# CVEs published 2025-07-22

119 CVEs were published on July 22, 2025: 12 critical, 47 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-43489](https://cve.now/CVE-2025-43489.md): Poly Clariti Manager - Multiple Security Vulnerabilities (CVSS 2.0, HP Poly Clariti Manager)
- [CVE-2025-43488](https://cve.now/CVE-2025-43488.md): Poly Clariti Manager - Multiple Security Vulnerabilities (CVSS 2.0, HP Poly Clariti Manager)
- [CVE-2025-43487](https://cve.now/CVE-2025-43487.md): Poly Clariti Manager - Multiple Security Vulnerabilities (CVSS 6.9, HP Poly Clariti Manager)
- [CVE-2025-54139](https://cve.now/CVE-2025-54139.md): HAX CMS' application pages are vulnerable to clickjacking (CVSS 4.3, haxtheweb issues · @haxtheweb/haxcms-nodejs +1)
- [CVE-2025-43486](https://cve.now/CVE-2025-43486.md): Poly Clariti Manager - Multiple Security Vulnerabilities (CVSS 5.7, HP Poly Clariti Manager)
- [CVE-2025-43485](https://cve.now/CVE-2025-43485.md): Poly Clariti Manager - Multiple Security Vulnerabilities (CVSS 5.7, HP Poly Clariti Manager)
- [CVE-2025-43484](https://cve.now/CVE-2025-43484.md): Poly Clariti Manager - Multiple Security Vulnerabilities (CVSS 6.0, HP Poly Clariti Manager)
- [CVE-2025-43483](https://cve.now/CVE-2025-43483.md): Poly Clariti Manager - Multiple Security Vulnerabilities (CVSS 5.9, HP Poly Clariti Manager)
- [CVE-2025-43022](https://cve.now/CVE-2025-43022.md): Poly Clariti Manager - Multiple Security Vulnerabilities (CVSS 7.3, HP Poly Clariti Manager)
- [CVE-2025-43021](https://cve.now/CVE-2025-43021.md): Poly Clariti Manager - Multiple Security Vulnerabilities (CVSS 5.9, HP Poly Clariti Manager)
- [CVE-2025-43020](https://cve.now/CVE-2025-43020.md): Poly Clariti Manager - Multiple Security Vulnerabilities (CVSS 5.7, HP Poly Clariti Manager)
- [CVE-2025-7766](https://cve.now/CVE-2025-7766.md): Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference (CVSS 8.6, Lantronix Provisioning Manager)
- [CVE-2025-41425](https://cve.now/CVE-2025-41425.md): DuraComm DP-10iN-100-MU Cross-site Scripting (CVSS 7.2, DuraComm SPM-500 DP-10iN-100-MU)
- [CVE-2025-53538](https://cve.now/CVE-2025-53538.md): Suricata's mishandling of data on HTTP2 stream 0 can lead to resource starvation (CVSS 7.5, OISF suricata)
- [CVE-2025-48733](https://cve.now/CVE-2025-48733.md): DuraComm DP-10iN-100-MU Missing Authentication for Critical Function (CVSS 8.7, DuraComm SPM-500 DP-10iN-100-MU)
- [CVE-2025-54141](https://cve.now/CVE-2025-54141.md): ViewVC's standalone server exposes arbitrary server filesystem content (CVSS 7.5, viewvc)
- [CVE-2025-54072](https://cve.now/CVE-2025-54072.md): yt-dlp allows \`--exec\` command injection when using placeholder on Windows (CVSS 7.5, yt-dlp)
- [CVE-2025-54140](https://cve.now/CVE-2025-54140.md): pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write (CVSS 7.5, pyload · pyload-ng)
- [CVE-2025-54137](https://cve.now/CVE-2025-54137.md): NodeJS version of the HAX CMS application is distributed with Default Secrets (CVSS 7.3, haxtheweb issues · @haxtheweb/haxcms-nodejs)
- [CVE-2025-54138](https://cve.now/CVE-2025-54138.md): LibreNMS has Authenticated Local File Inclusion in ajax\_form.php that Allows RCE (CVSS 7.5, librenms · librenms/librenms)
- [CVE-2025-53703](https://cve.now/CVE-2025-53703.md): DuraComm DP-10iN-100-MU Cleartext Transmission of Sensitive Information (CVSS 8.7, DuraComm SPM-500 DP-10iN-100-MU)
- [CVE-2025-8011](https://cve.now/CVE-2025-8011.md): Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2025-8010](https://cve.now/CVE-2025-8010.md): Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2025-8044](https://cve.now/CVE-2025-8044.md): Memory safety bugs fixed in Firefox 141 and Thunderbird 141 (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-8043](https://cve.now/CVE-2025-8043.md): Incorrect URL truncation (CVSS 9.8, Mozilla Firefox)
