CVEs published July 25, 2025
219 CVEs were published on July 25, 2025: 17 critical, 79 high.
- Published
- 219
- Critical
- 17
- High
- 79
- Medium
- 48
- Low
- 5
- Unrated
- 70
- Now in CISA KEV
- 0
- Fix available
- 72
Most affected products
- Linux
- 114
- Salesforce Tableau Server
- 8
- deerwms deer-wms-2
- 6
- TOTOLINK A702R
- 5
- D-Link DIR-513
- 3
- Gardyn Home Kit Firmware
- 3
- HCL Software IEM
- 3
- code-projects Church Donation System
- 2
- Commvault
- 2
- Droip
- 2
Critical 17
- CVE-2014-125115Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCEArtica ST Pandora FMS
- CVE-2014-125116HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration InjectionHybridAuth
- CVE-2014-125118eScan 5.5-2 Web Management Console Command InjectionMicroWorld eScan Web Management Console
- CVE-2014-125117D-Link info.cgi POST Request Stack-Based Buffer Overflow RCED-Link DSP-W215
- CVE-2025-38439bnxt_en: Set DMA unmap len correctly for XDP_REDIRECTLinux
- CVE-2025-38430nfsd: nfsd4_spo_must_allow() must check this is a v4 compound requestLinux
- CVE-2025-38429bus: mhi: ep: Update read pointer only after buffer is writtenLinux
- CVE-2025-38411netfs: Fix double put of requestLinux
- CVE-2025-38365btrfs: fix a race between renames and directory loggingLinux
- CVE-2019-25224WP Database Backup < 5.2 - Unauthenticated OS Command Injectiondatabasebackup WP Database Backup – Unlimited Database & Fi…
- CVE-2015-10143Platform < 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Options UpdatePageLines Platform
- CVE-2025-29628A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Gardyn Home Kit Firmware
- CVE-2025-29629Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak defaGardyn Home Kit Firmware
- CVE-2025-29631Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow commandGardyn Home Kit Firmware
- CVE-2025-30135An issue was discovered on IROAD Dashcam FX2 devices.
- CVE-2025-45777An issue in the OTP mechanism of Chavara Family Welfare Centre Chavara Matrimony Site v2.0 allows attackers to bypass authentication via sup
- CVE-2025-46199Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form
High 79
- CVE-2025-8101Linkify 4.3.1 - Prototype Pollution & HTML Attribute Injection (XSS)Linkify · linkifyjs
- CVE-2025-8170TOTOLINK T6 MQTT Packet meshSlaveDlfw tcpcheck_net buffer overflowTOTOLINK T6
- CVE-2025-8169D-Link DIR-513 HTTP POST Request formSetWanPPTPpath formSetWanPPTPcallback buffer overflowD-Link DIR-513
- CVE-2025-8168D-Link DIR-513 formSetWanPPPoE websAspInit buffer overflowD-Link DIR-513
- CVE-2025-52454Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows ResourcSalesforce Tableau Server
- CVE-2025-52453Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource LSalesforce Tableau Server
- CVE-2025-52452Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux Salesforce Tableau Server
- CVE-2025-52449Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service moSalesforce Tableau Server
- CVE-2025-52448Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api moduSalesforce Tableau Server
- CVE-2025-52447Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc commanSalesforce Tableau Server
- CVE-2025-52446Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows ISalesforce Tableau Server
- CVE-2025-36727SimpleHelp Inclusion of functionality from untrusted control sphereSimplehelp
- CVE-2014-125119WinRAR < 5.00 Filename Spoofing RCERARLab WinRAR
- CVE-2025-34139Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File ReadSitecore Experience Manager · Sitecore Experience Platfo… +2
- CVE-2020-36850Sitecore JSS React Sample Application 11.0.0 - 14.0.1 Information DisclosureSitecore JSS React Sample Application
- CVE-2016-15046Hanwha Techwin SSM 1.32 & 1.4 ActiveMQ File Upload RCEHanwha Smart Security Manager
- CVE-2025-34114OpenBlow Missing Critical Security HeadersLaser Romae s.r.l. OpenBlow
- CVE-2014-125114i-Ftp 2.20 Schedule.xml Stack-Based Buffer Overflowi-Ftp
- CVE-2013-10032GetSimple CMS 3.2.1 Authenticated RCE via Arbitrary PHP File UploadGetSimple CMS Project GetSimple CMS
- CVE-2024-13976Commvault 11.20.0 - 11.36.0 Windows Maintenance Installer DLL InjectionCommvault for Windows
- CVE-2024-13975Commvault 11.20.0 - 11.36.0 Windows Access Nodes Compromise via Local File Server Agent AbuseCommvault
- CVE-2025-38466perf: Revert to requiring CAP_SYS_ADMIN for uprobesLinux
- CVE-2025-38464tipc: Fix use-after-free in tipc_conn_close().Linux
