CVEs published July 23, 2025
94 CVEs were published on July 23, 2025: 21 critical, 41 high.
- Published
- 94
- Critical
- 21
- High
- 41
- Medium
- 31
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- Samsung Electronics MagicINFO 9 Server
- 18
- IBM SmartCloud Analytics Log Analysis
- 4
- SonicWall SMA 100 Series
- 4
- IBM Engineering Systems Design Rhapsody
- 3
- Synology Router Manager
- 3
- Weidmueller IE-SR-2TX-WL · Weidmueller IE-SR-2TX-WL-4G-EU +1
- 3
- Dahua IPC · Dahua SD
- 2
- GitLab
- 2
- IBM Db2 Mirror for i
- 2
- NI LabVIEW
- 2
Critical 21
- CVE-2016-15044Kaltura < 11.1.0-2 PHP Object Injection RCEKaltura Video Platform
- CVE-2015-10141Xdebug Remote Debugger Unauthenticated OS Command ExecutionXdebug
- CVE-2017-20198DC/OS Marathon UI < 1.9.0 Unauthenticated RCE via Docker Mount AbuseD2iQ DC/OS Marathon
- CVE-2018-25114osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code ExecutionosCommerce Online Merchant
- CVE-2022-4978Steppschuh Remote Control Server 3.1.1.12 Unauthenticated RCESteppschuh Remote Control Collection Server
- CVE-2025-40599An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface.SonicWall SMA 100 Series
- CVE-2025-54294Extension - stackideas.com - SQLi vulnerability in Komento component 4.0.0-4.0.7 for Joomlastackideas.com Komento component for Joomla
- CVE-2025-41687Weidmueller: Unauthenticated Stack-Based Buffer Overflow in u-link Management APIWeidmueller IE-SR-2TX-WL · Weidmueller IE-SR-2TX-WL-4G-EU +1
- CVE-2025-8070Windows service registered with an unquoted ImagePath vulnerability in the system registryASUSTOR ABP and AES
- CVE-2025-54438Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allowSamsung Electronics MagicINFO 9 Server
- CVE-2025-54444Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affSamsung Electronics MagicINFO 9 Server
- CVE-2025-54443Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allowSamsung Electronics MagicINFO 9 Server
- CVE-2025-54442Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affSamsung Electronics MagicINFO 9 Server
- CVE-2025-54440Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affSamsung Electronics MagicINFO 9 Server
- CVE-2025-54446Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allowSamsung Electronics MagicINFO 9 Server
- CVE-2025-54448Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affSamsung Electronics MagicINFO 9 Server
- CVE-2025-54451Improper Control of Generation of Code ('Code Injection') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.ThisSamsung Electronics MagicINFO 9 Server
- CVE-2025-54449Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affSamsung Electronics MagicINFO 9 Server
- CVE-2025-54455Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicISamsung Electronics MagicINFO 9 Server
- CVE-2025-54454Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicISamsung Electronics MagicINFO 9 Server
- CVE-2025-54120PCL Community Edition exposes login credentials in logsPCL-Community PCL2-CE
High 41
- CVE-2025-54365fastapi-guard patch contains bypassable RegExrennf93 fastapi-guard · fastapi-guard
- CVE-2025-54377Roo Code Lacks Line Break Validation in its Command Execution ToolRooCodeInc Roo-Code
- CVE-2025-53537LibHTP's memory leak with lzma can lead to resource starvationOISF libhtp
- CVE-2025-47281Kyverno's Improper JMESPath Variable Evaluation Leads to Denial of Servicekyverno · github.com/kyverno/kyverno
- CVE-2025-53942authentik has an insufficient check for account active status during OAuth/SAML authenticationgoauthentik authentik · goauthentik.io
- CVE-2025-4439Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-4700Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-2634Out of Bounds Read Vulnerability in NI LabVIEW when building font mapNI LabVIEW
- CVE-2025-2633Out of Bounds Read Vulnerability in NI LabVIEW when loading fontsNI LabVIEW
- CVE-2025-8069Local Privilege Escalation Vulnerability in AWS Client VPN Windows ClientAWS Client VPN
- CVE-2025-6018Pam-config: lpe from unprivileged to allow_active in pampam · Red Hat Enterprise Linux
- CVE-2025-33077IBM Engineering Systems Design Rhapsody code executionIBM Engineering Systems Design Rhapsody
- CVE-2025-33076IBM Engineering Systems Design Rhapsody code executionIBM Engineering Systems Design Rhapsody
- CVE-2025-40597A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of SerSonicWall SMA 100 Series
- CVE-2025-40596A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of SeSonicWall SMA 100 Series
- CVE-2010-10012httpdASM 0.92 Path TraversalJapheth httpdasm
- CVE-2016-15045Deepin lastore-daemon Privilege Escalation via Unsigned .deb InstallationWuhan Deepin Technology Co. Deepin Linux
- CVE-2018-25113Dicoogle PACS Web Server 2.5.0 Unauthenticated Path TraversalDicoogle Project PACS Web Server
- CVE-2024-12310Bypass of Login Screen on Shared Kiosk WorkstationsImprivata Enterprise Access Management
- CVE-2025-54297Extension - compojoom.com - Stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomlacompojoom.com CComment component for Joomla
- CVE-2025-54296Extension - mooj.org - Stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomlamooj.org ProFiles component for Joomla
- CVE-2025-50127Extension - dj-extensions.com - SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomladj-extensions.com DJ-Flyer component for Joomla
- CVE-2025-41684Weidmueller: Root Command Injection via Unsanitized Input in tls_iotgen_setting EndpointWeidmueller IE-SR-2TX-WL · Weidmueller IE-SR-2TX-WL-4G-EU +1
