# CVEs published 2025-07-28

124 CVEs were published on July 28, 2025: 19 critical, 33 high. Days are UTC.

- [CVE-2025-54769](https://cve.now/CVE-2025-54769.md): KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal (CVSS 8.8, Xorux LPAR2RRD)
- [CVE-2025-54768](https://cve.now/CVE-2025-54768.md): KL-001-2025-015: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information (CVSS 5.3, Xorux LPAR2RRD)
- [CVE-2025-54767](https://cve.now/CVE-2025-54767.md): KL-001-2025-014: Xorux LPAR2RRD Read Only User Denial of Service (CVSS 6.5, Xorux LPAR2RRD)
- [CVE-2025-54765](https://cve.now/CVE-2025-54765.md): KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator (CVSS 5.3, Xorux XorMon-NG)
- [CVE-2025-54766](https://cve.now/CVE-2025-54766.md): KL-001-2025-012: Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensitive Information (CVSS 5.3, Xorux XorMon-NG)
- [CVE-2025-54429](https://cve.now/CVE-2025-54429.md): Polkadot Frontier's constructing smart contract can bypass precompile address bounding (CVSS 6.9, polkadot-evm frontier)
- [CVE-2025-54428](https://cve.now/CVE-2025-54428.md): RevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak) (CVSS 9.8, musombi123 RevelaCode-Backend)
- [CVE-2025-54427](https://cve.now/CVE-2025-54427.md): Polkadot Frontier contains missing \`check\_inherent\` for \`note\_min\_gas\_price\_target\` inflates gas price (CVSS 6.9, polkadot-evm frontier)
- [CVE-2025-54426](https://cve.now/CVE-2025-54426.md): Polkadot Frontier contains silent failure in Curve25519 arithmetic precompiles with malformed points (CVSS 9.9, polkadot-evm frontier)
- [CVE-2025-54423](https://cve.now/CVE-2025-54423.md): copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata (CVSS 5.4, 9001 copyparty · copyparty)
- [CVE-2025-54419](https://cve.now/CVE-2025-54419.md): Node-SAML Contains SAML Signature Verification Vulnerability (CVSS 10.0, node-saml · @node-saml/node-saml +2)
- [CVE-2025-8194](https://cve.now/CVE-2025-8194.md): Tarfile infinite loop during parsing with negative member offset (CVSS 7.5, Python Software Foundation CPython)
- [CVE-2025-8283](https://cve.now/CVE-2025-8283.md): Netavark: podman: netavark may resolve hostnames to unexpected hosts (CVSS 3.7, netavark · Red Hat Enterprise Linux +1)
- [CVE-2025-43023](https://cve.now/CVE-2025-43023.md): HP Linux Imaging and Printing Software - Use of DSA Key (CVSS 5.9, HP Linux Imaging and Printing Software)
- [CVE-2025-54299](https://cve.now/CVE-2025-54299.md): Extension - nobossextensions.com - Stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla (CVSS 9.4, nobossextensions.com No Boss Testimonials component for Joo…)
- [CVE-2025-54298](https://cve.now/CVE-2025-54298.md): Extension - firecoders.com - Stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla (CVSS 9.4, firecoders.com CommentBox component for Joomla)
- [CVE-2025-7676](https://cve.now/CVE-2025-7676.md): DLL hijacking of all PE32 executables on Windows 11 for ARM CPUs (CVSS 5.4, Microsoft Windows)
- [CVE-2025-54538](https://cve.now/CVE-2025-54538.md): In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command (CVSS 5.5, JetBrains TeamCity)
- [CVE-2025-54537](https://cve.now/CVE-2025-54537.md): In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots (CVSS 5.5, JetBrains TeamCity)
- [CVE-2025-54536](https://cve.now/CVE-2025-54536.md): In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint (CVSS 5.4, JetBrains TeamCity)
- [CVE-2025-54535](https://cve.now/CVE-2025-54535.md): In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms (CVSS 5.8, JetBrains TeamCity)
- [CVE-2025-54534](https://cve.now/CVE-2025-54534.md): In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page (CVSS 4.8, JetBrains TeamCity)
- [CVE-2025-54533](https://cve.now/CVE-2025-54533.md): In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration (CVSS 4.3, JetBrains TeamCity)
