CVEs published August 8, 2025
76 CVEs were published on August 8, 2025: 22 critical, 17 high. 1 is now in CISA KEV.
- Published
- 76
- Critical
- 22
- High
- 17
- Medium
- 34
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 18
Most affected products
- EG4 Electronics EG4 12kPV · EG4 Electronics EG4 18kPV +4
- 4
- Wanzhou WOES Intelligent Optimization Energy Saving System
- 4
- Huawei EnzoH-W5611T
- 3
- GNU cflow
- 2
- Imagination Technologies Graphics DDK
- 2
- macrozheng mall
- 2
- Mubit co. Powered BLUE
- 2
- Xerox FreeFlow Core
- 2
- zhenfeng13 My-Blog
- 2
- zlt2000 microservices-platform
- 2
Critical 22
- CVE-2025-6573GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/OverwriteImagination Technologies Graphics DDK
- CVE-2012-10045XODA 0.4.5 Arbitrary PHP File UploadXODA
- CVE-2012-10049WebPageTest Arbitrary PHP File Upload RCEWPO Foundation WebPageTest
- CVE-2012-10041WAN Emulator v2.3 Command ExecutionWAN Emulator
- CVE-2012-10053Simple Web Server Connection Header Buffer OverflowPMSoftware Simple Web Server
- CVE-2012-10036Project Pier <= 0.8.8 Arbitrary File Upload RCEProjectPier
- CVE-2012-10044MobileCartly 1.0 savepage.php Arbitrary File CreationMobileCartly
- CVE-2012-10046E-Mail Security Virtual Appliance learn-msg.cgi Command InjectionESVA-Project E-Mail Security Virtual Appliance
- CVE-2012-10052EGallery 1.2 Arbitrary PHP File UploadEGallery
- CVE-2012-10047Cyclope Employee Surveillance Solution v6.x SQL InjectionCyclope-Series Cyclope Employee Surveillance Solution
- CVE-2012-10050CuteFlow <= 2.11.2 Arbitrary File Upload RCECuteFlow.org CuteFlow
- CVE-2010-10013AjaXplorer < 2.6 checkInstall.php Unauthenticated RCEAjaXplorer
- CVE-2012-10043ActFax 4.32 Client Importer Buffer OverflowActFax Server
- CVE-2025-5095Burk Technology ARC Solo Missing Authentication for Critical FunctionBurk Technology ARC Solo
- CVE-2025-8284Packet Power EMX and EG Missing Authentication for Critical FunctionPacket Power EMX · Packet Power EG
- CVE-2025-8356Path Traversal leading to RCEXerox FreeFlow Core
- CVE-2025-8731TRENDnet TI-G160i/TI-PG102i/TPL-430AP SSH Service default credentialsTRENDnet TI-G160i · TRENDnet TI-PG102i +1
- CVE-2025-8730Belkin F9K1009/F9K1010 Web Interface hard-coded credentialsBelkin F9K1009 · Belkin F9K1010
- CVE-2025-53606Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata ServerApache Software Foundation Apache Seata · org.apache.seata:…
- CVE-2025-48913Apache CXF: Untrusted JMS configuration can lead to RCEApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2025-54887jwe: Missing AES-GCM authentication tag validation in encrypted JWEsjwt ruby-jwe · jwe
- CVE-2025-52913A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated
High 17
- CVE-2025-46709GPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leakImagination Technologies Graphics DDK
- CVE-2025-4796Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeoverarraytics Eventin – Event Calendar, Event Registration, Tic…
- CVE-2012-10048Zenoss 3.x showDaemonXMLConfig Command ExecutionZenoss Core
- CVE-2012-10042Sflog! CMS 1.0 Arbitrary File Upload RCESflog! CMS
- CVE-2012-10051Photodex ProShow Producer 5.0.3256 load File Handling Buffer OverflowPhotodex ProShow Producer
- CVE-2025-8393Dreame Technology iOS and Android Mobile Applications Improper Certificate ValidationDreame Technology Dreamehome iOS app · Dreame Technology… +1
- CVE-2025-46414EG4 Electronics EG4 Inverters Improper Restriction of Excessive Authentication AttemptsEG4 Electronics EG4 12kPV · EG4 Electronics EG4 18kPV +4
- CVE-2025-53520EG4 Electronics EG4 Inverters Download of Code Without Integrity CheckEG4 Electronics EG4 12kPV · EG4 Electronics EG4 18kPV +4
- CVE-2025-8355XXE leading to SSRFXerox FreeFlow Core
- CVE-2025-36119IBM i authentication bypassIBM i
- CVE-2025-8088Path traversal vulnerability in WinRARwin.rar WinRAR
- CVE-2025-8748OS command injection in MiR robots and MiR fleet via crafted HTTP requestsMobile Industrial Robots MiR Robots · Mobile Industrial Rob…
- CVE-2025-54886skops: Card.get_model does not block arbitrary code executionskops-dev skops · skops
- CVE-2020-9322The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user.
- CVE-2025-50465OpenMetadata <=1.4.4 is vulnerable to SQL Injection.
