CVEs published August 1, 2025
110 CVEs were published on August 1, 2025: 23 critical, 34 high.
- Published
- 110
- Critical
- 23
- High
- 34
- Medium
- 47
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 40
Most affected products
- Alpine iLX-507
- 7
- HashiCorp Vault · github.com/hashicorp/vault
- 7
- TESI Gandia Integra Total
- 5
- AcademySoftwareFoundation MaterialX · materialx
- 4
- cursor
- 4
- code-projects Online Medicine Guide
- 3
- microweber/microweber
- 3
- code-projects Online Movie Streaming
- 2
- code-projects Wazifa System
- 2
- humhub cfiles
- 2
Critical 23
- CVE-2025-54790Files: Potential for SQL Injection through File Browse and List Operationshumhub cfiles
- CVE-2025-54782@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developersnestjs nest · @nestjs/devtools-integration
- CVE-2025-54792LocalSend is Vulnerable to Man-in-the-Middle Attacks, Leading to File Interceptionlocalsend
- CVE-2013-10049Raidsonic NAS Devices Unauthenticated Remote Command ExecutionRaidsonic Technology IB-NAS5220 · Raidsonic Technology IB-N…
- CVE-2013-10060Netgear Routers pppoe.cgi RCENetgear DGN2200B
- CVE-2013-10047MiniWeb <= Build 300 Arbitrary File UploadMiniWeb
- CVE-2013-10051InstantCMS <= 1.6 Remote PHP Code ExecutionInstantCMS
- CVE-2013-10055Havalite CMS Arbitary File Upload RCEHavalite CMS
- CVE-2013-10048D-Link Devices command.php Unauthenticated RCED-Link DIR-600 · D-Link DIR-300
- CVE-2025-54574Squid's URN Handling can lead to Buffer Overflowsquid-cache squid
- CVE-2025-6000Arbitrary Remote Code Execution via Plugin Catalog AbuseHashiCorp Vault · github.com/hashicorp/vault
- CVE-2025-41375SQL Injection in LimesurveyLimeSurvey
- CVE-2025-41371SQL injection vulnerability in Gandia Integra TotalTESI Gandia Integra Total
- CVE-2025-41370SQL injection vulnerability in Gandia Integra TotalTESI Gandia Integra Total
- CVE-2025-8454It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scDebian devscripts
- CVE-2025-5947Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookieaonetheme Service Finder Bookings
- CVE-2025-5954Service Finder SMS System <= 2.0.0 - Unauthenticated Privilege Escalationaonetheme Service Finder SMS System
- CVE-2019-19144XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via rest/Users?action=authenticate.
- CVE-2025-45150Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying
- CVE-2025-50460A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py usingms-swift
- CVE-2025-50472The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the `l
- CVE-2025-50870Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint.
- CVE-2025-52390Saurus CMS Community Edition since commit d886e5b0 (2010-04-23) is vulnerable to a SQL Injection vulnerability in the `prepareSearchQuery()`
High 34
- CVE-2025-54796Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page9001 copyparty · copyparty
- CVE-2025-54386Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Executiontraefik · github.com/traefik/traefik +2
- CVE-2025-54136Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvalscursor
- CVE-2025-544241Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution1Panel-dev 1Panel · github.com/1Panel-dev/1Panel/core
- CVE-2013-10053ZPanel <= 10.0.0.2 htpasswd Module Username Command ExecutionZPanel Project ZPanel
- CVE-2013-10057Synactis PDF In-The-Box ConnectToSynactic Stack-Based Buffer OverflowSynactis PDF In-The-Box
- CVE-2013-10044OpenEMR ≤ 4.1.1 SQL Injection Privilege Escalation and RCEOpenEMR Foundation OpenEMR
- CVE-2013-10061Netgear Routers setup.cgi RCENetgear DGN1000B
- CVE-2013-10058Linksys Routers apply.cgi Remote Command InjectionLinksys WRT160nv2
- CVE-2012-10022Kloxo <= 6.1.12 Local Privilege EscalationLxCenter Kloxo
- CVE-2013-10050D-Link Devices tools_vct.xgi Authenticated RCED-Link DIR-300 rev A · D-Link DIR-615 rev D
- CVE-2013-10059D-Link Routers tools_vct.htm OS Command InjectionD-Link DIR-615H1
- CVE-2013-10046Agnitum Outpost Internet Security Local Privilege EscalationAgnitum Outpost Internet Security
