CVEs published August 13, 2025
145 CVEs were published on August 13, 2025: 28 critical, 58 high.
- Published
- 145
- Critical
- 28
- High
- 58
- Medium
- 56
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 58
Most affected products
- GitLab
- 11
- WellChoose Organization Portal System
- 6
- Google Chrome
- 5
- ZKTeco WL20 Biometric Attendance System
- 4
- code-projects Job Diary
- 3
- F5 BIG-IP
- 3
- INSTAR 2K+ · INSTAR
- 3
- Insyde Software InsydeH2O
- 3
- Apache Software Foundation Apache Tomcat · org.apache.to… +1
- 2
- CherryHQ cherry-studio
- 2
Critical 28
- CVE-2025-34154UnForm Server Manager < 10.1.12 Unauthenticated Arbitrary File ReadSynergetic Data Systems UnForm Server Manager
- CVE-2011-10011WeBid 1.0.2 converter.php Remote PHP Code InjectionWeBid
- CVE-2012-10054Umbraco CMS < 4.7.1 codeEditorSave.asmx RCEUmbraco CMS
- CVE-2011-10013Traq 2.0–2.3 admincp/common.php RCETraq Project Issue Tracking System
- CVE-2012-10060Sysax Multi Server < 5.55 SSH Username Buffer OverflowSysax Software Multi Server
- CVE-2011-10019Spreecommerce < 0.60.2 Search Parameter RCESpreecommerce · spree
- CVE-2011-10017Snort Report nmap.php/nbtscan.php RCESymmetrix Technologies Snort Report
- CVE-2011-10016Real Networks Netzip Classic 7.5.1.86 File Parsing Buffer OverflowRealNetworks Netzip Classic
- CVE-2012-10058RabidHamster R4 Log Entry sprintf() Buffer OverflowRabidHamster R4 Embedded Server
- CVE-2011-10010QuickShare File Server 1.2.1 Path Traversal RCEQuickShareHQ QuickShare File Server
- CVE-2011-10018myBB 1.6.4 Backdoor Arbitrary Command ExecutionmyBB Group Forum Software
- CVE-2012-10059Dolibarr ERP/CRM Post-Auth OS Command InjectionDolibarr Project ERP/CRM
- CVE-2011-10015Cytel Studio <= 9.0 .CY3 File Stack Buffer OverflowCytel Studio
- CVE-2012-10055ComSndFTP v1.3.7 Beta USER Format String RCEComSndFTP FTP Server
- CVE-2025-8904Privilege escalation issue in Amazon EMR Secret Agent componentAmazon EMR
- CVE-2025-34153Hyland OnBase < 17.0.2.87 .NET Remoting TCP Channel Unauthenticated RCEHyland Software OnBase
- CVE-2025-54382Cherry Studio RCE Vulnerability DisclosureCherryHQ cherry-studio
- CVE-2025-8913WellChoose｜Organization Portal System - Local File InclusionWellChoose Organization Portal System
- CVE-2025-8760INSTAR 2K+/4K fcgi_server base64_decode buffer overflowINSTAR 2K+ · INSTAR
- CVE-2025-6715Latepoint < 5.1.94 - Unauthenticated LFILatePoint
- CVE-2025-7384Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletioncrmperks Database for Contact Form 7, WPforms, Elementor fo…
- CVE-2025-43982Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default.
- CVE-2025-43986An issue was discovered on KuWFi GC111 GC111-GL-LM321_V3.0_20191211 devices.
- CVE-2025-50251Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery.
