# CVEs published 2025-08-13

145 CVEs were published on August 13, 2025: 28 critical, 58 high. Days are UTC.

- [CVE-2025-55198](https://cve.now/CVE-2025-55198.md): Helm May Panic Due To Incorrect YAML Content (CVSS 6.5, helm · helm.sh/helm/v3 +1)
- [CVE-2025-55199](https://cve.now/CVE-2025-55199.md): Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion (CVSS 6.5, helm · helm.sh/helm/v3 +1)
- [CVE-2025-55197](https://cve.now/CVE-2025-55197.md): pypdf's Manipulated FlateDecode streams can exhaust RAM (CVSS 6.6, py-pdf pypdf · pypdf)
- [CVE-2025-55196](https://cve.now/CVE-2025-55196.md): External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Access (CVSS 7.1, external-secrets · github.com/external-secrets/external-sec…)
- [CVE-2025-55194](https://cve.now/CVE-2025-55194.md): Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload (CVSS 5.7, Part-DB-server)
- [CVE-2025-55193](https://cve.now/CVE-2025-55193.md): Active Record logging vulnerable to ANSI escape injection (CVSS 2.7, rails · activerecord)
- [CVE-2025-8929](https://cve.now/CVE-2025-8929.md): code-projects Medical Store Management System MainPanel.java sql injection (CVSS 5.3, code-projects Medical Store Management System)
- [CVE-2025-8928](https://cve.now/CVE-2025-8928.md): code-projects Medical Store Management System Update Medicines UpdateMedicines.java sql injection (CVSS 5.3, code-projects Medical Store Management System)
- [CVE-2025-34154](https://cve.now/CVE-2025-34154.md): UnForm Server Manager \< 10.1.12 Unauthenticated Arbitrary File Read (CVSS 9.2, Synergetic Data Systems UnForm Server Manager)
- [CVE-2011-10011](https://cve.now/CVE-2011-10011.md): WeBid 1.0.2 converter.php Remote PHP Code Injection (CVSS 10.0, WeBid)
- [CVE-2012-10054](https://cve.now/CVE-2012-10054.md): Umbraco CMS \< 4.7.1 codeEditorSave.asmx RCE (CVSS 9.3, Umbraco CMS)
- [CVE-2011-10013](https://cve.now/CVE-2011-10013.md): Traq 2.0–2.3 admincp/common.php RCE (CVSS 10.0, Traq Project Issue Tracking System)
- [CVE-2012-10060](https://cve.now/CVE-2012-10060.md): Sysax Multi Server \< 5.55 SSH Username Buffer Overflow (CVSS 9.3, Sysax Software Multi Server)
- [CVE-2011-10019](https://cve.now/CVE-2011-10019.md): Spreecommerce \< 0.60.2 Search Parameter RCE (CVSS 10.0, Spreecommerce · spree)
- [CVE-2011-10017](https://cve.now/CVE-2011-10017.md): Snort Report nmap.php/nbtscan.php RCE (CVSS 10.0, Symmetrix Technologies Snort Report)
- [CVE-2011-10009](https://cve.now/CVE-2011-10009.md): S40 CMS 0.4.2 Path Traversal (CVSS 8.7, S40 CMS)
- [CVE-2011-10016](https://cve.now/CVE-2011-10016.md): Real Networks Netzip Classic 7.5.1.86 File Parsing Buffer Overflow (CVSS 9.3, RealNetworks Netzip Classic)
- [CVE-2012-10058](https://cve.now/CVE-2012-10058.md): RabidHamster R4 Log Entry sprintf() Buffer Overflow (CVSS 10.0, RabidHamster R4 Embedded Server)
- [CVE-2011-10010](https://cve.now/CVE-2011-10010.md): QuickShare File Server 1.2.1 Path Traversal RCE (CVSS 9.4, QuickShareHQ QuickShare File Server)
- [CVE-2012-10056](https://cve.now/CVE-2012-10056.md): PHP Volunteer Management System 1.0.2 Arbitrary File Upload (CVSS 8.7, PHP Volunteer Management)
- [CVE-2011-10012](https://cve.now/CVE-2011-10012.md): NetOp Remote Control Client 9.5 .dws File Buffer Overflow (CVSS 8.4, NetOp Remote Control Client)
- [CVE-2011-10018](https://cve.now/CVE-2011-10018.md): myBB 1.6.4 Backdoor Arbitrary Command Execution (CVSS 10.0, myBB Group Forum Software)
- [CVE-2012-10057](https://cve.now/CVE-2012-10057.md): Lattice Semiconductor ispVM System 18.0.2 XCF File Handling Buffer Overflow (CVSS 8.4, Lattice Semiconductor ispVM System)
- [CVE-2011-10014](https://cve.now/CVE-2011-10014.md): GTA SA-MP server.cfg Buffer Overflow (CVSS 8.7, SA-MP Team San Andreas Multiplayer)
