# CVEs published 2025-08-18

74 CVEs were published on August 18, 2025: 10 critical, 25 high. Days are UTC.

- [CVE-2025-54759](https://cve.now/CVE-2025-54759.md): Santesoft Sante PACS Server Cross-site Scripting (CVSS 5.1, Santesoft Sante PACS Server)
- [CVE-2025-54862](https://cve.now/CVE-2025-54862.md): Santesoft Sante PACS Server Cross-site Scripting (CVSS 4.8, Santesoft Sante PACS Server)
- [CVE-2025-54156](https://cve.now/CVE-2025-54156.md): Santesoft Sante PACS Server Cleartext Transmission of Sensitive Information (CVSS 9.1, Santesoft Sante PACS Server)
- [CVE-2025-53948](https://cve.now/CVE-2025-53948.md): Santesoft Sante PACS Server Double Free (CVSS 8.7, Santesoft Sante PACS Server)
- [CVE-2025-46269](https://cve.now/CVE-2025-46269.md): Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Heap-based Buffer Overflow (CVSS 8.4, Ashlar-Vellum Cobalt · Ashlar-Vellum Xenon +2)
- [CVE-2025-52584](https://cve.now/CVE-2025-52584.md): Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Heap-based Buffer Overflow (CVSS 8.4, Ashlar-Vellum Cobalt · Ashlar-Vellum Xenon +2)
- [CVE-2025-41392](https://cve.now/CVE-2025-41392.md): Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Out-of-bounds Read (CVSS 8.4, Ashlar-Vellum Cobalt · Ashlar-Vellum Xenon +2)
- [CVE-2025-53705](https://cve.now/CVE-2025-53705.md): Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Out-of-bounds Write (CVSS 8.4, Ashlar-Vellum Cobalt · Ashlar-Vellum Xenon +2)
- [CVE-2025-9119](https://cve.now/CVE-2025-9119.md): Netis WF2419 Wireless Settings index.htm cross site scripting (CVSS 4.8, Netis WF2419)
- [CVE-2025-53192](https://cve.now/CVE-2025-53192.md): Apache Commons OGNL: Expression Injection leading to RCE (CVSS 8.8, Apache Software Foundation Apache Commons OGNL)
- [CVE-2025-8098](https://cve.now/CVE-2025-8098.md): An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges. (CVSS 8.5, Lenovo PC Manager)
- [CVE-2025-4371](https://cve.now/CVE-2025-4371.md): A potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that could allow an attacker with physical acce (CVSS 7.0, Lenovo 510 FHD Webcam · Lenovo Performance FHD Webcam)
- [CVE-2025-55213](https://cve.now/CVE-2025-55213.md): OpenFGA Authorization Bypass (Check) (CVSS 5.8, openfga · github.com/openfga/openfga)
- [CVE-2025-43731](https://cve.now/CVE-2025-43731.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-7693](https://cve.now/CVE-2025-7693.md): Rockwell Automation Micro800 Vulnerability (CVSS 9.3, Rockwell Automation PLC - Micro850 L50E)
- [CVE-2025-55300](https://cve.now/CVE-2025-55300.md): Komari Allows Cross-site WebSocket Hijacking (CVSS 8.6, komari-monitor komari · github.com/komari-monitor/komari)
- [CVE-2025-55299](https://cve.now/CVE-2025-55299.md): VaulTLS has a password-based login exploit in additional user accounts (CVSS 9.4, 7ritn VaulTLS)
- [CVE-2025-55296](https://cve.now/CVE-2025-55296.md): LibreNMS allows stored XSS in Alert Template name field (CVSS 5.5, librenms · librenms/librenms)
- [CVE-2025-55293](https://cve.now/CVE-2025-55293.md): Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB (CVSS 9.4, meshtastic firmware)
- [CVE-2025-55291](https://cve.now/CVE-2025-55291.md): Shaarli allows reflected XSS via searchtags parameter (CVSS 7.1, Shaarli)
- [CVE-2025-55288](https://cve.now/CVE-2025-55288.md): Genealogy has a Reflected XSS Vulnerability (CVSS 5.5, MGeurts genealogy)
- [CVE-2025-55287](https://cve.now/CVE-2025-55287.md): Genealogy has a stored XSS vulnerability (CVSS 8.0, MGeurts genealogy)
- [CVE-2025-3639](https://cve.now/CVE-2025-3639.md): Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13 (CVSS 2.0, Liferay Portal · Liferay DXP +1)
- [CVE-2025-55283](https://cve.now/CVE-2025-55283.md): aiven-db-migrate allows Privilege Escalation through use of psql during migration (CVSS 9.1, aiven-db-migrate)
- [CVE-2025-55282](https://cve.now/CVE-2025-55282.md): aiven-db-migrate allows Privilege Escalation via unrestricted search\_path during migration (CVSS 9.1, aiven-db-migrate)
