CVEs published July 29, 2025
174 CVEs were published on July 29, 2025: 31 critical, 53 high. 1 is now in CISA KEV.
- Published
- 174
- Critical
- 31
- High
- 53
- Medium
- 90
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 124
Most affected products
- Apple macOS
- 49
- IBM Db2
- 8
- Apple Safari · Apple iOS and iPadOS +4
- 7
- Apple iOS and iPadOS · Apple iPadOS +4
- 5
- Autodesk Shared Components
- 5
- Human Resource Management System
- 5
- Samsung Electronics Data Management Server
- 5
- Apple iPadOS · Apple macOS
- 4
- TP-Link Systems TL-WR841N
- 4
- Apple iOS and iPadOS · Apple macOS +2
- 3
Critical 31
- CVE-2025-43237An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2025-43233This issue was addressed with improved access restrictions.Apple macOS
- CVE-2025-43186The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-43245A downgrade issue was addressed with additional code-signing restrictions.Apple macOS
- CVE-2025-43253This issue was addressed with improved input validation.Apple macOS
- CVE-2025-43199A permissions issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2025-43232A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-43198This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2025-43209An out-of-bounds access issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-43194The issue was addressed with improved checks.Apple macOS
- CVE-2025-43244A race condition was addressed with improved state handling.Apple macOS
- CVE-2025-43275A race condition was addressed with additional validation.Apple macOS
- CVE-2025-43234Multiple memory corruption issues were addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-43261A logic issue was addressed with improved checks.Apple macOS
- CVE-2025-43220This issue was addressed with improved validation of symlinks.Apple iPadOS · Apple macOS
- CVE-2025-43273A permissions issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2025-31229A logic issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2025-43189This issue was addressed with improved memory handling.Apple macOS
- CVE-2025-43222A use-after-free issue was addressed by removing the vulnerable code.Apple iPadOS · Apple macOS
- CVE-2025-43243A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-43193The issue was addressed with improved memory handling.Apple macOS
- CVE-2025-31279A permissions issue was addressed with additional restrictions.Apple iPadOS · Apple macOS
- CVE-2025-31281An input validation issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-43192A configuration issue was addressed with additional restrictions.Apple macOS
- CVE-2025-43184This issue was addressed by adding an additional prompt for user consent.Apple macOS
- CVE-2025-54381BentoML is Vulnerable to an SSRF Attack Through File Upload ProcessingBentoML
- CVE-2025-40600Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause SonicWall SonicOS
- CVE-2025-8264Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend.z-push/z-push-dev
- CVE-2025-44136MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS).
- CVE-2025-46059langchain-ai v0.3.51 was discovered to contain an indirect prompt injection vulnerability in the GmailToolkit component.
- CVE-2025-50738The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs.github.com/usememos/memos
High 53
- CVE-2025-43196A path handling issue was addressed with improved validation.Apple macOS
- CVE-2025-24224The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-43227This issue was addressed through improved state management.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-43270An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2025-43249A logic issue was addressed with improved checks.Apple macOS
- CVE-2025-43224An out-of-bounds access issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-24119This issue was addressed through improved state management.Apple macOS
- CVE-2025-31243A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-31280A memory corruption issue was addressed with improved validation.Apple macOS
