CVEs published August 18, 2025
74 CVEs were published on August 18, 2025: 10 critical, 25 high.
- Published
- 74
- Critical
- 10
- High
- 25
- Medium
- 35
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 37
Most affected products
- Portabilis i-Diario
- 6
- IBM Concert Software
- 5
- Ashlar-Vellum Cobalt · Ashlar-Vellum Xenon +2
- 4
- Delta Electronics DIAEnergie
- 4
- Liferay Portal · Liferay DXP +1
- 4
- Santesoft Sante PACS Server
- 4
- NamelessMC Nameless
- 3
- Unisoc (Shanghai) Technologies Co. SL8521E/SL8521ET/ SL8541…
- 3
- aiven-db-migrate
- 2
- copier-org copier · copier
- 2
Critical 10
- CVE-2025-54156Santesoft Sante PACS Server Cleartext Transmission of Sensitive InformationSantesoft Sante PACS Server
- CVE-2025-7693Rockwell Automation Micro800 VulnerabilityRockwell Automation PLC - Micro850 L50E
- CVE-2025-55299VaulTLS has a password-based login exploit in additional user accounts7ritn VaulTLS
- CVE-2025-55293Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDBmeshtastic firmware
- CVE-2025-55283aiven-db-migrate allows Privilege Escalation through use of psql during migrationaiven-db-migrate
- CVE-2025-55282aiven-db-migrate allows Privilege Escalation via unrestricted search_path during migrationaiven-db-migrate
- CVE-2025-55205Capsule tenant owners with "patch namespace" permission can hijack system namespaces labelprojectcapsule capsule · github.com/projectcapsule/capsule
- CVE-2025-54117NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editorNamelessMC Nameless
- CVE-2025-31715In vowifi service, there is a possible command injection due to improper input validation.Unisoc (Shanghai) Technologies Co. SL8521E/SL8521ET/ SL8541…
- CVE-2025-55591TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac parameter in the formMapD
High 25
- CVE-2025-53948Santesoft Sante PACS Server Double FreeSantesoft Sante PACS Server
- CVE-2025-46269Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Heap-based Buffer OverflowAshlar-Vellum Cobalt · Ashlar-Vellum Xenon +2
- CVE-2025-52584Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Heap-based Buffer OverflowAshlar-Vellum Cobalt · Ashlar-Vellum Xenon +2
- CVE-2025-41392Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Out-of-bounds ReadAshlar-Vellum Cobalt · Ashlar-Vellum Xenon +2
- CVE-2025-53705Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Out-of-bounds WriteAshlar-Vellum Cobalt · Ashlar-Vellum Xenon +2
- CVE-2025-53192Apache Commons OGNL: Expression Injection leading to RCEApache Software Foundation Apache Commons OGNL
- CVE-2025-8098An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges.Lenovo PC Manager
- CVE-2025-4371A potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that could allow an attacker with physical acceLenovo 510 FHD Webcam · Lenovo Performance FHD Webcam
- CVE-2025-55300Komari Allows Cross-site WebSocket Hijackingkomari-monitor komari · github.com/komari-monitor/komari
- CVE-2025-55291Shaarli allows reflected XSS via searchtags parameterShaarli
- CVE-2025-55287Genealogy has a stored XSS vulnerabilityMGeurts genealogy
- CVE-2025-55201Copier safe template has arbitrary filesystem read/write accesscopier-org copier · copier
- CVE-2025-54421NamelessMC allows Stored Cross Site Scripting (XSS) in SEO componentNamelessMC Nameless
- CVE-2025-33090IBM Concert Software denial of serviceIBM Concert Software
- CVE-2025-36120IBM Storage Virtualize privilege escalationIBM Storage Virtualize
- CVE-2025-4962IDOR Vulnerability in Template Creation via `projectId` Manipulation in lunary-ai/lunarylunary-ai/lunary
- CVE-2025-47206File Station 5QNAP Systems File Station
- CVE-2025-5296CWE-59: Improper Link Resolution Before File Access ('Link Following') vulnerability exists that could cause arbitrary data to be written tSchneider Electric SESU
- CVE-2025-6625CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to theSchneider Electric Modicon M340 · Schneider ELectric BMX… +4
- CVE-2025-57700Stored Cross-site Scripting in DIAEnergieDelta Electronics DIAEnergie
- CVE-2025-31713In engineer mode service, there is a possible command injection due to improper input validation.Unisoc (Shanghai) Technologies Co. SL8521E/SL8521ET/ SL8541…
- CVE-2025-32992Thermo Fisher Scientific ePort through 3.0.0 has Incorrect Access Control.