- CVE-2025-38463tcp: Correct signedness in skb remaining space calculationLinux
- CVE-2025-38461vsock: Fix transport_* TOCTOULinux
- CVE-2025-38460atm: clip: Fix potential null-ptr-deref in to_atmarpd().Linux
- CVE-2025-38456ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()Linux
- CVE-2025-38455KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flightLinux
- CVE-2025-38453io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCULinux
- CVE-2025-38449drm/gem: Acquire references on GEM handles for framebuffersLinux
- CVE-2025-38447mm/rmap: fix potential out-of-bounds page table access during batched unmapLinux
- CVE-2025-38446clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_dataLinux
- CVE-2025-38440net/mlx5e: Fix race between DIM disable and net_dim()Linux
- CVE-2025-38437ksmbd: fix potential use-after-free in oplock/lease break ackLinux
- CVE-2025-8160Tenda AC20 httpd SetSysTimeCfg buffer overflowTenda AC20
- CVE-2025-38435riscv: vector: Fix context save/restore with xtheadvectorLinux
- CVE-2025-38434Revert "riscv: Define TASK_SIZE_MAX for __access_ok()"Linux
- CVE-2025-8159D-Link DIR-513 HTTP POST Request formLanguageChange stack-based overflowD-Link DIR-513
- CVE-2025-38425i2c: tegra: check msg length in SMBUS block readLinux
- CVE-2025-38424perf: Fix sample vs do_exit()Linux
- CVE-2025-38422net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devicesLinux
- CVE-2025-38421platform/x86/amd: pmf: Use device managed allocationsLinux
- CVE-2025-38416NFC: nci: uart: Set tty->disc_data only in success pathLinux
- CVE-2025-38413virtio-net: xsk: rx: fix the frame's length checkLinux
- CVE-2025-38412platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacksLinux
- CVE-2025-38408genirq/irq_sim: Initialize work context pointers properlyLinux
- CVE-2025-38405nvmet: fix memory leak of bio integrityLinux
- CVE-2025-38401mtk-sd: Prevent memory corruption from DMA map failureLinux
- CVE-2025-38399scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()Linux
- CVE-2025-38398spi: spi-qpic-snand: reallocate BAM transactionsLinux
- CVE-2025-38396fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypassLinux
- CVE-2025-38395regulator: gpio: Fix the out-of-bounds access to drvdata::gpiodsLinux
- CVE-2025-38393NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAINLinux
- CVE-2025-38386ACPICA: Refuse to evaluate a method if arguments are missingLinux
- CVE-2025-38382btrfs: fix iteration of extrefs during log replayLinux
- CVE-2025-38379smb: client: fix warning when reconnecting channelLinux
- CVE-2025-38377rose: fix dangling neighbour pointers in rose_rt_device_down()Linux
- CVE-2025-38375virtio-net: ensure the received length does not exceed allocated sizeLinux
- CVE-2025-38372RDMA/mlx5: Fix unsafe xarray access in implicit ODP handlingLinux
- CVE-2025-38367LoongArch: KVM: Avoid overflow with array indexLinux
- CVE-2025-38366LoongArch: KVM: Check validity of "num_cpu" from user spaceLinux
- CVE-2025-38357fuse: fix runtime warning on truncate_folio_batch_exceptionals()Linux
- CVE-2025-8183NULL Pointer Dereference in µD3TNµD3TN · pyd3tn
- CVE-2025-8140TOTOLINK A702R HTTP POST Request formWlanMultipleAP buffer overflowTOTOLINK A702R
- CVE-2025-8139TOTOLINK A702R HTTP POST Request formPortFw buffer overflowTOTOLINK A702R
- CVE-2023-7306Frontend File Manager <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletionnmedia Frontend File Manager Plugin
- CVE-2025-8138TOTOLINK A702R HTTP POST Request formOneKeyAccessButton buffer overflowTOTOLINK A702R
- CVE-2025-8137TOTOLINK A702R HTTP POST Request formIpQoS buffer overflowTOTOLINK A702R
- CVE-2025-8136TOTOLINK A702R HTTP POST Request formFilter buffer overflowTOTOLINK A702R
- CVE-2025-5835Droip <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Many ActionsDroip
- CVE-2025-5831Droip < 2.5.2 - Authenticated (Subscriber+) Arbitrary File UploadDroip
- CVE-2025-8131Tenda AC20 SetStaticRouteCfg stack-based overflowTenda AC20
- CVE-2015-10144Responsive Thumbnail Slider < 1.0.1 - Authenticated (Subscriber+) Arbitrary File Uploadnik00726 Thumbnail carousel slider
- CVE-2023-53155goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter.EmbedThis GoAhead
- CVE-2024-48729An issue in ETSI Open-Source MANO (OSM) 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, and 17.0.0 allows a remote authenticated attacke
- CVE-2025-45466Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext.