- CVE-2025-31278The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +5
- CVE-2025-43188A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-31277The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-43277The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-43256This issue was addressed through improved state management.Apple macOS
- CVE-2025-43221An out-of-bounds access issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-31273The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-43248A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2025-43239An out-of-bounds access issue was addressed with improved bounds checking.Apple macOS
- CVE-2025-43254An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2025-43223A denial-of-service issue was addressed with improved input validation.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-7849Memory Corruption Issue in NI LabVIEW due to improper error handlingNI LabVIEW
- CVE-2025-7848Missing input check in lvpict.cpp used in NI LabVIEWNI LabVIEW
- CVE-2025-7361Code Injection Vulnerability in NI LabVIEW when using CIN nodesNI LabVIEW
- CVE-2025-4674Unexpected command execution in untrusted VCS repositories in cmd/goGo toolchain cmd/go · toolchain
- CVE-2025-53102Discourse's WebAuthn challenge isn't cleared from user session after authenticationdiscourse
- CVE-2025-33092IBM Db2 for Linux code executionIBM Db2
- CVE-2025-76753DM File Parsing Out-of-Bounds Write VulnerabilityAutodesk Shared Components · Autodesk AutoCAD
- CVE-2025-7497PRT File Parsing Out-of-Bounds Write VulnerabilityAutodesk Shared Components
- CVE-2025-6637PRT File Parsing Out-of-Bounds Write VulnerabilityAutodesk Shared Components
- CVE-2025-6636PRT File Parsing Use-After-Free VulnerabilityAutodesk Shared Components
- CVE-2025-6635PRT File Parsing Out-of-Bounds Read VulnerabilityAutodesk Shared Components
- CVE-2025-6631PRT File Parsing Out-of-Bounds Write VulnerabilityAutodesk Shared Components
- CVE-2025-50433DM File Parsing Heap-Based Overflow VulnerabilityAutodesk Shared Components · Autodesk AutoCAD
- CVE-2025-5038X_T File Parsing Memory Corruption VulnerabilityAutodesk Shared Components · Autodesk AutoCAD
- CVE-2025-2928SQL Injection affecting the Archiver role.Genetec Security Center
- CVE-2025-31965HCL BigFix Remote Control is affected by an authorization bypass vulnerabilityHCL Software BigFix Remote Control
- CVE-2025-6505Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on LinuxProgress Software Hybrid Data Pipeline
- CVE-2025-6504Possibilities of IP Spoofing via X-Forwarded-For (XFF) HeaderProgress Software Hybrid Data Pipeline
- CVE-2025-6175CRLF Injection in DECE Software's GeodiDECE Software Geodi
- CVE-2025-40682SQL injection vulnerability in Human Resource Management SystemHuman Resource Management System
- CVE-2025-7689Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Functionthemefic Hydra Booking – All in One Appointment Booking Sys…
- CVE-2025-53080Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Samsung DMS(Data Management Server) allows authenticated aSamsung Electronics Data Management Server
- CVE-2025-53078Deserialization of Untrusted Data in Samsung DMS(Data Management Server) allows attackers to execute arbitrary code via write file to systemSamsung Electronics Data Management Server
- CVE-2025-6495Bricks Builder <= 1.12.4 - Unauthenticated SQL Injection via `p` ParameterBricks Builder Bricks
- CVE-2024-42644FlashMQ v1.14.0 was discovered to contain an assertion failure in the function PublishCopyFactory::getNewPublish, which occurs when the QoS
- CVE-2024-42645An issue in FlashMQ v1.14.0 allows attackers to cause an assertion failure via sending a crafted retain message, leading to a Denial of Serv
- CVE-2024-42651NanoMQ v0.17.9 was discovered to contain a heap use-after-free vulnerability via the component sub_Ctx_handle.
- CVE-2024-42655An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using
- CVE-2025-28170Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control.
- CVE-2025-44137MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal.