- [CVE-2012-10059](https://cve.now/CVE-2012-10059.md): Dolibarr ERP/CRM Post-Auth OS Command Injection (CVSS 9.4, Dolibarr Project ERP/CRM)
- [CVE-2011-10015](https://cve.now/CVE-2011-10015.md): Cytel Studio \<= 9.0 .CY3 File Stack Buffer Overflow (CVSS 9.3, Cytel Studio)
- [CVE-2012-10055](https://cve.now/CVE-2012-10055.md): ComSndFTP v1.3.7 Beta USER Format String RCE (CVSS 9.3, ComSndFTP FTP Server)
- [CVE-2025-8927](https://cve.now/CVE-2025-8927.md): mtons mblog Verification Code send\_code excessive authentication (CVSS 6.3, mtons mblog)
- [CVE-2025-8926](https://cve.now/CVE-2025-8926.md): SourceCodester COVID 19 Testing Management System login.php sql injection (CVSS 6.9, SourceCodester COVID 19 Testing Management System)
- [CVE-2025-8925](https://cve.now/CVE-2025-8925.md): itsourcecode Sports Management System match.php sql injection (CVSS 6.9, itsourcecode Sports Management System)
- [CVE-2025-8924](https://cve.now/CVE-2025-8924.md): Campcodes Online Water Billing System viewbill.php sql injection (CVSS 6.9, Campcodes Online Water Billing System)
- [CVE-2025-8923](https://cve.now/CVE-2025-8923.md): code-projects Job Diary edit-details.php sql injection (CVSS 6.9, code-projects Job Diary)
- [CVE-2025-8922](https://cve.now/CVE-2025-8922.md): code-projects Job Diary admin-inbox.php sql injection (CVSS 6.9, code-projects Job Diary)
- [CVE-2025-8921](https://cve.now/CVE-2025-8921.md): code-projects Job Diary user-apply.php sql injection (CVSS 6.9, code-projects Job Diary)
- [CVE-2025-8920](https://cve.now/CVE-2025-8920.md): Portabilis i-Diario Dicionário de Termos BNCC dicionario-de-termos-bncc cross site scripting (CVSS 4.8, Portabilis i-Diario)
- [CVE-2024-5477](https://cve.now/CVE-2024-5477.md): A potential security vulnerability has been identified in the System BIOS for some HP PC products which may allow escalation of privilege, a (CVSS 7.3, Certain HP PC Products)
- [CVE-2025-8754](https://cve.now/CVE-2025-8754.md): ABB AbilityTM zenon Remote Transport Vulnerability (CVSS 7.5, ABB AbilityTM zenon)
- [CVE-2025-23306](https://cve.now/CVE-2025-23306.md): NVIDIA Megatron-LM for all platforms contains a vulnerability in the megatron/training/ arguments.py component where an attacker could cause (CVSS 7.8, NVIDIA Megatron-LM)
- [CVE-2025-23305](https://cve.now/CVE-2025-23305.md): NVIDIA Megatron-LM for all platforms contains a vulnerability in the tools component, where an attacker may exploit a code injection issue. (CVSS 7.8, NVIDIA Megatron-LM)
- [CVE-2025-8919](https://cve.now/CVE-2025-8919.md): Portabilis i-Diario History objetivos-de-aprendizagem-e-habilidades cross site scripting (CVSS 4.8, Portabilis i-Diario)
- [CVE-2025-23298](https://cve.now/CVE-2025-23298.md): NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability in a python dependency, where an attacker could cause a code injec (CVSS 7.8, NVIDIA Merlin Transformers4Rec)
- [CVE-2024-10219](https://cve.now/CVE-2024-10219.md): Incorrect Authorization in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-12303](https://cve.now/CVE-2024-12303.md): Incorrect Privilege Assignment in GitLab (CVSS 6.7, GitLab)
- [CVE-2025-1477](https://cve.now/CVE-2025-1477.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-2498](https://cve.now/CVE-2025-2498.md): Insufficient Granularity of Access Control in GitLab (CVSS 3.1, GitLab)
- [CVE-2025-2614](https://cve.now/CVE-2025-2614.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-2937](https://cve.now/CVE-2025-2937.md): Inefficient Regular Expression Complexity in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-5819](https://cve.now/CVE-2025-5819.md): Incorrect Permission Assignment for Critical Resource in GitLab (CVSS 5.0, GitLab)