- CVE-2025-41683Weidmueller: Root Command Injection via Unsanitized Input in event_mail_test EndpointWeidmueller IE-SR-2TX-WL · Weidmueller IE-SR-2TX-WL-4G-EU +1
- CVE-2025-31701A vulnerability has been found in Dahua products.Dahua IPC · Dahua SD
- CVE-2025-31700A vulnerability has been found in Dahua products.Dahua IPC · Dahua SD
- CVE-2025-54439Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affSamsung Electronics MagicINFO 9 Server
- CVE-2025-54441Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affSamsung Electronics MagicINFO 9 Server
- CVE-2025-54447Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affSamsung Electronics MagicINFO 9 Server
- CVE-2025-54445Improper Restriction of XML External Entity Reference vulnerability in Samsung Electronics MagicINFO 9 Server allows Server Side Request ForSamsung Electronics MagicINFO 9 Server
- CVE-2025-54453Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allowSamsung Electronics MagicINFO 9 Server
- CVE-2025-54452Improper Authentication vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Samsung Electronics MagicINFO 9 Server
- CVE-2025-54450Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allowSamsung Electronics MagicINFO 9 Server
- CVE-2025-8021All versions of the package files-bucket-server are vulnerable to Directory Traversal where an attacker can traverse the file system and accfiles-bucket-server
- CVE-2025-8020All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname private-ip
- CVE-2024-53286Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in SynSynology Router Manager
- CVE-2025-7722Social Streams <= 1.2.1 - Authenticated (Subscriber+) Privilege Escalationsteverio Social Streams
- CVE-2025-6190Realty Portal – Agent <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() Functionnootheme Realty Portal – Agent
- CVE-2025-8060Tenda AC23 httpd setMacFilterCfg sub_46C940 stack-based overflowTenda AC23
- CVE-2025-46099In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it v
- CVE-2025-47187A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Un
Medium, low and unrated 32
- CVE-2025-32019Harbor's repository description page allows for XSSgoharbor harbor · github.com/goharbor/harbor
- CVE-2025-8058The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails.The GNU C Library glibc
- CVE-2025-40598A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker tSonicWall SMA 100 Series
- CVE-2025-33020IBM Engineering Systems Design Rhapsody information disclosureIBM Engineering Systems Design Rhapsody
- CVE-2025-36117IBM Db2 Mirror for i session fixationIBM Db2 Mirror for i
- CVE-2025-36116IBM Db2 Mirror for i cross-site websocket hijackingIBM Db2 Mirror for i
- CVE-2025-54090Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64Apache Software Foundation Apache HTTP Server
- CVE-2025-4411XSS in Dataprom Informatics' PACS-ACSSDataprom Informatics PACS-ACSS
- CVE-2025-4296Open Redirect in HotelRunner's B2BHotelRunner B2B
- CVE-2025-54295Extension - dj-extensions.com - Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomladj-extensions.com DJ-Reviews component for Joomla
- CVE-2024-41750IBM SmartCloud Analytics - Log Analysis security bypassIBM SmartCloud Analytics Log Analysis
- CVE-2024-40682IBM SmartCloud Analytics - Log Analysis denial of serviceIBM SmartCloud Analytics Log Analysis
- CVE-2024-40686IBM SmartCloud Analytics - Log Analysis HOST header injectionIBM SmartCloud Analytics Log Analysis
- CVE-2024-41751IBM SmartCloud Analytics - Log Analysis security bypassIBM SmartCloud Analytics Log Analysis
- CVE-2025-27930Stored XSSManageEngine Applications Manager
- CVE-2025-53882The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceessopenSUSE Tumbleweed
- CVE-2025-6174WordPress Qwizcards <= 3.9.4 - Reflected XSSQwizcards | online quizzes and flashcards
- CVE-2025-43881Improper validation of specified quantity in input issue exists in Real-time Bus Tracking System versions prior to 1.1.SYNCK GRAPHICA Real-time Bus Tracking System
- CVE-2024-53288Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology RSynology Router Manager
- CVE-2024-53287Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology Synology Router Manager
- CVE-2025-42947Code Injection vulnerability in SAP FICA ODN frameworkSAP_SE SAP FICA ODN framework
- CVE-2025-5753Valuation Calculator <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameterreallaunch Commercial Real Estate Valuation Calculator
- CVE-2025-6214Omnishop <= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST EndpointOmnishop – Mobile shop apps complementing your WooCommerce…
- CVE-2025-6261Fleetwire Fleet Management Plugin <= 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via fleetwire_list ShortcodeFleetwire Fleet Management
- CVE-2025-5818Featured Image Plus – Quick & Bulk Edit with Unsplash <= 1.6.6 - Authenticated (Admin+) Server-Side Request Forgerykrasenslavov Featured Image Plus – Bulk Edit Featured Image…
- CVE-2025-6054YANewsflash <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scriptingstratosg YANewsflash
- CVE-2025-6215Omnishop <= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST EndpointOmnishop – Mobile shop apps complementing your WooCommerce…
- CVE-2025-44109A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages.
- CVE-2025-46171vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint.
- CVE-2025-46686Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user.Redis
- CVE-2025-50477A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages.
- CVE-2025-50481A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrarymezzanine