# CVEs published 2025-07-23

94 CVEs were published on July 23, 2025: 21 critical, 41 high. Days are UTC.

- [CVE-2025-54365](https://cve.now/CVE-2025-54365.md): fastapi-guard patch contains bypassable RegEx (CVSS 7.8, rennf93 fastapi-guard · fastapi-guard)
- [CVE-2016-15044](https://cve.now/CVE-2016-15044.md): Kaltura \< 11.1.0-2 PHP Object Injection RCE (CVSS 9.3, Kaltura Video Platform)
- [CVE-2025-32019](https://cve.now/CVE-2025-32019.md): Harbor's repository description page allows for XSS (CVSS 4.1, goharbor harbor · github.com/goharbor/harbor)
- [CVE-2025-54377](https://cve.now/CVE-2025-54377.md): Roo Code Lacks Line Break Validation in its Command Execution Tool (CVSS 7.8, RooCodeInc Roo-Code)
- [CVE-2025-53537](https://cve.now/CVE-2025-53537.md): LibHTP's memory leak with lzma can lead to resource starvation (CVSS 7.5, OISF libhtp)
- [CVE-2025-47281](https://cve.now/CVE-2025-47281.md): Kyverno's Improper JMESPath Variable Evaluation Leads to Denial of Service (CVSS 7.7, kyverno · github.com/kyverno/kyverno)
- [CVE-2025-53942](https://cve.now/CVE-2025-53942.md): authentik has an insufficient check for account active status during OAuth/SAML authentication (CVSS 7.1, goauthentik authentik · goauthentik.io)
- [CVE-2025-8058](https://cve.now/CVE-2025-8058.md): The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. (CVSS 5.9, The GNU C Library glibc)
- [CVE-2025-4439](https://cve.now/CVE-2025-4439.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 7.7, GitLab)
- [CVE-2025-4700](https://cve.now/CVE-2025-4700.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-2634](https://cve.now/CVE-2025-2634.md): Out of Bounds Read Vulnerability in NI LabVIEW when building font map (CVSS 7.8, NI LabVIEW)
- [CVE-2025-2633](https://cve.now/CVE-2025-2633.md): Out of Bounds Read Vulnerability in NI LabVIEW when loading fonts (CVSS 7.8, NI LabVIEW)
- [CVE-2025-8069](https://cve.now/CVE-2025-8069.md): Local Privilege Escalation Vulnerability in AWS Client VPN Windows Client (CVSS 7.3, AWS Client VPN)
- [CVE-2025-6018](https://cve.now/CVE-2025-6018.md): Pam-config: lpe from unprivileged to allow\_active in pam (CVSS 7.8, pam · Red Hat Enterprise Linux)
- [CVE-2025-40598](https://cve.now/CVE-2025-40598.md): A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker t (CVSS 6.1, SonicWall SMA 100 Series)
- [CVE-2025-33077](https://cve.now/CVE-2025-33077.md): IBM Engineering Systems Design Rhapsody code execution (CVSS 8.8, IBM Engineering Systems Design Rhapsody)
- [CVE-2025-33076](https://cve.now/CVE-2025-33076.md): IBM Engineering Systems Design Rhapsody code execution (CVSS 8.8, IBM Engineering Systems Design Rhapsody)
- [CVE-2025-40597](https://cve.now/CVE-2025-40597.md): A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Ser (CVSS 7.5, SonicWall SMA 100 Series)
- [CVE-2025-33020](https://cve.now/CVE-2025-33020.md): IBM Engineering Systems Design Rhapsody information disclosure (CVSS 5.9, IBM Engineering Systems Design Rhapsody)
- [CVE-2025-40596](https://cve.now/CVE-2025-40596.md): A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Se (CVSS 7.3, SonicWall SMA 100 Series)
- [CVE-2025-36117](https://cve.now/CVE-2025-36117.md): IBM Db2 Mirror for i session fixation (CVSS 6.3, IBM Db2 Mirror for i)
- [CVE-2025-36116](https://cve.now/CVE-2025-36116.md): IBM Db2 Mirror for i cross-site websocket hijacking (CVSS 6.3, IBM Db2 Mirror for i)
- [CVE-2010-10012](https://cve.now/CVE-2010-10012.md): httpdASM 0.92 Path Traversal (CVSS 8.7, Japheth httpdasm)
- [CVE-2015-10141](https://cve.now/CVE-2015-10141.md): Xdebug Remote Debugger Unauthenticated OS Command Execution (CVSS 9.3, Xdebug)
- [CVE-2016-15045](https://cve.now/CVE-2016-15045.md): Deepin lastore-daemon Privilege Escalation via Unsigned .deb Installation (CVSS 8.5, Wuhan Deepin Technology Co. Deepin Linux)