- CVE-2025-54595Pearcleaner's unauthenticated access to privileged XPC helper allows root command executionalienator88 Pearcleaner
- CVE-2025-54593FreshRSS is vulnerable to RCE attacks by authenticated adminFreshRSS
- CVE-2025-2824IBM Operational Decision Manager HTTP open redirectIBM Operational Decision Manager
- CVE-2025-5999Vault Root Namespace Operator May Elevate Token PrivilegesHashiCorp Vault · github.com/hashicorp/vault
- CVE-2025-8477Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityAlpine iLX-507
- CVE-2025-8480Alpine iLX-507 Command Injection Remote Code ExecutionAlpine iLX-507
- CVE-2025-8476Alpine iLX-507 TIDAL Improper Certificate Validation VulnerabilityAlpine iLX-507
- CVE-2025-8475Alpine iLX-507 AVRCP Stack-based Buffer Overflow Remote Code Execution VulnerabilityAlpine iLX-507
- CVE-2025-8472Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityAlpine iLX-507
- CVE-2023-32256Kernel: ksmbd race issue from smb2 close and logoff with multichannellinux · Red Hat Enterprise Linux
- CVE-2025-41374SQL injection vulnerability in Gandia Integra TotalTESI Gandia Integra Total
- CVE-2025-41373SQL injection vulnerability in Gandia Integra TotalTESI Gandia Integra Total
- CVE-2025-41372SQL injection vulnerability in Gandia Integra TotalTESI Gandia Integra Total
- CVE-2025-7443BerqWP <= 2.2.42 - Unauthenticated Arbitrary File UploadBerqWP – Automated All-In-One Page Speed Optimization for C…
- CVE-2025-7725Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scriptingcontest-gallery Contest Gallery – Upload & Vote Photos, Med…
- CVE-2025-44139Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zip
- CVE-2025-45767jose v6.0.10 was discovered to contain weak encryption.
- CVE-2025-51504Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.microweber/microweber
- CVE-2025-52327SQL Injection vulnerability in Restaurant Order System 1.0 allows a local attacker to obtain sensitive information via the payment.php file
- CVE-2025-52361Insecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0.16 Build 2023-03-13 allows a locally authent
- CVE-2025-54564uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution
Medium, low and unrated 53
- CVE-2025-54781Himmelblau leaks an Intune service access token in its logshimmelblau-idm himmelblau
- CVE-2025-54789Files is Vulnerable to Reflected Self-XSS through its File Move Functionalityhumhub cfiles
- CVE-2025-54133Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialogcursor
- CVE-2025-54132Cursor's Mermaid Diagram Tool is Vulnerable to an Arbitrary Image Fetchcursor
- CVE-2025-54131Cursor bypasses its allow list to execute arbitrary commandscursor
- CVE-2024-13978LibTIFF fax2ps tiff2pdf.c t2p_read_tiff_init null pointer dereferenceLibTIFF
- CVE-2013-10063Netgear SPH200D <= 1.0.4.80 Path Traversal via HTTP GETNetgear SPH200D
- CVE-2013-10062Linksys Routers apply.cgi Path TraversalLinksys E1500
- CVE-2025-6015Vault Login MFA Bypass of Rate Limiting and TOTP Code ReuseHashiCorp Vault · github.com/hashicorp/vault
- CVE-2025-54590webfinger.js is vulnerable to Blind SSRF attacks through localhostsilverbucket webfinger.js · webfinger.js
- CVE-2025-53012MaterialX's Lack of Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack ExhaustionAcademySoftwareFoundation MaterialX · materialx
- CVE-2025-6011Timing Side-Channel in Vault’s Userpass Auth MethodHashiCorp Vault · github.com/hashicorp/vault
- CVE-2025-53011MaterialX is Vulnerable to NULL Pointer Dereference due to Unchecked implGraphOutputAcademySoftwareFoundation MaterialX · materialx
- CVE-2025-53010MaterialX's unchecked nodeGraph->getOutput return is vulnerable to NULL Pointer DereferenceAcademySoftwareFoundation MaterialX · materialx
- CVE-2025-53009MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion LimitAcademySoftwareFoundation MaterialX · materialx
- CVE-2025-49832Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocationasterisk
