CVEs published August 5, 2025
120 CVEs were published on August 5, 2025: 26 critical, 36 high. 2 are now in CISA KEV.
- Published
- 120
- Critical
- 26
- High
- 36
- Medium
- 55
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 49
Most affected products
- atjiu pybbs
- 10
- Portabilis i-Educar
- 8
- Adobe Experience Manager
- 3
- libav
- 3
- Rockwell Automation Arena® Simulation
- 3
- anthropics claude-code · @anthropic-ai/claude-code
- 2
- Concrete CMS · concrete5/concrete5
- 2
- cursor
- 2
- DavidOsipov Vision-ui
- 2
- Draeger ICMHelper
- 2
Critical 26
- CVE-2025-54883Vision UI's security-kit Contains Cryptographic WeaknessDavidOsipov Vision-ui
- CVE-2025-54594react-native-bottom-tabs: Arbitrary code execution in GitHub Actions canary workflow leads to secret exfiltrationcallstackincubator react-native-bottom-tabs
- CVE-2012-10027WordPress Plugin WP-Property <= 1.35.0 PHP File UploadWP-Property WordPress Plugin
- CVE-2012-10026WordPress Plugin Asset-Manager <= 2.0 PHP File Uploadjkriddle asset-manager
- CVE-2012-10025WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File InclusionAdvanced Custom Fields WordPress Plugin
- CVE-2012-10035Turbo FTP Server 1.30.823/826 PORT Command Buffer OverflowTurboSoft TurboFTP Server
- CVE-2013-10070PHP-Charts v1.0 PHP Code ExecutionPHP-Charts
- CVE-2012-10033Narcissus backend.php Image Configuration Command InjectionÅngström Distribution Project Narcissus
- CVE-2013-10066Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File UploadKordil EDMS
- CVE-2013-10067Glossword 1.8.8 - 1.8.12 Arbitrary File Upload RCEGlossword Team Glossword
- CVE-2012-10030FreeFloat FTP Server Arbitrary File UploadFreeFloat FTP Server
- CVE-2013-10068Foxit Reader <= 5.4.5.0114 Plugin URL Processing Buffer OverflowFoxit Reader
- CVE-2013-10069D-Link Devices Unauthenticated RCED-Link DIR-600 rev B · D-Link DIR-300 rev B
- CVE-2013-10064ActFax 5.01 RAW Server Buffer OverflowActFax Communication ActFax Server
- CVE-2014-125113Dell/Quest KACE K1000 Unauthenticated File Upload RCEDell/Quest KACE K1000 Systems Management Appliance
- CVE-2025-54253Adobe Experience Manager | Incorrect Authorization (CWE-863)Adobe Experience Manager
- CVE-2025-2611ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCEICT Innovations ICTBroadcast
- CVE-2025-54987A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious Trend Micro Apex One
- CVE-2025-54948A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious Trend Micro Apex One
- CVE-2025-54982SAML 2.0 Public Key Validation IssueZscaler Authentication Server
- CVE-2025-53417File Parsing Deserialization of Untrusted Data in DTM SoftDelta Electronics DIAView
- CVE-2025-54119ADOdb's sqlite3 driver allows SQL injectionADOdb · adodb/adodb-php
- CVE-2025-54802pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)pyload · pyload-ng
- CVE-2025-46658An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6.
- CVE-2025-50706An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck functiontopthink/framework
- CVE-2025-50707An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component
High 36
- CVE-2025-54872onion-site-template tor Secrets Baked Into ImageVessel9817 onion-site-template
- CVE-2025-54884Vision UI security-kit.js: Potential Uncontrolled Resource Allocation VulnerabilityDavidOsipov Vision-ui
- CVE-2025-54801Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decodergofiber fiber · github.com/gofiber/fiber/v2
- CVE-2025-54125XWiki Platform: Password and email exposure in xml.vm fieldsxwiki-platform · org.xwiki.platform:xwiki-platform-oldco… +1
- CVE-2025-54124XWiki Platform: Any user with editing rights can access password properties through Database List Propertiesxwiki-platform · org.xwiki.platform:xwiki-platform-oldco… +1
- CVE-2025-53534RatPanel can perform remote command execution without authorizationtnb-labs panel · github.com/tnborg/panel +3
- CVE-2012-10024XBMC ≤ 11.0 Web Server Path TraversalXBMC Media Center
- CVE-2013-10065Sysax Multi-Server <= 6.10 SSHD Key Exchange DoSSysax Software Multi-Server
- CVE-2012-10028Netwin SurgeFTP <= v23c8 Authenticated RCENetwin SurgeFTP
- CVE-2012-10029Nagios XI Network Monitor Graph Explorer Component < 1.3 Authenticated Command InjectionNagios Enterprises Nagios XI Graph Explorer
- CVE-2012-10032Maxthon3 about:history XCS Trusted Zone Code ExecutionMaxthon International Maxthon3 Browser
