CVEs published August 16, 2025
95 CVEs were published on August 16, 2025: 8 critical, 34 high.
- Published
- 95
- Critical
- 8
- High
- 34
- Medium
- 21
- Low
- 1
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- Linux
- 59
- pencidesign Soledad
- 3
- Tenda AC20
- 3
- dasinfomedia School Management System for Wordpress
- 2
- dasinfomedia WPGYM - Wordpress Gym Management System
- 2
- yeashir Anber Elementor Addon
- 2
- anthropics claude-code · @anthropic-ai/claude-code
- 1
- ays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…
- 1
- cozmoslabs User Profile Builder – Beautiful User Registrati…
- 1
- delabon Woocommerce Blocks – Woolook
- 1
Critical 8
- CVE-2023-3867ksmbd: fix out of bounds read in smb2_sess_setupLinux
- CVE-2023-4515ksmbd: validate command request sizeLinux
- CVE-2023-32249ksmbd: not allow guest user on multichannelLinux
- CVE-2025-38552mptcp: plug races between subflow fail and subflow creationLinux
- CVE-2025-38533net: libwx: fix the using of Rx buffer DMALinux
- CVE-2025-38527smb: client: fix use-after-free in cifs_oplock_breakLinux
- CVE-2025-8898Taxi Booking Manager for Woocommerce | E-cab <= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account Takeovermagepeopleteam E-cab Taxi Booking Manager for Woocommerce
- CVE-2025-7441StoryChief <= 1.0.42 - Unauthenticated Arbitrary File UploadStoryChief
High 34
- CVE-2025-9089Tenda AC20 SetIpMacBind sub_48E628 stack-based overflowTenda AC20
- CVE-2025-9088Tenda AC20 formSetVirtualSer save_virtualser_data stack-based overflowTenda AC20
- CVE-2025-9087Tenda AC20 SetNetControlList Endpoint set_qosMib_list stack-based overflowTenda AC20
- CVE-2023-4130ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()Linux
- CVE-2023-3866ksmbd: validate session id and tree id in the compound requestLinux
- CVE-2023-3865ksmbd: fix out-of-bound read in smb2_writeLinux
- CVE-2025-38550ipv6: mcast: Delay put pmc->idev in mld_del_delrec()Linux
- CVE-2025-38547iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel mapsLinux
- CVE-2025-38545net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_infoLinux
- CVE-2025-38542net: appletalk: Fix device refcount leak in atrtr_create()Linux
- CVE-2025-38539tracing: Add down_write(trace_event_sem) when adding trace eventLinux
- CVE-2025-38536net: airoha: fix potential use-after-free in airoha_npu_get()Linux
- CVE-2025-38532net: libwx: properly reset Rx ring descriptorLinux
- CVE-2025-38528bpf: Reject %p% format string in bprintf-like helpersLinux
- CVE-2025-38526ice: add NULL check in eswitch lag checkLinux
- CVE-2025-38525rxrpc: Fix irq-disabled in local_bh_enable()Linux
- CVE-2025-38524rxrpc: Fix recv-recv race of completed callLinux
- CVE-2025-38523cifs: Fix the smbd_response slab to allow usercopyLinux
- CVE-2025-8105Soledad <= 8.6.7 - Unauthenticated Arbitrary Shortcode Executionpencidesign Soledad
- CVE-2025-8142Soledad <= 8.6.7 - Authenticated (Contributor+) Local File Inclusion via 'header_layout'pencidesign Soledad
- CVE-2025-38514rxrpc: Fix oops due to non-existence of prealloc backlog structLinux
- CVE-2025-38512wifi: prevent A-MSDU attacks in mesh networksLinux
- CVE-2025-38511drm/xe/pf: Clear all LMTT pages on allocLinux
- CVE-2025-38508x86/sev: Use TSC_FACTOR for Secure TSC frequency calculationLinux
- CVE-2025-38505wifi: mwifiex: discard erroneous disassoc frames on STA interfaceLinux
- CVE-2025-38502bpf: Fix oob access in cgroup local storageLinux
- CVE-2025-38501ksmbd: limit repeated connections from clients with the same IPLinux
- CVE-2025-6079School Management System <= 93.2.0 - Authenticated (Student+) Arbitrary File Uploaddasinfomedia School Management System for Wordpress
- CVE-2025-7664Al Pack <= 1.1.1 - Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Functionloword AL Pack
- CVE-2025-6080WPGYM <= 67.7.0 - Missing Authorization to Admin Account Creationdasinfomedia WPGYM - Wordpress Gym Management System
- CVE-2025-3671WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Updatedasinfomedia WPGYM - Wordpress Gym Management System
- CVE-2024-12612School Management System for Wordpress <= 93.2.0 - Unauthenticated SQL Injectiondasinfomedia School Management System for Wordpress
- CVE-2025-55284Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Codeanthropics claude-code · @anthropic-ai/claude-code
- CVE-2025-55286z2d OOB drawing with new multi-sample anti-aliasing could lead to invalid memory access and corruptionvancluever z2d
Medium, low and unrated 53
- CVE-2023-32246ksmbd: call rcu_barrier() in ksmbd_server_exit()Linux
- CVE-2025-38551virtio-net: fix recursived rtnl_lock() during probe()Linux
- CVE-2025-38549efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error pathsLinux
- CVE-2025-38548hwmon: (corsair-cpro) Validate the size of the received input bufferLinux
- CVE-2025-38546atm: clip: Fix memory leak of struct clip_vcc.Linux
- CVE-2025-38544rxrpc: Fix bug due to prealloc collisionLinux