- CVE-2025-45467Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an
- CVE-2025-46198Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attr
- CVE-2025-52360A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05.
Medium, low and unrated 123
- CVE-2025-81731000 Projects ABC Courier Management System Add_reciver.php sql injection1000 Projects ABC Courier Management System
- CVE-2025-8172itsourcecode Employee Management System index.php sql injectionitsourcecode Employee Management System
- CVE-2025-8171code-projects Document Management System insert.php unrestricted uploadcode-projects Document Management System
- CVE-2025-8167code-projects Church Donation System edit_members.php cross site scriptingcode-projects Church Donation System
- CVE-2025-52455Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource LocatioSalesforce Tableau Server
- CVE-2025-8166code-projects Church Donation System HTTP POST Request index.php sql injectioncode-projects Church Donation System
- CVE-2025-8165code-projects Food Review System approve_reservation.php sql injectioncode-projects Food Review System
- CVE-2025-8164code-projects Public Chat Room send_message.php sql injectioncode-projects Public Chat Room
- CVE-2025-8163deerwms deer-wms-2 list sql injectiondeerwms deer-wms-2
- CVE-2025-5449Libssh: integer overflow in libssh sftp server packet length validation leading to denial of servicelibssh · Red Hat Enterprise Linux +1
- CVE-2025-8162deerwms deer-wms-2 list sql injectiondeerwms deer-wms-2
- CVE-2025-36728SimpleHelp Cross Site Request ForgerySimplehelp
- CVE-2025-8161deerwms deer-wms-2 export sql injectiondeerwms deer-wms-2
- CVE-2025-3508Certain HP DesignJet products – Information disclosureCertain HP DesignJet products
- CVE-2022-4979Sitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSSSitecore Experience Platform · Sitecore Content Mangemen… +1
- CVE-2015-10142Sitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known PathSitecore Experience Platform · Sitecore Content Management…
- CVE-2025-2329High traffic causes corrupt SPI packets in OpenThread leading to denial of servicesilabs.com OpenThread
- CVE-2025-34136Commvault CommServe Web Server Unauthenticated SQL InjectionCommvault
- CVE-2025-3873Buffer overflow in Si91x crypto APIssilabs.com WiseConnect
- CVE-2025-38467drm/exynos: exynos7_drm_decon: add vblank check in IRQ handlingLinux
- CVE-2025-38465netlink: Fix wraparounds of sk->sk_rmem_alloc.Linux
- CVE-2025-38462vsock: Fix transport_{g2h,h2g} TOCTOULinux
- CVE-2025-38459atm: clip: Fix infinite recursive call of clip_push().Linux
- CVE-2025-38458atm: clip: Fix NULL pointer dereference in vcc_sendmsg()Linux
- CVE-2025-38457net/sched: Abort __tc_modify_qdisc if parent class does not existLinux
- CVE-2025-38454ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp()Linux
- CVE-2025-38452net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe()Linux
- CVE-2025-38451md/md-bitmap: fix GPF in bitmap_get_stats()Linux
- CVE-2025-38450wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload()Linux
- CVE-2025-38448usb: gadget: u_serial: Fix race condition in TTY wakeupLinux
- CVE-2025-38445md/raid1: Fix stack memory use after return in raid1_reshapeLinux
- CVE-2025-38444raid10: cleanup memleak at raid10_make_requestLinux
- CVE-2025-38443nbd: fix uaf in nbd_genl_connect() error pathLinux
- CVE-2025-38442block: reject bs > ps block devices when THP is disabledLinux
- CVE-2025-38441netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()Linux
- CVE-2025-38438ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.Linux
- CVE-2025-38436drm/scheduler: signal scheduled fence when kill jobLinux
- CVE-2025-38433riscv: fix runtime constant support for nommu kernelsLinux