- CVE-2025-50466OpenMetadata <=1.4.4 is vulnerable to SQL Injection.
- CVE-2025-52914A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticate
Medium, low and unrated 37
- CVE-2025-8744CesiumLab Web lodmodels sql injectionCesiumLab Web
- CVE-2025-8743Scada-LTS Virtual Data Source Property data_source_edit.shtm cross site scriptingScada-LTS
- CVE-2025-8742macrozheng mall Admin Login excessive authenticationmacrozheng mall
- CVE-2025-8741macrozheng mall login cleartext transmissionmacrozheng mall
- CVE-2025-8740zhenfeng13 My-Blog Category save cross site scriptingzhenfeng13 My-Blog
- CVE-2025-8739zhenfeng13 My-Blog save cross-site request forgeryzhenfeng13 My-Blog
- CVE-2025-8738zlt2000 microservices-platform Spring Actuator Interface actuator information disclosurezlt2000 microservices-platform
- CVE-2025-8737zlt2000 microservices-platform OauthLogoutSuccessHandler.java onLogoutSuccess redirectzlt2000 microservices-platform
- CVE-2025-8736GNU cflow Lexer c.c yylex buffer overflowGNU cflow
- CVE-2025-8735GNU cflow Lexer c.c yylex null pointer dereferenceGNU cflow
- CVE-2025-8732libxml2 xmlcatalog xmlParseSGMLCatalog recursionlibxml2
- CVE-2025-47872EG4 Electronics EG4 Inverters Observable DiscrepancyEG4 Electronics EG4 12kPV · EG4 Electronics EG4 18kPV +4
- CVE-2025-52586EG4 Electronics EG4 Inverters Cleartext Transmission of Sensitive InformationEG4 Electronics EG4 12kPV · EG4 Electronics EG4 18kPV +4
- CVE-2025-4576A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.QLiferay Portal · Liferay DXP +1
- CVE-2025-36023IBM Cloud Pak for Business Automation security bypassIBM Cloud Pak for Business Automation
- CVE-2025-8729MigoXLab LMeterX upload_service.py process_cert_files path traversalMigoXLab LMeterX
- CVE-2025-8749Path traversal vulnerability in MiR robot software via API requestsMobile Industrial Robots MiR Robots
- CVE-2025-6572OpenStreetMap for Gutenberg and WPBakery Page Builder <= 1.2.0 - Contributor+ Stored XSSOpenStreetMap for Gutenberg and WPBakery Page Builder
- CVE-2025-54958Powered BLUE 870 versions 0.20130927 and prior contain an OS command injection vulnerability.Mubit co. Powered BLUE
- CVE-2025-54959Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability.Mubit co. Powered BLUE
- CVE-2025-54940An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3.WPEngine Advanced Custom Fields
- CVE-2024-58255EnzoH has an OS command injection vulnerability.Huawei EnzoH-W5611T
- CVE-2024-58257EnzoH has an OS command injection vulnerability.Huawei EnzoH-W5611T
- CVE-2024-58256EnzoH has an OS command injection vulnerability.Huawei EnzoH-W5611T
- CVE-2025-8708Antabot White-Jotter com.gm.wj.config.ShiroConfiguration ShiroConfiguration.java CookieRememberMeManager deserializationAntabot White-Jotter
- CVE-2025-8707Huuge Box App com.huuge.game.zjbox AndroidManifest.xml improper export of android application componentsHuuge Box App
- CVE-2025-8706Wanzhou WOES Intelligent Optimization Energy Saving System Energy Overview Module CreateFunctionLog sql injectionWanzhou WOES Intelligent Optimization Energy Saving System
- CVE-2025-8705Wanzhou WOES Intelligent Optimization Energy Saving System Energy Overview Module GetTargetConfig sql injectionWanzhou WOES Intelligent Optimization Energy Saving System
- CVE-2025-8704Wanzhou WOES Intelligent Optimization Energy Saving System Analysis Conclusion Query Module GetAlarmResultProcessList sql injectionWanzhou WOES Intelligent Optimization Energy Saving System
- CVE-2025-54793Astro: Duplicate trailing slash feature can lead to Open Redirectswithastro astro · astro
- CVE-2025-8703Wanzhou WOES Intelligent Optimization Energy Saving System Environmental Real-Time Data Module GetAreaTrendChartData sql injectionWanzhou WOES Intelligent Optimization Energy Saving System
- CVE-2025-54368uv is vulnerable to ZIP payload obfuscation through parsing differentialsastral-sh uv · uv
- CVE-2025-50467OpenMetadata <=1.4.4 is vulnerable to SQL Injection.
- CVE-2025-50468OpenMetadata <=1.4.4 is vulnerable to SQL Injection.
- CVE-2025-50927A reflected cross-site scripting (XSS) vulnerability in the List All FTP User Function in EHCP v20.04.1.b allows authenticated attackers to
- CVE-2025-50928Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the Change Settin
- CVE-2025-551887-Zip before 25.01 does not always properly handle symbolic links during extraction.7-Zip