- [CVE-2025-8035](https://cve.now/CVE-2025-8035.md): Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-8040](https://cve.now/CVE-2025-8040.md): Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-8034](https://cve.now/CVE-2025-8034.md): Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-8033](https://cve.now/CVE-2025-8033.md): Incorrect JavaScript state machine for generators (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-8039](https://cve.now/CVE-2025-8039.md): Search terms persisted in URL bar (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-8038](https://cve.now/CVE-2025-8038.md): CSP frame-src was not correctly enforced for paths (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-8032](https://cve.now/CVE-2025-8032.md): XSLT documents could bypass CSP (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-8031](https://cve.now/CVE-2025-8031.md): Incorrect URL stripping in CSP reports (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-8030](https://cve.now/CVE-2025-8030.md): Potential user-assisted code execution in “Copy as cURL” command (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-8037](https://cve.now/CVE-2025-8037.md): Nameless cookies shadow secure cookies (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-8036](https://cve.now/CVE-2025-8036.md): DNS rebinding circumvents CORS (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-8029](https://cve.now/CVE-2025-8029.md): javascript: URLs executed on object and embed tags (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-8028](https://cve.now/CVE-2025-8028.md): Large branch table could lead to truncated instruction (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-8027](https://cve.now/CVE-2025-8027.md): JavaScript engine only wrote partial return value to stack (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-7724](https://cve.now/CVE-2025-7724.md): Unauthenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2 (CVSS 8.7, TP-Link Systems VIGI NVR1104H-4P · TP-Link Systems VIGI NVR…)
- [CVE-2025-7723](https://cve.now/CVE-2025-7723.md): Authenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2 (CVSS 8.5, TP-Link Systems VIGI NVR1104H-4P · TP-Link Systems VIGI NVR…)
- [CVE-2024-38335](https://cve.now/CVE-2024-38335.md): IBM Security QRadar Network Threat Analytics denial of service (CVSS 4.5, IBM Security QRadar Network Threat Analytics)
- [CVE-2025-6741](https://cve.now/CVE-2025-6741.md): Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the (CVSS 7.1, Devolutions Server)
- [CVE-2025-6523](https://cve.now/CVE-2025-6523.md): Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authenticat (CVSS 9.5, Devolutions Server)
- [CVE-2025-5042](https://cve.now/CVE-2025-5042.md): RFA File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk Revit)
- [CVE-2025-7371](https://cve.now/CVE-2025-7371.md): Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. (CVSS 6.8, Okta On-Premises Provisioning Agent)
- [CVE-2025-8019](https://cve.now/CVE-2025-8019.md): Shenzhen Libituo Technology LBT-T300-T310 appy.cgi sub\_40B6F0 buffer overflow (CVSS 8.7, Shenzhen Libituo Technology LBT-T300-T310)
- [CVE-2025-36520](https://cve.now/CVE-2025-36520.md): A null pointer dereference vulnerability exists in the net\_connectmsg Protocol Buffer Message functionality of Bloomberg Comdb2 8.1. (CVSS 7.5, Bloomberg Comdb2)
- [CVE-2025-46354](https://cve.now/CVE-2025-46354.md): A denial of service vulnerability exists in the Distributed Transaction Commit/Abort Operation functionality of Bloomberg Comdb2 8.1. (CVSS 7.5, Bloomberg Comdb2)
- [CVE-2025-48498](https://cve.now/CVE-2025-48498.md): A null pointer dereference vulnerability exists in the Distributed Transaction component of Bloomberg Comdb2 8.1 when processing a number of (CVSS 7.5, Bloomberg Comdb2)
- [CVE-2025-36512](https://cve.now/CVE-2025-36512.md): A denial of service vulnerability exists in the Bloomberg Comdb2 8.1 database when handling a distributed transaction heartbeat. (CVSS 7.5, Bloomberg Comdb2)
