# CVEs published 2025-07-26 45 CVEs were published on July 26, 2025: 3 critical, 16 high. Days are UTC. - [CVE-2025-8211](https://cve.now/CVE-2025-8211.md): Roothub SystemConfigAdminController.java edit cross site scripting (CVSS 5.1, Roothub) - [CVE-2025-8210](https://cve.now/CVE-2025-8210.md): Yeelink Yeelight App com.yeelight.cherry AndroidManifest.xml improper export of android application components (CVSS 4.8, Yeelink Yeelight App) - [CVE-2025-8207](https://cve.now/CVE-2025-8207.md): Canara ai1 Mobile Banking App com.canarabank.mobility AndroidManifest.xml improper export of android application components (CVSS 4.8, Canara ai1 Mobile Banking App) - [CVE-2025-8206](https://cve.now/CVE-2025-8206.md): Comodo Dragon IP DNS Leakage Detector cross site scripting (CVSS 2.3, Comodo Dragon) - [CVE-2025-8205](https://cve.now/CVE-2025-8205.md): Comodo Dragon IP DNS Leakage Detector cleartext transmission (CVSS 6.3, Comodo Dragon) - [CVE-2025-8204](https://cve.now/CVE-2025-8204.md): Comodo Dragon HSTS security check (CVSS 2.3, Comodo Dragon) - [CVE-2025-8203](https://cve.now/CVE-2025-8203.md): Jingmen Zeyou Large File Upload Control index.jsp sql injection (CVSS 5.3, Jingmen Zeyou Large File Upload Control) - [CVE-2025-8191](https://cve.now/CVE-2025-8191.md): macrozheng mall Swagger UI index.html cross site scripting (CVSS 5.1, macrozheng mall) - [CVE-2025-8190](https://cve.now/CVE-2025-8190.md): Campcodes Courier Management System print\_pdets.php sql injection (CVSS 5.3, Campcodes Courier Management System) - [CVE-2025-8189](https://cve.now/CVE-2025-8189.md): Campcodes Courier Management System edit\_user.php sql injection (CVSS 5.3, Campcodes Courier Management System) - [CVE-2025-8188](https://cve.now/CVE-2025-8188.md): Campcodes Courier Management System edit\_staff.php sql injection (CVSS 5.3, Campcodes Courier Management System) - [CVE-2025-8187](https://cve.now/CVE-2025-8187.md): Campcodes Courier Management System edit\_parcel.php sql injection (CVSS 5.3, Campcodes Courier Management System) - [CVE-2025-8186](https://cve.now/CVE-2025-8186.md): Campcodes Courier Management System edit\_branch.php sql injection (CVSS 5.3, Campcodes Courier Management System) - [CVE-2025-8185](https://cve.now/CVE-2025-8185.md): 1000 Projects ABC Courier Management System getbyid.php sql injection (CVSS 6.9, 1000 Projects ABC Courier Management System) - [CVE-2025-8184](https://cve.now/CVE-2025-8184.md): D-Link DIR-513 HTTP POST Request formSetWanL2TPtriggers formSetWanL2TPcallback stack-based overflow (CVSS 8.7, D-Link DIR-513) - [CVE-2025-8182](https://cve.now/CVE-2025-8182.md): Tenda AC18 Samba smb.conf weak password (CVSS 6.3, Tenda AC18) - [CVE-2025-6991](https://cve.now/CVE-2025-6991.md): Kallyas \<= 4.21.0 - Authenticated (Contributor+) Local File Inclusion (CVSS 7.5, hogash KALLYAS - Creative eCommerce Multi-Purpose WordPress…) - [CVE-2025-6989](https://cve.now/CVE-2025-6989.md): Kallyas \<= 4.21.0 - Authenticated (Contributor+) Arbitrary Folder Deletion (CVSS 8.1, hogash KALLYAS - Creative eCommerce Multi-Purpose WordPress…) - [CVE-2025-5529](https://cve.now/CVE-2025-5529.md): Educenter \<= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, sparklewpthemes Educenter) - [CVE-2025-8181](https://cve.now/CVE-2025-8181.md): TOTOLINK N600R/X2000R FTP Service vsftpd.conf least privilege violation (CVSS 8.6, TOTOLINK N600R · TOTOLINK X2000R) - [CVE-2025-8097](https://cve.now/CVE-2025-8097.md): WoodMart - Multipurpose WooCommerce Theme \<= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation (CVSS 5.3, xTemos Woodmart) - [CVE-2025-6987](https://cve.now/CVE-2025-6987.md): Advanced iFrame \<= 2025.