# CVEs published 2025-08-06

217 CVEs were published on August 6, 2025: 7 critical, 67 high. Days are UTC.

- [CVE-2025-54788](https://cve.now/CVE-2025-54788.md): SuiteCRM: Authenticated Blind SQL Injection in InboundEmail module (CVSS 8.8, SuiteCRM)
- [CVE-2025-54786](https://cve.now/CVE-2025-54786.md): SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data (CVSS 5.3, SuiteCRM-Core)
- [CVE-2025-54785](https://cve.now/CVE-2025-54785.md): SuiteCRM is Vulnerable to PHP Object Injection in Reports (CVSS 8.8, SuiteCRM)
- [CVE-2025-7770](https://cve.now/CVE-2025-7770.md): Predictable Seed in Pseudo-Random Number Generator (PRNG) in Tigo Energy Cloud Connect Advanced (CVSS 8.7, Tigo Energy Cloud Connect Advanced)
- [CVE-2025-6634](https://cve.now/CVE-2025-6634.md): TGA File Parsing Memory Corruption Vulnerability (CVSS 7.8, Autodesk 3ds Max)
- [CVE-2025-6633](https://cve.now/CVE-2025-6633.md): RBG File Parsing Out-of-Bounds Write Vulnerability (CVSS 7.8, Autodesk 3ds Max)
- [CVE-2025-7769](https://cve.now/CVE-2025-7769.md): Improper Neutralization of Special Elements used in a Command ('Command Injection') in Tigo Energy Cloud Connect Advanced (CVSS 8.7, Tigo Energy Cloud Connect Advanced)
- [CVE-2025-6632](https://cve.now/CVE-2025-6632.md): PSD File Parsing Out-of-Bounds Read Vulnerability (CVSS 5.3, Autodesk 3ds Max)
- [CVE-2025-47908](https://cve.now/CVE-2025-47908.md): Denial of service via malicious preflight requests in github.com/rs/cors (CVSS 7.5, github.com/rs/cors)
- [CVE-2025-7768](https://cve.now/CVE-2025-7768.md): Use of Hard-coded Credentials in Tigo Energy Cloud Connect Advanced (CVSS 9.3, Tigo Energy Cloud Connect Advanced)
- [CVE-2025-38746](https://cve.now/CVE-2025-38746.md): Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerabi (CVSS 3.5, Dell SupportAssist OS Recovery)
- [CVE-2025-38747](https://cve.now/CVE-2025-38747.md): Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. (CVSS 7.8, Dell SupportAssist OS Recovery)
- [CVE-2025-8667](https://cve.now/CVE-2025-8667.md): SkyworkAI DeepResearchAgent tools.py from\_mcp os command injection (CVSS 5.3, SkyworkAI DeepResearchAgent)
- [CVE-2025-8419](https://cve.now/CVE-2025-8419.md): Org.keycloak/keycloak-services: keycloak smtp inject vulnerability (CVSS 5.3, keycloak · Red Hat build of Keycloak +1)
- [CVE-2025-8665](https://cve.now/CVE-2025-8665.md): agno-agi agno Model Context Protocol mcp.py MultiMCPTools os command injection (CVSS 5.3, agno-agi agno)
- [CVE-2025-20215](https://cve.now/CVE-2025-20215.md): Cisco Webex Meeting Client Join Certificate Validation Vulnerability (CVSS 5.4, Cisco Webex Meetings)
- [CVE-2025-20332](https://cve.now/CVE-2025-20332.md): Cisco Identity Services Engine Authorization Bypass Vulnerability (CVSS 4.3, Cisco Identity Services Engine Software)
- [CVE-2025-20331](https://cve.now/CVE-2025-20331.md): Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabiliy (CVSS 5.4, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2025-53786](https://cve.now/CVE-2025-53786.md): Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2024-8244](https://cve.now/CVE-2024-8244.md): Walk/WalkDir in path/filepath susceptible to symlink race (CVSS 3.7, Go standard library path/filepath)
- [CVE-2025-48394](https://cve.now/CVE-2025-48394.md): An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited (CVSS 4.7, Eaton G4 PDU)
- [CVE-2025-48393](https://cve.now/CVE-2025-48393.md): The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attac (CVSS 5.7, Eaton G4 PDU)
- [CVE-2024-52885](https://cve.now/CVE-2024-52885.md): Path Traversal (CVSS 5.0, checkpoint Check Point Mobile Access)
- [CVE-2025-2028](https://cve.now/CVE-2025-2028.md): Lack of TLS validation (CVSS 6.5, checkpoint Check Point Management Log Server)
- [CVE-2025-36020](https://cve.now/CVE-2025-36020.md): IBM Guardium Data Protection information disclosure (CVSS 5.9, IBM Guardium Data Protection)
- [CVE-2025-8616](https://cve.now/CVE-2025-8616.md): Malicious browser plugins may cause Authentication replay attack vulnerability to bypass authentication in OpenText Advanced Authentication (CVSS 6.1, OpenText Advanced Authentication)
- [CVE-2025-3354](https://cve.now/CVE-2025-3354.md): IBM Tivoli Monitoring code execution (CVSS 8.1, IBM Tivoli Monitoring)