- [CVE-2025-6186](https://cve.now/CVE-2025-6186.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-7739](https://cve.now/CVE-2025-7739.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-7734](https://cve.now/CVE-2025-7734.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-8770](https://cve.now/CVE-2025-8770.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-23296](https://cve.now/CVE-2025-23296.md): NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue. (CVSS 7.8, NVIDIA Isaac-GR00T N1)
- [CVE-2025-23295](https://cve.now/CVE-2025-23295.md): NVIDIA Apex for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue by providi (CVSS 7.8, NVIDIA Apex)
- [CVE-2025-23304](https://cve.now/CVE-2025-23304.md): NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injection (CVSS 7.8, NVIDIA NeMo Framework)
- [CVE-2025-23303](https://cve.now/CVE-2025-23303.md): NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote code (CVSS 7.8, NVIDIA NeMo Framework)
- [CVE-2025-23294](https://cve.now/CVE-2025-23294.md): NVIDIA WebDataset for all platforms contains a vulnerability where an attacker could execute arbitrary code with elevated permissions. (CVSS 7.8, NVIDIA WebDataset)
- [CVE-2025-8904](https://cve.now/CVE-2025-8904.md): Privilege escalation issue in Amazon EMR Secret Agent component (CVSS 9.0, Amazon EMR)
- [CVE-2025-2184](https://cve.now/CVE-2025-2184.md): Cortex XDR Broker VM: Secrets Shared Across Multiple Broker VM Images (CVSS 5.3, Palo Alto Networks Cortex XDR Broker VM)
- [CVE-2025-2183](https://cve.now/CVE-2025-2183.md): GlobalProtect App: Improper Certificate Validation Leads to Privilege Escalation (CVSS 5.3, Palo Alto Networks GlobalProtect App · Palo Alto Networks G…)
- [CVE-2025-2182](https://cve.now/CVE-2025-2182.md): PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK) (CVSS 5.6, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2025-2181](https://cve.now/CVE-2025-2181.md): Checkov by Prisma Cloud: Cleartext Exposure of Credentials (CVSS 5.9, Palo Alto Networks Checkov by Prisma Cloud)
- [CVE-2025-2180](https://cve.now/CVE-2025-2180.md): Checkov by Prisma Cloud: Unsafe Deserialization of Terraform Files Allows Code Execution (CVSS 4.8, Palo Alto Networks Checkov by Prisma Cloud)
- [CVE-2025-34153](https://cve.now/CVE-2025-34153.md): Hyland OnBase \< 17.0.2.87 .NET Remoting TCP Channel Unauthenticated RCE (CVSS 10.0, Hyland Software OnBase)
- [CVE-2025-8918](https://cve.now/CVE-2025-8918.md): Portabilis i-Educar Editar educar\_instituicao\_cad.php cross site scripting (CVSS 4.8, Portabilis i-Educar)
- [CVE-2025-53859](https://cve.now/CVE-2025-53859.md): NGINX ngx\_mail\_smtp\_module vulnerability (CVSS 3.7, F5 NGINX Plus · F5 NGINX Open Source)
- [CVE-2025-54500](https://cve.now/CVE-2025-54500.md): HTTP/2 Vulnerability (CVSS 5.3, F5 BIG-IP)
- [CVE-2025-48500](https://cve.now/CVE-2025-48500.md): BIG-IP APM VPN web client for macOS vulnerability (CVSS 7.3, F5 BIG-IP Edge Client · F5 BIG-IP)
- [CVE-2025-46405](https://cve.now/CVE-2025-46405.md): BIG-IP APM vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2025-52585](https://cve.now/CVE-2025-52585.md): BIG-IP Client SSL profile vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2025-54809](https://cve.now/CVE-2025-54809.md): F5 Access for Android vulnerability (CVSS 7.4, F5 Access)
- [CVE-2025-8941](https://cve.now/CVE-2025-8941.md): Linux-pam: incomplete fix for cve-2025-6020 (CVSS 7.8, linux-pam · Red Hat Enterprise Linux 7 Extended Lifecycl… +8)
- [CVE-2025-55163](https://cve.now/CVE-2025-55163.md): Netty MadeYouReset HTTP/2 DDoS Vulnerability (CVSS 8.2, netty · io.netty:netty-codec-http2 +1)
- [CVE-2025-54791](https://cve.now/CVE-2025-54791.md): OMERO.web displays unecessary user information when requesting to reset the password (CVSS 5.3, omero-web)