- [CVE-2017-20198](https://cve.now/CVE-2017-20198.md): DC/OS Marathon UI \< 1.9.0 Unauthenticated RCE via Docker Mount Abuse (CVSS 9.3, D2iQ DC/OS Marathon)
- [CVE-2018-25113](https://cve.now/CVE-2018-25113.md): Dicoogle PACS Web Server 2.5.0 Unauthenticated Path Traversal (CVSS 8.7, Dicoogle Project PACS Web Server)
- [CVE-2018-25114](https://cve.now/CVE-2018-25114.md): osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution (CVSS 9.3, osCommerce Online Merchant)
- [CVE-2022-4978](https://cve.now/CVE-2022-4978.md): Steppschuh Remote Control Server 3.1.1.12 Unauthenticated RCE (CVSS 9.3, Steppschuh Remote Control Collection Server)
- [CVE-2025-54090](https://cve.now/CVE-2025-54090.md): Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64 (CVSS 6.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-40599](https://cve.now/CVE-2025-40599.md): An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. (CVSS 9.1, SonicWall SMA 100 Series)
- [CVE-2025-4411](https://cve.now/CVE-2025-4411.md): XSS in Dataprom Informatics' PACS-ACSS (CVSS 6.5, Dataprom Informatics PACS-ACSS)
- [CVE-2024-12310](https://cve.now/CVE-2024-12310.md): Bypass of Login Screen on Shared Kiosk Workstations (CVSS 7.0, Imprivata Enterprise Access Management)
- [CVE-2025-4296](https://cve.now/CVE-2025-4296.md): Open Redirect in HotelRunner's B2B (CVSS 4.7, HotelRunner B2B)
- [CVE-2025-54297](https://cve.now/CVE-2025-54297.md): Extension - compojoom.com - Stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomla (CVSS 7.0, compojoom.com CComment component for Joomla)
- [CVE-2025-54294](https://cve.now/CVE-2025-54294.md): Extension - stackideas.com - SQLi vulnerability in Komento component 4.0.0-4.0.7 for Joomla (CVSS 9.3, stackideas.com Komento component for Joomla)
- [CVE-2025-54295](https://cve.now/CVE-2025-54295.md): Extension - dj-extensions.com - Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla (CVSS 5.1, dj-extensions.com DJ-Reviews component for Joomla)
- [CVE-2024-41750](https://cve.now/CVE-2024-41750.md): IBM SmartCloud Analytics - Log Analysis security bypass (CVSS 5.5, IBM SmartCloud Analytics Log Analysis)
- [CVE-2025-54296](https://cve.now/CVE-2025-54296.md): Extension - mooj.org - Stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomla (CVSS 7.0, mooj.org ProFiles component for Joomla)
- [CVE-2024-40682](https://cve.now/CVE-2024-40682.md): IBM SmartCloud Analytics - Log Analysis denial of service (CVSS 6.2, IBM SmartCloud Analytics Log Analysis)
- [CVE-2025-50127](https://cve.now/CVE-2025-50127.md): Extension - dj-extensions.com - SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla (CVSS 8.5, dj-extensions.com DJ-Flyer component for Joomla)
- [CVE-2024-40686](https://cve.now/CVE-2024-40686.md): IBM SmartCloud Analytics - Log Analysis HOST header injection (CVSS 5.4, IBM SmartCloud Analytics Log Analysis)
- [CVE-2024-41751](https://cve.now/CVE-2024-41751.md): IBM SmartCloud Analytics - Log Analysis security bypass (CVSS 5.5, IBM SmartCloud Analytics Log Analysis)
- [CVE-2025-27930](https://cve.now/CVE-2025-27930.md): Stored XSS (CVSS 6.4, ManageEngine Applications Manager)
- [CVE-2025-53882](https://cve.now/CVE-2025-53882.md): The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess (CVSS 4.4, openSUSE Tumbleweed)
- [CVE-2025-41687](https://cve.now/CVE-2025-41687.md): Weidmueller: Unauthenticated Stack-Based Buffer Overflow in u-link Management API (CVSS 9.8, Weidmueller IE-SR-2TX-WL · Weidmueller IE-SR-2TX-WL-4G-EU +1)
- [CVE-2025-41684](https://cve.now/CVE-2025-41684.md): Weidmueller: Root Command Injection via Unsanitized Input in tls\_iotgen\_setting Endpoint (CVSS 8.8, Weidmueller IE-SR-2TX-WL · Weidmueller IE-SR-2TX-WL-4G-EU +1)
- [CVE-2025-41683](https://cve.now/CVE-2025-41683.md): Weidmueller: Root Command Injection via Unsanitized Input in event\_mail\_test Endpoint (CVSS 8.8, Weidmueller IE-SR-2TX-WL · Weidmueller IE-SR-2TX-WL-4G-EU +1)