- [CVE-2025-35966](https://cve.now/CVE-2025-35966.md): A null pointer dereference vulnerability exists in the CDB2SQLQUERY protocol buffer message handling of Bloomberg Comdb2 8.1. (CVSS 7.5, Bloomberg Comdb2)
- [CVE-2025-8015](https://cve.now/CVE-2025-8015.md): Shortcodes Ultimate \<= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link (CVSS 6.4, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2025-8018](https://cve.now/CVE-2025-8018.md): code-projects Food Ordering Review System reservation\_page.php sql injection (CVSS 5.3, code-projects Food Ordering Review System)
- [CVE-2025-4878](https://cve.now/CVE-2025-4878.md): Libssh: use of uninitialized variable in privatekey\_from\_file() (CVSS 3.6, libssh · Red Hat Enterprise Linux +1)
- [CVE-2025-4295](https://cve.now/CVE-2025-4295.md): Host Header Injection in HotelRunner's B2B (CVSS 4.6, HotelRunner B2B)
- [CVE-2025-4294](https://cve.now/CVE-2025-4294.md): XSS in HotelRunner's B2B (CVSS 4.8, HotelRunner B2B)
- [CVE-2025-8017](https://cve.now/CVE-2025-8017.md): Tenda AC7 httpd setMacFilterCfg formSetMacFilterCfg stack-based overflow (CVSS 8.7, Tenda AC7)
- [CVE-2015-10140](https://cve.now/CVE-2015-10140.md): Ajax Load More \< 2.8.1.2 - Subscriber+ File Upload & Deletion (CVSS 8.8, Ajax Load More)
- [CVE-2025-34141](https://cve.now/CVE-2025-34141.md): ETQ Reliance CG \< SE.2025.1 Reflected XSS in \`SQLConverterServlet\` (CVSS 5.1, ETQ Reliance CG)
- [CVE-2025-34140](https://cve.now/CVE-2025-34140.md): ETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI Suffix (CVSS 8.7, ETQ Reliance CG · ETQ Reliance NXG)
- [CVE-2025-34142](https://cve.now/CVE-2025-34142.md): ETQ Reliance CG \< SE.2025.1 / \< 2025.1.2 XXE Injection in SSO SAML Handler (CVSS 6.9, ETQ Reliance CG)
- [CVE-2025-34143](https://cve.now/CVE-2025-34143.md): ETQ Reliance CG Authentication Bypass via Trailing Space RCE (CVSS 9.3, ETQ Reliance CG)
- [CVE-2025-7705](https://cve.now/CVE-2025-7705.md): Authentication bypass due to compatibility mode enabled by default (CVSS 6.8, ABB Switch Actuator 4 DU-83330 · ABB Switch actuator, door/…)
- [CVE-2025-4284](https://cve.now/CVE-2025-4284.md): Reflected XSS in Rolantis Information Technologies' Agentis (CVSS 6.1, Rolantis Information Technologies Agentis)
- [CVE-2025-4285](https://cve.now/CVE-2025-4285.md): SQLi in Rolantis Information Technologies' Agentis (CVSS 10.0, Rolantis Information Technologies Agentis)
- [CVE-2025-7900](https://cve.now/CVE-2025-7900.md): Insecure Direct Object Reference in extension "femanager" (femanager) (CVSS 5.3, TYPO3 Extension "femanager" · in2code/femanager)
- [CVE-2025-7899](https://cve.now/CVE-2025-7899.md): Insecure Direct Object Reference in extension "powermail" (powermail) (CVSS 6.0, TYPO3 Extension "powermail" · in2code/powermail)
- [CVE-2025-7427](https://cve.now/CVE-2025-7427.md): Uncontrolled Search Path Element in Arm Development Studio before 2025 (CVSS 5.9, Arm Development Studio)
- [CVE-2025-46267](https://cve.now/CVE-2025-46267.md): Hidden functionality issue exists in WRC-BE36QS-B and WRC-W701-B. (CVSS 4.9, ELECOM CO. WRC-BE36QS-B · ELECOM CO. WRC-W701-B)
- [CVE-2025-53472](https://cve.now/CVE-2025-53472.md): WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabil (CVSS 7.2, ELECOM CO. WRC-BE36QS-B · ELECOM CO. WRC-W701-B)
- [CVE-2025-6187](https://cve.now/CVE-2025-6187.md): bSecure 1.3.7 - 1.7.9 - Missing Authorization to Unauthenticated Privilege Escalation via order\_info REST Endpoint (CVSS 9.8, bsecuretech bSecure – Your Universal Checkout)
- [CVE-2025-6213](https://cve.now/CVE-2025-6213.md): Nginx Cache Purge Preload \<= 2.1.1 - Authenticated (Administrator+) Remote Code Execution (CVSS 7.2, psauxit Nginx Cache Purge Preload)
- [CVE-2025-7685](https://cve.now/CVE-2025-7685.md): Like & Share My Site \<= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, sflack Like & Share My Site)
