# CVEs published 2025-07-30

87 CVEs were published on July 30, 2025: 4 critical, 29 high. Days are UTC.

- [CVE-2025-36040](https://cve.now/CVE-2025-36040.md): IBM Aspera Faspex session fixation (CVSS 6.5, IBM Aspera Faspex)
- [CVE-2025-36039](https://cve.now/CVE-2025-36039.md): IBM Aspera Faspex bypass security (CVSS 6.5, IBM Aspera Faspex)
- [CVE-2025-49082](https://cve.now/CVE-2025-49082.md): Permissions bypass vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56 (CVSS 5.1, Absolute Security Secure Access)
- [CVE-2025-54085](https://cve.now/CVE-2025-54085.md): Elevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56 (CVSS 5.1, Absolute Security Secure Access)
- [CVE-2025-49084](https://cve.now/CVE-2025-49084.md): Elevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56 (CVSS 5.3, Absolutee Security Secure Access)
- [CVE-2025-8338](https://cve.now/CVE-2025-8338.md): projectworlds Online Admission System adminac.php sql injection (CVSS 6.9, projectworlds Online Admission System)
- [CVE-2025-49083](https://cve.now/CVE-2025-49083.md): Data deserialization vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56 (CVSS 7.0, Absolute Security Secure Access)
- [CVE-2025-8337](https://cve.now/CVE-2025-8337.md): code-projects Simple Car Rental System add\_vehicles.php cross site scripting (CVSS 4.8, code-projects Simple Car Rental System)
- [CVE-2025-8336](https://cve.now/CVE-2025-8336.md): Campcodes Online Recruitment Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Recruitment Management System)
- [CVE-2025-8335](https://cve.now/CVE-2025-8335.md): code-projects Simple Car Rental System cross-site request forgery (CVSS 5.3, code-projects Simple Car Rental System)
- [CVE-2025-8334](https://cve.now/CVE-2025-8334.md): Campcodes Online Recruitment Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Recruitment Management System)
- [CVE-2025-54586](https://cve.now/CVE-2025-54586.md): GitProxy is susceptible to a hidden commits injection attack (CVSS 7.1, finos git-proxy · @finos/git-proxy)
- [CVE-2025-8333](https://cve.now/CVE-2025-8333.md): code-projects Online Farm System categoryvalue.php sql injection (CVSS 6.9, code-projects Online Farm System)
- [CVE-2025-8332](https://cve.now/CVE-2025-8332.md): code-projects Online Farm System register.php sql injection (CVSS 6.9, code-projects Online Farm System)
- [CVE-2025-54585](https://cve.now/CVE-2025-54585.md): GitProxy is vulnerable to a new branch approval exploit (CVSS 8.2, finos git-proxy · @finos/git-proxy)
- [CVE-2025-8331](https://cve.now/CVE-2025-8331.md): code-projects Online Farm System forgot\_pass.php sql injection (CVSS 6.9, code-projects Online Farm System)
- [CVE-2025-54584](https://cve.now/CVE-2025-54584.md): GitProxy is vulnerable to a packfile parsing exploit (CVSS 7.0, finos git-proxy · @finos/git-proxy)
- [CVE-2025-54583](https://cve.now/CVE-2025-54583.md): GitProxy bypasses approvals when pushing multiple branches (CVSS 8.3, finos git-proxy · @finos/git-proxy)
- [CVE-2025-54581](https://cve.now/CVE-2025-54581.md): vproxy is vulnerable to a divide by zero DoS attack (CVSS 7.5, 0x676e67 vproxy · vproxy)
- [CVE-2025-54575](https://cve.now/CVE-2025-54575.md): ImageSharp Triggers an Infinite Loop in its GIF Decoder When Skipping Malformed Comment Extension Blocks (CVSS 5.3, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2024-48916](https://cve.now/CVE-2024-48916.md): Ceph is vulnerable to authentication bypass through RadosGW (CVSS 8.1, ceph)
- [CVE-2025-54576](https://cve.now/CVE-2025-54576.md): OAuth2-Proxy has authentication bypass in oauth2-proxy skip\_auth\_routes due to Query Parameter inclusion (CVSS 9.1, oauth2-proxy · github.com/oauth2-proxy/oauth2-proxy +1)