- [CVE-2025-8070](https://cve.now/CVE-2025-8070.md): Windows service registered with an unquoted ImagePath vulnerability in the system registry (CVSS 9.2, ASUSTOR ABP and AES)
- [CVE-2025-31701](https://cve.now/CVE-2025-31701.md): A vulnerability has been found in Dahua products. (CVSS 8.1, Dahua IPC · Dahua SD)
- [CVE-2025-31700](https://cve.now/CVE-2025-31700.md): A vulnerability has been found in Dahua products. (CVSS 8.1, Dahua IPC · Dahua SD)
- [CVE-2025-6174](https://cve.now/CVE-2025-6174.md): WordPress Qwizcards \<= 3.9.4 - Reflected XSS (CVSS 6.1, Qwizcards | online quizzes and flashcards)
- [CVE-2025-54439](https://cve.now/CVE-2025-54439.md): Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue aff (CVSS 8.8, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54438](https://cve.now/CVE-2025-54438.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allow (CVSS 9.8, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54444](https://cve.now/CVE-2025-54444.md): Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue aff (CVSS 9.8, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54443](https://cve.now/CVE-2025-54443.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allow (CVSS 9.8, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54442](https://cve.now/CVE-2025-54442.md): Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue aff (CVSS 9.8, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54441](https://cve.now/CVE-2025-54441.md): Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue aff (CVSS 8.8, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54440](https://cve.now/CVE-2025-54440.md): Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue aff (CVSS 9.8, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54447](https://cve.now/CVE-2025-54447.md): Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue aff (CVSS 8.1, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54446](https://cve.now/CVE-2025-54446.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allow (CVSS 9.8, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54445](https://cve.now/CVE-2025-54445.md): Improper Restriction of XML External Entity Reference vulnerability in Samsung Electronics MagicINFO 9 Server allows Server Side Request For (CVSS 8.2, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54448](https://cve.now/CVE-2025-54448.md): Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue aff (CVSS 9.8, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54453](https://cve.now/CVE-2025-54453.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allow (CVSS 8.8, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54452](https://cve.now/CVE-2025-54452.md): Improper Authentication vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 (CVSS 7.3, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54451](https://cve.now/CVE-2025-54451.md): Improper Control of Generation of Code ('Code Injection') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This (CVSS 9.8, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54450](https://cve.now/CVE-2025-54450.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allow (CVSS 7.2, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54449](https://cve.now/CVE-2025-54449.md): Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue aff (CVSS 9.8, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54455](https://cve.now/CVE-2025-54455.md): Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicI (CVSS 9.1, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-54454](https://cve.now/CVE-2025-54454.md): Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicI (CVSS 9.1, Samsung Electronics MagicINFO 9 Server)