- CVE-2025-38432net: netpoll: Initialize UDP checksum field before checksummingLinux
- CVE-2025-38431smb: client: fix regression with native SMB symlinksLinux
- CVE-2025-38428Input: ims-pcu - check record size in ims_pcu_flash_firmware()Linux
- CVE-2025-38427video: screen_info: Relocate framebuffers behind PCI bridgesLinux
- CVE-2025-38426drm/amdgpu: Add basic validation for RAS headerLinux
- CVE-2025-38423ASoC: codecs: wcd9375: Fix double free of regulator suppliesLinux
- CVE-2025-38420wifi: carl9170: do not ping device which has failed to load firmwareLinux
- CVE-2025-38419remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()Linux
- CVE-2025-38418remoteproc: core: Release rproc->clean_table after rproc_attach() failsLinux
- CVE-2025-38417ice: fix eswitch code memory leak in reset scenarioLinux
- CVE-2025-38415Squashfs: check return result of sb_min_blocksizeLinux
- CVE-2025-38414wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850Linux
- CVE-2025-8158PHPGurukul Login and User Management System yesterday-reg-users.php sql injectionPHPGurukul Login and User Management System
- CVE-2025-38410drm/msm: Fix a fence leak in submit error pathLinux
- CVE-2025-38409drm/msm: Fix another leak in the submit error pathLinux
- CVE-2025-38407riscv: cpu_ops_sbi: Use static array for boot_dataLinux
- CVE-2025-38406wifi: ath6kl: remove WARN on bad firmware inputLinux
- CVE-2025-38404usb: typec: displayport: Fix potential deadlockLinux
- CVE-2025-38403vsock/vmci: Clear the vmci transport packet properly when initializing itLinux
- CVE-2025-8157PHPGurukul User Registration & Login and User Management lastthirtyays-reg-users.php sql injectionPHPGurukul User Registration & Login and User Management
- CVE-2025-38402idpf: return 0 size for RSS key if not supportedLinux
- CVE-2025-38400nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.Linux
- CVE-2025-38397nvme-multipath: fix suspicious RCU usage warningLinux
- CVE-2025-38394HID: appletb-kbd: fix memory corruption of input_handler_listLinux
- CVE-2025-38392idpf: convert control queue mutex to a spinlockLinux
- CVE-2025-38391usb: typec: altmodes/displayport: do not index invalid pin_assignmentsLinux
- CVE-2025-38390firmware: arm_ffa: Fix memory leak by freeing notifier callback nodeLinux
- CVE-2025-38389drm/i915/gt: Fix timeline left held on VMA alloc errorLinux
- CVE-2025-38388firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic contextLinux
- CVE-2025-38387RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insertLinux
- CVE-2025-38385net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnectLinux
- CVE-2025-38384mtd: spinand: fix memory leak of ECC engine confLinux
- CVE-2025-38383mm/vmalloc: fix data race in show_numa_info()Linux
- CVE-2025-38381Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt()Linux
- CVE-2025-38378HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probeLinux
- CVE-2025-38376usb: chipidea: udc: disconnect/reconnect from host when do suspend/resumeLinux
- CVE-2025-38374optee: ffa: fix sleep in atomic contextLinux
- CVE-2025-38373IB/mlx5: Fix potential deadlock in MR deregistrationLinux
- CVE-2025-38371drm/v3d: Disable interrupts before resetting the GPULinux
- CVE-2025-38370btrfs: fix failure to rebuild free space tree using multiple transactionsLinux
- CVE-2025-38369dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before usingLinux
- CVE-2025-38368misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe()Linux
- CVE-2025-38364maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()Linux
- CVE-2025-38363drm/tegra: Fix a possible null pointer dereferenceLinux
- CVE-2025-38362drm/amd/display: Add null pointer check for get_first_active_display()Linux
- CVE-2025-38361drm/amd/display: Check dce_hwseq before dereferencing itLinux