- [CVE-2025-3320](https://cve.now/CVE-2025-3320.md): IBM Tivoli Monitoring code execution (CVSS 8.1, IBM Tivoli Monitoring)
- [CVE-2025-23335](https://cve.now/CVE-2025-23335.md): NVIDIA Triton Inference Server for Windows and Linux and the Tensor RT backend contain a vulnerability where an attacker could cause an unde (CVSS 4.4, NVIDIA Triton Inference Server)
- [CVE-2025-23334](https://cve.now/CVE-2025-23334.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of (CVSS 5.9, NVIDIA Triton Inference Server)
- [CVE-2025-23333](https://cve.now/CVE-2025-23333.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of (CVSS 5.9, NVIDIA Triton Inference Server)
- [CVE-2025-23331](https://cve.now/CVE-2025-23331.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause a memory allocation with excessive si (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2025-23327](https://cve.now/CVE-2025-23327.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an integer overflow through spec (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2025-23326](https://cve.now/CVE-2025-23326.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an integer overflow through a sp (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2025-23325](https://cve.now/CVE-2025-23325.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause uncontrolled recursion through a (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2025-23324](https://cve.now/CVE-2025-23324.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause an integer overflow or wraparound, le (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2025-23323](https://cve.now/CVE-2025-23323.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause an integer overflow or wraparound, le (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2025-23322](https://cve.now/CVE-2025-23322.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where multiple requests could cause a double free when a strea (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2025-23321](https://cve.now/CVE-2025-23321.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause a divide by zero issue by issuing an (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2025-23320](https://cve.now/CVE-2025-23320.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause the share (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2025-23319](https://cve.now/CVE-2025-23319.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of (CVSS 8.1, NVIDIA Triton Inference Server)
- [CVE-2025-23318](https://cve.now/CVE-2025-23318.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of (CVSS 8.1, NVIDIA Triton Inference Server)
- [CVE-2025-23317](https://cve.now/CVE-2025-23317.md): NVIDIA Triton Inference Server contains a vulnerability in the HTTP server, where an attacker could start a reverse shell by sending a speci (CVSS 9.1, NVIDIA Triton Inference Server)
- [CVE-2025-23311](https://cve.now/CVE-2025-23311.md): NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a stack overflow through specially crafted HTTP reques (CVSS 9.8, NVIDIA Triton Inference Server)
- [CVE-2025-23310](https://cve.now/CVE-2025-23310.md): NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause stack buffer overflow by special (CVSS 9.8, NVIDIA Triton Inference Server)
- [CVE-2025-5197](https://cve.now/CVE-2025-5197.md): Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 5.3, huggingface/transformers · transformers)
- [CVE-2025-46391](https://cve.now/CVE-2025-46391.md): CWE-284: Improper Access Control (CVSS 6.5, Emby MediaBrowser)
- [CVE-2025-46390](https://cve.now/CVE-2025-46390.md): CWE-204: Observable Response Discrepancy (CVSS 7.5, Emby MediaBrowser)
- [CVE-2025-46389](https://cve.now/CVE-2025-46389.md): CWE-620: Unverified Password Change (CVSS 6.5, Emby MediaBrowser)
- [CVE-2025-46388](https://cve.now/CVE-2025-46388.md): CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (CVSS 4.3, Emby MediaBrowser)
- [CVE-2025-46387](https://cve.now/CVE-2025-46387.md): CWE-639 Authorization Bypass Through User-Controlled Key (CVSS 8.8, Emby MediaBrowser)
- [CVE-2025-46386](https://cve.now/CVE-2025-46386.md): CWE-639 Authorization Bypass Through User-Controlled Key (CVSS 8.8, Emby MediaBrowser)