- CVE-2025-50594An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management
- CVE-2025-51451In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
- CVE-2025-51452In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
- CVE-2025-52385An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the child_process mo
High 58
- CVE-2025-55196External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Accessexternal-secrets · github.com/external-secrets/external-sec…
- CVE-2011-10009S40 CMS 0.4.2 Path TraversalS40 CMS
- CVE-2012-10056PHP Volunteer Management System 1.0.2 Arbitrary File UploadPHP Volunteer Management
- CVE-2011-10012NetOp Remote Control Client 9.5 .dws File Buffer OverflowNetOp Remote Control Client
- CVE-2012-10057Lattice Semiconductor ispVM System 18.0.2 XCF File Handling Buffer OverflowLattice Semiconductor ispVM System
- CVE-2011-10014GTA SA-MP server.cfg Buffer OverflowSA-MP Team San Andreas Multiplayer
- CVE-2024-5477A potential security vulnerability has been identified in the System BIOS for some HP PC products which may allow escalation of privilege, aCertain HP PC Products
- CVE-2025-8754ABB AbilityTM zenon Remote Transport VulnerabilityABB AbilityTM zenon
- CVE-2025-23306NVIDIA Megatron-LM for all platforms contains a vulnerability in the megatron/training/ arguments.py component where an attacker could causeNVIDIA Megatron-LM
- CVE-2025-23305NVIDIA Megatron-LM for all platforms contains a vulnerability in the tools component, where an attacker may exploit a code injection issue.NVIDIA Megatron-LM
- CVE-2025-23298NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability in a python dependency, where an attacker could cause a code injecNVIDIA Merlin Transformers4Rec
- CVE-2025-6186Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-7739Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-7734Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2025-23296NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue.NVIDIA Isaac-GR00T N1
- CVE-2025-23295NVIDIA Apex for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue by providiNVIDIA Apex
- CVE-2025-23304NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injection NVIDIA NeMo Framework
- CVE-2025-23303NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote codeNVIDIA NeMo Framework
- CVE-2025-23294NVIDIA WebDataset for all platforms contains a vulnerability where an attacker could execute arbitrary code with elevated permissions.NVIDIA WebDataset
- CVE-2025-48500BIG-IP APM VPN web client for macOS vulnerabilityF5 BIG-IP Edge Client · F5 BIG-IP
- CVE-2025-46405BIG-IP APM vulnerabilityF5 BIG-IP
- CVE-2025-52585BIG-IP Client SSL profile vulnerabilityF5 BIG-IP
- CVE-2025-54809F5 Access for Android vulnerabilityF5 Access
- CVE-2025-8941Linux-pam: incomplete fix for cve-2025-6020linux-pam · Red Hat Enterprise Linux 7 Extended Lifecycl… +8
- CVE-2025-55163Netty MadeYouReset HTTP/2 DDoS Vulnerabilitynetty · io.netty:netty-codec-http2 +1
- CVE-2025-55154ImageMagick: integer overflows in MNG magnificationImageMagick · Magick.NET-Q8-x86 +17
- CVE-2025-55004ImageMagick: heap-buffer overflow read in MNG magnification with alphaImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2025-32451A memory corruption vulnerability exists in Foxit Reader 2025.1.0.27937 due to the use of an uninitialized pointer.Foxit Reader
- CVE-2025-54074Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP ServerCherryHQ cherry-studio
- CVE-2025-8907H3C M2 NAS Webserver Configuration unnecessary privilegesH3C M2 NAS
- CVE-2025-48989Apache Tomcat: h2 DoS - Made You ResetApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2025-8671CVE-2025-8671SUSE Linux Enterprise Module for Development Tools · SU… +13
- CVE-2025-54464Cleartext Storage Vulnerability in ZKTeco WL20ZKTeco WL20 Biometric Attendance System
- CVE-2025-8914WellChoose｜Organization Portal System - SQL InjectionWellChoose Organization Portal System
- CVE-2025-8912WellChoose｜Organization Portal System - Arbitrary File Reading through Path TraversalWellChoose Organization Portal System
- CVE-2025-55345Unsafe symlink following in restricted workspace-write sandbox leads to RCE@openai/codex
- CVE-2025-6184Tutor LMS Pro – eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injectionthemeum Tutor LMS Pro
- CVE-2025-8761INSTAR 2K+/4K Backend IPC Server denial of serviceINSTAR 2K+ · INSTAR
- CVE-2025-8762INSTAR 2K+/4K UART improper physical access controlINSTAR 2K+ · INSTAR
- CVE-2025-8882Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestGoogle Chrome
- CVE-2025-8901Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via aGoogle Chrome
- CVE-2025-8880Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML Google Chrome
- CVE-2025-8879Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2025-4410SetupUtility: A buffer overflow vulnerability leads to arbitrary code execution.Insyde Software InsydeH2O
- CVE-2025-4277Tcg2Smm: improper input validation may lead to arbitrary code executionInsyde Software InsydeH2O
- CVE-2025-4276UsbCoreDxe: improper input validation may lead to arbitrary code executionInsyde Software InsydeH2O
- CVE-2025-43988KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers to retrieve sensitive
- CVE-2025-50608A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00471994 function of the cgitest.cgi file.