- [CVE-2025-54532](https://cve.now/CVE-2025-54532.md): In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies (CVSS 4.3, JetBrains TeamCity)
- [CVE-2025-54531](https://cve.now/CVE-2025-54531.md): In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows (CVSS 7.7, JetBrains TeamCity)
- [CVE-2025-54530](https://cve.now/CVE-2025-54530.md): In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions (CVSS 7.5, JetBrains TeamCity)
- [CVE-2025-54529](https://cve.now/CVE-2025-54529.md): In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration (CVSS 3.7, JetBrains TeamCity)
- [CVE-2025-54528](https://cve.now/CVE-2025-54528.md): In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow (CVSS 5.4, JetBrains TeamCity)
- [CVE-2025-54527](https://cve.now/CVE-2025-54527.md): In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allow (CVSS 6.1, JetBrains YouTrack)
- [CVE-2025-6250](https://cve.now/CVE-2025-6250.md): Privilege Management for Windows - Elevation of Privilege (CVSS 7.1, BeyondTrust Privilege Management for Windows)
- [CVE-2025-2297](https://cve.now/CVE-2025-2297.md): Privilege Management for Windows - Elevation of Privilege (CVSS 7.2, BeyondTrust Privilege Management for Windows)
- [CVE-2024-49343](https://cve.now/CVE-2024-49343.md): IBM Informix Dynamic Server HTML injection (CVSS 5.4, IBM Informix Dynamic Server)
- [CVE-2024-49342](https://cve.now/CVE-2024-49342.md): IBM Informix Dynamic Server information disclosure (CVSS 7.5, IBM Informix Dynamic Server)
- [CVE-2025-54418](https://cve.now/CVE-2025-54418.md): CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability (CVSS 9.8, CodeIgniter4 · codeigniter4/framework)
- [CVE-2025-53696](https://cve.now/CVE-2025-53696.md): iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. (CVSS 9.3, Johnson Controls iSTAR Ultra)
- [CVE-2025-53695](https://cve.now/CVE-2025-53695.md): OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' us (CVSS 9.4, Johnson Controls iSTAR Ultra)
- [CVE-2025-8279](https://cve.now/CVE-2025-8279.md): Missing Authentication for Critical Function in GitLab Language Server (CVSS 8.7, GitLab Language Server)
- [CVE-2025-26469](https://cve.now/CVE-2025-26469.md): An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3 (CVSS 9.3, MedDream PACS Premium)
- [CVE-2025-27724](https://cve.now/CVE-2025-27724.md): A privilege escalation vulnerability exists in the login.php functionality of meddream MedDream PACS Premium 7.3.3.840. (CVSS 9.3, MedDream PACS Premium)
- [CVE-2025-32731](https://cve.now/CVE-2025-32731.md): A reflected cross-site scripting (xss) vulnerability exists in the radiationDoseReport.php functionality of meddream MedDream PACS Premium 7 (CVSS 6.1, MedDream PACS Premium)
- [CVE-2025-24485](https://cve.now/CVE-2025-24485.md): A server-side request forgery vulnerability exists in the cecho.php functionality of MedDream PACS Premium 7.3.5.860. (CVSS 5.8, MedDream PACS Premium)
- [CVE-2025-4056](https://cve.now/CVE-2025-4056.md): Glib: glib crash after long command line (CVSS 7.5, glib · Red Hat Enterprise Linux)
- [CVE-2025-8275](https://cve.now/CVE-2025-8275.md): bsc Peru Cocktails App bsc.devy.peru\_cocktails AndroidManifest.xml improper export of android application components (CVSS 4.8, bsc Peru Cocktails App)
- [CVE-2025-8274](https://cve.now/CVE-2025-8274.md): Campcodes Online Recruitment Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Recruitment Management System)
- [CVE-2025-5997](https://cve.now/CVE-2025-5997.md): Privilege Escalation in Beamsec PhishPro (CVSS 8.8, Beamsec PhishPro)
- [CVE-2025-38497](https://cve.now/CVE-2025-38497.md): usb: gadget: configfs: Fix OOB read on empty string write (no CVSS, Linux)
- [CVE-2025-38496](https://cve.now/CVE-2025-38496.md): dm-bufio: fix sched in atomic context (no CVSS, Linux)
- [CVE-2025-38495](https://cve.now/CVE-2025-38495.md): HID: core: ensure the allocated report buffer can contain the reserved report ID (CVSS 8.8, Linux)