- [CVE-2025-6013](https://cve.now/CVE-2025-6013.md): Vault LDAP MFA Enforcement Bypass When Using Username As Alias (CVSS 6.5, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2025-22470](https://cve.now/CVE-2025-22470.md): CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1 allow crafted dangerous files to be uploaded. (CVSS 9.8, SATO CL4/6NX Plus · SATO CL4/6NX-J Plus)
- [CVE-2025-22469](https://cve.now/CVE-2025-22469.md): OS command injection vulnerability exists in CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1. (CVSS 7.3, SATO CL4/6NX Plus · SATO CL4/6NX-J Plus)
- [CVE-2025-7771](https://cve.now/CVE-2025-7771.md): Code Execution / Escalation of Privileges in ThrottleStop (CVSS 8.7, TechPowerUp ThrottleStop)
- [CVE-2025-8620](https://cve.now/CVE-2025-8620.md): GiveWP – Donation Plugin and Fundraising Platform \<= 4.6.0 - Unauthenticated Donor Data Exposure (CVSS 5.3, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2025-8556](https://cve.now/CVE-2025-8556.md): Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results (CVSS 3.7, circl · Builds for Red Hat OpenShift +22)
- [CVE-2025-7202](https://cve.now/CVE-2025-7202.md): Cross-Site Request Forgery (CSRF) allowed remote control of Elgato Key Lights (CVSS 5.1, Elgato Key Light · Elgato Ring Light +1)
- [CVE-2025-47324](https://cve.now/CVE-2025-47324.md): Exposure of Sensitive Information Through Metadata in Powerline Communication Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-27076](https://cve.now/CVE-2025-27076.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Display (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27075](https://cve.now/CVE-2025-27075.md): Improper Validation of Array Index in Bluetooth HOST (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27073](https://cve.now/CVE-2025-27073.md): Reachable Assertion in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-27072](https://cve.now/CVE-2025-27072.md): Buffer Copy Without Checking Size of Input in Automotive Vehicle Networks (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2025-27071](https://cve.now/CVE-2025-27071.md): Buffer Copy Without Checking Size of Input in Powerline Communication Firmware (CVSS 7.3, Qualcomm Snapdragon)
- [CVE-2025-27069](https://cve.now/CVE-2025-27069.md): Untrusted Pointer Dereference in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27068](https://cve.now/CVE-2025-27068.md): Buffer Over-read in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27067](https://cve.now/CVE-2025-27067.md): Improper Validation of Array Index in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-27066](https://cve.now/CVE-2025-27066.md): Reachable Assertion in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-27065](https://cve.now/CVE-2025-27065.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-27062](https://cve.now/CVE-2025-27062.md): Improper Access Control in Automotive Multimedia (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21477](https://cve.now/CVE-2025-21477.md): Improper Input Validation in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-21474](https://cve.now/CVE-2025-21474.md): Use After Free in BTHOST (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21473](https://cve.now/CVE-2025-21473.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera\_Linux (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21472](https://cve.now/CVE-2025-21472.md): Leftover Debug Code in Secure Element (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2025-21465](https://cve.now/CVE-2025-21465.md): Out-of-bounds Read in Core (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2025-21464](https://cve.now/CVE-2025-21464.md): Out-of-bounds Read in Core (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2025-21461](https://cve.now/CVE-2025-21461.md): Out-of-bounds Write in Camera\_Linux (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21458](https://cve.now/CVE-2025-21458.md): Use After Free in NPU (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21457](https://cve.now/CVE-2025-21457.md): Buffer Over-read in Automotive OS Platform Android (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2025-21456](https://cve.now/CVE-2025-21456.md): Use After Free in NPU (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21455](https://cve.now/CVE-2025-21455.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera\_Linux (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-21452](https://cve.now/CVE-2025-21452.md): Reachable Assertion in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2025-7954](https://cve.now/CVE-2025-7954.md): Race Condition in Shopware Voucher Submission (CVSS 6.0, Shopware · shopware/platform)
