CVEs published August 7, 2025
91 CVEs were published on August 7, 2025: 20 critical, 25 high.
- Published
- 91
- Critical
- 20
- High
- 25
- Medium
- 42
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 37
Most affected products
- Google Chrome
- 8
- Meta Platforms ExecuTorch · executorch +2
- 5
- Shenzhen Aitemi E Commerce Co. M300 Wi-Fi Repeater
- 5
- Agora Foundation Agora
- 3
- SuiteCRM
- 3
- Latkecrszy LinkJoin
- 2
- Microsoft 365 Copilot's Business Chat
- 2
- TAGFREE X-Free Uploader
- 2
- Wanzhou WOES Intelligent Optimization Energy Saving System
- 2
- agentUniverse
- 1
Critical 20
- CVE-2025-54952An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentMeta Platforms ExecuTorch · executorch
- CVE-2025-54951A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially resultMeta Platforms ExecuTorch · executorch +2
- CVE-2025-54950An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execMeta Platforms ExecuTorch · executorch +2
- CVE-2025-54949A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effecMeta Platforms ExecuTorch · executorch +2
- CVE-2025-30405An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, poMeta Platforms ExecuTorch · executorch +2
- CVE-2025-30404An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execuMeta Platforms ExecuTorch · executorch +2
- CVE-2025-53767Azure OpenAI Elevation of Privilege VulnerabilityMicrosoft Azure Open AI
- CVE-2025-53792Azure Portal Elevation of Privilege VulnerabilityMicrosoft Azure Portal
- CVE-2025-34148Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via WISP SSIDShenzhen Aitemi E Commerce Co. M300 Wi-Fi Repeater
- CVE-2025-34149Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via WPA2 KeyShenzhen Aitemi E Commerce Co. M300 Wi-Fi Repeater
- CVE-2025-34150Shenzhen Aitemi M300 Wi-Fi Repeater PPPoE Username Command InjectionShenzhen Aitemi E Commerce Co. M300 Wi-Fi Repeater
- CVE-2025-34151Shenzhen Aitemi M300 Wi-Fi Repeater PPPoE Password Command InjectionShenzhen Aitemi E Commerce Co. M300 Wi-Fi Repeater
- CVE-2025-34152Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time ParameterShenzhen Aitemi E Commerce Co. M300 Wi-Fi Repeater
- CVE-2023-41525Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php
- CVE-2023-41526Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func1.php via the username3 and password3
- CVE-2023-41527Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the password2 parameter in func.php.
- CVE-2023-41528Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in contact.php via the txtname, txtphone, and
- CVE-2023-41530Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php.
- CVE-2025-45765ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption.
- CVE-2025-50692FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html.
High 25
- CVE-2025-53787Microsoft 365 Copilot BizChat Information Disclosure VulnerabilityMicrosoft 365 Copilot's Business Chat
- CVE-2025-26513The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when successfully exploited cNetApp SAN Host Utilities for Windows
- CVE-2025-24000WordPress Post SMTP plugin <= 3.2.0 - Account Takeover VulnerabilitySaad Iqbal Post SMTP
- CVE-2025-47907Incorrect results returned from Rows.Scan in database/sqlGo standard library database/sql · stdlib
- CVE-2025-7054Infinite loop triggered by connection ID retirementCloudflare quiche · quiche
- CVE-2025-35970On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from the information availSEIKO EPSON Multiple EPSON product · FUJIFILM FRONTIER DX40…
- CVE-2025-29866: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free TAGFREE X-Free Uploader
- CVE-2025-8578Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2025-8576Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2025-29865: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TAGFREE X-Free Uploader XFU allows Path TrTAGFREE X-Free Uploader
- CVE-2025-3770SMM IDT Privilege Escalation VulnerabilityTianoCore EDK2
- CVE-2025-54784SuiteCRM is vulnerable to Cross Site Scripting (XSS) through its email viewerSuiteCRM
- CVE-2025-54882Himmelblau's Kerberos credential cache collection is world readablehimmelblau-idm himmelblau
- CVE-2023-41520Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the clas
- CVE-2023-41521Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm.php via the id
- CVE-2023-41522Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStudents.php via the Id, f
- CVE-2023-41523Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClas
- CVE-2023-41524Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index.php.
- CVE-2023-41531Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func3.php via the username1 and password2
- CVE-2023-41532Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the doctor_contact parameter in doctorsearch.php.
- CVE-2025-47219In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 fil
- CVE-2025-50675GPMAW 14, a bioinformatics software, has a critical vulnerability related to insecure file permissions in its installation directory.