- CVE-2025-45346SQL Injection vulnerability in Bacula-web before v.9.7.1 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request.bacula-web/bacula-web
- CVE-2025-51970A SQL Injection vulnerability exists in the action.php endpoint of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper saniti
- CVE-2025-52490An issue was discovered in Couchbase Sync Gateway before 3.2.6.couchbase · github.com/couchbase/sync_gateway
Medium, low and unrated 90
- CVE-2025-43191A path handling issue was addressed with improved validation.Apple macOS
- CVE-2025-43197This issue was addressed with additional entitlement checks.Apple macOS
- CVE-2025-43206A parsing issue in the handling of directory paths was addressed with improved path validation.Apple macOS
- CVE-2025-43265An out-of-bounds read was addressed with improved input validation.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-43218An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2025-24188A logic issue was addressed with improved checks.Apple Safari · Apple macOS
- CVE-2025-43216A use-after-free issue was addressed with improved memory management.Apple Safari · Apple iOS and iPadOS +5
- CVE-2025-43217The issue was addressed by adding additional logic.Apple iOS and iPadOS · Apple iPadOS
- CVE-2025-43276A logic error was addressed with improved error handling.Apple macOS
- CVE-2025-31276This issue was addressed through improved state management.Apple iOS and iPadOS · Apple iPadOS
- CVE-2025-43260This issue was addressed with improved data protection.Apple macOS
- CVE-2025-43247A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-43230The issue was addressed with additional permissions checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-43226An out-of-bounds read was addressed with improved input validation.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-43266A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-43211The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +5
- CVE-2025-43250A path handling issue was addressed with improved validation.Apple macOS
- CVE-2025-43212The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-43195An issue existed in the handling of environment variables.Apple macOS
- CVE-2025-43228The issue was addressed with improved UI.Apple Safari · Apple iOS and iPadOS
- CVE-2025-43252This issue was addressed by adding an additional prompt for user consent.Apple macOS
- CVE-2025-43259This issue was addressed with improved redaction of sensitive information.Apple macOS
- CVE-2025-43185A downgrade issue was addressed with additional code-signing restrictions.Apple macOS
- CVE-2025-43214The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-43215The issue was addressed with improved checks.Apple macOS
- CVE-2025-8319the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL Barracuda Message Archiver
- CVE-2025-43241A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-43240A logic issue was addressed with improved checks.Apple Safari · Apple macOS
- CVE-2025-43251An authorization issue was addressed with improved state management.Apple macOS
- CVE-2025-43267An injection issue was addressed with improved validation.Apple macOS
- CVE-2025-43246This issue was addressed with improved checks.Apple macOS
- CVE-2025-43225A logging issue was addressed with improved data redaction.Apple iPadOS · Apple macOS
- CVE-2025-43229This issue was addressed through improved state management.Apple Safari · Apple macOS
- CVE-2025-43213The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-31275A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-43235The issue was addressed with improved memory handling.Apple macOS
- CVE-2025-43274A privacy issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2025-54126WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specifiedbytecodealliance wasm-micro-runtime
- CVE-2025-5684MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Elementroxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2025-53902Tuleap exposes artifacts to a mentioned user via email notificationsEnalean tuleap
- CVE-2025-53541Tuleap is vulnerable to XSS attacks when displaying the children of a parent artifactEnalean tuleap
- CVE-2025-52899Tuleap vulnerable to user enumeration via the lost password formEnalean tuleap
- CVE-2024-49828IBM Db2 for Linux, UNIX and Windows denial of serviceIBM Db2
- CVE-2024-51473IBM Db2 for Linux, UNIX and Windows denial of serviceIBM Db2
- CVE-2024-52894IBM Db2 for Linux, UNIX and Windows denial of serviceIBM Db2
- CVE-2025-33114IBM Db2 for Linux denial of serviceIBM Db2
- CVE-2025-36071IBM Db2 denial of serviceIBM Db2
- CVE-2025-36010IBM Db2 for Linux denial of serviceIBM Db2
- CVE-2025-53715TP-Link TL-WR841N Wan6to4TunnelCfgRpm.htm buffer overflowTP-Link Systems TL-WR841N
- CVE-2025-53714TP-Link TL-WR841N WzdWlanSiteSurveyRpm_AP.htm buffer overflowTP-Link Systems TL-WR841N
- CVE-2025-53713TP-Link TL-WR841N WlanNetworkRpm_APC.htm buffer overflowTP-Link Systems TL-WR841N