- [CVE-2025-7727](https://cve.now/CVE-2025-7727.md): Gutenverse \<= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks (CVSS 6.4, jegstudio Gutenverse – Ultimate WordPress FSE Blocks Addons…)
- [CVE-2025-7376](https://cve.now/CVE-2025-7376.md): Information Tampering Vulnerability in Multiple Processes of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, and GENESIS (CVSS 5.9, Mitsubishi Electric GENESIS64 · Mitsubishi Electric Ico… +13)
- [CVE-2025-21024](https://cve.now/CVE-2025-21024.md): Use of Implicit Intent for Sensitive Communication in Smart View prior to Android 16 allows local attackers to access sensitive information. (CVSS 3.3, Samsung Mobile Smart View)
- [CVE-2025-21023](https://cve.now/CVE-2025-21023.md): Improper access control in WcsExtension for Galaxy Watch prior to Android Watch 16 allows local attackers to access sensitive information. (CVSS 3.3, Samsung Mobile WcsExtension for Galaxy Watch)
- [CVE-2025-21022](https://cve.now/CVE-2025-21022.md): Improper access control in Galaxy Wearable prior to version 2.2.63.25042861 allows local attackers to access sensitive information. (CVSS 3.3, Samsung Mobile Galaxy Wearable)
- [CVE-2025-21021](https://cve.now/CVE-2025-21021.md): Out-of-bounds write in drawing pinpad in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bou (CVSS 5.7, Samsung Mobile Blockchain Keystore)
- [CVE-2025-21020](https://cve.now/CVE-2025-21020.md): Out-of-bounds write in creating bitmap images in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write ou (CVSS 5.7, Samsung Mobile Blockchain Keystore)
- [CVE-2025-21019](https://cve.now/CVE-2025-21019.md): Improper authorization in Samsung Health prior to version 6.30.1.003 allows local attackers to access data in Samsung Health. (CVSS 5.5, Samsung Mobile Samsung Health)
- [CVE-2025-21018](https://cve.now/CVE-2025-21018.md): Out-of-bounds read in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to read out-of-bounds memory. (CVSS 4.4, Samsung Mobile Blockchain Keystore)
- [CVE-2025-21017](https://cve.now/CVE-2025-21017.md): Out-of-bounds write in detaching crypto box in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out- (CVSS 6.3, Samsung Mobile Blockchain Keystore)
- [CVE-2025-21016](https://cve.now/CVE-2025-21016.md): Improper access control in PkgPredictorService prior to SMR Aug-2025 Release 1 in Chinese Android 13, 14, 15 and 16 allows local attackers t (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2025-21015](https://cve.now/CVE-2025-21015.md): Path Traversal in Document scanner prior to SMR Aug-2025 Release 1 allows local attackers to delete file with Document scanner's privilege. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21014](https://cve.now/CVE-2025-21014.md): Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2025-21013](https://cve.now/CVE-2025-21013.md): Improper access control in SemSensorManager for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive info (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2025-21012](https://cve.now/CVE-2025-21012.md): Improper access control in fall detection for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to modify fall detection c (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-21011](https://cve.now/CVE-2025-21011.md): Improper access control in SemSensorService for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive info (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-21010](https://cve.now/CVE-2025-21010.md): Improper privilege management in SamsungAccount prior to SMR Aug-2025 Release 1 allows local privileged attackers to deactivate Samsung acco (CVSS 6.0, Samsung Mobile Devices)