- CVE-2025-51629A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attackers to execute arbitra
- CVE-2025-55137LinkJoin through 882f196 mishandles lacks type checking in password reset.Latkecrszy LinkJoin
- CVE-2025-55138LinkJoin through 882f196 mishandles token ownership in password reset.Latkecrszy LinkJoin
Medium, low and unrated 46
- CVE-2025-8702Wanzhou WOES Intelligent Optimization Energy Saving System Historical Data Query Module GetVariableByOneIDNew sql injectionWanzhou WOES Intelligent Optimization Energy Saving System
- CVE-2025-54787SuiteCRM: Improper Authorization for attachment downloadsSuiteCRM
- CVE-2025-8701Wanzhou WOES Intelligent Optimization Energy Saving System GetPageList sql injectionWanzhou WOES Intelligent Optimization Energy Saving System
- CVE-2025-53774Microsoft 365 Copilot BizChat Information Disclosure VulnerabilityMicrosoft 365 Copilot's Business Chat
- CVE-2025-8698Open5GS AMF Service nsmf-handler.c amf_nsmf_pdusession_handle_release_sm_context assertionOpen5GS
- CVE-2025-7195Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwdoperator-framework operator-sdk · Red Hat RHEL-9-CNV-4.… +15
- CVE-2025-8697agentUniverse MCPSessionManager/MCPTool/MCPToolkit StdioServerParameters os command injectionagentUniverse
- CVE-2025-55077Tyler Technologies ERP Pro 9 SaaS application escapeTyler Technologies ERP Pro 9 SaaS
- CVE-2024-56339IBM WebSphere Application Server information disclosureIBM WebSphere Application Server
- CVE-2025-8533Incorrect Authorization of XPC Service in Fantastical.appFlexibits Fantastical
- CVE-2025-8583Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a cGoogle Chrome
- CVE-2025-8582Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents oGoogle Chrome
- CVE-2025-8581Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2025-8580Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a cGoogle Chrome
- CVE-2025-8579Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user toGoogle Chrome
- CVE-2025-8577Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user toGoogle Chrome
- CVE-2025-54783SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer headerSuiteCRM
- CVE-2025-54798tmp does not restrict arbitrary temporary file / directory write via symbolic link `dir` parameterraszi node-tmp · tmp
- CVE-2025-54799Lego does not enforce HTTPSgo-acme lego · github.com/go-acme/lego +2
- CVE-2025-54885Thinbus generates insufficient entropy: 252 bits vs minimum 256 bitssimbo1905 thinbus-srp-npm · thinbus-srp
- CVE-2023-40992Hospital Management System 4 is vulnerable to a SQL injection in /Hospital-Management-System-master/func.php via the password2 parameter.
- CVE-2023-41519Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter a
- CVE-2023-41529Hospital Management System v4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in func2.php via the fname and l
- CVE-2024-42048OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing all authenticated users
- CVE-2024-52680EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn.
- CVE-2024-55401An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal.
- CVE-2025-32094An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26.AkamaiGhost
- CVE-2025-44779An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.github.com/ollama/ollama
- CVE-2025-47183In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 fil
- CVE-2025-47188A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Un
- CVE-2025-47806In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data past the bounds of a stack buffer, leading to a
- CVE-2025-47807In GStreamer through 1.26.1, the subparse plugin's subrip_unescape_formatting function may dereference a NULL pointer while parsing a subtit
- CVE-2025-47808In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may dereference a NULL pointer while parsing a subtitle file
- CVE-2025-48709BMC Control-M/Server cleartext database credentials in process lists and logsBMC Control-M/Server
- CVE-2025-50952openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.
- CVE-2025-51533An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access internal forms via sen
- CVE-2025-54392Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data, a different vul
- CVE-2025-54393Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows Static Code Injection.
- CVE-2025-54394Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 has Insufficiently Protected Credentials for requests to
- CVE-2025-54395Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication configuration data.
- CVE-2025-54396Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows SQL Injection.
- CVE-2025-54397Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 inserts Sensitive Information Into Sent Data to authentic
- CVE-2025-55133In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManager.js.Agora Foundation Agora
- CVE-2025-55134In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js.Agora Foundation Agora
- CVE-2025-55135In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js.Agora Foundation Agora
- CVE-2025-55136ERC (aka Emotion Recognition in Conversation) through 0.3 has insecure deserialization via a serialized object because jsonpickle is used.tae898 ERC