- [CVE-2025-55160](https://cve.now/CVE-2025-55160.md): ImageMagick Undefined Behavior (function-type-mismatch) in CloneSplayTree (CVSS 6.1, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2025-55154](https://cve.now/CVE-2025-55154.md): ImageMagick: integer overflows in MNG magnification (CVSS 8.8, ImageMagick · Magick.NET-Q8-x86 +17)
- [CVE-2025-55005](https://cve.now/CVE-2025-55005.md): ImageMagick: heap-buffer overflow in log colorspace handling (CVSS 5.5, ImageMagick)
- [CVE-2025-55004](https://cve.now/CVE-2025-55004.md): ImageMagick: heap-buffer overflow read in MNG magnification with alpha (CVSS 7.6, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2025-32451](https://cve.now/CVE-2025-32451.md): A memory corruption vulnerability exists in Foxit Reader 2025.1.0.27937 due to the use of an uninitialized pointer. (CVSS 8.8, Foxit Reader)
- [CVE-2025-54382](https://cve.now/CVE-2025-54382.md): Cherry Studio RCE Vulnerability Disclosure (CVSS 9.7, CherryHQ cherry-studio)
- [CVE-2025-54074](https://cve.now/CVE-2025-54074.md): Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP Server (CVSS 7.7, CherryHQ cherry-studio)
- [CVE-2025-55668](https://cve.now/CVE-2025-55668.md): Apache Tomcat: session fixation via rewrite valve (CVSS 6.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2025-8908](https://cve.now/CVE-2025-8908.md): Shanghai Lingdang Information Technology Lingdang CRM event.php sql injection (CVSS 5.3, Shanghai Lingdang Information Technology Lingdang CRM)
- [CVE-2025-8907](https://cve.now/CVE-2025-8907.md): H3C M2 NAS Webserver Configuration unnecessary privileges (CVSS 7.3, H3C M2 NAS)
- [CVE-2025-48989](https://cve.now/CVE-2025-48989.md): Apache Tomcat: h2 DoS - Made You Reset (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2025-8671](https://cve.now/CVE-2025-8671.md): CVE-2025-8671 (CVSS 7.5, SUSE Linux Enterprise Module for Development Tools · SU… +13)
- [CVE-2025-55280](https://cve.now/CVE-2025-55280.md): Information Disclosure Vulnerability in ZKTeco WL20 (CVSS 5.2, ZKTeco WL20 Biometric Attendance System)
- [CVE-2025-55279](https://cve.now/CVE-2025-55279.md): Hard-coded Private Key Vulnerability in ZKTeco WL20 (CVSS 6.9, ZKTeco WL20 Biometric Attendance System)
- [CVE-2025-54465](https://cve.now/CVE-2025-54465.md): Hard-coded Credentials Vulnerability in ZKTeco WL20 (CVSS 6.8, ZKTeco WL20 Biometric Attendance System)
- [CVE-2025-54464](https://cve.now/CVE-2025-54464.md): Cleartext Storage Vulnerability in ZKTeco WL20 (CVSS 7.0, ZKTeco WL20 Biometric Attendance System)
- [CVE-2025-8916](https://cve.now/CVE-2025-8916.md): Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer (CVSS 6.3, Legion of the Bouncy Castle BC Java · Legion of the Boun… +4)
- [CVE-2025-8914](https://cve.now/CVE-2025-8914.md): WellChoose｜Organization Portal System - SQL Injection (CVSS 7.1, WellChoose Organization Portal System)
- [CVE-2025-8913](https://cve.now/CVE-2025-8913.md): WellChoose｜Organization Portal System - Local File Inclusion (CVSS 9.3, WellChoose Organization Portal System)
- [CVE-2025-8912](https://cve.now/CVE-2025-8912.md): WellChoose｜Organization Portal System - Arbitrary File Reading through Path Traversal (CVSS 7.5, WellChoose Organization Portal System)
- [CVE-2025-8911](https://cve.now/CVE-2025-8911.md): WellChoose｜Organization Portal System - Reflected Cross-site Scripting (CVSS 5.3, WellChoose Organization Portal System)
- [CVE-2025-8910](https://cve.now/CVE-2025-8910.md): WellChoose｜Organization Portal System - Reflected Cross-site Scripting (CVSS 5.3, WellChoose Organization Portal System)
- [CVE-2025-8909](https://cve.now/CVE-2025-8909.md): WellChoose｜Organization Portal System - Arbitrary File Reading through Path Traversal (CVSS 6.5, WellChoose Organization Portal System)