- CVE-2025-38543drm/tegra: nvdec: Fix dma_alloc_coherent error checkLinux
- CVE-2025-38541wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init()Linux
- CVE-2025-38540HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP CamerasLinux
- CVE-2025-38538dmaengine: nbpfaxi: Fix memory corruption in probe()Linux
- CVE-2025-38537net: phy: Don't register LEDs for genphyLinux
- CVE-2025-38535phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY modeLinux
- CVE-2025-38534netfs: Fix copy-to-cache so that it performs collection with ceph+fscacheLinux
- CVE-2025-38531iio: common: st_sensors: Fix use of uninitialize device structsLinux
- CVE-2025-38530comedi: pcl812: Fix bit shift out of boundsLinux
- CVE-2025-38529comedi: aio_iiro_16: Fix bit shift out of boundsLinux
- CVE-2025-38522sched/ext: Prevent update_locked_rq() calls with NULL rqLinux
- CVE-2025-8143Soledad <= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h'pencidesign Soledad
- CVE-2025-8878Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Executionproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2025-38521drm/imagination: Fix kernel crash when hard resetting the GPULinux
- CVE-2025-38520drm/amdkfd: Don't call mmput from MMU notifier callbackLinux
- CVE-2025-38519mm/damon: fix divide by zero in damon_get_intervals_score()Linux
- CVE-2025-38518x86/CPU/AMD: Disable INVLPGB on Zen2Linux
- CVE-2025-38517lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users()Linux
- CVE-2025-38516pinctrl: qcom: msm: mark certain pins as invalid for interruptsLinux
- CVE-2025-38515drm/sched: Increment job count before swapping tail spsc queueLinux
- CVE-2025-38513wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()Linux
- CVE-2025-38510kasan: remove kasan_find_vm_area() to prevent possible deadlockLinux
- CVE-2025-38509wifi: mac80211: reject VHT opmode for unsupported channel widthsLinux
- CVE-2025-38507HID: nintendo: avoid bluetooth suspend/resume stallsLinux
- CVE-2025-38506KVM: Allow CPU to reschedule while setting per-page memory attributesLinux
- CVE-2025-38504io_uring/zcrx: fix pp destruction warningsLinux
- CVE-2025-38503btrfs: fix assertion when building free space treeLinux
- CVE-2025-9092Hybrid Module Deployment in Multi-JVM Environments Leading to Resource ExhaustionLegion of the Bouncy Castle Bouncy Castle for Java - BC-FJA…
- CVE-2025-8719Translate This - Google Translate Web Element Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via base_lang Parameterreubenthiessen Translate This gTranslate Shortcode
- CVE-2025-7499BetterDocs <= 4.1.1 - Missing Authorization to Private And Password-Protected Posts Information Disclosurewpdevteam BetterDocs – Knowledge Base Docs & FAQ Solution…
- CVE-2025-8464Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookieglenwpcoder Drag and Drop Multiple File Upload for Contact…
- CVE-2025-8089Advanced iFrame <= 2025.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingmdempfle Advanced iFrame
- CVE-2025-8896User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scriptingcozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2025-8113Ebook Store < 5.8015 - Reflected XSS via $_SERVER['REQUEST_URI']Ebook Store
- CVE-2025-7686weichuncai(WP伪春菜) <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scriptinglmyoaoa weichuncai
- CVE-2025-8293Intl DateTime Calendar <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via date ParameterTheerawat Patthawee Intl DateTime Calendar
- CVE-2024-8393Woocommerce Blocks – Woolook <= 1.7.0 - Authenticated (Admin+) Local File Inclusiondelabon Woocommerce Blocks – Woolook
- CVE-2025-7439Anber Elementor Addon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner button linkyeashir Anber Elementor Addon
- CVE-2025-7683LatestCheckins <= 1 - Cross-Site Request Forgery to Stored Cross-Site Scriptingjanyksteenbeek LatestCheckins
- CVE-2025-7668Linux Promotional Plugin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scriptingtimothyja Linux Promotional Plugin
- CVE-2025-7440Anber Elementor Addon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel button linkyeashir Anber Elementor Addon
- CVE-2025-7649Surbma | Recent Comments Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingSurbma | Recent Comments Shortcode
- CVE-2025-7651Earnware Connect <= 1.0.74 - Authenticated (Contributor+) Stored Cross-Site ScriptingEarnware Connect
- CVE-2025-7684Last.fm Recent Album Artwork <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scriptingremysharp Last.fm Recent Album Artwork
- CVE-2025-6221Embed Bokun <= 0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameterluuptek Embed Bokun
- CVE-2025-49895WordPress ServerBuddy by PluginBuddy.com plugin <= 1.0.5 - CSRF to PHP Object Injection vulnerabilityiThemes ServerBuddy by PluginBuddy.com
- CVE-2024-12575Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.8.9 - Unauthenticated Basic Information Exposureays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…