- [CVE-2025-38494](https://cve.now/CVE-2025-38494.md): HID: core: do not bypass hid\_hw\_raw\_request (CVSS 7.8, Linux)
- [CVE-2025-38493](https://cve.now/CVE-2025-38493.md): tracing/osnoise: Fix crash in timerlat\_dump\_stack() (no CVSS, Linux)
- [CVE-2025-38492](https://cve.now/CVE-2025-38492.md): netfs: Fix race between cache write completion and ALL\_QUEUED being set (no CVSS, Linux)
- [CVE-2025-38491](https://cve.now/CVE-2025-38491.md): mptcp: make fallback action and fallback decision atomic (CVSS 8.2, Linux)
- [CVE-2025-38490](https://cve.now/CVE-2025-38490.md): net: libwx: remove duplicate page\_pool\_put\_full\_page() (CVSS 9.8, Linux)
- [CVE-2025-38489](https://cve.now/CVE-2025-38489.md): s390/bpf: Fix bpf\_arch\_text\_poke() with new\_addr == NULL again (no CVSS, Linux)
- [CVE-2025-38488](https://cve.now/CVE-2025-38488.md): smb: client: fix use-after-free in crypt\_message when using async crypto (CVSS 9.8, Linux)
- [CVE-2025-38487](https://cve.now/CVE-2025-38487.md): soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (no CVSS, Linux)
- [CVE-2025-38486](https://cve.now/CVE-2025-38486.md): soundwire: Revert "soundwire: qcom: Add set\_channel\_map api support" (CVSS 7.8, Linux)
- [CVE-2025-38485](https://cve.now/CVE-2025-38485.md): iio: accel: fxls8962af: Fix use after free in fxls8962af\_fifo\_flush (CVSS 7.8, Linux)
- [CVE-2025-38484](https://cve.now/CVE-2025-38484.md): iio: backend: fix out-of-bound write (CVSS 7.8, Linux)
- [CVE-2025-38483](https://cve.now/CVE-2025-38483.md): comedi: das16m1: Fix bit shift out of bounds (no CVSS, Linux)
- [CVE-2025-38482](https://cve.now/CVE-2025-38482.md): comedi: das6402: Fix bit shift out of bounds (no CVSS, Linux)
- [CVE-2025-38481](https://cve.now/CVE-2025-38481.md): comedi: Fail COMEDI\_INSNLIST ioctl if n\_insns is too large (no CVSS, Linux)
- [CVE-2025-38480](https://cve.now/CVE-2025-38480.md): comedi: Fix use of uninitialized data in insn\_rw\_emulate\_bits() (no CVSS, Linux)
- [CVE-2025-38478](https://cve.now/CVE-2025-38478.md): comedi: Fix initialization of data for instructions that write to subdevice (CVSS 7.8, Linux)
- [CVE-2025-38477](https://cve.now/CVE-2025-38477.md): net/sched: sch\_qfq: Fix race condition on qfq\_aggregate (CVSS 7.8, Linux)
- [CVE-2025-38476](https://cve.now/CVE-2025-38476.md): rpl: Fix use-after-free in rpl\_do\_srh\_inline(). (CVSS 9.8, Linux)
- [CVE-2025-38475](https://cve.now/CVE-2025-38475.md): smc: Fix various oops due to inet\_sock type confusion. (CVSS 7.8, Linux)
- [CVE-2025-38474](https://cve.now/CVE-2025-38474.md): usb: net: sierra: check for no status endpoint (no CVSS, Linux)
- [CVE-2025-38473](https://cve.now/CVE-2025-38473.md): Bluetooth: Fix null-ptr-deref in l2cap\_sock\_resume\_cb() (no CVSS, Linux)
- [CVE-2025-38472](https://cve.now/CVE-2025-38472.md): netfilter: nf\_conntrack: fix crash due to removal of uninitialised entry (CVSS 9.8, Linux)
- [CVE-2025-38471](https://cve.now/CVE-2025-38471.md): tls: always refresh the queue when reading sock (CVSS 9.8, Linux)
- [CVE-2025-38470](https://cve.now/CVE-2025-38470.md): net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVSS 7.8, Linux)
- [CVE-2025-38469](https://cve.now/CVE-2025-38469.md): KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (no CVSS, Linux)
- [CVE-2025-38468](https://cve.now/CVE-2025-38468.md): net/sched: Return NULL when htb\_lookup\_leaf encounters an empty rbtree (no CVSS, Linux)
- [CVE-2025-6918](https://cve.now/CVE-2025-6918.md): SQLi in Ncvav's Virtual PBX Software (CVSS 9.8, Ncvav Virtual PBX Software)
- [CVE-2025-8273](https://cve.now/CVE-2025-8273.md): code-projects Exam Form Submission update\_s8.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-8272](https://cve.now/CVE-2025-8272.md): code-projects Exam Form Submission update\_fst.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-40730](https://cve.now/CVE-2025-40730.md): HTML injection in Vox Media's Chorus CMS (CVSS 4.8, Vox Media Chorus CMS)