- [CVE-2025-8330](https://cve.now/CVE-2025-8330.md): code-projects Vehicle Management edit1.php sql injection (CVSS 6.9, code-projects Vehicle Management)
- [CVE-2025-8329](https://cve.now/CVE-2025-8329.md): code-projects Vehicle Management filter3.php sql injection (CVSS 6.9, code-projects Vehicle Management)
- [CVE-2025-30103](https://cve.now/CVE-2025-30103.md): Dell SmartFabric OS10 Software, versions prior to 10.6.0.5 contains a Files or Directories Accessible to External Parties vulnerability. (CVSS 5.5, Dell SmartFabric OS10 Software)
- [CVE-2025-36609](https://cve.now/CVE-2025-36609.md): Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains a Use of Hard-coded Password vulnerability. (CVSS 2.5, Dell SmartFabric OS10 Software)
- [CVE-2025-36608](https://cve.now/CVE-2025-36608.md): Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability. (CVSS 6.5, Dell SmartFabric OS10 Software)
- [CVE-2025-8328](https://cve.now/CVE-2025-8328.md): code-projects Exam Form Submission register.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-30480](https://cve.now/CVE-2025-30480.md): Dell PowerProtect Data Manager, versions prior to 19.19, contain(s) an Improper Input Validation vulnerability in PowerProtect Data Manager. (CVSS 6.5, Dell PowerProtect Data Manager)
- [CVE-2025-26332](https://cve.now/CVE-2025-26332.md): TechAdvisor versions 2.6 through 3.37-30 for Dell XtremIO X2, contain(s) an Insertion of Sensitive Information into Log File vulnerability. (CVSS 8.8, Dell TechAdvisor)
- [CVE-2025-30105](https://cve.now/CVE-2025-30105.md): Dell XtremIO, version(s) 6.4.0-22, contain(s) an Insertion of Sensitive Information into Log File vulnerability. (CVSS 8.8, Dell XtremIO)
- [CVE-2025-8327](https://cve.now/CVE-2025-8327.md): code-projects Exam Form Submission delete\_s8.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-36611](https://cve.now/CVE-2025-36611.md): Dell Encryption and Dell Security Management Server, versions prior to 11.11.0, contain an Improper Link Resolution Before File Access ('Lin (CVSS 7.3, Dell Encryption · Dell Security Management Server)
- [CVE-2025-8312](https://cve.now/CVE-2025-8312.md): Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out (CVSS 7.1, Devolutions Server)
- [CVE-2025-8353](https://cve.now/CVE-2025-8353.md): UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a r (CVSS 5.9, Devolutions Server)
- [CVE-2025-54656](https://cve.now/CVE-2025-54656.md): Apache Struts Extras: Improper Output Neutralization for Logs (CVSS 6.5, Apache Software Foundation Apache Struts Extras · org.ap… +1)
- [CVE-2023-2593](https://cve.now/CVE-2023-2593.md): Kernel: ksmbd memory exhaustion denial-of-service vulnerability (CVSS 5.9, linux · Red Hat Enterprise Linux)
- [CVE-2025-54573](https://cve.now/CVE-2025-54573.md): CVAT vulnerable to email verification bypass by use of basic authentication (CVSS 4.3, cvat-ai cvat)
- [CVE-2025-43018](https://cve.now/CVE-2025-43018.md): Certain HP LaserJet Pro Printers – Potential Information Disclosure (CVSS 6.9, Certain HP LaserJet Pro Printers)
- [CVE-2025-54433](https://cve.now/CVE-2025-54433.md): Bugsink is vulnerable to Path Traversal attacks via event\_id in ingestion (CVSS 7.2, bugsink)
- [CVE-2025-53944](https://cve.now/CVE-2025-53944.md): AutoGPT Platform Exposes Graph Execution Results via Authorization Gap (CVSS 7.7, Significant-Gravitas AutoGPT)
- [CVE-2025-46811](https://cve.now/CVE-2025-46811.md): SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint (CVSS 9.8, Container suse/manager/5.0/x86\_64/server:5.0.5.7.30.1 ·… +4)