- [CVE-2025-20990](https://cve.now/CVE-2025-20990.md): Improper access control in accessing system device node prior to SMR Aug-2025 Release 1 allows local attackers to access device identifier. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-6994](https://cve.now/CVE-2025-6994.md): Reveal Listing \<= 3.3 - Unauthenticated Privilege Escalation (CVSS 9.8, SmartDataSoft Reveal Listing)
- [CVE-2025-7399](https://cve.now/CVE-2025-7399.md): Betheme \<= 28.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, MuffinGroup Betheme)
- [CVE-2025-7498](https://cve.now/CVE-2025-7498.md): Exclusive Addons for Elementor \<= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2025-8100](https://cve.now/CVE-2025-8100.md): Element Pack Elementor Addons and Templates \<= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content (CVSS 5.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2025-54651](https://cve.now/CVE-2025-54651.md): Race condition vulnerability in the kernel hufs module. (CVSS 4.8, Huawei HarmonyOS)
- [CVE-2025-54650](https://cve.now/CVE-2025-54650.md): Improper array index verification vulnerability in the audio codec module. (CVSS 4.2, Huawei HarmonyOS)
- [CVE-2025-54649](https://cve.now/CVE-2025-54649.md): Vulnerability of using incompatible types to access resources in the location service. (CVSS 4.5, Huawei HarmonyOS)
- [CVE-2025-54648](https://cve.now/CVE-2025-54648.md): Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack. (CVSS 5.4, Huawei HarmonyOS)
- [CVE-2025-54647](https://cve.now/CVE-2025-54647.md): Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack. (CVSS 5.4, Huawei HarmonyOS)
- [CVE-2025-54646](https://cve.now/CVE-2025-54646.md): Vulnerability of inadequate packet length check in the BLE module. (CVSS 5.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-54645](https://cve.now/CVE-2025-54645.md): Out-of-bounds array access issue due to insufficient data verification in the location service module. (CVSS 5.0, Huawei HarmonyOS)
- [CVE-2025-54644](https://cve.now/CVE-2025-54644.md): Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module. (CVSS 6.6, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-54643](https://cve.now/CVE-2025-54643.md): Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module. (CVSS 6.6, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-54642](https://cve.now/CVE-2025-54642.md): Issue of buffer overflow caused by insufficient data verification in the kernel gyroscope module. (CVSS 6.7, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-54641](https://cve.now/CVE-2025-54641.md): Issue of buffer overflow caused by insufficient data verification in the kernel acceleration module. (CVSS 6.7, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-54640](https://cve.now/CVE-2025-54640.md): ParcelMismatch vulnerability in attribute deserialization. (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2025-54639](https://cve.now/CVE-2025-54639.md): ParcelMismatch vulnerability in attribute deserialization. (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2025-54638](https://cve.now/CVE-2025-54638.md): Issue of inconsistent read/write serialization in the ad module. (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2025-54637](https://cve.now/CVE-2025-54637.md): Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module. (CVSS 4.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-54636](https://cve.now/CVE-2025-54636.md): Issue of buffer overflow caused by insufficient data verification in the kernel drop detection module. (CVSS 4.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-54635](https://cve.now/CVE-2025-54635.md): Vulnerability of returning released pointers in the distributed notification service. (CVSS 5.9, Huawei HarmonyOS)
- [CVE-2025-8420](https://cve.now/CVE-2025-8420.md): Multiple Plugins by emarket-design \<= Multiple Versions - Unauthenticated Limited Remote Code Execution (CVSS 8.1, emarket-design Campus Directory – Faculty, Staff & Stude… +6)
- [CVE-2025-8595](https://cve.now/CVE-2025-8595.md): Zakra \<= 4.1.5 - Missing Authorization to Subscriber+ Demo Import (CVSS 4.3, themegrill Zakra)
- [CVE-2025-54634](https://cve.now/CVE-2025-54634.md): Vulnerability of improper processing of abnormal conditions in huge page separation. (CVSS 8.0, Huawei HarmonyOS)
- [CVE-2025-54633](https://cve.now/CVE-2025-54633.md): Out-of-bounds read vulnerability in the register configuration of the DMA module. (CVSS 6.7, Huawei HarmonyOS)