- CVE-2025-50609A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the Function_00465620 of the cgitest.cgi file.
- CVE-2025-50610A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00476598 function of the cgitest.cgi file.
- CVE-2025-50611A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00473154 function of the cgitest.cgi file.
- CVE-2025-50612A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN_004743f8 function of the cgitest.cgi file.
- CVE-2025-50613A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00475e1c function of the cgitest.cgi file.
- CVE-2025-50614A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN_0047151c function of the cgitest.cgi file.
- CVE-2025-50615A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00470c50 function of the cgitest.cgi file.
- CVE-2025-50616A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046f984 function of the cgitest.cgi file.
- CVE-2025-50617A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046ed68 function of the cgitest.cgi file.
- CVE-2025-50635A null pointer dereference vulnerability was discovered in Netis WF2780 v2.2.35445.
Medium, low and unrated 59
- CVE-2025-55198Helm May Panic Due To Incorrect YAML Contenthelm · helm.sh/helm/v3 +1
- CVE-2025-55199Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustionhelm · helm.sh/helm/v3 +1
- CVE-2025-55197pypdf's Manipulated FlateDecode streams can exhaust RAMpy-pdf pypdf · pypdf
- CVE-2025-55194Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar UploadPart-DB-server
- CVE-2025-55193Active Record logging vulnerable to ANSI escape injectionrails · activerecord
- CVE-2025-8929code-projects Medical Store Management System MainPanel.java sql injectioncode-projects Medical Store Management System
- CVE-2025-8928code-projects Medical Store Management System Update Medicines UpdateMedicines.java sql injectioncode-projects Medical Store Management System
- CVE-2025-8927mtons mblog Verification Code send_code excessive authenticationmtons mblog
- CVE-2025-8926SourceCodester COVID 19 Testing Management System login.php sql injectionSourceCodester COVID 19 Testing Management System
- CVE-2025-8925itsourcecode Sports Management System match.php sql injectionitsourcecode Sports Management System
- CVE-2025-8924Campcodes Online Water Billing System viewbill.php sql injectionCampcodes Online Water Billing System
- CVE-2025-8923code-projects Job Diary edit-details.php sql injectioncode-projects Job Diary
- CVE-2025-8922code-projects Job Diary admin-inbox.php sql injectioncode-projects Job Diary
- CVE-2025-8921code-projects Job Diary user-apply.php sql injectioncode-projects Job Diary
- CVE-2025-8920Portabilis i-Diario Dicionário de Termos BNCC dicionario-de-termos-bncc cross site scriptingPortabilis i-Diario
- CVE-2025-8919Portabilis i-Diario History objetivos-de-aprendizagem-e-habilidades cross site scriptingPortabilis i-Diario
- CVE-2024-10219Incorrect Authorization in GitLabGitLab
- CVE-2024-12303Incorrect Privilege Assignment in GitLabGitLab
- CVE-2025-1477Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-2498Insufficient Granularity of Access Control in GitLabGitLab
- CVE-2025-2614Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-2937Inefficient Regular Expression Complexity in GitLabGitLab
- CVE-2025-5819Incorrect Permission Assignment for Critical Resource in GitLabGitLab
- CVE-2025-8770Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2025-2184Cortex XDR Broker VM: Secrets Shared Across Multiple Broker VM ImagesPalo Alto Networks Cortex XDR Broker VM
- CVE-2025-2183GlobalProtect App: Improper Certificate Validation Leads to Privilege EscalationPalo Alto Networks GlobalProtect App · Palo Alto Networks G…
