CVEs published July 27, 2025
41 CVEs were published on July 27, 2025: 0 critical, 8 high.
- Published
- 41
- Critical
- 0
- High
- 8
- Medium
- 27
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- code-projects Online Ordering System
- 5
- TOTOLINK X15
- 5
- code-projects Exam Form Submission
- 4
- jerryshensjf JPACookieShop 蛋糕商城JPA版
- 3
- yanyutao0402 ChanCMS
- 3
- Campcodes Courier Management System
- 2
- GNU Binutils
- 2
- 1000 Projects ABC Courier Management System
- 1
- comex shlex · shlex
- 1
- CosmWasm serde-json-wasm · serde-json-wasm
- 1
High 8
- CVE-2025-8246TOTOLINK X15 HTTP POST Request formRoute buffer overflowTOTOLINK X15
- CVE-2025-8245TOTOLINK X15 HTTP POST Request formMultiAPVLAN buffer overflowTOTOLINK X15
- CVE-2025-8244TOTOLINK X15 HTTP POST Request formMapDelDevice buffer overflowTOTOLINK X15
- CVE-2025-8243TOTOLINK X15 HTTP POST Request formMapDel buffer overflowTOTOLINK X15
- CVE-2025-8242TOTOLINK X15 HTTP POST Request formFilter buffer overflowTOTOLINK X15
- CVE-2025-8231D-Link DIR-890L UART Port rgbin hard-coded credentialsD-Link DIR-890L
- CVE-2025-5120Sandbox Escape Vulnerability in huggingface/smolagentshuggingface/smolagents · smolagents
- CVE-2025-54597LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.LinuxServer Heimdall
Medium, low and unrated 33
- CVE-2025-8247Projectworlds Online Admission System admin.php sql injectionProjectworlds Online Admission System
- CVE-2025-82411000 Projects ABC Courier Management System report.php sql injection1000 Projects ABC Courier Management System
- CVE-2025-8240code-projects Exam Form Submission dashboard.php sql injectioncode-projects Exam Form Submission
- CVE-2025-8239code-projects Exam Form Submission admin sql injectioncode-projects Exam Form Submission
- CVE-2025-8238code-projects Exam Form Submission update_s2.php sql injectioncode-projects Exam Form Submission
- CVE-2025-8237code-projects Exam Form Submission update_s1.php sql injectioncode-projects Exam Form Submission
- CVE-2025-8236code-projects Online Ordering System edit_product.php sql injectioncode-projects Online Ordering System
- CVE-2025-8235code-projects Online Ordering System product.php sql injectioncode-projects Online Ordering System
- CVE-2025-8234code-projects Online Ordering System delete_member.php sql injectioncode-projects Online Ordering System
- CVE-2025-8233code-projects Online Ordering System user.php sql injectioncode-projects Online Ordering System
- CVE-2025-8232code-projects Online Ordering System delete_user.php sql injectioncode-projects Online Ordering System
- CVE-2025-8230Campcodes Courier Management System manage_user.php sql injectionCampcodes Courier Management System
- CVE-2025-8229Campcodes Courier Management System parcel_list.php sql injectionCampcodes Courier Management System
- CVE-2025-8228yanyutao0402 ChanCMS getPages server-side request forgeryyanyutao0402 ChanCMS
- CVE-2025-8227yanyutao0402 ChanCMS getArticle deserializationyanyutao0402 ChanCMS
- CVE-2025-8226yanyutao0402 ChanCMS find information disclosureyanyutao0402 ChanCMS
- CVE-2025-8225GNU Binutils DWARF Section dwarf.c process_debug_info memory leakGNU Binutils
- CVE-2025-8224GNU Binutils BFD Library elf.c bfd_elf_get_str_section null pointer dereferenceGNU Binutils
- CVE-2025-8223jerryshensjf JPACookieShop 蛋糕商城JPA版 AdminTypeCustController.java cross-site request forgeryjerryshensjf JPACookieShop 蛋糕商城JPA版
- CVE-2025-8222jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java cross site scriptingjerryshensjf JPACookieShop 蛋糕商城JPA版
- CVE-2025-8104Memory Usage <= 3.98 - Cross-Site Request Forgery to Limited Plugin Installation via wpmemory_install_plugin Functionsminozzi Memory Usage, Memory Limit, PHP and Server Memory…
- CVE-2025-8221jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsCustController.java goodsSearch cross site scriptingjerryshensjf JPACookieShop 蛋糕商城JPA版
- CVE-2025-8220Engeman Web Password Recovery RecoveryPass sql injectionEngeman Web
- CVE-2025-8219Shanghai Lingdang Information Technology Lingdang CRM HTTP POST Request tabdetail_moduleSave_dxkp.php sql injectionShanghai Lingdang Information Technology Lingdang CRM
- CVE-2025-6241CVE-2025-6241Lakeside Software SysTrack
- CVE-2023-53156The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.ejmahler transpose · transpose
- CVE-2023-53157The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet.rosenpass
- CVE-2024-58261The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messequoia-pgp sequoia · sequoia-openpgp
- CVE-2024-58262The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM.dalek-cryptography curve25519-dalek · curve25519-dalek
- CVE-2024-58263The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.cosmwasm-std
- CVE-2024-58264The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.CosmWasm serde-json-wasm · serde-json-wasm
- CVE-2024-58265The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message deliverymcginty snow · snow
- CVE-2024-58266The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injcomex shlex · shlex