CVEs published August 4, 2025
85 CVEs were published on August 4, 2025: 16 critical, 26 high. 2 are now in CISA KEV.
- Published
- 85
- Critical
- 16
- High
- 26
- Medium
- 36
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 33
Most affected products
- Dell PowerProtect Data Domain Feature Release · Dell Pow… +1
- 5
- givanz Vvveb
- 5
- RUCKUS SmartZone
- 5
- Dell Unity
- 4
- Exrick xboot
- 4
- RUCKUS Network Director
- 3
- Airoha Technology AB156x, AB157x, AB158x, AB159x series, AB…
- 2
- Dassault Systèmes DELMIA Apriso
- 2
- LiquidFiles
- 2
- Airoha Technology AB156x, AB157x, AB158x, AB159x series
- 1
Critical 16
- CVE-2025-27212An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi AccesUbiquiti UniFi Access Reader Pro · Ubiquiti UniFi Access… +3
- CVE-2013-10054LibrettoCMS File Manager Arbitrary File UploadLibrettoCMS
- CVE-2025-34147Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via SSIDShenzhen Aitemi E Commerce Co. M300 Wi-Fi Repeater
- CVE-2025-36594Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2024 releasDell PowerProtect Data Domain Feature Release · Dell Pow… +1
- CVE-2025-6205Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025Dassault Systèmes DELMIA Apriso
- CVE-2025-44954RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account.RUCKUS SmartZone
- CVE-2025-44961In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated uRUCKUS SmartZone
- CVE-2025-44963RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain sRUCKUS Network Director
- CVE-2025-46093LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as LiquidFiles
- CVE-2025-50341A Boolean-based SQL injection vulnerability was discovered in Axelor 5.2.4 via the _domain parameter.
- CVE-2025-50754Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality.
- CVE-2025-51387The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses.
- CVE-2025-51390TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsCo
- CVE-2025-51535Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a SQL injection vulnerability.
- CVE-2025-51536Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.
- CVE-2025-52239An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.
High 26
- CVE-2025-27211An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with acUbiquiti EdgeMAX EdgeSwitch
- CVE-2025-26476Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability.Dell ECS · Dell ObjectScale
- CVE-2025-21120Dell Avamar, versions prior to 19.10 SP1 with patch 338904, contains a Trusting HTTP Permission Methods on the Server-Side vulnerability in Dell Avamar Server · Dell Avamar Virtual Edition
- CVE-2025-38741Dell Enterprise SONiC OS, version 4.5.0, contains a cryptographic key vulnerability in SSH.Dell Enterprise SONiC OS
- CVE-2013-10052ZPanel zsudo Local Privilege EscalationZPanel Project ZPanel
- CVE-2025-38739Dell Digital Delivery, versions prior to 5.6.1.0, contains an Insufficiently Protected Credentials vulnerability.Dell Digital Delivery
- CVE-2025-30099Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 releasDell PowerProtect Data Domain Feature Release · Dell Pow… +1
- CVE-2025-36607Dell Unity, version(s) 5.5 and prior, contain(s) an OS Command Injection Vulnerability in its svc_nas utility.Dell Unity
- CVE-2025-36606Dell Unity, version(s) 5.5 and prior, contain(s) an OS Command Injection Vulnerability in its svc_nfssupport utility.Dell Unity
- CVE-2025-36604Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionDell Unity
- CVE-2025-8109GPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operationImagination Technologies Graphics DDK
- CVE-2025-6204Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025Dassault Systèmes DELMIA Apriso
- CVE-2025-41691CODESYS Control DoS via Unauthenticated NULL Pointer DereferenceCODESYS Control RTE · CODESYS Control Win +12
- CVE-2025-41659CODESYS Control PKI Exposure Enables Remote Certificate AccessCODESYS Control RTE · CODESYS Control Win +13
- CVE-2025-20702In the Airoha Bluetooth audio SDK, there is a possible unauthorized access to the RACE protocol.Airoha Technology AB156x, AB157x, AB158x, AB159x series, AB…
- CVE-2025-20701In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent.Airoha Technology AB156x, AB157x, AB158x, AB159x series
- CVE-2025-20700In the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE protocol through BluetoothAiroha Technology AB156x, AB157x, AB158x, AB159x series, AB…
- CVE-2025-26065A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts o
- CVE-2025-44643Certain Draytek products are affected by Insecure Configuration.
