CVEs published July 24, 2025
78 CVEs were published on July 24, 2025: 14 critical, 16 high.
- Published
- 78
- Critical
- 14
- High
- 16
- Medium
- 46
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- WWBN AVideo
- 7
- GitLab
- 4
- Adobe Experience Manager
- 3
- HCL Software iAutomate
- 3
- Medtronic MyCareLink Patient Monitor
- 3
- Calibre Web · Autocaliweb +1
- 2
- deerwms deer-wms-2
- 2
- HCL Software IEM
- 2
- IBM MQ Operator
- 2
- 995525477-1 Mine CloudVod LMS
- 1
Critical 14
- CVE-2025-32429XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterxwiki-platform · org.xwiki.platform:xwiki-platform-distribu…
- CVE-2025-6260Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical FunctionNetwork Thermostat X-Series WiFi thermostats
- CVE-2025-46410A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 aWWBN AVideo
- CVE-2025-53084A cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8WWBN AVideo
- CVE-2025-50128A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev masteWWBN AVideo
- CVE-2025-41420A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commWWBN AVideo
- CVE-2025-4784SQLi in Moderec's TourtellaModerec Tourtella
- CVE-2025-4822SQLi in Bayraktar Solar Energies' ScadaWatt OtopilotBayraktar Solar Energies ScadaWatt Otopilot
- CVE-2025-5243Arbitrary File Upload in SMG Software's Information PortalSMG Software Information Portal
- CVE-2025-6380ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback FunctionONLYOFFICE Docs
- CVE-2025-6441Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition <= 4.03.32 - Unauthenticated Login Token Generation to Authentication Bypasstobias_conrad WebinarIgnition – Live, Automated & Evergreen…
- CVE-2025-41240Mounted Kubernetes Secrets under a predictable path located within the web server document rootVMware bitnamicharts/appsmith · VMware bitnamicharts/dru… +1
- CVE-2025-7437Ebook Store <= 5.8012 - Unauthenticated Arbitrary File Uploadmotovnet Ebook Store
- CVE-2025-7852WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Functioniqonicdesign WPBookit
High 16
- CVE-2025-7742Authentication Bypass in LG Innotek CameraLG Innotek Camera Model LNV5110R
- CVE-2025-54379eKuiper API endpoints handling SQL queries with user-controlled table names.lf-edge ekuiper · ekuiper +2
- CVE-2025-53940Quiet uses insecure, inconsistent verification on local backend tokenTryQuiet quiet
- CVE-2025-31952HCL iAutomate is affected by an insufficient session expirationHCL Software iAutomate
- CVE-2025-31955HCL iAutomate is affected by a sensitive data exposure vulnerabilityHCL Software iAutomate
- CVE-2025-31953HCL iAutomate is affected by hardcoded credentialsHCL Software iAutomate
- CVE-2025-6998Calibre Web 0.6.24 & Autocaliweb 0.7.0 - ReDoSCalibre Web · Autocaliweb +1
- CVE-2025-5039Privilege Ecalation due to Untrusted Search Path VulnerabilityAutodesk AutoCAD · Autodesk RealDWG +1
- CVE-2025-36548A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and WWBN AVideo
- CVE-2025-25214A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff.WWBN AVideo
- CVE-2025-48732An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff.WWBN AVideo
- CVE-2025-33109IBM i privilege escalationIBM i
- CVE-2025-7695Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Routealexacrm Dataverse Integration
- CVE-2025-7640hiWeb Export Posts <= 0.9.0.0 - Cross-Site Request Forgery to Arbitrary File Deletionden-media hiWeb Export Posts
- CVE-2025-26397SolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation VulnerabilitySolarWinds Observability Self-Hosted
- CVE-2025-51087Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/saveParentControlInfo.
