# CVEs published 2025-08-01

110 CVEs were published on August 1, 2025: 23 critical, 34 high. Days are UTC.

- [CVE-2025-54796](https://cve.now/CVE-2025-54796.md): Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page (CVSS 7.5, 9001 copyparty · copyparty)
- [CVE-2025-54790](https://cve.now/CVE-2025-54790.md): Files: Potential for SQL Injection through File Browse and List Operations (CVSS 9.2, humhub cfiles)
- [CVE-2025-54782](https://cve.now/CVE-2025-54782.md): @nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers (CVSS 9.4, nestjs nest · @nestjs/devtools-integration)
- [CVE-2025-54781](https://cve.now/CVE-2025-54781.md): Himmelblau leaks an Intune service access token in its logs (CVSS 2.8, himmelblau-idm himmelblau)
- [CVE-2025-54386](https://cve.now/CVE-2025-54386.md): Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution (CVSS 7.3, traefik · github.com/traefik/traefik +2)
- [CVE-2025-54789](https://cve.now/CVE-2025-54789.md): Files is Vulnerable to Reflected Self-XSS through its File Move Functionality (CVSS 5.1, humhub cfiles)
- [CVE-2025-54136](https://cve.now/CVE-2025-54136.md): Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals (CVSS 7.2, cursor)
- [CVE-2025-54133](https://cve.now/CVE-2025-54133.md): Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog (CVSS 5.3, cursor)
- [CVE-2025-54132](https://cve.now/CVE-2025-54132.md): Cursor's Mermaid Diagram Tool is Vulnerable to an Arbitrary Image Fetch (CVSS 4.4, cursor)
- [CVE-2025-54131](https://cve.now/CVE-2025-54131.md): Cursor bypasses its allow list to execute arbitrary commands (CVSS 6.4, cursor)
- [CVE-2025-54424](https://cve.now/CVE-2025-54424.md): 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution (CVSS 8.1, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel/core)
- [CVE-2025-54792](https://cve.now/CVE-2025-54792.md): LocalSend is Vulnerable to Man-in-the-Middle Attacks, Leading to File Interception (CVSS 9.3, localsend)
- [CVE-2024-13978](https://cve.now/CVE-2024-13978.md): LibTIFF fax2ps tiff2pdf.c t2p\_read\_tiff\_init null pointer dereference (CVSS 2.0, LibTIFF)
- [CVE-2013-10053](https://cve.now/CVE-2013-10053.md): ZPanel \<= 10.0.0.2 htpasswd Module Username Command Execution (CVSS 8.7, ZPanel Project ZPanel)
- [CVE-2013-10057](https://cve.now/CVE-2013-10057.md): Synactis PDF In-The-Box ConnectToSynactic Stack-Based Buffer Overflow (CVSS 7.5, Synactis PDF In-The-Box)
- [CVE-2013-10049](https://cve.now/CVE-2013-10049.md): Raidsonic NAS Devices Unauthenticated Remote Command Execution (CVSS 9.3, Raidsonic Technology IB-NAS5220 · Raidsonic Technology IB-N…)
- [CVE-2013-10044](https://cve.now/CVE-2013-10044.md): OpenEMR ≤ 4.1.1 SQL Injection Privilege Escalation and RCE (CVSS 8.7, OpenEMR Foundation OpenEMR)
- [CVE-2013-10063](https://cve.now/CVE-2013-10063.md): Netgear SPH200D \<= 1.0.4.80 Path Traversal via HTTP GET (CVSS 6.9, Netgear SPH200D)
- [CVE-2013-10060](https://cve.now/CVE-2013-10060.md): Netgear Routers pppoe.cgi RCE (CVSS 9.4, Netgear DGN2200B)
- [CVE-2013-10061](https://cve.now/CVE-2013-10061.md): Netgear Routers setup.cgi RCE (CVSS 8.6, Netgear DGN1000B)
- [CVE-2013-10047](https://cve.now/CVE-2013-10047.md): MiniWeb \<= Build 300 Arbitrary File Upload (CVSS 9.3, MiniWeb)
- [CVE-2013-10058](https://cve.now/CVE-2013-10058.md): Linksys Routers apply.cgi Remote Command Injection (CVSS 8.6, Linksys WRT160nv2)
- [CVE-2013-10062](https://cve.now/CVE-2013-10062.md): Linksys Routers apply.cgi Path Traversal (CVSS 6.9, Linksys E1500)