- [CVE-2025-54234](https://cve.now/CVE-2025-54234.md): ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 2.7, Adobe ColdFusion)
- [CVE-2025-55214](https://cve.now/CVE-2025-55214.md): Copier safe template has filesystem write access outside destination path (CVSS 6.9, copier-org copier · copier)
- [CVE-2025-55205](https://cve.now/CVE-2025-55205.md): Capsule tenant owners with "patch namespace" permission can hijack system namespaces label (CVSS 9.1, projectcapsule capsule · github.com/projectcapsule/capsule)
- [CVE-2025-55201](https://cve.now/CVE-2025-55201.md): Copier safe template has arbitrary filesystem read/write access (CVSS 8.5, copier-org copier · copier)
- [CVE-2025-54117](https://cve.now/CVE-2025-54117.md): NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor (CVSS 9.1, NamelessMC Nameless)
- [CVE-2025-54421](https://cve.now/CVE-2025-54421.md): NamelessMC allows Stored Cross Site Scripting (XSS) in SEO component (CVSS 7.2, NamelessMC Nameless)
- [CVE-2025-54118](https://cve.now/CVE-2025-54118.md): NamelessMC allows sensitive information disclosure in member list component (CVSS 5.3, NamelessMC Nameless)
- [CVE-2025-33100](https://cve.now/CVE-2025-33100.md): IBM Concert Software information disclosure (CVSS 6.2, IBM Concert Software)
- [CVE-2025-33090](https://cve.now/CVE-2025-33090.md): IBM Concert Software denial of service (CVSS 7.5, IBM Concert Software)
- [CVE-2025-27909](https://cve.now/CVE-2025-27909.md): IBM Concert Software cross-origin resource sharing (CVSS 5.4, IBM Concert Software)
- [CVE-2025-1759](https://cve.now/CVE-2025-1759.md): IBM Concert Software information disclosure (CVSS 5.9, IBM Concert Software)
- [CVE-2024-49827](https://cve.now/CVE-2024-49827.md): IBM Concert Software information disclosure (CVSS 3.7, IBM Concert Software)
- [CVE-2025-36120](https://cve.now/CVE-2025-36120.md): IBM Storage Virtualize privilege escalation (CVSS 8.8, IBM Storage Virtualize)
- [CVE-2025-4962](https://cve.now/CVE-2025-4962.md): IDOR Vulnerability in Template Creation via \`projectId\` Manipulation in lunary-ai/lunary (CVSS 7.7, lunary-ai/lunary)
- [CVE-2025-43732](https://cve.now/CVE-2025-43732.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3 (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-43733](https://cve.now/CVE-2025-43733.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a r (CVSS 2.3, Liferay Portal · Liferay DXP +1)
- [CVE-2025-41242](https://cve.now/CVE-2025-41242.md): CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers (CVSS 5.9, VMware Spring Framework · org.springframework:spring-webmvc)
- [CVE-2025-47206](https://cve.now/CVE-2025-47206.md): File Station 5 (CVSS 7.1, QNAP Systems File Station)
- [CVE-2025-5296](https://cve.now/CVE-2025-5296.md): CWE-59: Improper Link Resolution Before File Access ('Link Following') vulnerability exists that could cause arbitrary data to be written t (CVSS 7.0, Schneider Electric SESU)
- [CVE-2025-6625](https://cve.now/CVE-2025-6625.md): CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the (CVSS 8.7, Schneider Electric Modicon M340 · Schneider ELectric BMX… +4)
- [CVE-2025-57703](https://cve.now/CVE-2025-57703.md): Reflected Cross-site Scripting in DIAEnergie (CVSS 5.9, Delta Electronics DIAEnergie)
- [CVE-2025-57702](https://cve.now/CVE-2025-57702.md): Reflected Cross-site Scripting in DIAEnergie (CVSS 5.9, Delta Electronics DIAEnergie)
- [CVE-2025-57701](https://cve.now/CVE-2025-57701.md): Reflected Cross-site Scripting in DIAEnergie (CVSS 5.9, Delta Electronics DIAEnergie)
- [CVE-2025-57700](https://cve.now/CVE-2025-57700.md): Stored Cross-site Scripting in DIAEnergie (CVSS 7.0, Delta Electronics DIAEnergie)
- [CVE-2025-9109](https://cve.now/CVE-2025-9109.md): Portabilis i-Diario Password Recovery Endpoint email observable response discrepancy (CVSS 6.3, Portabilis i-Diario)
- [CVE-2025-9108](https://cve.now/CVE-2025-9108.md): Portabilis i-Diario Login Page ui layer (CVSS 5.3, Portabilis i-Diario)
- [CVE-2025-9107](https://cve.now/CVE-2025-9107.md): Portabilis i-Diario search\_autocomplete cross site scripting (CVSS 5.3, Portabilis i-Diario)
