CVEs published July 30, 2025
87 CVEs were published on July 30, 2025: 4 critical, 29 high.
- Published
- 87
- Critical
- 4
- High
- 29
- Medium
- 50
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 46
Most affected products
- glpi-project glpi
- 7
- Insyde Software InsydeH2O
- 6
- finos git-proxy · @finos/git-proxy
- 4
- Absolute Security Secure Access
- 3
- code-projects Exam Form Submission
- 3
- code-projects Online Farm System
- 3
- Dell SmartFabric OS10 Software
- 3
- Campcodes Online Recruitment Management System
- 2
- code-projects Simple Car Rental System
- 2
- code-projects Vehicle Management
- 2
Critical 4
- CVE-2025-54576OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusionoauth2-proxy · github.com/oauth2-proxy/oauth2-proxy +1
- CVE-2025-46811SUSE Multi Linux Manager allows code execution via unprotected websocket endpointContainer suse/manager/5.0/x86_64/server:5.0.5.7.30.1 ·… +4
- CVE-2025-54430dedupe is vulnerable to secret exfiltration via `issue_comment`dedupeio dedupe
- CVE-2025-50578LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` a
High 29
- CVE-2025-49083Data deserialization vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56Absolute Security Secure Access
- CVE-2025-54586GitProxy is susceptible to a hidden commits injection attackfinos git-proxy · @finos/git-proxy
- CVE-2025-54585GitProxy is vulnerable to a new branch approval exploitfinos git-proxy · @finos/git-proxy
- CVE-2025-54584GitProxy is vulnerable to a packfile parsing exploitfinos git-proxy · @finos/git-proxy
- CVE-2025-54583GitProxy bypasses approvals when pushing multiple branchesfinos git-proxy · @finos/git-proxy
- CVE-2025-54581vproxy is vulnerable to a divide by zero DoS attack0x676e67 vproxy · vproxy
- CVE-2024-48916Ceph is vulnerable to authentication bypass through RadosGWceph
- CVE-2025-26332TechAdvisor versions 2.6 through 3.37-30 for Dell XtremIO X2, contain(s) an Insertion of Sensitive Information into Log File vulnerability.Dell TechAdvisor
- CVE-2025-30105Dell XtremIO, version(s) 6.4.0-22, contain(s) an Insertion of Sensitive Information into Log File vulnerability.Dell XtremIO
- CVE-2025-36611Dell Encryption and Dell Security Management Server, versions prior to 11.11.0, contain an Improper Link Resolution Before File Access ('LinDell Encryption · Dell Security Management Server
- CVE-2025-8312Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out Devolutions Server
- CVE-2025-54433Bugsink is vulnerable to Path Traversal attacks via event_id in ingestionbugsink
- CVE-2025-53944AutoGPT Platform Exposes Graph Execution Results via Authorization GapSignificant-Gravitas AutoGPT
- CVE-2025-38498do_change_type(): refuse to operate on unmounted/not ours mountsLinux
- CVE-2025-8323Ventem｜e-School - Arbitrary File UploadVentem e-School
- CVE-2025-8322Ventem｜e-School - Missing AuthorizationVentem e-School
- CVE-2025-8292Use after free in Media Stream in Google Chrome prior to 138.0.7204.183 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2025-8320Tesla Wall Connector Content-Length Header Improper Input Validation Remote Code Execution VulnerabilityTesla Wall Connector
- CVE-2025-4425SetupAutomationSmm: Stack overflow vulnerability in SMI handlerInsyde Software InsydeH2O
- CVE-2025-4423SetupAutomationSmm:Vulnerability in the SMM module allow attacker to write arbitrary code and lead to memory corruptionInsyde Software InsydeH2O
- CVE-2025-4422EfiSmiServices : EfiPcdProtocol, SMM memory corruption vulnerabilities in SMM moduleInsyde Software InsydeH2O
- CVE-2025-4421EfiSmiServices: gEfiSmmCpuProtocol, SMM memory corruption vulnerabilities in SMM moduleInsyde Software InsydeH2O
- CVE-2025-25011Beats Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows InstallerElastic Beats
- CVE-2025-0712APM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows InstallerElastic APM Server
- CVE-2024-45955Rocket Software Rocket Zena 4.4.1.26 is vulnerable to SQL Injection via the filter parameter.
- CVE-2025-45620An issue in Aver PTC310UV2 v.0.1.0000.59 allows a remote attacker to obtain sensitive information via a crafted request
- CVE-2025-50777The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Access Control vulnerab
- CVE-2025-52187GetProjectsIdea Create School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in my_profile_update_form1.php.