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mdempfle Advanced iFrame) - [CVE-2025-7501](https://cve.now/CVE-2025-7501.md): Wonder Slider Lite & Wonder Slider \<= 14.4 - Authenticated (Contributor+) Dom-based Stored Cross-Site Scripting (CVSS 6.4, wonderplugin Wonder Slider) - [CVE-2025-8180](https://cve.now/CVE-2025-8180.md): Tenda CH22 deleteUserName formdeleteUserName buffer overflow (CVSS 8.7, Tenda CH22) - [CVE-2025-8198](https://cve.now/CVE-2025-8198.md): MinimogWP – The High Converting eCommerce WordPress Theme \<= 3.9.0 - Unauthenticated Price Manipulation (CVSS 7.5, ThemeMove MinimogWP – The High Converting eCommerce WordPre…) - [CVE-2025-8179](https://cve.now/CVE-2025-8179.md): PHPGurukul Local Services Search Engine Management System changeimage.php sql injection (CVSS 6.9, PHPGurukul Local Services Search Engine Management System) - [CVE-2025-8178](https://cve.now/CVE-2025-8178.md): Tenda AC10 RequestsProcessLaid heap-based overflow (CVSS 8.7, Tenda AC10) - [CVE-2025-6895](https://cve.now/CVE-2025-6895.md): MelaPress Login Security 2.1.0 - 2.1.1 - Authentication Bypass to Privilege Escalation via get\_valid\_user\_based\_on\_token Function (CVSS 9.8, Melapress Login Security) - [CVE-2025-8177](https://cve.now/CVE-2025-8177.md): LibTIFF thumbnail.c setrow buffer overflow (CVSS 4.8, LibTIFF) - [CVE-2025-8103](https://cve.now/CVE-2025-8103.md): WPeMatico RSS Feed Fetcher \<= 2.8.7 - Cross-Site Request Forgery to Plugin Deactivation via handle\_feedback\_submission Function (CVSS 4.3, etruel WPeMatico RSS Feed Fetcher) - [CVE-2024-13507](https://cve.now/CVE-2024-13507.md): GeoDirectory – WP Business Directory Plugin and Classified Listings Directory \<= 2.8.97 - Unauthenticated SQL Injection (CVSS 7.5, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…) - [CVE-2025-54366](https://cve.now/CVE-2025-54366.md): FreeScout's deserialization of untrusted data leads to Remote Code Execution (CVSS 8.6, freescout-help-desk freescout) - [CVE-2025-50185](https://cve.now/CVE-2025-50185.md): DbGate allows Unauthorized File Access via CSV Plugin (CVSS 7.0, dbgate) - [CVE-2025-54416](https://cve.now/CVE-2025-54416.md): tj-actions/branch-names Contains Command Injection Vulnerability (CVSS 9.1, tj-actions branch-names) - [CVE-2025-54415](https://cve.now/CVE-2025-54415.md): dag-factory's CI/CD Workflow Allows for Repository Takeover and Secret Exfiltration (CVSS 9.1, astronomer dag-factory) - [CVE-2025-8176](https://cve.now/CVE-2025-8176.md): LibTIFF tiffmedian.c get\_histogram use after free (CVSS 4.8, LibTIFF) - [CVE-2025-54414](https://cve.now/CVE-2025-54414.md): Anubis accepts crafted redirect URLs in pass-challenge 'Try Again' buttons (CVSS 5.1, TecharoHQ anubis) - [CVE-2025-54413](https://cve.now/CVE-2025-54413.md): skops' MethodNode can access unexpected object fields through dot notation, leading to arbitrary code execution at load time (CVSS 8.7, skops-dev skops · skops) - [CVE-2025-54412](https://cve.now/CVE-2025-54412.md): skops' Inconsistent Trusted Type Validation Enables Hidden \`operator\` Methods Execution (CVSS 8.7, skops-dev skops · skops) - [CVE-2025-54385](https://cve.now/CVE-2025-54385.md): XWiki Platform's searchDocuments API allows for SQL injection (CVSS 8.6, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore) - [CVE-2025-54380](https://cve.now/CVE-2025-54380.md): Opencast still publishes global system account credentials (CVSS 6.5, opencast · org.opencastproject:opencast-common +3) - [CVE-2025-54378](https://cve.now/CVE-2025-54378.md): HAX CMS Backend Lacks Comprehensive Authorization Checks (CVSS 8.3, haxtheweb issues · @haxtheweb/haxcms-nodejs +1) - [CVE-2025-50184](https://cve.now/CVE-2025-50184.md): DbGate allows for File Traversal via file parameter (CVSS 7.1, dbgate) - [CVE-2025-8175](https://cve.now/CVE-2025-8175.md): D-Link DI-8400 jhttpd usb\_paswd.asp null pointer dereference (CVSS 7.1, D-Link DI-8400) - [CVE-2025-8174](https://cve.now/CVE-2025-8174.md): code-projects Voting System candidates\_add.php unrestricted upload (CVSS 5.3, code-projects Voting System) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-07-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.