- CVE-2025-55586TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the url parameter at /boafrm/formFilter.
- CVE-2025-55587TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the hostname parameter at /boafrm/formMapDelDevice.
- CVE-2025-55588TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the fw_ip parameter at /boafrm/formPortFw.
Medium, low and unrated 39
- CVE-2025-54759Santesoft Sante PACS Server Cross-site ScriptingSantesoft Sante PACS Server
- CVE-2025-54862Santesoft Sante PACS Server Cross-site ScriptingSantesoft Sante PACS Server
- CVE-2025-9119Netis WF2419 Wireless Settings index.htm cross site scriptingNetis WF2419
- CVE-2025-55213OpenFGA Authorization Bypass (Check)openfga · github.com/openfga/openfga
- CVE-2025-43731A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QLiferay Portal · Liferay DXP +1
- CVE-2025-55296LibreNMS allows stored XSS in Alert Template name fieldlibrenms · librenms/librenms
- CVE-2025-55288Genealogy has a Reflected XSS VulnerabilityMGeurts genealogy
- CVE-2025-3639Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13Liferay Portal · Liferay DXP +1
- CVE-2025-54234ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)Adobe ColdFusion
- CVE-2025-55214Copier safe template has filesystem write access outside destination pathcopier-org copier · copier
- CVE-2025-54118NamelessMC allows sensitive information disclosure in member list componentNamelessMC Nameless
- CVE-2025-33100IBM Concert Software information disclosureIBM Concert Software
- CVE-2025-27909IBM Concert Software cross-origin resource sharingIBM Concert Software
- CVE-2025-1759IBM Concert Software information disclosureIBM Concert Software
- CVE-2024-49827IBM Concert Software information disclosureIBM Concert Software
- CVE-2025-43732Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3Liferay Portal · Liferay DXP +1
- CVE-2025-43733A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a rLiferay Portal · Liferay DXP +1
- CVE-2025-41242CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containersVMware Spring Framework · org.springframework:spring-webmvc
- CVE-2025-57703Reflected Cross-site Scripting in DIAEnergieDelta Electronics DIAEnergie
- CVE-2025-57702Reflected Cross-site Scripting in DIAEnergieDelta Electronics DIAEnergie
- CVE-2025-57701Reflected Cross-site Scripting in DIAEnergieDelta Electronics DIAEnergie
- CVE-2025-9109Portabilis i-Diario Password Recovery Endpoint email observable response discrepancyPortabilis i-Diario
- CVE-2025-9108Portabilis i-Diario Login Page ui layerPortabilis i-Diario
- CVE-2025-9107Portabilis i-Diario search_autocomplete cross site scriptingPortabilis i-Diario
- CVE-2025-9106Portabilis i-Diario Informações Adicionais /planos-de-ensino-por-disciplina cross site scriptingPortabilis i-Diario
- CVE-2025-9105Portabilis i-Diario Informações Adicionais /planos-de-ensino-por-areas-de-conhecimento cross site scriptingPortabilis i-Diario
- CVE-2025-9104Portabilis i-Diario Informações Adicionais /planos-de-aulas-por-disciplina cross site scriptingPortabilis i-Diario
- CVE-2025-9103ZenCart CKEditor cross site scriptingZenCart
- CVE-2025-91021&1 Mail & Media mail.com App com.mail.mobile.android.mail AndroidManifest.xml improper export of android application components1&1 Mail & Media mail.com App
- CVE-2025-9101zhenfeng13 My-Blog Tag save cross site scriptingzhenfeng13 My-Blog
- CVE-2025-9100zhenfeng13 My-Blog Frontend Blog Article Comment comment authentication replayzhenfeng13 My-Blog
- CVE-2025-9099Acrel Environmental Monitoring Cloud Platform UploadNewsImg unrestricted uploadAcrel Environmental Monitoring Cloud Platform
- CVE-2025-31714In Developer Tools, there is a possible missing verification incorrect input.Unisoc (Shanghai) Technologies Co. SL8521E/SL8521ET/ SL8541…
- CVE-2025-9098Elseplus File Recovery App AndroidManifest.xml improper export of android application componentsElseplus File Recovery App
- CVE-2025-9097Euro Information CIC banque et compte en ligne App com.cic_prod.bad AndroidManifest.xml improper export of android application componentsEuro Information CIC banque et compte en ligne App
- CVE-2025-55584TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root account.
- CVE-2025-55585TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an eval injection vulnerability via the eval() function.
- CVE-2025-55589TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain multiple OS command injection vulnerabilities via the macstr, bandstr, and c
- CVE-2025-55590TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an command injection vulnerability via the component bupload.html.