- CVE-2025-44955RUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password.RUCKUS Network Director
- CVE-2025-44957Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers.RUCKUS SmartZone
- CVE-2025-44960RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route.RUCKUS SmartZone
- CVE-2025-51534A cross-site scripting (XSS) vulnerability in Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 allows attackers to execute arbitrary
- CVE-2025-51726CyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision att
- CVE-2025-53394Paramount Macrium Reflect through 2025-06-26 allows attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx
- CVE-2025-53395Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .m
Medium, low and unrated 43
- CVE-2025-8534libtiff tiff2ps tiff2ps.c PS_Lvl2page null pointer dereferencelibtiff
- CVE-2025-8530elunez eladmin Druid application-prod.yml default credentialselunez eladmin
- CVE-2025-8529cloudfavorites favorites-web CollectController.java getCollectLogoUrl server-side request forgerycloudfavorites favorites-web
- CVE-2025-4604The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19,Liferay Portal · Liferay DXP +1
- CVE-2025-8528Exrick xboot getMenuList sensitive information in a cookieExrick xboot
- CVE-2025-7844wolfTPM library wrapper function `wolfTPM2_RsaKey_TpmToWolf` copies external data to a fixed-size stack buffer without length validation potentially causing stack-based buffer overflowwolfSSL wolfTPM
- CVE-2025-8527Exrick xboot Swagger SecurityController.java server-side request forgeryExrick xboot
- CVE-2025-4599The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 throLiferay Portal · Liferay DXP
- CVE-2025-8526Exrick xboot UploadController.java upload unrestricted uploadExrick xboot
- CVE-2025-8525Exrick xboot Spring Boot Admin/Spring Actuator information disclosureExrick xboot
- CVE-2025-8524Boquan DotWallet App com.boquanhash.dotwallet AndroidManifest.xml improper export of android application componentsBoquan DotWallet App
- CVE-2025-8523RiderLike Fruit Crush-Brain App com.fruitcrush.fun AndroidManifest.xml improper export of android application componentsRiderLike Fruit Crush-Brain App
- CVE-2025-8522givanz Vvvebjs node.js save.php path traversalgivanz Vvvebjs
- CVE-2025-8521givanz Vvveb Add Type post-types cross site scriptinggivanz Vvveb
- CVE-2025-8520givanz Vvveb Drag-and-Drop Editor editor server-side request forgerygivanz Vvveb
- CVE-2025-8519givanz Vvveb Drag-and-Drop Editor editor information disclosuregivanz Vvveb
- CVE-2025-8518givanz Vvveb Code Editor code.php save code injectiongivanz Vvveb
- CVE-2025-8517givanz Vvveb session fixiationgivanz Vvveb
- CVE-2025-8516Kingdee Cloud-Starry-Sky Enterprise Edition IIS-K3CloudMiniApp FileUploadAction.class path traversalKingdee Cloud-Starry-Sky Enterprise Edition
- CVE-2025-5988Aap-gateway: csrf origin checking is disabledautomation-gateway-server · Red Hat Ansible Automation Plat…
- CVE-2025-30098Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 releasDell PowerProtect Data Domain Feature Release · Dell Pow… +1
- CVE-2025-30097Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 releasDell PowerProtect Data Domain Feature Release · Dell Pow… +1
- CVE-2025-30096Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 releasDell PowerProtect Data Domain Feature Release · Dell Pow… +1
- CVE-2025-36605Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulDell Unity
- CVE-2025-8515Intelbras InControl JSON Endpoint operador information disclosureIntelbras InControl
- CVE-2025-0932Mali GPU Userspace Driver allows access to already freed memoryArm Bifrost GPU Userspace Driver · Arm Valhall GPU Users… +1
- CVE-2025-8341SSRF in Infinity Datasource Plugingrafana-infinity-datasource · github.com/grafana/grafana-in…
- CVE-2025-41658CODESYS Toolkit Exposes Sensitive Files via Default PermissionsCODESYS Runtime Toolkit · CODESYS Control for BeagleBon… +10
- CVE-2025-48499Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs.FUJIFILM Business Innovation DocuPrint CP225 w · FUJIFI… +12
- CVE-2025-20698In Power HAL, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2718, MT6739, MT6761, MT6765, MT6768, MT6781, MT…
- CVE-2025-20697In Power HAL, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2718, MT6761, MT6765, MT6768, MT6853, MT6855, MT…
- CVE-2025-20696In DA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT…
- CVE-2024-45183An issue was discovered in Samsung Mobile Processor Exynos 2100, 1280, 2200, 1330, 1380, 1480, and 2400.
- CVE-2025-44958RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format.RUCKUS Network Director
- CVE-2025-44962RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files.RUCKUS SmartZone
- CVE-2025-46094LiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as an Actionscript.LiquidFiles
- CVE-2025-46206An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clea
- CVE-2025-50340An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail thru 5.6.0, allowing an authenticated user to send e
- CVE-2025-50420An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted
- CVE-2025-50422Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_finicairographics Cairo
- CVE-2025-54554tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the undeTera Insights tiCrypt
- CVE-2025-54962/edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files (such as .html or .svg), athiagoralves OpenPLC_v3
- CVE-2025-55014The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the dStarDict