanager applicationcom.bluebird.filemanagers
- CVE-2025-3415Grafana is an open-source platform for monitoring and observability.Grafana · github.com/grafana/grafana
- CVE-2025-4302Stop User Enumeration < 1.7.3 - Protection BypassStop User Enumeration
- CVE-2025-7729Scada-LTS usersProfiles.shtm cross site scriptingScada-LTS
- CVE-2025-7728Scada-LTS users.shtm cross site scriptingScada-LTS
- CVE-2025-46102Cross Site Scripting vulnerability in Beakon Software Beakon Learning Management System Sharable Content Object Reference Model (SCORM) vers
- CVE-2025-47189Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data of certain user
- CVE-2025-51497An issue was discovered in AdGuard plugin before 1.11.22 for Safari on MacOS.