- [CVE-2012-10022](https://cve.now/CVE-2012-10022.md): Kloxo \<= 6.1.12 Local Privilege Escalation (CVSS 8.5, LxCenter Kloxo)
- [CVE-2013-10051](https://cve.now/CVE-2013-10051.md): InstantCMS \<= 1.6 Remote PHP Code Execution (CVSS 9.3, InstantCMS)
- [CVE-2013-10055](https://cve.now/CVE-2013-10055.md): Havalite CMS Arbitary File Upload RCE (CVSS 9.3, Havalite CMS)
- [CVE-2013-10048](https://cve.now/CVE-2013-10048.md): D-Link Devices command.php Unauthenticated RCE (CVSS 9.3, D-Link DIR-600 · D-Link DIR-300)
- [CVE-2013-10050](https://cve.now/CVE-2013-10050.md): D-Link Devices tools\_vct.xgi Authenticated RCE (CVSS 8.7, D-Link DIR-300 rev A · D-Link DIR-615 rev D)
- [CVE-2013-10059](https://cve.now/CVE-2013-10059.md): D-Link Routers tools\_vct.htm OS Command Injection (CVSS 8.6, D-Link DIR-615H1)
- [CVE-2013-10046](https://cve.now/CVE-2013-10046.md): Agnitum Outpost Internet Security Local Privilege Escalation (CVSS 8.5, Agnitum Outpost Internet Security)
- [CVE-2025-54595](https://cve.now/CVE-2025-54595.md): Pearcleaner's unauthenticated access to privileged XPC helper allows root command execution (CVSS 7.3, alienator88 Pearcleaner)
- [CVE-2025-54593](https://cve.now/CVE-2025-54593.md): FreshRSS is vulnerable to RCE attacks by authenticated admin (CVSS 7.2, FreshRSS)
- [CVE-2025-6015](https://cve.now/CVE-2025-6015.md): Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse (CVSS 5.7, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2025-54590](https://cve.now/CVE-2025-54590.md): webfinger.js is vulnerable to Blind SSRF attacks through localhost (CVSS 6.9, silverbucket webfinger.js · webfinger.js)
- [CVE-2025-54574](https://cve.now/CVE-2025-54574.md): Squid's URN Handling can lead to Buffer Overflow (CVSS 9.3, squid-cache squid)
- [CVE-2025-53012](https://cve.now/CVE-2025-53012.md): MaterialX's Lack of Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion (CVSS 5.5, AcademySoftwareFoundation MaterialX · materialx)
- [CVE-2025-6011](https://cve.now/CVE-2025-6011.md): Timing Side-Channel in Vault’s Userpass Auth Method (CVSS 3.7, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2025-53011](https://cve.now/CVE-2025-53011.md): MaterialX is Vulnerable to NULL Pointer Dereference due to Unchecked implGraphOutput (CVSS 2.0, AcademySoftwareFoundation MaterialX · materialx)
- [CVE-2025-53010](https://cve.now/CVE-2025-53010.md): MaterialX's unchecked nodeGraph-\>getOutput return is vulnerable to NULL Pointer Dereference (CVSS 2.0, AcademySoftwareFoundation MaterialX · materialx)
- [CVE-2025-53009](https://cve.now/CVE-2025-53009.md): MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit (CVSS 5.5, AcademySoftwareFoundation MaterialX · materialx)
- [CVE-2025-49832](https://cve.now/CVE-2025-49832.md): Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation (CVSS 6.5, asterisk)
- [CVE-2025-6004](https://cve.now/CVE-2025-6004.md): Vault Userpass and LDAP User Lockout Bypass (CVSS 5.3, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2025-6037](https://cve.now/CVE-2025-6037.md): Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates (CVSS 6.8, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2025-6014](https://cve.now/CVE-2025-6014.md): Vault TOTP Secrets Engine Code Reuse (CVSS 6.5, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2025-2824](https://cve.now/CVE-2025-2824.md): IBM Operational Decision Manager HTTP open redirect (CVSS 7.4, IBM Operational Decision Manager)