- [CVE-2025-9106](https://cve.now/CVE-2025-9106.md): Portabilis i-Diario Informações Adicionais /planos-de-ensino-por-disciplina cross site scripting (CVSS 5.1, Portabilis i-Diario)
- [CVE-2025-9105](https://cve.now/CVE-2025-9105.md): Portabilis i-Diario Informações Adicionais /planos-de-ensino-por-areas-de-conhecimento cross site scripting (CVSS 5.1, Portabilis i-Diario)
- [CVE-2025-9104](https://cve.now/CVE-2025-9104.md): Portabilis i-Diario Informações Adicionais /planos-de-aulas-por-disciplina cross site scripting (CVSS 5.1, Portabilis i-Diario)
- [CVE-2025-9103](https://cve.now/CVE-2025-9103.md): ZenCart CKEditor cross site scripting (CVSS 4.8, ZenCart)
- [CVE-2025-9102](https://cve.now/CVE-2025-9102.md): 1&1 Mail & Media mail.com App com.mail.mobile.android.mail AndroidManifest.xml improper export of android application components (CVSS 4.8, 1&1 Mail & Media mail.com App)
- [CVE-2025-9101](https://cve.now/CVE-2025-9101.md): zhenfeng13 My-Blog Tag save cross site scripting (CVSS 5.1, zhenfeng13 My-Blog)
- [CVE-2025-9100](https://cve.now/CVE-2025-9100.md): zhenfeng13 My-Blog Frontend Blog Article Comment comment authentication replay (CVSS 6.9, zhenfeng13 My-Blog)
- [CVE-2025-9099](https://cve.now/CVE-2025-9099.md): Acrel Environmental Monitoring Cloud Platform UploadNewsImg unrestricted upload (CVSS 5.3, Acrel Environmental Monitoring Cloud Platform)
- [CVE-2025-31715](https://cve.now/CVE-2025-31715.md): In vowifi service, there is a possible command injection due to improper input validation. (CVSS 9.8, Unisoc (Shanghai) Technologies Co. SL8521E/SL8521ET/ SL8541…)
- [CVE-2025-31714](https://cve.now/CVE-2025-31714.md): In Developer Tools, there is a possible missing verification incorrect input. (CVSS 6.8, Unisoc (Shanghai) Technologies Co. SL8521E/SL8521ET/ SL8541…)
- [CVE-2025-31713](https://cve.now/CVE-2025-31713.md): In engineer mode service, there is a possible command injection due to improper input validation. (CVSS 8.4, Unisoc (Shanghai) Technologies Co. SL8521E/SL8521ET/ SL8541…)
- [CVE-2025-9098](https://cve.now/CVE-2025-9098.md): Elseplus File Recovery App AndroidManifest.xml improper export of android application components (CVSS 4.8, Elseplus File Recovery App)
- [CVE-2025-9097](https://cve.now/CVE-2025-9097.md): Euro Information CIC banque et compte en ligne App com.cic\_prod.bad AndroidManifest.xml improper export of android application components (CVSS 4.8, Euro Information CIC banque et compte en ligne App)
- [CVE-2025-32992](https://cve.now/CVE-2025-32992.md): Thermo Fisher Scientific ePort through 3.0.0 has Incorrect Access Control. (CVSS 8.5)
- [CVE-2025-55584](https://cve.now/CVE-2025-55584.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root account. (CVSS 5.3)
- [CVE-2025-55585](https://cve.now/CVE-2025-55585.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an eval injection vulnerability via the eval() function. (CVSS 6.5)
- [CVE-2025-55586](https://cve.now/CVE-2025-55586.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the url parameter at /boafrm/formFilter. (CVSS 7.5)
- [CVE-2025-55587](https://cve.now/CVE-2025-55587.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the hostname parameter at /boafrm/formMapDelDevice. (CVSS 7.5)
- [CVE-2025-55588](https://cve.now/CVE-2025-55588.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the fw\_ip parameter at /boafrm/formPortFw. (CVSS 7.5)
- [CVE-2025-55589](https://cve.now/CVE-2025-55589.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain multiple OS command injection vulnerabilities via the macstr, bandstr, and c (CVSS 6.5)
- [CVE-2025-55590](https://cve.now/CVE-2025-55590.md): TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an command injection vulnerability via the component bupload.html. (CVSS 6.5)
- [CVE-2025-55591](https://cve.now/CVE-2025-55591.md): TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac parameter in the formMapD (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.