CVEs published July 26, 2025
45 CVEs were published on July 26, 2025: 3 critical, 16 high.
- Published
- 45
- Critical
- 3
- High
- 16
- Medium
- 24
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Campcodes Courier Management System
- 5
- Comodo Dragon
- 3
- dbgate
- 2
- hogash KALLYAS - Creative eCommerce Multi-Purpose WordPress…
- 2
- LibTIFF
- 2
- skops-dev skops · skops
- 2
- 1000 Projects ABC Courier Management System
- 1
- astronomer dag-factory
- 1
- Canara ai1 Mobile Banking App
- 1
- code-projects Voting System
- 1
Critical 3
- CVE-2025-6895MelaPress Login Security 2.1.0 - 2.1.1 - Authentication Bypass to Privilege Escalation via get_valid_user_based_on_token FunctionMelapress Login Security
- CVE-2025-54416tj-actions/branch-names Contains Command Injection Vulnerabilitytj-actions branch-names
- CVE-2025-54415dag-factory's CI/CD Workflow Allows for Repository Takeover and Secret Exfiltrationastronomer dag-factory
High 16
- CVE-2025-8184D-Link DIR-513 HTTP POST Request formSetWanL2TPtriggers formSetWanL2TPcallback stack-based overflowD-Link DIR-513
- CVE-2025-6991Kallyas <= 4.21.0 - Authenticated (Contributor+) Local File Inclusionhogash KALLYAS - Creative eCommerce Multi-Purpose WordPress…
- CVE-2025-6989Kallyas <= 4.21.0 - Authenticated (Contributor+) Arbitrary Folder Deletionhogash KALLYAS - Creative eCommerce Multi-Purpose WordPress…
- CVE-2025-8181TOTOLINK N600R/X2000R FTP Service vsftpd.conf least privilege violationTOTOLINK N600R · TOTOLINK X2000R
- CVE-2025-8180Tenda CH22 deleteUserName formdeleteUserName buffer overflowTenda CH22
- CVE-2025-8198MinimogWP – The High Converting eCommerce WordPress Theme <= 3.9.0 - Unauthenticated Price ManipulationThemeMove MinimogWP – The High Converting eCommerce WordPre…
- CVE-2025-8178Tenda AC10 RequestsProcessLaid heap-based overflowTenda AC10
- CVE-2024-13507GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injectionpaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2025-54366FreeScout's deserialization of untrusted data leads to Remote Code Executionfreescout-help-desk freescout
- CVE-2025-50185DbGate allows Unauthorized File Access via CSV Plugindbgate
- CVE-2025-54413skops' MethodNode can access unexpected object fields through dot notation, leading to arbitrary code execution at load timeskops-dev skops · skops
- CVE-2025-54412skops' Inconsistent Trusted Type Validation Enables Hidden `operator` Methods Executionskops-dev skops · skops
- CVE-2025-54385XWiki Platform's searchDocuments API allows for SQL injectionxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2025-54378HAX CMS Backend Lacks Comprehensive Authorization Checkshaxtheweb issues · @haxtheweb/haxcms-nodejs +1
- CVE-2025-50184DbGate allows for File Traversal via file parameterdbgate
- CVE-2025-8175D-Link DI-8400 jhttpd usb_paswd.asp null pointer dereferenceD-Link DI-8400
Medium, low and unrated 26
- CVE-2025-8211Roothub SystemConfigAdminController.java edit cross site scriptingRoothub
- CVE-2025-8210Yeelink Yeelight App com.yeelight.cherry AndroidManifest.xml improper export of android application componentsYeelink Yeelight App
- CVE-2025-8207Canara ai1 Mobile Banking App com.canarabank.mobility AndroidManifest.xml improper export of android application componentsCanara ai1 Mobile Banking App
- CVE-2025-8206Comodo Dragon IP DNS Leakage Detector cross site scriptingComodo Dragon
- CVE-2025-8205Comodo Dragon IP DNS Leakage Detector cleartext transmissionComodo Dragon
- CVE-2025-8204Comodo Dragon HSTS security checkComodo Dragon
- CVE-2025-8203Jingmen Zeyou Large File Upload Control index.jsp sql injectionJingmen Zeyou Large File Upload Control
- CVE-2025-8191macrozheng mall Swagger UI index.html cross site scriptingmacrozheng mall
- CVE-2025-8190Campcodes Courier Management System print_pdets.php sql injectionCampcodes Courier Management System
- CVE-2025-8189Campcodes Courier Management System edit_user.php sql injectionCampcodes Courier Management System
- CVE-2025-8188Campcodes Courier Management System edit_staff.php sql injectionCampcodes Courier Management System
- CVE-2025-8187Campcodes Courier Management System edit_parcel.php sql injectionCampcodes Courier Management System
- CVE-2025-8186Campcodes Courier Management System edit_branch.php sql injectionCampcodes Courier Management System
- CVE-2025-81851000 Projects ABC Courier Management System getbyid.php sql injection1000 Projects ABC Courier Management System
- CVE-2025-8182Tenda AC18 Samba smb.conf weak passwordTenda AC18
- CVE-2025-5529Educenter <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingsparklewpthemes Educenter
- CVE-2025-8097WoodMart - Multipurpose WooCommerce Theme <= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart ManipulationxTemos Woodmart
- CVE-2025-6987Advanced iFrame <= 2025.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingmdempfle Advanced iFrame
- CVE-2025-7501Wonder Slider Lite & Wonder Slider <= 14.4 - Authenticated (Contributor+) Dom-based Stored Cross-Site Scriptingwonderplugin Wonder Slider
- CVE-2025-8179PHPGurukul Local Services Search Engine Management System changeimage.php sql injectionPHPGurukul Local Services Search Engine Management System
- CVE-2025-8177LibTIFF thumbnail.c setrow buffer overflowLibTIFF
- CVE-2025-8103WPeMatico RSS Feed Fetcher <= 2.8.7 - Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Functionetruel WPeMatico RSS Feed Fetcher
- CVE-2025-8176LibTIFF tiffmedian.c get_histogram use after freeLibTIFF
- CVE-2025-54414Anubis accepts crafted redirect URLs in pass-challenge 'Try Again' buttonsTecharoHQ anubis
- CVE-2025-54380Opencast still publishes global system account credentialsopencast · org.opencastproject:opencast-common +3
- CVE-2025-8174code-projects Voting System candidates_add.php unrestricted uploadcode-projects Voting System