- CVE-2025-53022TrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmwar
Medium, low and unrated 54
- CVE-2025-36040IBM Aspera Faspex session fixationIBM Aspera Faspex
- CVE-2025-36039IBM Aspera Faspex bypass securityIBM Aspera Faspex
- CVE-2025-49082Permissions bypass vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56Absolute Security Secure Access
- CVE-2025-54085Elevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56Absolute Security Secure Access
- CVE-2025-49084Elevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56Absolutee Security Secure Access
- CVE-2025-8338projectworlds Online Admission System adminac.php sql injectionprojectworlds Online Admission System
- CVE-2025-8337code-projects Simple Car Rental System add_vehicles.php cross site scriptingcode-projects Simple Car Rental System
- CVE-2025-8336Campcodes Online Recruitment Management System ajax.php sql injectionCampcodes Online Recruitment Management System
- CVE-2025-8335code-projects Simple Car Rental System cross-site request forgerycode-projects Simple Car Rental System
- CVE-2025-8334Campcodes Online Recruitment Management System ajax.php sql injectionCampcodes Online Recruitment Management System
- CVE-2025-8333code-projects Online Farm System categoryvalue.php sql injectioncode-projects Online Farm System
- CVE-2025-8332code-projects Online Farm System register.php sql injectioncode-projects Online Farm System
- CVE-2025-8331code-projects Online Farm System forgot_pass.php sql injectioncode-projects Online Farm System
- CVE-2025-54575ImageSharp Triggers an Infinite Loop in its GIF Decoder When Skipping Malformed Comment Extension BlocksSixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2025-8330code-projects Vehicle Management edit1.php sql injectioncode-projects Vehicle Management
- CVE-2025-8329code-projects Vehicle Management filter3.php sql injectioncode-projects Vehicle Management
- CVE-2025-30103Dell SmartFabric OS10 Software, versions prior to 10.6.0.5 contains a Files or Directories Accessible to External Parties vulnerability.Dell SmartFabric OS10 Software
- CVE-2025-36609Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains a Use of Hard-coded Password vulnerability.Dell SmartFabric OS10 Software
- CVE-2025-36608Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability.Dell SmartFabric OS10 Software
- CVE-2025-8328code-projects Exam Form Submission register.php sql injectioncode-projects Exam Form Submission
- CVE-2025-30480Dell PowerProtect Data Manager, versions prior to 19.19, contain(s) an Improper Input Validation vulnerability in PowerProtect Data Manager.Dell PowerProtect Data Manager
- CVE-2025-8327code-projects Exam Form Submission delete_s8.php sql injectioncode-projects Exam Form Submission
- CVE-2025-8353UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a rDevolutions Server
- CVE-2025-54656Apache Struts Extras: Improper Output Neutralization for LogsApache Software Foundation Apache Struts Extras · org.ap… +1
- CVE-2023-2593Kernel: ksmbd memory exhaustion denial-of-service vulnerabilitylinux · Red Hat Enterprise Linux
- CVE-2025-54573CVAT vulnerable to email verification bypass by use of basic authenticationcvat-ai cvat
- CVE-2025-43018Certain HP LaserJet Pro Printers – Potential Information DisclosureCertain HP LaserJet Pro Printers
- CVE-2025-53357GLPI permits reservation modification by unauthorized usersglpi-project glpi
- CVE-2025-53113GLPI technicians can access unauthorized information through external linksglpi-project glpi
- CVE-2025-53112GLPI's incomprehensive permission checks can lead to data removal from allowed usersglpi-project glpi
- CVE-2025-53111GLPI exposes data to non-allowed usersglpi-project glpi
- CVE-2025-53008GLPI's MailCollector Receiver is vulnerable to credential exfiltrationglpi-project glpi
- CVE-2025-52897GLPI is vulnerable to XSS and open redirection attacks through planning featureglpi-project glpi
- CVE-2025-52567GLPI has overly permissive URL verificationglpi-project glpi
- CVE-2025-54572Ruby SAML DOS vulnerability with large SAML responseSAML-Toolkits ruby-saml · ruby-saml
- CVE-2025-54425Umbraco's Delivery API allows for cached requests to be returned with an invalid API keyUmbraco-CMS · Umbraco.Cms.Api.Delivery
- CVE-2025-54410Moby's Firewalld reload removes bridge network isolationmoby · github.com/docker/docker
- CVE-2025-54388Moby's Firewalld reload makes published container ports accessible from remote hostsmoby · github.com/docker/docker
- CVE-2025-8326code-projects Exam Form Submission delete_s7.php sql injectioncode-projects Exam Form Submission
- CVE-2025-47001Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-6348Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameternextendweb Smart Slider
- CVE-2025-1394Denial of Service (DoS) vulnerabilitiey in Zigbee librarysilabs.com Zigbee Stack
- CVE-2025-1221DoS in Zigbee device due to heavy trafficsilabs.com Zigbee
- CVE-2025-8321Tesla Wall Connector Firmware Downgrade VulnerabilityTesla Wall Connector
- CVE-2025-4426SetupAutomationSmm : SMRAM memory contents leak / information disclosure vulnerability in SMM moduleInsyde Software InsydeH2O
- CVE-2025-4424SetupAutomationSmm : Arbitrary calls to SmmSetVariable with unsanitised arguments in SMI handlerInsyde Software InsydeH2O
- CVE-2025-8217Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) ExtensionAmazon Q Developer VS Code Extension
- CVE-2024-45515An issue was discovered in Zimbra Collaboration (ZCS) through 10.1.
- CVE-2025-25691A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a c
- CVE-2025-25692A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a craft
- CVE-2025-45619An issue in Aver PTC310UV2 firmware v.0.1.0000.59 allows a remote attacker to execute arbitrary code via the SendAction function
- CVE-2025-50464A buffer overflow vulnerability exists in the upload.cgi module of the iptime NAS firmware v1.5.04.
- CVE-2025-51951andisearch v0.5.249 was discovered to contain a cross-site scripting (XSS) vulnerability.
- CVE-2025-51954playground.electronhub.ai v1.1.9 was discovered to contain a cross-site scripting (XSS) vulnerability.