- [CVE-2025-6000](https://cve.now/CVE-2025-6000.md): Arbitrary Remote Code Execution via Plugin Catalog Abuse (CVSS 9.1, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2025-5999](https://cve.now/CVE-2025-5999.md): Vault Root Namespace Operator May Elevate Token Privileges (CVSS 7.2, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2025-8477](https://cve.now/CVE-2025-8477.md): Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.4, Alpine iLX-507)
- [CVE-2025-8480](https://cve.now/CVE-2025-8480.md): Alpine iLX-507 Command Injection Remote Code Execution (CVSS 8.0, Alpine iLX-507)
- [CVE-2025-8476](https://cve.now/CVE-2025-8476.md): Alpine iLX-507 TIDAL Improper Certificate Validation Vulnerability (CVSS 7.1, Alpine iLX-507)
- [CVE-2025-8475](https://cve.now/CVE-2025-8475.md): Alpine iLX-507 AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.4, Alpine iLX-507)
- [CVE-2025-8474](https://cve.now/CVE-2025-8474.md): Alpine iLX-507 CarPlay Stack-based Buffer Overflow Code Execution Vulnerability (CVSS 6.8, Alpine iLX-507)
- [CVE-2025-8473](https://cve.now/CVE-2025-8473.md): Alpine iLX-507 UPDM\_wstpCBCUpdStart Command Injection Vulnerability (CVSS 6.4, Alpine iLX-507)
- [CVE-2025-8472](https://cve.now/CVE-2025-8472.md): Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.4, Alpine iLX-507)
- [CVE-2023-32256](https://cve.now/CVE-2023-32256.md): Kernel: ksmbd race issue from smb2 close and logoff with multichannel (CVSS 7.5, linux · Red Hat Enterprise Linux)
- [CVE-2025-33118](https://cve.now/CVE-2025-33118.md): IBM QRadar SIEM cross-site scripting (CVSS 6.4, IBM QRadar SIEM)
- [CVE-2025-48074](https://cve.now/CVE-2025-48074.md): OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory Errors (CVSS 4.6, AcademySoftwareFoundation openexr · openexr)
- [CVE-2025-41376](https://cve.now/CVE-2025-41376.md): CRLF Injection in Limesurvey (CVSS 5.1, LimeSurvey)
- [CVE-2025-41375](https://cve.now/CVE-2025-41375.md): SQL Injection in Limesurvey (CVSS 9.3, LimeSurvey)
- [CVE-2025-41374](https://cve.now/CVE-2025-41374.md): SQL injection vulnerability in Gandia Integra Total (CVSS 8.7, TESI Gandia Integra Total)
- [CVE-2025-41373](https://cve.now/CVE-2025-41373.md): SQL injection vulnerability in Gandia Integra Total (CVSS 8.7, TESI Gandia Integra Total)
- [CVE-2025-41372](https://cve.now/CVE-2025-41372.md): SQL injection vulnerability in Gandia Integra Total (CVSS 8.7, TESI Gandia Integra Total)
- [CVE-2025-41371](https://cve.now/CVE-2025-41371.md): SQL injection vulnerability in Gandia Integra Total (CVSS 9.3, TESI Gandia Integra Total)
- [CVE-2025-41370](https://cve.now/CVE-2025-41370.md): SQL injection vulnerability in Gandia Integra Total (CVSS 9.3, TESI Gandia Integra Total)
- [CVE-2025-6228](https://cve.now/CVE-2025-6228.md): Sina Extension for Elementor \<= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via \`Sina Posts\`, \`Sina Blog Post\` and \`Sina Table\` Widgets (CVSS 6.4, shaonsina Sina Extension for Elementor)
- [CVE-2025-4684](https://cve.now/CVE-2025-4684.md): BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites \<= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets (CVSS 6.4, BlockSpare — News, Magazine and Blog Addons for (Gutenberg)…)
- [CVE-2025-6398](https://cve.now/CVE-2025-6398.md): A null pointer dereference vulnerability exists in the IOMap64.sys driver of ASUS AI Suite 3. (CVSS 6.7, ASUS AI Suite)