- [CVE-2025-6082](https://cve.now/CVE-2025-6082.md): Birth Chart Compatibility \<= 2.0 - Unauthenticated Full Path Exposure (CVSS 5.3, mia4 Birth Chart Compatibility)
- [CVE-2025-7692](https://cve.now/CVE-2025-7692.md): Orion Login with SMS \<= 1.0.5 - Authentication Bypass via Weak OTP (CVSS 8.1, gsayed786 Orion Login with SMS)
- [CVE-2025-7687](https://cve.now/CVE-2025-7687.md): Latest Post Accordian Slider \<= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, anop-goswami Latest Post Accordian Slider)
- [CVE-2025-38352](https://cve.now/CVE-2025-38352.md): posix-cpu-timers: fix race between handle\_posix\_cpu\_timers() and posix\_cpu\_timer\_del() (CVSS 7.8, KEV, Linux)
- [CVE-2025-7645](https://cve.now/CVE-2025-7645.md): Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) \<= 3.2.8 - Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion (CVSS 8.1, htplugins Extensions For CF7)
- [CVE-2025-52580](https://cve.now/CVE-2025-52580.md): Insertion of sensitive information into log file issue exists in "region PAY" App for Android prior to 1.5.28. (CVSS 2.4, Gift Pad Co. "region PAY" App for Android)
- [CVE-2025-6585](https://cve.now/CVE-2025-6585.md): WP JobHunt \<= 7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Account Deletion (CVSS 8.1, WP JobHunt)
- [CVE-2025-7644](https://cve.now/CVE-2025-7644.md): Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery \<= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bdthemes Pixel Gallery Addons for Elementor – Easy Grid, Cr…)
- [CVE-2025-7495](https://cve.now/CVE-2025-7495.md): WP-Members \<= 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, cbutlerjr WP-Members Membership Plugin)
- [CVE-2025-7953](https://cve.now/CVE-2025-7953.md): Sanluan PublicCMS viewer.html redirect (CVSS 5.1, Sanluan PublicCMS)
- [CVE-2025-7952](https://cve.now/CVE-2025-7952.md): TOTOLINK T6 MQTT Packet wireless.so ckeckKeepAlive command injection (CVSS 5.3, TOTOLINK T6)
- [CVE-2025-7951](https://cve.now/CVE-2025-7951.md): code-projects Public Chat Room send\_message.php cross site scripting (CVSS 5.1, code-projects Public Chat Room)
- [CVE-2025-7950](https://cve.now/CVE-2025-7950.md): code-projects Public Chat Room login.php sql injection (CVSS 6.9, code-projects Public Chat Room)
- [CVE-2012-10020](https://cve.now/CVE-2012-10020.md): FoxyPress \<= 0.4.2.1 - Arbitrary File Upload (CVSS 9.8, WebMovementLLC FoxyPress)
- [CVE-2015-10137](https://cve.now/CVE-2015-10137.md): Website Contact Form With File Upload \<= 1.3.4 - Arbitrary File Upload (CVSS 9.8, N-Media Website Contact Form With File Upload)
- [CVE-2025-6831](https://cve.now/CVE-2025-6831.md): User Registration \<= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr\_restrict Shortcode (CVSS 6.4, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2025-5240](https://cve.now/CVE-2025-5240.md): CRM and Lead Management by vcita \<= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter (CVSS 6.4, CRM and Lead Management by vcita)
- [CVE-2025-7949](https://cve.now/CVE-2025-7949.md): Sanluan PublicCMS preview.html redirect (CVSS 5.1, Sanluan PublicCMS)
- [CVE-2025-7948](https://cve.now/CVE-2025-7948.md): jshERP updatePwd password recovery (CVSS 5.3, jshERP)
- [CVE-2025-7947](https://cve.now/CVE-2025-7947.md): jshERP Account delete improper authorization (CVSS 5.3, jshERP)
- [CVE-2025-7946](https://cve.now/CVE-2025-7946.md): PHPGurukul Apartment Visitors Management System HTTP POST Request search-visitor.php cross site scripting (CVSS 5.3, PHPGurukul Apartment Visitors Management System)
- [CVE-2025-31511](https://cve.now/CVE-2025-31511.md): An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. (CVSS 7.3)
- [CVE-2025-31512](https://cve.now/CVE-2025-31512.md): An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. (CVSS 7.3)
- [CVE-2025-31513](https://cve.now/CVE-2025-31513.md): An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. (CVSS 6.5)