- [CVE-2025-54632](https://cve.now/CVE-2025-54632.md): Vulnerability of insufficient data length verification in the HVB module. (CVSS 6.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-54631](https://cve.now/CVE-2025-54631.md): Vulnerability of insufficient data length verification in the partition module. (CVSS 6.7, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-54630](https://cve.now/CVE-2025-54630.md): :Vulnerability of insufficient data length verification in the DFA module. (CVSS 6.8, Huawei HarmonyOS)
- [CVE-2025-54629](https://cve.now/CVE-2025-54629.md): Race condition issue occurring in the physical page import process of the memory management module. (CVSS 6.7, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-54628](https://cve.now/CVE-2025-54628.md): Vulnerability of incomplete verification information in the communication module. (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-54627](https://cve.now/CVE-2025-54627.md): Out-of-bounds write vulnerability in the skia module. (CVSS 8.8, Huawei HarmonyOS)
- [CVE-2025-54625](https://cve.now/CVE-2025-54625.md): Race condition vulnerability in the kernel file system module. (CVSS 6.7, Huawei HarmonyOS)
- [CVE-2025-54626](https://cve.now/CVE-2025-54626.md): Pointer dangling vulnerability in the cjwindow module. (CVSS 4.4, Huawei HarmonyOS)
- [CVE-2025-54624](https://cve.now/CVE-2025-54624.md): Unexpected injection event vulnerability in the multimodalinput module. (CVSS 5.7, Huawei HarmonyOS)
- [CVE-2025-7502](https://cve.now/CVE-2025-7502.md): WPBakery Page Builder for WordPress \<= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, WPBakery Page Builder)
- [CVE-2025-6986](https://cve.now/CVE-2025-6986.md): FileBird – WordPress Media Library Folders & File Manager \<= 6.4.8 - Authenticated (Author+) SQL Injection (CVSS 6.5, ninjateam FileBird – WordPress Media Library Folders & File…)
- [CVE-2025-6256](https://cve.now/CVE-2025-6256.md): Flex Guten \<= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect Parameter (CVSS 6.4, dragwp Flex Guten – Multile Blocks)
- [CVE-2025-6690](https://cve.now/CVE-2025-6690.md): WP Tournament Registration \<= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via field Parameter (CVSS 6.4, archaeopath WP Tournament Registration)
- [CVE-2025-7036](https://cve.now/CVE-2025-7036.md): CleverReach WP \<= 1.5.20 - Unauthenticated SQL Injection via title Parameter (CVSS 7.5, cleverreach43 CleverReach® WP)
- [CVE-2025-6259](https://cve.now/CVE-2025-6259.md): esri-map-view \<= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via esri-map-view Shortcode (CVSS 6.4, geoplay9 esri-map-view)
- [CVE-2025-54623](https://cve.now/CVE-2025-54623.md): Out-of-bounds read vulnerability in the devicemanager module. (CVSS 6.3, Huawei HarmonyOS)
- [CVE-2025-54622](https://cve.now/CVE-2025-54622.md): Binding authentication bypass vulnerability in the devicemanager module. (CVSS 8.3, Huawei HarmonyOS)
- [CVE-2025-54621](https://cve.now/CVE-2025-54621.md): Iterator failure issue in the WantAgent module. (CVSS 5.3, Huawei HarmonyOS)
- [CVE-2025-54620](https://cve.now/CVE-2025-54620.md): Deserialization vulnerability of untrusted data in the ability module. (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2025-54619](https://cve.now/CVE-2025-54619.md): Iterator failure issue in the multi-mode input module. (CVSS 5.3, Huawei HarmonyOS)
- [CVE-2025-54618](https://cve.now/CVE-2025-54618.md): Permission control vulnerability in the distributed clipboard module. (CVSS 5.7, Huawei HarmonyOS)
- [CVE-2025-54617](https://cve.now/CVE-2025-54617.md): Stack-based buffer overflow vulnerability in the dms\_fwk module. (CVSS 6.8, Huawei HarmonyOS)
- [CVE-2025-54616](https://cve.now/CVE-2025-54616.md): Out-of-bounds array access vulnerability in the ArkUI framework. (CVSS 4.0, Huawei HarmonyOS)
- [CVE-2025-54615](https://cve.now/CVE-2025-54615.md): Vulnerability of insufficient information protection in the media library module. (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2025-54614](https://cve.now/CVE-2025-54614.md): Input verification vulnerability in the home screen module. (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2025-54613](https://cve.now/CVE-2025-54613.md): Iterator failure vulnerability in the card management module. (CVSS 5.9, Huawei HarmonyOS)