- [CVE-2025-8271](https://cve.now/CVE-2025-8271.md): code-projects Exam Form Submission delete\_s3.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-8270](https://cve.now/CVE-2025-8270.md): code-projects Exam Form Submission delete\_s2.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-8269](https://cve.now/CVE-2025-8269.md): code-projects Exam Form Submission delete\_s1.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-27802](https://cve.now/CVE-2025-27802.md): Stored Cross-Site Scripting in Episerver Content Management System (CMS) Edit Preview (CVSS 4.8, Optimizely Episerver Content Management System)
- [CVE-2025-27801](https://cve.now/CVE-2025-27801.md): Stored Cross-Site Scripting in Episerver Content Management System (CMS) Media Selection Preview (CVSS 4.6, Optimizely Episerver Content Management System)
- [CVE-2025-27800](https://cve.now/CVE-2025-27800.md): Stored Cross-Site Scripting in Episerver Content Management System (CMS) Admin Dashboard (CVSS 4.8, Optimizely Episerver Content Management System)
- [CVE-2025-8266](https://cve.now/CVE-2025-8266.md): yanyutao0402 ChanCMS collect.js getArticle deserialization (CVSS 5.3, yanyutao0402 ChanCMS)
- [CVE-2025-8265](https://cve.now/CVE-2025-8265.md): 299Ko CMS File Management view unrestricted upload (CVSS 5.1, 299Ko CMS)
- [CVE-2025-8262](https://cve.now/CVE-2025-8262.md): yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos (CVSS 5.3, yarnpkg Yarn)
- [CVE-2025-8261](https://cve.now/CVE-2025-8261.md): Vaelsys VaelsysV4 User Creation vgrid\_server.php improper authorization (CVSS 6.9, VaelsysV4)
- [CVE-2025-8260](https://cve.now/CVE-2025-8260.md): Vaelsys VaelsysV4 Web interface vgrid\_server.php weak hash (CVSS 2.3, VaelsysV4)
- [CVE-2025-8259](https://cve.now/CVE-2025-8259.md): Vaelsys VaelsysV4 Web interface vgrid\_server.php execute\_DataObjectProc os command injection (CVSS 6.9, VaelsysV4)
- [CVE-2025-8258](https://cve.now/CVE-2025-8258.md): Cool Mo Maigcal Number App com.sdmagic.number AndroidManifest.xml improper export of android application components (CVSS 4.8, Cool Mo Maigcal Number App)
- [CVE-2025-8267](https://cve.now/CVE-2025-8267.md): Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP addr (CVSS 8.8, ssrfcheck)
- [CVE-2025-8257](https://cve.now/CVE-2025-8257.md): Lobby Universe Lobby App com.maverick.lobby AndroidManifest.xml improper export of android application components (CVSS 4.8, Lobby Universe Lobby App)
- [CVE-2025-8256](https://cve.now/CVE-2025-8256.md): code-projects Online Ordering System product.php unrestricted upload (CVSS 5.3, code-projects Online Ordering System)
- [CVE-2025-8255](https://cve.now/CVE-2025-8255.md): code-projects Exam Form Submission register.php unrestricted upload (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-8254](https://cve.now/CVE-2025-8254.md): Campcodes Courier Management System view\_parcel.php sql injection (CVSS 5.3, Campcodes Courier Management System)
- [CVE-2025-8253](https://cve.now/CVE-2025-8253.md): code-projects Exam Form Submission delete\_s6.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-8252](https://cve.now/CVE-2025-8252.md): code-projects Exam Form Submission delete\_s5.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-8251](https://cve.now/CVE-2025-8251.md): code-projects Exam Form Submission delete\_s4.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-8250](https://cve.now/CVE-2025-8250.md): code-projects Exam Form Submission update\_s4.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-8249](https://cve.now/CVE-2025-8249.md): code-projects Exam Form Submission update\_s3.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-8248](https://cve.now/CVE-2025-8248.md): code-projects Online Ordering System signup.php sql injection (CVSS 6.9, code-projects Online Ordering System)