- [CVE-2025-8443](https://cve.now/CVE-2025-8443.md): code-projects Online Medicine Guide login.php sql injection (CVSS 6.9, code-projects Online Medicine Guide)
- [CVE-2025-8442](https://cve.now/CVE-2025-8442.md): code-projects Online Medicine Guide cussignup.php sql injection (CVSS 6.9, code-projects Online Medicine Guide)
- [CVE-2025-8441](https://cve.now/CVE-2025-8441.md): code-projects Online Medicine Guide pharsignup.php sql injection (CVSS 6.9, code-projects Online Medicine Guide)
- [CVE-2025-8439](https://cve.now/CVE-2025-8439.md): code-projects Wazifa System updatesettings.php sql injection (CVSS 6.9, code-projects Wazifa System)
- [CVE-2025-7646](https://cve.now/CVE-2025-7646.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2025-8438](https://cve.now/CVE-2025-8438.md): code-projects Wazifa System postpublish.php sql injection (CVSS 6.9, code-projects Wazifa System)
- [CVE-2025-8437](https://cve.now/CVE-2025-8437.md): code-projects Kitchen Treasure userregistration.php sql injection (CVSS 6.9, code-projects Kitchen Treasure)
- [CVE-2025-5921](https://cve.now/CVE-2025-5921.md): SureForms \< 1.7.2 - Reflected XSS (CVSS 5.8, SureForms)
- [CVE-2025-31716](https://cve.now/CVE-2025-31716.md): In bootloader, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.1, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2025-8454](https://cve.now/CVE-2025-8454.md): It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of sc (CVSS 9.8, Debian devscripts)
- [CVE-2025-8436](https://cve.now/CVE-2025-8436.md): projectworlds Online Admission System viewdoc.php sql injection (CVSS 6.9, projectworlds Online Admission System)
- [CVE-2025-8435](https://cve.now/CVE-2025-8435.md): code-projects Online Movie Streaming admin-control.php authorization (CVSS 6.9, code-projects Online Movie Streaming)
- [CVE-2025-7845](https://cve.now/CVE-2025-7845.md): Stratum – Elementor Widgets \<= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets (CVSS 6.4, jetmonsters Stratum Widgets for Elementor)
- [CVE-2025-4523](https://cve.now/CVE-2025-4523.md): IDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin\_donor\_profile\_view Function (CVSS 6.5, themeatelier IDonate – Blood Donation, Request And Donor Ma…)
- [CVE-2025-7443](https://cve.now/CVE-2025-7443.md): BerqWP \<= 2.2.42 - Unauthenticated Arbitrary File Upload (CVSS 8.1, BerqWP – Automated All-In-One Page Speed Optimization for C…)
- [CVE-2025-7725](https://cve.now/CVE-2025-7725.md): Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI \<= 26.1.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, contest-gallery Contest Gallery – Upload & Vote Photos, Med…)
- [CVE-2025-8434](https://cve.now/CVE-2025-8434.md): code-projects Online Movie Streaming admin.php authorization (CVSS 6.9, code-projects Online Movie Streaming)
- [CVE-2025-5947](https://cve.now/CVE-2025-5947.md): Service Finder Bookings \<= 6.0 - Authentication Bypass via User Switch Cookie (CVSS 9.8, aonetheme Service Finder Bookings)
- [CVE-2025-8433](https://cve.now/CVE-2025-8433.md): code-projects Document Management System dell.php unlink path traversal (CVSS 5.3, code-projects Document Management System)
- [CVE-2025-5954](https://cve.now/CVE-2025-5954.md): Service Finder SMS System \<= 2.0.0 - Unauthenticated Privilege Escalation (CVSS 9.8, aonetheme Service Finder SMS System)
- [CVE-2025-8431](https://cve.now/CVE-2025-8431.md): PHPGurukul Boat Booking System add-boat.php sql injection (CVSS 6.9, PHPGurukul Boat Booking System)