Medium, low and unrated 48
- CVE-2025-8124deerwms deer-wms-2 unallocatedList sql injectiondeerwms deer-wms-2
- CVE-2025-0250HCL IEM is affected by an authorization token sent in cookie vulnerabilityHCL Software IEM
- CVE-2025-0249HCL IEM is affected by an improper invalidation of access or JWT token vulnerabilityHCL Software IEM
- CVE-2025-22165This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac.Atlassian Sourcetree for Mac
- CVE-2025-3614ElementsKit Elementor Addons and Templates <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Widgetroxnor ElementsKit Elementor Addons – Advanced Widgets & Te…
- CVE-2025-8123deerwms deer-wms-2 edit sql injectiondeerwms deer-wms-2
- CVE-2025-7404Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind CCalibre Web · Autocaliweb +1
- CVE-2025-8115PHPGurukul Taxi Stand Management System new-autoortaxi-entry-form.php cross site scriptingPHPGurukul Taxi Stand Management System
- CVE-2025-46993Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-46996Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-47061Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-33013IBM MQ Operator information disclosureIBM MQ Operator
- CVE-2025-36005IBM MQ Operator information disclosureIBM MQ Operator
- CVE-2025-8114Libssh: null pointer dereference in libssh kex session id calculationlibssh · Red Hat Enterprise Linux +1
- CVE-2025-40680Encryption of sensitive data in CapillaryScope missingCapillary io CapillaryScope
- CVE-2025-7959Station Pro <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height Parametersmarviorocha Station Pro – Advanced Audio Streaming & Player…
- CVE-2025-7690Affiliate Plus <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scriptingmindnl Affiliate Plus
- CVE-2025-7835iThoughts Advanced Code Editor <= 1.2.10 - Cross-Site Request Forgery to Settings Updategerkin iThoughts Advanced Code Editor
- CVE-2025-6588FunnelCockpit <= 1.4.3 - Reflected Cross-Site Scripting via `error` ParameterFunnelCockpit
- CVE-2025-4608Structured Content <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcodegorbo Structured Content (JSON-LD) #wpsc
- CVE-2025-6382Taeggie Feed <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via name AttributeTaeggie Feed
- CVE-2025-6539Voltax Video Player <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameterminutemedia Voltax Video Player
- CVE-2025-3669Supreme Addons for Beaver Builder <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb Shortcodeullakalim8 Supreme Addons for Beaver Builder –
- CVE-2025-6387WP Get The Table <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameterjonsisk WP Get The Table
- CVE-2025-6262muse.ai video embedding <= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via muse-ai Shortcodemuseai skiv video embedding
- CVE-2025-6385WP Applink <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameterejointjp WP Applink
- CVE-2025-7822WP Wallcreeper <= 1.6.1 - Missing Authorization to Authenticated (Susbcriber+) Cache Enable/Disablealexalouit WP Wallcreeper
- CVE-2025-8071Mine CloudVod <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via audio Parameter995525477-1 Mine CloudVod LMS
- CVE-2025-7966Get Youtube Subs <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via subscribe_link_att Functionzohaib167 Get Youtube Subs
- CVE-2025-7780AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functionstigroumeow AI Engine – The Chatbot, AI Framework & MCP for…
- CVE-2025-5084Post Grid Master <= 3.4.13 - Reflected Cross-Site Scripting via argsArray['read_more_text']mdshuvo Post Grid Master — Post Grids & AJAX Filters
- CVE-2025-8009Security Ninja – Secure Firewall & Secure Malware Scanner - 5.201 - 5.242 - Authenticated (Administrator+) Arbitrary File Readcleverplugins Security Ninja – WordPress Security Plugin &…
- CVE-2025-8107In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executiOB OceanBase Server
- CVE-2025-7745Modbus TCP buffer overreadABB AC500
- CVE-2025-0765Incorrect Authorization in GitLabGitLab
- CVE-2025-1299Missing Authorization in GitLabGitLab
- CVE-2025-4976Exposure of Sensitive Information Due to Incompatible Policies in GitLabGitLab
- CVE-2025-7001Insufficient Granularity of Access Control in GitLabGitLab
- CVE-2025-4968WPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder ElementsWPBakery Page Builder
- CVE-2025-4395Medtronic MyCareLink Patient Monitor Empty Password VulnerabilityMedtronic MyCareLink Patient Monitor
- CVE-2025-4394Medtronic MyCareLink Patient Monitor Unencrypted Filesystem VulnerabilityMedtronic MyCareLink Patient Monitor
- CVE-2025-4393Medtronic MyCareLink Patient Monitor Deserialization VulnerabilityMedtronic MyCareLink Patient Monitor
- CVE-2025-45702SoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in plaintext.
- CVE-2025-45731A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other opera
- CVE-2025-51082Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/fast_setting_wifi_set.
- CVE-2025-51085Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/SetSysTimeCfg.
- CVE-2025-51088Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/WifiGuestSet.
- CVE-2025-51089Tenda AC8V4 V16.03.34.06` was discovered to contain heap overflow at /goform/GetParentControlInfo.The manipulation of the argument `mac` lea