- [CVE-2022-50237](https://cve.now/CVE-2022-50237.md): The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. (CVSS 5.9, dalek-cryptography ed25519-dalek · ed25519-dalek)
- [CVE-2023-53158](https://cve.now/CVE-2023-53158.md): The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. (CVSS 4.1, GitoxideLabs gix-transport · gix-transport)
- [CVE-2023-53159](https://cve.now/CVE-2023-53159.md): The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set\_host. (CVSS 4.5, sfackler openssl · openssl)
- [CVE-2023-53160](https://cve.now/CVE-2023-53160.md): The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic. (CVSS 2.9, sequoia-pgp sequoia · sequoia-openpgp)
- [CVE-2023-53161](https://cve.now/CVE-2023-53161.md): The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic. (CVSS 2.9, sequoia-pgp buffered-reader · buffered-reader)
- [CVE-2025-29534](https://cve.now/CVE-2025-29534.md): An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentia (CVSS 8.8)
- [CVE-2025-30124](https://cve.now/CVE-2025-30124.md): An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. (CVSS 9.8)
- [CVE-2025-30125](https://cve.now/CVE-2025-30125.md): An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. (CVSS 9.8)
- [CVE-2025-30126](https://cve.now/CVE-2025-30126.md): An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. (CVSS 5.3)
- [CVE-2025-30133](https://cve.now/CVE-2025-30133.md): An issue was discovered on IROAD Dashcam FX2 devices. (CVSS 9.8)
- [CVE-2025-50484](https://cve.now/CVE-2025-50484.md): Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session h (CVSS 7.1)
- [CVE-2025-50485](https://cve.now/CVE-2025-50485.md): Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 allows attackers to ex (CVSS 7.1)
- [CVE-2025-50486](https://cve.now/CVE-2025-50486.md): Improper session invalidation in the component /carrental/update-password.php of PHPGurukul Car Rental Project v3.0 allows attackers to exec (CVSS 7.1)
- [CVE-2025-50487](https://cve.now/CVE-2025-50487.md): Improper session invalidation in the component /bbdms/change-password.php of PHPGurukul Blood Bank & Donor Management System v2.4 allows att (CVSS 7.1)
- [CVE-2025-50488](https://cve.now/CVE-2025-50488.md): Improper session invalidation in the component /library/change-password.php of PHPGurukul Online Library Management System v3.0 allows attac (CVSS 7.1)
- [CVE-2025-50489](https://cve.now/CVE-2025-50489.md): Improper session invalidation in the component /srms/change-password.php of PHPGurukul Student Result Management System v2.0 allows attacker (CVSS 7.5)
- [CVE-2025-50490](https://cve.now/CVE-2025-50490.md): Improper session invalidation in the component /elms/emp-changepassword.php of PHPGurukul Student Result Management System v2.0 allows attac (CVSS 7.5)
- [CVE-2025-50491](https://cve.now/CVE-2025-50491.md): Improper session invalidation in the component /banker/change-password.php of PHPGurukul Bank Locker Management System v1 allows attackers t (CVSS 7.1)
- [CVE-2025-50492](https://cve.now/CVE-2025-50492.md): Improper session invalidation in the component /edms/change-password.php of PHPGurukul e-Diary Management System v1 allows attackers to exec (CVSS 7.5)
- [CVE-2025-50493](https://cve.now/CVE-2025-50493.md): Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management System v1 allows atta (CVSS 7.5)
- [CVE-2025-50494](https://cve.now/CVE-2025-50494.md): Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Car Washing Management System v1.0 allows attackers (CVSS 7.5)
- [CVE-2025-54569](https://cve.now/CVE-2025-54569.md): In Malwarebytes Binisoft Windows Firewall Control before 6.16.0.0, the installer is vulnerable to local privilege escalation. (CVSS 4.5, Malwarebytes Binisoft Windows Firewall Control)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.