- [CVE-2025-48964](https://cve.now/CVE-2025-48964.md): ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a craf (CVSS 6.5, iputils)
- [CVE-2025-51458](https://cve.now/CVE-2025-51458.md): SQL Injection in editor\_sql\_run and query\_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary SQL statements via cr (CVSS 6.5)
- [CVE-2025-51459](https://cve.now/CVE-2025-51459.md): File Upload vulnerability in agent.hub.controller.refresh\_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary (CVSS 6.5)
- [CVE-2025-51462](https://cve.now/CVE-2025-51462.md): Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog\_app.set\_dialog in RAGFlow 0.17.2 allows remote attackers to execute arbit (CVSS 6.1)
- [CVE-2025-51463](https://cve.now/CVE-2025-51463.md): Path Traversal in restore\_run\_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a craft (CVSS 7.0)
- [CVE-2025-51464](https://cve.now/CVE-2025-51464.md): Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious (CVSS 8.8, aim)
- [CVE-2025-51471](https://cve.now/CVE-2025-51471.md): Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and (CVSS 6.9, github.com/ollama/ollama)
- [CVE-2025-51472](https://cve.now/CVE-2025-51472.md): Code Injection in AgentTemplate.eval\_agent\_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python (CVSS 6.5)
- [CVE-2025-51475](https://cve.now/CVE-2025-51475.md): Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to ove (CVSS 5.0)
- [CVE-2025-51479](https://cve.now/CVE-2025-51479.md): Authorization bypass in update\_user\_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arb (CVSS 5.4)
- [CVE-2025-51480](https://cve.now/CVE-2025-51480.md): Path Traversal vulnerability in onnx.external\_data\_helper.save\_external\_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by (CVSS 8.8, onnx)
- [CVE-2025-51481](https://cve.now/CVE-2025-51481.md): Local File Inclusion in dagster.\_grpc.impl.get\_notebook\_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbi (CVSS 6.6, dagster-ge · dagster)
- [CVE-2025-51482](https://cve.now/CVE-2025-51482.md): Remote Code Execution in letta.server.rest\_api.routers.v1.tools.run\_tool\_from\_source in letta-ai Letta 0.7.12 allows remote attackers to exe (CVSS 8.8)
- [CVE-2025-51858](https://cve.now/CVE-2025-51858.md): Self Cross-Site Scripting (XSS) vulnerability in ChatPlayground.ai through 2025-05-24, allows attackers to execute arbitrary code and gain s (CVSS 6.1)
- [CVE-2025-51859](https://cve.now/CVE-2025-51859.md): Stored Cross-Site Scripting (XSS) vulnerability in Chaindesk thru 2025-05-26 in its agent chat component. (CVSS 6.5)
- [CVE-2025-51860](https://cve.now/CVE-2025-51860.md): Stored Cross-Site Scripting (XSS) in TelegAI (telegai.com) 2025-05-26 in its chat component and character container component. (CVSS 6.1)
- [CVE-2025-51862](https://cve.now/CVE-2025-51862.md): Insecure Direct Object Reference (IDOR) vulnerability in TelegAI (telegai.com) thru 2025-05-26 in its chat component. (CVSS 6.1)
- [CVE-2025-51863](https://cve.now/CVE-2025-51863.md): Self Cross Site Scripting (XSS) vulnerability in ChatGPT Unli (ChatGPTUnli.com) thru 2025-05-26 allows attackers to execute arbitrary code v (CVSS 6.1)
- [CVE-2025-51864](https://cve.now/CVE-2025-51864.md): A reflected cross-site scripting (XSS) vulnerability exists in AIBOX LLM chat (chat.aibox365.cn) through 2025-05-27, allowing attackers to h (CVSS 6.5)
- [CVE-2025-51865](https://cve.now/CVE-2025-51865.md): Ai2 playground web service (playground.allenai.org) LLM chat through 2025-06-03 is vulnerable to Insecure Direct Object Reference (IDOR), al (CVSS 8.8)
- [CVE-2025-51867](https://cve.now/CVE-2025-51867.md): Insecure Direct Object Reference (IDOR) vulnerability in Deepfiction AI (deepfiction.ai) thru June 3, 2025, allowing attackers to chat with (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.