- CVE-2012-10034ClanSphere 2011.3 Local File Inclusion via cs_lang CookieClanSphere Project ClanSphere
- CVE-2012-10031BlazeVideo HDTV Player Pro 6.6.0.3 Filename Handling Buffer OverflowBlazeVideo HDTV Player Pro
- CVE-2025-54254Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)Adobe Experience Manager
- CVE-2025-7674navify Monitoring API input validationRoche Diagnostics navify Monitoring
- CVE-2025-7033Rockwell Automation Heap-based Buffer Overflow In Arena® SimulationRockwell Automation Arena® Simulation
- CVE-2025-7032Rockwell Automation Stack-based Buffer Overflow In Arena® SimulationRockwell Automation Arena® Simulation
- CVE-2025-7025Rockwell Automation Heap-based Buffer Overflow In Arena® SimulationRockwell Automation Arena® Simulation
- CVE-2025-41698Draeger: ICMHelper is vulnerable to a privilege escalation due too missing authorizationDraeger ICMHelper
- CVE-2025-5061WP Import Export Lite <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Uploadvjinfotech WP Import Export Lite
- CVE-2025-6207WP Import Export Lite <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Uploadvjinfotech WP Import Export Lite
- CVE-2025-7050Use-your-Drive | Google Drive plugin for WordPress <= 3.3.1- Unauthenticated Stored Cross-Site Scripting via File MetadataWP Cloud Plugins/_deleeuw_ Use-your-Drive | Google Drive pl…
- CVE-2025-54868LibreChat exposes arbitrary chats through Meilisearch enginedanny-avila LibreChat
- CVE-2025-53544Trilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed RetrievalTriliumNext Trilium
- CVE-2025-54130Cursor Agent is vulnerable prompt injection via Editor Special Filescursor
- CVE-2025-54135Cursor Agent is vulnerable to prompt injection via MCP Special Filescursor
- CVE-2025-54780glpi-screenshot-plugin exposes local files in /ajax/screenshot.phpcconard96 glpi-screenshot-plugin
- CVE-2025-54794Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file accessanthropics claude-code · @anthropic-ai/claude-code
- CVE-2025-54795Claude Code echo command allowed bypass of user approval prompt for command executionanthropics claude-code · @anthropic-ai/claude-code
- CVE-2025-54803js-toml is vulnerable to Prototype Pollutionsunnyadn js-toml · js-toml
- CVE-2025-54865Tilesheets MediaWiki Extension is Vulnerable to Potential SQL InjectionFTB-Gamepedia Tilesheets
- CVE-2025-54870VTun-ng's failure to initialize encryption modules may cause reversion to plaintextleakingmemory vtun-ng
- CVE-2025-29745A vulnerability affecting the scanning module in Emsisoft Anti-Malware prior to 2024.12 allows attackers on a remote server to obtain Net-NT
- CVE-2025-43978Jointelli 5G CPE 21H01 firmware JY_21H01_A3_v1.36 devices allow (blind) OS command injection.
- CVE-2025-43979An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN that allows authenticated attackers to execute arbitrary OS system co
- CVE-2025-51628Insecure Direct Object Reference (IDOR) vulnerability in PdfHandler component in Agenzia Impresa Eccobook v2.81.1 and below allows unauthent
Medium, low and unrated 58
- CVE-2025-54879Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emailsmastodon
- CVE-2025-54571ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosureowasp-modsecurity ModSecurity
- CVE-2025-54876Jans CLI stores plaintext passwords in the local cli_cmd.log fileJanssenProject jans
- CVE-2025-54873RISC Zero Underconstrained Vulnerability: Divisionrisc0 · risc0-zkvm +2
- CVE-2025-54869FPDI is Vulnerable to Memory Exhaustion (OOM) through its PDF ParserSetasign FPDI · setasign/fpdi
- CVE-2025-32430XWiki Platform contains Reflected XSS vulnerability in two templatesxwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…
- CVE-2025-8571Concrete CMS 9 through 9.4.2 and below 8.5.21 is vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard PageConcrete CMS · concrete5/concrete5
- CVE-2025-8573Concrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard pageConcrete CMS · concrete5/concrete5
- CVE-2012-10023FreeFloat FTP Server USER Command Buffer OverflowFreeFloat FTP Server
- CVE-2025-8586libav MPEG File Parser utils.c ff_seek_frame_binary null pointer dereferencelibav
- CVE-2025-8585libav DSS File Demuxer avconv.c main double freelibav
- CVE-2025-8584libav AVI File Parser buffer.c av_buffer_unref null pointer dereferencelibav
- CVE-2025-27931An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Editor version 10.5.2.395.PDF-XChange Co. PDF-XChange Editor