- [CVE-2025-55345](https://cve.now/CVE-2025-55345.md): Unsafe symlink following in restricted workspace-write sandbox leads to RCE (CVSS 8.8, @openai/codex)
- [CVE-2025-6184](https://cve.now/CVE-2025-6184.md): Tutor LMS Pro – eLearning and online course solution \<= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injection (CVSS 8.8, themeum Tutor LMS Pro)
- [CVE-2025-8761](https://cve.now/CVE-2025-8761.md): INSTAR 2K+/4K Backend IPC Server denial of service (CVSS 8.7, INSTAR 2K+ · INSTAR)
- [CVE-2025-8762](https://cve.now/CVE-2025-8762.md): INSTAR 2K+/4K UART improper physical access control (CVSS 7.0, INSTAR 2K+ · INSTAR)
- [CVE-2025-8760](https://cve.now/CVE-2025-8760.md): INSTAR 2K+/4K fcgi\_server base64\_decode buffer overflow (CVSS 9.3, INSTAR 2K+ · INSTAR)
- [CVE-2025-6715](https://cve.now/CVE-2025-6715.md): Latepoint \< 5.1.94 - Unauthenticated LFI (CVSS 9.8, LatePoint)
- [CVE-2025-7384](https://cve.now/CVE-2025-7384.md): Database for Contact Form 7, WPforms, Elementor forms \<= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion (CVSS 9.8, crmperks Database for Contact Form 7, WPforms, Elementor fo…)
- [CVE-2025-0818](https://cve.now/CVE-2025-0818.md): Multiple elFinder Plugins \<= (Various Versions) - Directory Traversal to Arbitrary File Deletion (CVSS 6.5, ninjateam File Manager Pro – Filester · saadiqbal Advanc… +1)
- [CVE-2025-8491](https://cve.now/CVE-2025-8491.md): Easy restaurant menu manager \<= 2.0.2 - Cross-Site Request Forgery to Menu Upload (CVSS 4.3, nikelschubert Easy restaurant menu manager)
- [CVE-2025-8891](https://cve.now/CVE-2025-8891.md): OceanWP \<= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation (CVSS 4.3, OceanWP)
- [CVE-2025-8882](https://cve.now/CVE-2025-8882.md): Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gest (CVSS 8.8, Google Chrome)
- [CVE-2025-8881](https://cve.now/CVE-2025-8881.md): Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engag (CVSS 6.5, Google Chrome)
- [CVE-2025-8901](https://cve.now/CVE-2025-8901.md): Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via a (CVSS 8.8, Google Chrome)
- [CVE-2025-8880](https://cve.now/CVE-2025-8880.md): Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML (CVSS 8.8, Google Chrome)
- [CVE-2025-8879](https://cve.now/CVE-2025-8879.md): Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2025-4410](https://cve.now/CVE-2025-4410.md): SetupUtility: A buffer overflow vulnerability leads to arbitrary code execution. (CVSS 7.5, Insyde Software InsydeH2O)
- [CVE-2025-4277](https://cve.now/CVE-2025-4277.md): Tcg2Smm: improper input validation may lead to arbitrary code execution (CVSS 7.5, Insyde Software InsydeH2O)
- [CVE-2025-4276](https://cve.now/CVE-2025-4276.md): UsbCoreDxe: improper input validation may lead to arbitrary code execution (CVSS 7.5, Insyde Software InsydeH2O)
- [CVE-2025-43982](https://cve.now/CVE-2025-43982.md): Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default. (CVSS 9.8)
- [CVE-2025-43986](https://cve.now/CVE-2025-43986.md): An issue was discovered on KuWFi GC111 GC111-GL-LM321\_V3.0\_20191211 devices. (CVSS 9.8)
- [CVE-2025-43988](https://cve.now/CVE-2025-43988.md): KuWFi 5G01-X55 FL2020\_V0.0.12 devices expose an unauthenticated API endpoint (ajax\_get.cgi), allowing remote attackers to retrieve sensitive (CVSS 7.5)
- [CVE-2025-43989](https://cve.now/CVE-2025-43989.md): The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set\_timesetti (CVSS 6.5)
- [CVE-2025-45313](https://cve.now/CVE-2025-45313.md): A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in (CVSS 6.1)
- [CVE-2025-45314](https://cve.now/CVE-2025-45314.md): A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript (CVSS 6.1)