- [CVE-2019-19144](https://cve.now/CVE-2019-19144.md): XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via rest/Users?action=authenticate. (CVSS 9.8)
- [CVE-2019-19145](https://cve.now/CVE-2019-19145.md): Quantum SuperLoader 3 V94.0 005E.0h devices allow attackers to access the hardcoded fa account because there are only 65536 possible passwor (CVSS 5.8, Quantum SuperLoader)
- [CVE-2023-44976](https://cve.now/CVE-2023-44976.md): Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via De (CVSS 3.2, Hangzhou Shunwang Rentdrv2)
- [CVE-2025-44139](https://cve.now/CVE-2025-44139.md): Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload\_zip (CVSS 7.2)
- [CVE-2025-45150](https://cve.now/CVE-2025-45150.md): Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying (CVSS 9.8)
- [CVE-2025-45767](https://cve.now/CVE-2025-45767.md): jose v6.0.10 was discovered to contain weak encryption. (CVSS 7.0)
- [CVE-2025-45778](https://cve.now/CVE-2025-45778.md): A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scrip (CVSS 6.1)
- [CVE-2025-46018](https://cve.now/CVE-2025-46018.md): CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorization by disabling Blu (CVSS 5.4)
- [CVE-2025-50460](https://cve.now/CVE-2025-50460.md): A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using (CVSS 9.8, ms-swift)
- [CVE-2025-50472](https://cve.now/CVE-2025-50472.md): The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the \`l (CVSS 9.8)
- [CVE-2025-50868](https://cve.now/CVE-2025-50868.md): A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. (CVSS 6.5)
- [CVE-2025-50869](https://cve.now/CVE-2025-50869.md): A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input (CVSS 6.1)
- [CVE-2025-50870](https://cve.now/CVE-2025-50870.md): Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. (CVSS 9.8)
- [CVE-2025-51501](https://cve.now/CVE-2025-51501.md): Reflected Cross-Site Scripting (XSS) in the id parameter of the live\_edit.module\_settings API endpoint in Microweber CMS2.0 allows execution (CVSS 6.1, microweber/microweber)
- [CVE-2025-51502](https://cve.now/CVE-2025-51502.md): Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScri (CVSS 6.1, microweber/microweber)
- [CVE-2025-51504](https://cve.now/CVE-2025-51504.md): Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field. (CVSS 7.6, microweber/microweber)
- [CVE-2025-52327](https://cve.now/CVE-2025-52327.md): SQL Injection vulnerability in Restaurant Order System 1.0 allows a local attacker to obtain sensitive information via the payment.php file (CVSS 7.8)
- [CVE-2025-52361](https://cve.now/CVE-2025-52361.md): Insecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0.16 Build 2023-03-13 allows a locally authent (CVSS 7.8)
- [CVE-2025-52390](https://cve.now/CVE-2025-52390.md): Saurus CMS Community Edition since commit d886e5b0 (2010-04-23) is vulnerable to a SQL Injection vulnerability in the \`prepareSearchQuery()\` (CVSS 9.1)
- [CVE-2025-53399](https://cve.now/CVE-2025-53399.md): In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attack (CVSS 6.9, Sipwise rtpengine)
- [CVE-2025-54564](https://cve.now/CVE-2025-54564.md): uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution (CVSS 7.8)
- [CVE-2025-54939](https://cve.now/CVE-2025-54939.md): LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic\_engine\_packet\_in memory leak. (CVSS 5.3, litespeedtech LSQUIC)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.