- [CVE-2025-8021](https://cve.now/CVE-2025-8021.md): All versions of the package files-bucket-server are vulnerable to Directory Traversal where an attacker can traverse the file system and acc (CVSS 8.7, files-bucket-server)
- [CVE-2025-8020](https://cve.now/CVE-2025-8020.md): All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname (CVSS 8.8, private-ip)
- [CVE-2025-43881](https://cve.now/CVE-2025-43881.md): Improper validation of specified quantity in input issue exists in Real-time Bus Tracking System versions prior to 1.1. (CVSS 4.3, SYNCK GRAPHICA Real-time Bus Tracking System)
- [CVE-2024-53288](https://cve.now/CVE-2024-53288.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology R (CVSS 5.9, Synology Router Manager)
- [CVE-2024-53287](https://cve.now/CVE-2024-53287.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology (CVSS 5.9, Synology Router Manager)
- [CVE-2024-53286](https://cve.now/CVE-2024-53286.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Syn (CVSS 7.2, Synology Router Manager)
- [CVE-2025-42947](https://cve.now/CVE-2025-42947.md): Code Injection vulnerability in SAP FICA ODN framework (CVSS 5.5, SAP\_SE SAP FICA ODN framework)
- [CVE-2025-7722](https://cve.now/CVE-2025-7722.md): Social Streams \<= 1.2.1 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, steverio Social Streams)
- [CVE-2025-5753](https://cve.now/CVE-2025-5753.md): Valuation Calculator \<= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter (CVSS 6.4, reallaunch Commercial Real Estate Valuation Calculator)
- [CVE-2025-6214](https://cve.now/CVE-2025-6214.md): Omnishop \<= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint (CVSS 6.5, Omnishop – Mobile shop apps complementing your WooCommerce…)
- [CVE-2025-6190](https://cve.now/CVE-2025-6190.md): Realty Portal – Agent \<= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp\_user\_profile() Function (CVSS 8.8, nootheme Realty Portal – Agent)
- [CVE-2025-6261](https://cve.now/CVE-2025-6261.md): Fleetwire Fleet Management Plugin \<= 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via fleetwire\_list Shortcode (CVSS 6.4, Fleetwire Fleet Management)
- [CVE-2025-5818](https://cve.now/CVE-2025-5818.md): Featured Image Plus – Quick & Bulk Edit with Unsplash \<= 1.6.6 - Authenticated (Admin+) Server-Side Request Forgery (CVSS 5.5, krasenslavov Featured Image Plus – Bulk Edit Featured Image…)
- [CVE-2025-6054](https://cve.now/CVE-2025-6054.md): YANewsflash \<= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, stratosg YANewsflash)
- [CVE-2025-6215](https://cve.now/CVE-2025-6215.md): Omnishop \<= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint (CVSS 5.3, Omnishop – Mobile shop apps complementing your WooCommerce…)
- [CVE-2025-8060](https://cve.now/CVE-2025-8060.md): Tenda AC23 httpd setMacFilterCfg sub\_46C940 stack-based overflow (CVSS 8.7, Tenda AC23)
- [CVE-2025-54120](https://cve.now/CVE-2025-54120.md): PCL Community Edition exposes login credentials in logs (CVSS 9.3, PCL-Community PCL2-CE)
- [CVE-2025-44109](https://cve.now/CVE-2025-44109.md): A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages. (CVSS 5.4)
- [CVE-2025-46099](https://cve.now/CVE-2025-46099.md): In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it v (CVSS 7.1)
- [CVE-2025-46171](https://cve.now/CVE-2025-46171.md): vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. (CVSS 5.4)
- [CVE-2025-46686](https://cve.now/CVE-2025-46686.md): Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. (CVSS 3.5, Redis)
- [CVE-2025-47187](https://cve.now/CVE-2025-47187.md): A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Un (CVSS 7.5)
- [CVE-2025-50477](https://cve.now/CVE-2025-50477.md): A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages. (CVSS 5.4)
- [CVE-2025-50481](https://cve.now/CVE-2025-50481.md): A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary (CVSS 4.8, mezzanine)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.