- CVE-2025-53712TP-Link TL-WR841N WlanNetworkRpm_AP.htm buffer overflowTP-Link Systems TL-WR841N
- CVE-2025-53711TP-Link TL-WR841N, TL-WR842ND and TL-WR949N WlanNetworkRpm.htm buffer overflowTP-Link Systems TL-WR841N · TP Link Systems TL-WR842ND +1
- CVE-2025-2533IBM Db2 for Linux denial of serviceIBM Db2
- CVE-2025-27514GLPI is susceptible to Stored XSS attack through project's kanbanglpi-project glpi
- CVE-2025-2179GlobalProtect App: Non Admin User Can Disable the GlobalProtect AppPalo Alto Networks GlobalProtect App · Palo Alto Networks G…
- CVE-2025-5922Retrievable password hash protecting TSplus admin consoleTSplus Remote Access
- CVE-2025-54422Sandboxie exposes encrypted sandbox key during password changesandboxie-plus Sandboxie
- CVE-2025-7458SQLite integer overflow in key info allocation may lead to information disclosure.SQLite
- CVE-2025-6060XSS in DECE Software's GeodiDECE Software Geodi
- CVE-2025-41241Denial-of-service vulnerabilityVMware vCenter · VMware Cloud Foundation +2
- CVE-2025-40686Reflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management SystemHuman Resource Management System
- CVE-2025-40685Reflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management SystemHuman Resource Management System
- CVE-2025-40684Reflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management SystemHuman Resource Management System
- CVE-2025-40683Reflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management SystemHuman Resource Management System
- CVE-2025-5587Appzend <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parametersparklewpthemes Appzend
- CVE-2025-6692YouTube Embed <= 10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via instance Parameterhanucodes YouTube Embed – YouTube Gallery, Vimeo Gallery –…
- CVE-2025-6681Fan Page <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameterdelower186 Fan Page
- CVE-2025-8196Magical Addons For Elementor <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributesnalam-1 Magical Addons For Elementor
- CVE-2025-6730Bonanza – WooCommerce Free Gifts Lite <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Opt In Successamans2k Bonanza – WooCommerce Free Gifts Lite
- CVE-2025-8216Sky Addons for Elementor <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetswowdevs Sky Addons – Elementor Addons with Widgets & Templa…
- CVE-2025-26400SolarWinds Web Help Desk XML External Entity Injection (XXE) VulnerabilitySolarWinds Web Help Desk
- CVE-2025-53082An 'Arbitrary File Deletion' in Samsung DMS(Data Management Server) allows attackers to delete arbitrary files from unintended locations on Samsung Electronics Data Management Server
- CVE-2025-53081An 'Arbitrary File Creation' in Samsung DMS(Data Management Server) allows attackers to create arbitrary files in unintended locations on thSamsung Electronics Data Management Server
- CVE-2025-53079Absolute Path Traversal in Samsung DMS(Data Management Server) allows authenticated attacker (Administrator) to read sensitive filesSamsung Electronics Data Management Server
- CVE-2025-53077An execution after redirect in Samsung DMS(Data Management Server) allows attackers to execute limited functions without permissions.Samsung Electronics DMS
- CVE-2025-53649"SwitchBot" App for iOS/Android contains an insertion of sensitive information into log file vulnerability in versions V6.24 through V9.12.SwitchBot App for iOS/Android
- CVE-2025-4370Brizy <= 2.6.20 - Missing Authorization to Unauthenticated Limited File Uploadthemefusecom Brizy – Page Builder
- CVE-2025-4566Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widgetelemntor Elementor Website Builder – more than just a page…
- CVE-2025-3075Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingelemntor Elementor Website Builder – more than just a page…
- CVE-2025-7811StreamWeasels YouTube Integration <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingStreamWeasels YouTube Integration
- CVE-2025-7809StreamWeasels Twitch Integration <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingStreamWeasels Twitch Integration
- CVE-2025-7810StreamWeasels Kick Integration <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingStreamWeasels Kick Integration
- CVE-2024-43018Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register.
- CVE-2025-28171An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /c
- CVE-2025-28172Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts.
- CVE-2025-51044phpgurukul Nipah virus (NiV) Testing Management System 1.0 contains a SQL injection vulnerability in the /new-user-testing.php file, due to
- CVE-2025-51045Phpgurukul Pre-School Enrollment System 1.0 contains a SQL injection vulnerability in the /admin/password-recovery.php file.
- CVE-2025-52284Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184C0 function via the tz paramet
- CVE-2025-52358A cross-site scripting vulnerability in Vivaldi United Group iCONTROL+ Server including Firmware version 4.7.8.0.eden Logic version 5.32 and