- CVE-2025-47152An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Co.PDF-XChange Co. PDF-XChange Editor
- CVE-2025-54874OpenJPEG allows OOB heap memory write in opj_jp2_read_headeruclouvain openjpeg
- CVE-2025-46958Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-52890IBM Engineering Lifecycle Optimization - Publishing cross-site scriptingIBM Engineering Lifecycle Optimization - Publishing
- CVE-2025-8555atjiu pybbs search cross site scriptingatjiu pybbs
- CVE-2025-8554atjiu pybbs list cross site scriptingatjiu pybbs
- CVE-2025-8553atjiu pybbs list cross site scriptingatjiu pybbs
- CVE-2025-2810Draeger: ICMHelper is vulnerable to use of Hard-coded Cryptographic KeyDraeger ICMHelper
- CVE-2025-8552atjiu pybbs list cross site scriptingatjiu pybbs
- CVE-2025-8551atjiu pybbs list cross site scriptingatjiu pybbs
- CVE-2025-8294Download Counter <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameteranatolyk Download Counter
- CVE-2025-8295Employee Directory <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameteremarket-design Employee Directory – Staff & Team Directory
- CVE-2025-8550atjiu pybbs list cross site scriptingatjiu pybbs
- CVE-2025-8313Campus Directory <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameteremarket-design Campus Directory – Faculty, Staff & Student…
- CVE-2025-8315WP Easy Contact <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameteremarket-design Simple Contact Form Plugin for WordPress – W…
- CVE-2025-8549atjiu pybbs UserAdminController.java update weak passwordatjiu pybbs
- CVE-2025-8548atjiu pybbs Registered Email SettingsApiController.java sendEmailCode information exposureatjiu pybbs
- CVE-2025-8547atjiu pybbs Email Verification improper authorizationatjiu pybbs
- CVE-2025-8546atjiu pybbs Verification Code login Captchaatjiu pybbs
- CVE-2025-8545Portabilis i-Educar educar_motivo_afastamento_cad.php cross site scriptingPortabilis i-Educar
- CVE-2025-8544Portabilis i-Educar edit cross site scriptingPortabilis i-Educar
- CVE-2025-8543Portabilis i-Educar educar_raca_cad.php cross site scriptingPortabilis i-Educar
- CVE-2025-8542Portabilis i-Educar empresas_cad.php cross site scriptingPortabilis i-Educar
- CVE-2025-8541Portabilis i-Educar public_uf_cad.php cross site scriptingPortabilis i-Educar
- CVE-2025-8540Portabilis i-Educar public_municipio_cad.php cross site scriptingPortabilis i-Educar
- CVE-2025-8539Portabilis i-Educar public_distrito_cad.php cross site scriptingPortabilis i-Educar
- CVE-2025-8538Portabilis i-Educar novo cross site scriptingPortabilis i-Educar
- CVE-2025-8537Axiomatic Bento4 mp4decrypt Mp4Decrypt.cpp SetDataSize allocation of resourcesAxiomatic Bento4
- CVE-2025-52892EspoCRM is vulnerable to access denial through double slash in URI corrupting router cacheespocrm
- CVE-2025-54387IPX is Vulnerable to Path Traversal via Prefix Matching Bypassunjs ipx · ipx
- CVE-2025-54804Russh is missing an overflow check during channel windows adjustEugeny russh · russh
- CVE-2025-54871Electron Capture is Vulnerable to TCC Bypass via Misconfigured Node Fuses (macOS)steveseguin electroncapture
- CVE-2025-8535cronoh NanoVault xrb URL main.js executeJavaScript cross site scriptingcronoh NanoVault
- CVE-2025-43980An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN.
- CVE-2025-44964A lack of SSL certificate validation in BlueStacks v5.20 allows attackers to execute a man-it-the-middle attack and obtain sensitive informa
- CVE-2025-45512A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attackers to install craft
- CVE-2025-50454An Authentication Bypass vulnerability in Blue Access' Cobalt X1 thru 02.000.187 allows an unauthorized attacker to log into the application
- CVE-2025-50592Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player.
- CVE-2025-50688A command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input sanitization in the file upload functionality.
- CVE-2025-51060An issue was discovered in CPUID cpuz.sys 1.0.5.4.
- CVE-2025-51541A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuratio
- CVE-2025-51627Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-level access to escala
- CVE-2025-51857The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks.
- CVE-2025-52078File upload vulnerability in Writebot AI Content Generator SaaS React Template thru 4.0.0, allowing remote attackers to gain escalated privi
- CVE-2025-52237An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory traversal.