- [CVE-2025-53357](https://cve.now/CVE-2025-53357.md): GLPI permits reservation modification by unauthorized users (CVSS 5.4, glpi-project glpi)
- [CVE-2025-53113](https://cve.now/CVE-2025-53113.md): GLPI technicians can access unauthorized information through external links (CVSS 2.7, glpi-project glpi)
- [CVE-2025-53112](https://cve.now/CVE-2025-53112.md): GLPI's incomprehensive permission checks can lead to data removal from allowed users (CVSS 4.3, glpi-project glpi)
- [CVE-2025-53111](https://cve.now/CVE-2025-53111.md): GLPI exposes data to non-allowed users (CVSS 6.5, glpi-project glpi)
- [CVE-2025-53008](https://cve.now/CVE-2025-53008.md): GLPI's MailCollector Receiver is vulnerable to credential exfiltration (CVSS 6.5, glpi-project glpi)
- [CVE-2025-52897](https://cve.now/CVE-2025-52897.md): GLPI is vulnerable to XSS and open redirection attacks through planning feature (CVSS 6.5, glpi-project glpi)
- [CVE-2025-52567](https://cve.now/CVE-2025-52567.md): GLPI has overly permissive URL verification (CVSS 3.5, glpi-project glpi)
- [CVE-2025-54572](https://cve.now/CVE-2025-54572.md): Ruby SAML DOS vulnerability with large SAML response (CVSS 6.9, SAML-Toolkits ruby-saml · ruby-saml)
- [CVE-2025-54430](https://cve.now/CVE-2025-54430.md): dedupe is vulnerable to secret exfiltration via \`issue\_comment\` (CVSS 9.1, dedupeio dedupe)
- [CVE-2025-54425](https://cve.now/CVE-2025-54425.md): Umbraco's Delivery API allows for cached requests to be returned with an invalid API key (CVSS 5.3, Umbraco-CMS · Umbraco.Cms.Api.Delivery)
- [CVE-2025-54410](https://cve.now/CVE-2025-54410.md): Moby's Firewalld reload removes bridge network isolation (CVSS 3.3, moby · github.com/docker/docker)
- [CVE-2025-54388](https://cve.now/CVE-2025-54388.md): Moby's Firewalld reload makes published container ports accessible from remote hosts (CVSS 5.1, moby · github.com/docker/docker)
- [CVE-2025-8326](https://cve.now/CVE-2025-8326.md): code-projects Exam Form Submission delete\_s7.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-47001](https://cve.now/CVE-2025-47001.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-6348](https://cve.now/CVE-2025-6348.md): Smart Slider 3 \<= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via \`sliderid\` Parameter (CVSS 4.9, nextendweb Smart Slider)
- [CVE-2025-1394](https://cve.now/CVE-2025-1394.md): Denial of Service (DoS) vulnerabilitiey in Zigbee library (CVSS 5.9, silabs.com Zigbee Stack)
- [CVE-2025-1221](https://cve.now/CVE-2025-1221.md): DoS in Zigbee device due to heavy traffic (CVSS 5.9, silabs.com Zigbee)
- [CVE-2025-38498](https://cve.now/CVE-2025-38498.md): do\_change\_type(): refuse to operate on unmounted/not ours mounts (CVSS 7.8, Linux)
- [CVE-2025-8323](https://cve.now/CVE-2025-8323.md): Ventem｜e-School - Arbitrary File Upload (CVSS 8.8, Ventem e-School)
- [CVE-2025-8322](https://cve.now/CVE-2025-8322.md): Ventem｜e-School - Missing Authorization (CVSS 8.8, Ventem e-School)
- [CVE-2025-8292](https://cve.now/CVE-2025-8292.md): Use after free in Media Stream in Google Chrome prior to 138.0.7204.183 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2025-8320](https://cve.now/CVE-2025-8320.md): Tesla Wall Connector Content-Length Header Improper Input Validation Remote Code Execution Vulnerability (CVSS 8.8, Tesla Wall Connector)
- [CVE-2025-8321](https://cve.now/CVE-2025-8321.md): Tesla Wall Connector Firmware Downgrade Vulnerability (CVSS 6.8, Tesla Wall Connector)