- CVE-2025-38360drm/amd/display: Add more checks for DSC / HUBP ONO guaranteesLinux
- CVE-2025-38359s390/mm: Fix in_atomic() handling in do_secure_storage_access()Linux
- CVE-2025-38358btrfs: fix race between async reclaim worker and close_ctree()Linux
- CVE-2025-38356drm/xe/guc: Explicitly exit CT safe mode on unwindLinux
- CVE-2025-38355drm/xe: Process deferred GGTT node removals on device unwindLinux
- CVE-2025-38354drm/msm/gpu: Fix crash when throttling GPU immediately during bootLinux
- CVE-2025-38353drm/xe: Fix taking invalid lock on wedgeLinux
- CVE-2025-8156PHPGurukul User Registration & Login and User Management lastsevendays-reg-users.php sql injectionPHPGurukul User Registration & Login and User Management
- CVE-2025-8155D-Link DCS-6010L Management Application vb.htm cross site scriptingD-Link DCS-6010L
- CVE-2025-5254Stored XSS in Kron Technologies' Kron PAMKron Technologies Kron PAM
- CVE-2025-5253DoS in Kron Technologies' Kron PAMKron Technologies Kron PAM
- CVE-2025-8135itsourcecode Insurance Management System updateAgent.php sql injectionitsourcecode Insurance Management System
- CVE-2025-8134PHPGurukul BP Monitoring Management System bwdates-report-result.php sql injectionPHPGurukul BP Monitoring Management System
- CVE-2025-7022My Reservation System <= 2.3 - Reflected XSSMy Reservation System
- CVE-2025-8133yanyutao0402 ChanCMS gather.js getArticle server-side request forgeryyanyutao0402 ChanCMS
- CVE-2025-8132yanyutao0402 ChanCMS utils.js delfile path traversalyanyutao0402 ChanCMS
- CVE-2025-8129KoaJS Koa HTTP Header response.js back redirectKoaJS Koa · koa
- CVE-2025-8128zhousg letao product.js unrestricted uploadzhousg letao
- CVE-2025-8127deerwms deer-wms-2 list sql injectiondeerwms deer-wms-2
- CVE-2025-8126deerwms deer-wms-2 export sql injectiondeerwms deer-wms-2
- CVE-2025-8125deerwms deer-wms-2 allocatedList sql injectiondeerwms deer-wms-2
- CVE-2025-0253HCL IEM is affected by a cookie attribute not set vulnerabilityHCL Software IEM
- CVE-2025-0252HCL IEM is affected by a password in cleartext vulnerabilityHCL Software IEM
- CVE-2025-0251HCL IEM is affected by a concurrent login vulnerabilityHCL Software IEM
- CVE-2024-48730The default configuration in ETSI Open-Source MANO (OSM) v.14.x, v.15.x, v.16.x, v.17.x does not impose any restrictions on the authenticati
- CVE-2025-30086CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak presengithub.com/goharbor/harbor
- CVE-2025-43712JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter.JHipster
- CVE-2025-44608CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter.
- CVE-2025-45406A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a cra
- CVE-2025-45892OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor.
- CVE-2025-45893OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts.
- CVE-2025-45939Apwide Golive 10.2.0 Jira plugin allows Server-Side Request Forgery (SSRF) via the test webhook function.
- CVE-2025-45960Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application s
- CVE-2025-51411A reflected cross-site scripting (XSS) vulnerability exists in Institute-of-Current-Students v1.0 via the email parameter in the /postqueryp
- CVE-2025-54558OpenAI Codex CLI before 0.9.0 auto-approves ripgrep (aka rg) execution even with the --pre or --hostname-bin or --search-zip or -z flag.OpenAI Codex CLI
- CVE-2025-54566hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327.QEMU
- CVE-2025-54567hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327.QEMU
- CVE-2025-54568Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separatAkamai Rate Control
- CVE-2025-54596Abnormal Security /v1.0/rbac/users_v2/{USER_ID}/ before 2025-02-19 allows downgrading the privileges of other user accounts.Abnormal AI Abnormal Security