- [CVE-2025-54612](https://cve.now/CVE-2025-54612.md): Iterator failure vulnerability in the card management module. (CVSS 5.9, Huawei HarmonyOS)
- [CVE-2025-8656](https://cve.now/CVE-2025-8656.md): Kenwood DMX958XR Protection Mechanism Failure Software Downgrade Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8655](https://cve.now/CVE-2025-8655.md): Kenwood DMX958XR libSystemLib Command injection Remote Code Execution Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8654](https://cve.now/CVE-2025-8654.md): Kenwood DMX958XR ReadMVGImage Command Injection Remote Code Execution Vulnerability (CVSS 8.8, Kenwood DMX958XR)
- [CVE-2025-8653](https://cve.now/CVE-2025-8653.md): Kenwood DMX958XR JKRadioService Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, Kenwood DMX958XR)
- [CVE-2025-8652](https://cve.now/CVE-2025-8652.md): Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8651](https://cve.now/CVE-2025-8651.md): Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8650](https://cve.now/CVE-2025-8650.md): Kenwood DMX958XR libSystemLib Command Injection Remote Code Execution Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8649](https://cve.now/CVE-2025-8649.md): Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-54611](https://cve.now/CVE-2025-54611.md): EXTRA\_REFERRER resource read vulnerability in the Gallery module. (CVSS 7.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-8648](https://cve.now/CVE-2025-8648.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8647](https://cve.now/CVE-2025-8647.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8646](https://cve.now/CVE-2025-8646.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8645](https://cve.now/CVE-2025-8645.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8644](https://cve.now/CVE-2025-8644.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8643](https://cve.now/CVE-2025-8643.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8642](https://cve.now/CVE-2025-8642.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8641](https://cve.now/CVE-2025-8641.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8640](https://cve.now/CVE-2025-8640.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8639](https://cve.now/CVE-2025-8639.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8638](https://cve.now/CVE-2025-8638.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8637](https://cve.now/CVE-2025-8637.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8636](https://cve.now/CVE-2025-8636.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8635](https://cve.now/CVE-2025-8635.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8634](https://cve.now/CVE-2025-8634.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8633](https://cve.now/CVE-2025-8633.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8632](https://cve.now/CVE-2025-8632.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8631](https://cve.now/CVE-2025-8631.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8630](https://cve.now/CVE-2025-8630.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8629](https://cve.now/CVE-2025-8629.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-8628](https://cve.now/CVE-2025-8628.md): Kenwood DMX958XR Firmware Update Command Injection Vulnerability (CVSS 6.8, Kenwood DMX958XR)
- [CVE-2025-54610](https://cve.now/CVE-2025-54610.md): Out-of-bounds access vulnerability in the audio codec module. (CVSS 5.4, Huawei HarmonyOS)
- [CVE-2025-54609](https://cve.now/CVE-2025-54609.md): Out-of-bounds access vulnerability in the audio codec module. (CVSS 5.4, Huawei HarmonyOS)
- [CVE-2025-54608](https://cve.now/CVE-2025-54608.md): Vulnerability that allows setting screen rotation direction without permission verification in the screen management module. (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2025-54607](https://cve.now/CVE-2025-54607.md): Authentication management vulnerability in the ArkWeb module. (CVSS 7.7, Huawei HarmonyOS)
- [CVE-2025-54606](https://cve.now/CVE-2025-54606.md): Status verification vulnerability in the lock screen module. (CVSS 7.3, Huawei HarmonyOS)