- [CVE-2025-4426](https://cve.now/CVE-2025-4426.md): SetupAutomationSmm : SMRAM memory contents leak / information disclosure vulnerability in SMM module (CVSS 6.0, Insyde Software InsydeH2O)
- [CVE-2025-4425](https://cve.now/CVE-2025-4425.md): SetupAutomationSmm: Stack overflow vulnerability in SMI handler (CVSS 8.2, Insyde Software InsydeH2O)
- [CVE-2025-4424](https://cve.now/CVE-2025-4424.md): SetupAutomationSmm : Arbitrary calls to SmmSetVariable with unsanitised arguments in SMI handler (CVSS 6.0, Insyde Software InsydeH2O)
- [CVE-2025-4423](https://cve.now/CVE-2025-4423.md): SetupAutomationSmm:Vulnerability in the SMM module allow attacker to write arbitrary code and lead to memory corruption (CVSS 8.2, Insyde Software InsydeH2O)
- [CVE-2025-4422](https://cve.now/CVE-2025-4422.md): EfiSmiServices : EfiPcdProtocol, SMM memory corruption vulnerabilities in SMM module (CVSS 8.2, Insyde Software InsydeH2O)
- [CVE-2025-4421](https://cve.now/CVE-2025-4421.md): EfiSmiServices: gEfiSmmCpuProtocol, SMM memory corruption vulnerabilities in SMM module (CVSS 8.2, Insyde Software InsydeH2O)
- [CVE-2025-8217](https://cve.now/CVE-2025-8217.md): Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension (CVSS 5.1, Amazon Q Developer VS Code Extension)
- [CVE-2025-25011](https://cve.now/CVE-2025-25011.md): Beats Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer (CVSS 7.0, Elastic Beats)
- [CVE-2025-0712](https://cve.now/CVE-2025-0712.md): APM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer (CVSS 7.0, Elastic APM Server)
- [CVE-2024-45515](https://cve.now/CVE-2024-45515.md): An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. (CVSS 6.1)
- [CVE-2024-45955](https://cve.now/CVE-2024-45955.md): Rocket Software Rocket Zena 4.4.1.26 is vulnerable to SQL Injection via the filter parameter. (CVSS 7.3)
- [CVE-2025-25691](https://cve.now/CVE-2025-25691.md): A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a c (CVSS 6.5)
- [CVE-2025-25692](https://cve.now/CVE-2025-25692.md): A PHAR deserialization vulnerability in the \_getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a craft (CVSS 6.5)
- [CVE-2025-45619](https://cve.now/CVE-2025-45619.md): An issue in Aver PTC310UV2 firmware v.0.1.0000.59 allows a remote attacker to execute arbitrary code via the SendAction function (CVSS 6.5)
- [CVE-2025-45620](https://cve.now/CVE-2025-45620.md): An issue in Aver PTC310UV2 v.0.1.0000.59 allows a remote attacker to obtain sensitive information via a crafted request (CVSS 8.1)
- [CVE-2025-50464](https://cve.now/CVE-2025-50464.md): A buffer overflow vulnerability exists in the upload.cgi module of the iptime NAS firmware v1.5.04. (CVSS 6.5)
- [CVE-2025-50578](https://cve.now/CVE-2025-50578.md): LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically \`X-Forwarded-Host\` a (CVSS 9.8)
- [CVE-2025-50777](https://cve.now/CVE-2025-50777.md): The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Access Control vulnerab (CVSS 7.8)
- [CVE-2025-51951](https://cve.now/CVE-2025-51951.md): andisearch v0.5.249 was discovered to contain a cross-site scripting (XSS) vulnerability. (CVSS 6.1)
- [CVE-2025-51954](https://cve.now/CVE-2025-51954.md): playground.electronhub.ai v1.1.9 was discovered to contain a cross-site scripting (XSS) vulnerability. (CVSS 6.1)
- [CVE-2025-52187](https://cve.now/CVE-2025-52187.md): GetProjectsIdea Create School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in my\_profile\_update\_form1.php. (CVSS 8.2)
- [CVE-2025-53022](https://cve.now/CVE-2025-53022.md): TrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmwar (CVSS 8.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.