- CVE-2025-2182PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK)Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2025-2181Checkov by Prisma Cloud: Cleartext Exposure of CredentialsPalo Alto Networks Checkov by Prisma Cloud
- CVE-2025-2180Checkov by Prisma Cloud: Unsafe Deserialization of Terraform Files Allows Code ExecutionPalo Alto Networks Checkov by Prisma Cloud
- CVE-2025-8918Portabilis i-Educar Editar educar_instituicao_cad.php cross site scriptingPortabilis i-Educar
- CVE-2025-53859NGINX ngx_mail_smtp_module vulnerabilityF5 NGINX Plus · F5 NGINX Open Source
- CVE-2025-54500HTTP/2 VulnerabilityF5 BIG-IP
- CVE-2025-54791OMERO.web displays unecessary user information when requesting to reset the passwordomero-web
- CVE-2025-55160ImageMagick Undefined Behavior (function-type-mismatch) in CloneSplayTreeImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2025-55005ImageMagick: heap-buffer overflow in log colorspace handlingImageMagick
- CVE-2025-55668Apache Tomcat: session fixation via rewrite valveApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2025-8908Shanghai Lingdang Information Technology Lingdang CRM event.php sql injectionShanghai Lingdang Information Technology Lingdang CRM
- CVE-2025-55280Information Disclosure Vulnerability in ZKTeco WL20ZKTeco WL20 Biometric Attendance System
- CVE-2025-55279Hard-coded Private Key Vulnerability in ZKTeco WL20ZKTeco WL20 Biometric Attendance System
- CVE-2025-54465Hard-coded Credentials Vulnerability in ZKTeco WL20ZKTeco WL20 Biometric Attendance System
- CVE-2025-8916Possible DOS in processing large name constraint structures in PKIXCertPathReveiwerLegion of the Bouncy Castle BC Java · Legion of the Boun… +4
- CVE-2025-8911WellChoose｜Organization Portal System - Reflected Cross-site ScriptingWellChoose Organization Portal System
- CVE-2025-8910WellChoose｜Organization Portal System - Reflected Cross-site ScriptingWellChoose Organization Portal System
- CVE-2025-8909WellChoose｜Organization Portal System - Arbitrary File Reading through Path TraversalWellChoose Organization Portal System
- CVE-2025-0818Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletionninjateam File Manager Pro – Filester · saadiqbal Advanc… +1
- CVE-2025-8491Easy restaurant menu manager <= 2.0.2 - Cross-Site Request Forgery to Menu Uploadnikelschubert Easy restaurant menu manager
- CVE-2025-8891OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin InstallationOceanWP
- CVE-2025-8881Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engagGoogle Chrome
- CVE-2025-43989The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetti
- CVE-2025-45313A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in
- CVE-2025-45314A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript
- CVE-2025-45315A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary
- CVE-2025-45316A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary
- CVE-2025-45317A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary code via a c
- CVE-2025-50690A Cross-Site Scripting (XSS) vulnerability exists in SpatialReference.org (OSGeo/spatialreference.org) versions prior to 2025-05-17 (commit
- CVE-2025-50946OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.github.com/OliveTin/OliveTin
- CVE-2025-51691Cross-Site Scripting (XSS) vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 (May 2025) allows a remote attacke
- CVE-2025-52386CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file
- CVE-2025-52392Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms.soosyze/soosyze