CVEs published August 9, 2025
41 CVEs were published on August 9, 2025: 1 critical, 8 high.
- Published
- 41
- Critical
- 1
- High
- 8
- Medium
- 29
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- openbao · github.com/openbao/openbao
- 7
- Liferay Portal · Liferay DXP +2
- 2
- linlinjava litemall
- 2
- Linux
- 2
- macrozheng mall
- 2
- Portabilis i-Educar
- 2
- BYD DiLink OS
- 1
- craftcms cms · craftcms/cms
- 1
- CybercentreCanada assemblyline · assemblyline-service-client
- 1
- Datacom DM955 5GT
- 1
Critical 1
High 8
- CVE-2025-8758TRENDnet TEW-822DRE vsftpd least privilege violationTRENDnet TEW-822DRE
- CVE-2025-8757TRENDnet TV-IP110WN Embedded Boa Web Server boa.conf least privilege violationTRENDnet TV-IP110WN
- CVE-2024-58238Bluetooth: btnxpuart: Resolve TX timeout error in power save stress testLinux
- CVE-2022-50233Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name}Linux
- CVE-2025-55008AuthKit React Router: Sensitive auth data rendered in HTMLworkos authkit-react-router · @workos-inc/authkit-react-rou…
- CVE-2025-55009AuthKit: Sensitive auth data rendered in HTMLworkos authkit-remix · @workos-inc/authkit-remix
- CVE-2025-54996OpenBao Root Namespace Operator May Elevate Token Privilegesopenbao · github.com/openbao/openbao
- CVE-2025-54888@fedify/fedify: Improper Authentication and Incorrect Authorizationfedify-dev fedify · @fedify/fedify
Medium, low and unrated 32
- CVE-2025-8785Portabilis i-Educar educar_usuario_lst.php cross site scriptingPortabilis i-Educar
- CVE-2025-8784Portabilis i-Educar Cadastrar Vínculo funcionario_vinculo_cad.php cross site scriptingPortabilis i-Educar
- CVE-2025-8775Qiyuesuo Eelectronic Signature Platform Scheduled Task upload execute unrestricted uploadQiyuesuo Eelectronic Signature Platform
- CVE-2025-8774riscv-boom SonicBOOM L1 Data Cache timing discrepancyriscv-boom SonicBOOM
- CVE-2025-8773Dinstar Monitoring Platform 甘肃省危险品库监控平台 login_getPasswordErrorNum.action sql injectionDinstar Monitoring Platform 甘肃省危险品库监控平台
- CVE-2025-8772Vinades NukeViet Module index.php server-side request forgeryVinades NukeViet
- CVE-2025-8765Datacom DM955 5GT 1200 Wireless Basic Settings cross site scriptingDatacom DM955 5GT
- CVE-2025-8764linlinjava litemall upload unrestricted uploadlinlinjava litemall
- CVE-2025-8763Ruijie EG306MG strongSwan strongswan.conf missing encryptionRuijie EG306MG
- CVE-2025-8759TRENDnet TN-200 Lighttpd hard-coded keyTRENDnet TN-200
- CVE-2025-8756TDuckCloud tduck-platform manage preHandle improper authorizationTDuckCloud tduck-platform
- CVE-2025-8755macrozheng mall com.macro.mall.portal.controller UmsMemberController.java detail authorizationmacrozheng mall
- CVE-2025-7726The7 <= 12.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title and data-dt-img-description AttributesDream-Theme The7 — Website and eCommerce Builder for WordPr…
- CVE-2025-8753linlinjava litemall File delete path traversallinlinjava litemall
- CVE-2025-7020BYD DiLink OS Incorrect encryption Implementation of system log dumpsBYD DiLink OS
- CVE-2025-8752wangzhixuan spring-shiro-training add command injectionwangzhixuan spring-shiro-training
- CVE-2025-8751Protected Total WebShield Extension Block Page cross site scriptingProtected Total WebShield Extension
- CVE-2025-8750macrozheng mall Add Product Page upload cross site scriptingmacrozheng mall
- CVE-2025-8746GNU libopts __strstr_sse2 memory corruptionGNU libopts
- CVE-2025-8745Weee RICEPO App com.ricepo.app AndroidManifest.xml improper export of android application componentsWeee RICEPO App
- CVE-2025-4655SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0Liferay Portal · Liferay DXP +2
- CVE-2025-4581Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.Liferay Portal · Liferay DXP +2
- CVE-2025-55149Path Traversal Vulnerability in PDF Review Function (CWE-22)ulab-uiuc tiny-scientist · tiny-scientist
- CVE-2025-55013Assemblyline 4 Service Client: Arbitrary Write through path traversal in Client codeCybercentreCanada assemblyline · assemblyline-service-client
- CVE-2025-55006Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Featurefrappe lms
- CVE-2025-55003OpenBao Login MFA Bypasses Rate Limiting and TOTP Token Reuseopenbao · github.com/openbao/openbao
- CVE-2025-55001OpenBao LDAP MFA Enforcement Bypass When Using Username As Aliasopenbao · github.com/openbao/openbao
- CVE-2025-55000OpenBao TOTP Secrets Engine Enables Code Reuseopenbao · github.com/openbao/openbao
- CVE-2025-54999OpenBao: Timing Side-Channel in Userpass Auth Methodopenbao · github.com/openbao/openbao
- CVE-2025-54998OpenBao Userpass and LDAP User Lockout Bypassopenbao · github.com/openbao/openbao
- CVE-2025-54417Craft contains a theoretical bypass for CVE-2025-23209craftcms cms · craftcms/cms
- CVE-2025-55152oak: ReDoS in x-forwarded-proto and x-forwarded-for headersoakserver oak · @oakserver/oak