- [CVE-2025-54655](https://cve.now/CVE-2025-54655.md): Race condition vulnerability in the virtualization base module. (CVSS 8.1, Huawei HarmonyOS)
- [CVE-2025-54653](https://cve.now/CVE-2025-54653.md): Path traversal vulnerability in the virtualization file module. (CVSS 8.4, Huawei HarmonyOS)
- [CVE-2025-54652](https://cve.now/CVE-2025-54652.md): Path traversal vulnerability in the virtualization base module. (CVSS 8.4, Huawei HarmonyOS)
- [CVE-2024-55398](https://cve.now/CVE-2024-55398.md): 4C Strategies Exonaut before v22.4 was discovered to contain insecure permissions. (CVSS 6.5)
- [CVE-2024-55399](https://cve.now/CVE-2024-55399.md): 4C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF). (CVSS 6.5)
- [CVE-2024-55402](https://cve.now/CVE-2024-55402.md): 4C Strategies Exonaut before v22.4 was discovered to contain an access control issue. (CVSS 5.3)
- [CVE-2025-30127](https://cve.now/CVE-2025-30127.md): An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. (CVSS 9.8)
- [CVE-2025-45764](https://cve.now/CVE-2025-45764.md): jsrsasign v11.1.0 was discovered to contain weak encryption. (CVSS 3.2, jsrsasign project jsrsasign)
- [CVE-2025-45766](https://cve.now/CVE-2025-45766.md): poco v1.14.1-release was discovered to contain weak encryption. (CVSS 7.0)
- [CVE-2025-46659](https://cve.now/CVE-2025-46659.md): An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. (CVSS 7.5)
- [CVE-2025-46660](https://cve.now/CVE-2025-46660.md): An issue was discovered in 4C Strategies Exonaut 21.6. (CVSS 5.3)
- [CVE-2025-50233](https://cve.now/CVE-2025-50233.md): A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of t (CVSS 6.5)
- [CVE-2025-50234](https://cve.now/CVE-2025-50234.md): MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\\apps\\controllers\\api\\Gf.php file, where the pic parameter is (CVSS 6.5)
- [CVE-2025-50286](https://cve.now/CVE-2025-50286.md): A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/to (CVSS 8.1)
- [CVE-2025-50740](https://cve.now/CVE-2025-50740.md): AutoConnect 1.4.2, an Arduino library, is vulnerable to a cross site scripting (xss) vulnerability. (CVSS 6.1)
- [CVE-2025-51040](https://cve.now/CVE-2025-51040.md): Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability via the /FrameSetCore.html endpoint in Electrolink (CVSS 7.5)
- [CVE-2025-51052](https://cve.now/CVE-2025-51052.md): A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting (CVSS 6.5)
- [CVE-2025-51053](https://cve.now/CVE-2025-51053.md): A Cross-site scripting (XSS) vulnerability in /api\_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascrip (CVSS 6.1)
- [CVE-2025-51054](https://cve.now/CVE-2025-51054.md): Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token witho (CVSS 6.5)
- [CVE-2025-51055](https://cve.now/CVE-2025-51055.md): Insecure Data Storage of credentials has been found in /api\_vedo/configuration/config.yml file in Vedo Suite version 2024.17. (CVSS 8.6)
- [CVE-2025-51056](https://cve.now/CVE-2025-51056.md): An unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesyst (CVSS 8.2)
- [CVE-2025-51057](https://cve.now/CVE-2025-51057.md): A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem (CVSS 6.5)
- [CVE-2025-51058](https://cve.now/CVE-2025-51058.md): Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api\_vedo/video/preview endpoint, whic (CVSS 6.5)
- [CVE-2025-51306](https://cve.now/CVE-2025-51306.md): In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the application without ex (CVSS 6.5)
- [CVE-2025-51308](https://cve.now/CVE-2025-51308.md): In Gatling Enterprise versions below 1.25.0, a low-privileged user that does not hold the role "admin" could perform a REST API call on read (CVSS 5.3)
- [CVE-2025-51531](https://cve.now/CVE-2025-51531.md): A reflected cross-site scripting (XSS) vulnerability in Sage DPW 2024\_12\_004 and earlier allows attackers to execute arbitrary JavaScript in (CVSS 6.1)
- [CVE-2025-51532](https://cve.now/CVE-2025-51532.md): Incorrect access control in Sage DPW 2024\_12\_004 and earlier allows unauthorized attackers to access the built-in Database Monitor via a cra (CVSS 7.5)
- [CVE-2025-51624](https://cve.now/CVE-2025-51624.md): Cross-site scripting (XSS) vulnerability in Zone Bitaqati thru 3.4.0. (CVSS 7.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.