- [CVE-2025-45315](https://cve.now/CVE-2025-45315.md): A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary (CVSS 5.4)
- [CVE-2025-45316](https://cve.now/CVE-2025-45316.md): A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary (CVSS 6.1)
- [CVE-2025-45317](https://cve.now/CVE-2025-45317.md): A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary code via a c (CVSS 6.5)
- [CVE-2025-50251](https://cve.now/CVE-2025-50251.md): Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery. (CVSS 9.1)
- [CVE-2025-50594](https://cve.now/CVE-2025-50594.md): An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management (CVSS 9.8)
- [CVE-2025-50608](https://cve.now/CVE-2025-50608.md): A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN\_00471994 function of the cgitest.cgi file. (CVSS 7.5)
- [CVE-2025-50609](https://cve.now/CVE-2025-50609.md): A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the Function\_00465620 of the cgitest.cgi file. (CVSS 7.5)
- [CVE-2025-50610](https://cve.now/CVE-2025-50610.md): A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN\_00476598 function of the cgitest.cgi file. (CVSS 7.5)
- [CVE-2025-50611](https://cve.now/CVE-2025-50611.md): A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN\_00473154 function of the cgitest.cgi file. (CVSS 7.5)
- [CVE-2025-50612](https://cve.now/CVE-2025-50612.md): A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN\_004743f8 function of the cgitest.cgi file. (CVSS 7.5)
- [CVE-2025-50613](https://cve.now/CVE-2025-50613.md): A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN\_00475e1c function of the cgitest.cgi file. (CVSS 7.5)
- [CVE-2025-50614](https://cve.now/CVE-2025-50614.md): A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN\_0047151c function of the cgitest.cgi file. (CVSS 7.5)
- [CVE-2025-50615](https://cve.now/CVE-2025-50615.md): A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN\_00470c50 function of the cgitest.cgi file. (CVSS 7.5)
- [CVE-2025-50616](https://cve.now/CVE-2025-50616.md): A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN\_0046f984 function of the cgitest.cgi file. (CVSS 7.5)
- [CVE-2025-50617](https://cve.now/CVE-2025-50617.md): A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN\_0046ed68 function of the cgitest.cgi file. (CVSS 7.5)
- [CVE-2025-50635](https://cve.now/CVE-2025-50635.md): A null pointer dereference vulnerability was discovered in Netis WF2780 v2.2.35445. (CVSS 7.5)
- [CVE-2025-50690](https://cve.now/CVE-2025-50690.md): A Cross-Site Scripting (XSS) vulnerability exists in SpatialReference.org (OSGeo/spatialreference.org) versions prior to 2025-05-17 (commit (CVSS 6.1)
- [CVE-2025-50946](https://cve.now/CVE-2025-50946.md): OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go. (CVSS 6.5, github.com/OliveTin/OliveTin)
- [CVE-2025-51451](https://cve.now/CVE-2025-51451.md): In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm. (CVSS 9.8)
- [CVE-2025-51452](https://cve.now/CVE-2025-51452.md): In TOTOLINK A7000R firmware 9.1.0u.6115\_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm. (CVSS 9.8)
- [CVE-2025-51691](https://cve.now/CVE-2025-51691.md): Cross-Site Scripting (XSS) vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 (May 2025) allows a remote attacke (CVSS 6.1)
- [CVE-2025-52385](https://cve.now/CVE-2025-52385.md): An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the child\_process mo (CVSS 9.8)
- [CVE-2025-52386](https://cve.now/CVE-2025-52386.md): CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file (CVSS 5.4)
- [CVE-2025-52392](https://cve.now/CVE-2025-52392.md): Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. (CVSS 5.4, soosyze/soosyze)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.