- CVE-2025-6004Vault Userpass and LDAP User Lockout BypassHashiCorp Vault · github.com/hashicorp/vault
- CVE-2025-6037Vault Certificate Auth Method Did Not Validate Common Name For Non-CA CertificatesHashiCorp Vault · github.com/hashicorp/vault
- CVE-2025-6014Vault TOTP Secrets Engine Code ReuseHashiCorp Vault · github.com/hashicorp/vault
- CVE-2025-8474Alpine iLX-507 CarPlay Stack-based Buffer Overflow Code Execution VulnerabilityAlpine iLX-507
- CVE-2025-8473Alpine iLX-507 UPDM_wstpCBCUpdStart Command Injection VulnerabilityAlpine iLX-507
- CVE-2025-33118IBM QRadar SIEM cross-site scriptingIBM QRadar SIEM
- CVE-2025-48074OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory ErrorsAcademySoftwareFoundation openexr · openexr
- CVE-2025-41376CRLF Injection in LimesurveyLimeSurvey
- CVE-2025-6228Sina Extension for Elementor <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` Widgetsshaonsina Sina Extension for Elementor
- CVE-2025-4684BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites <= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider WidgetsBlockSpare — News, Magazine and Blog Addons for (Gutenberg)…
- CVE-2025-6398A null pointer dereference vulnerability exists in the IOMap64.sys driver of ASUS AI Suite 3.ASUS AI Suite
- CVE-2025-8443code-projects Online Medicine Guide login.php sql injectioncode-projects Online Medicine Guide
- CVE-2025-8442code-projects Online Medicine Guide cussignup.php sql injectioncode-projects Online Medicine Guide
- CVE-2025-8441code-projects Online Medicine Guide pharsignup.php sql injectioncode-projects Online Medicine Guide
- CVE-2025-8439code-projects Wazifa System updatesettings.php sql injectioncode-projects Wazifa System
- CVE-2025-7646The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scriptingposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2025-8438code-projects Wazifa System postpublish.php sql injectioncode-projects Wazifa System
- CVE-2025-8437code-projects Kitchen Treasure userregistration.php sql injectioncode-projects Kitchen Treasure
- CVE-2025-5921SureForms < 1.7.2 - Reflected XSSSureForms
- CVE-2025-31716In bootloader, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2025-8436projectworlds Online Admission System viewdoc.php sql injectionprojectworlds Online Admission System
- CVE-2025-8435code-projects Online Movie Streaming admin-control.php authorizationcode-projects Online Movie Streaming
- CVE-2025-7845Stratum – Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgetsjetmonsters Stratum Widgets for Elementor
- CVE-2025-4523IDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Functionthemeatelier IDonate – Blood Donation, Request And Donor Ma…
- CVE-2025-8434code-projects Online Movie Streaming admin.php authorizationcode-projects Online Movie Streaming
- CVE-2025-8433code-projects Document Management System dell.php unlink path traversalcode-projects Document Management System
- CVE-2025-8431PHPGurukul Boat Booking System add-boat.php sql injectionPHPGurukul Boat Booking System
- CVE-2019-19145Quantum SuperLoader 3 V94.0 005E.0h devices allow attackers to access the hardcoded fa account because there are only 65536 possible passworQuantum SuperLoader
- CVE-2023-44976Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeHangzhou Shunwang Rentdrv2
- CVE-2025-45778A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scrip
- CVE-2025-46018CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorization by disabling Blu
- CVE-2025-50868A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0.
- CVE-2025-50869A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input
- CVE-2025-51501Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows executionmicroweber/microweber
- CVE-2025-51502Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScrimicroweber/microweber
- CVE-2025-53399In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackSipwise rtpengine
- CVE-2025-54939LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.litespeedtech LSQUIC