# CVEs published 2025-08-22

168 CVEs were published on August 22, 2025: 27 critical, 52 high. Days are UTC.

- [CVE-2025-4609](https://cve.now/CVE-2025-4609.md): Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker (CVSS 9.6, Google Chrome)
- [CVE-2025-9356](https://cve.now/CVE-2025-9356.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 inboundFilterAdd stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9355](https://cve.now/CVE-2025-9355.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 scheduleAdd stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-43761](https://cve.now/CVE-2025-43761.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q (CVSS 6.9, Liferay Portal · Liferay DXP +3)
- [CVE-2025-52451](https://cve.now/CVE-2025-52451.md): Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload mod (CVSS 8.5, Salesforce Tableau Server)
- [CVE-2025-52450](https://cve.now/CVE-2025-52450.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (CVSS 6.5, Salesforce Tableau Server)
- [CVE-2025-26498](https://cve.now/CVE-2025-26498.md): Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo m (CVSS 7.3, Salesforce Tableau Server)
- [CVE-2025-26497](https://cve.now/CVE-2025-26497.md): Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Ab (CVSS 7.3, Salesforce Tableau Server)
- [CVE-2025-26496](https://cve.now/CVE-2025-26496.md): Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (CVSS 9.3, Salesforce Tableau Server, Tableau Desktop)
- [CVE-2025-57801](https://cve.now/CVE-2025-57801.md): gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks (CVSS 8.6, Consensys gnark · github.com/consensys/gnark)
- [CVE-2025-43759](https://cve.now/CVE-2025-43759.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 thro (CVSS 6.7, Liferay Portal · Liferay DXP +1)
- [CVE-2025-6791](https://cve.now/CVE-2025-6791.md): Second order SQL injection available to user with low privilege (CVSS 8.8, Centreon web)
- [CVE-2025-4650](https://cve.now/CVE-2025-4650.md): User with high privileges is able to introduce a SQLi using the Meta Service indicator page (CVSS 7.2, Centreon web)
- [CVE-2025-54812](https://cve.now/CVE-2025-54812.md): Apache Log4cxx: Improper HTML escaping in HTMLLayout (CVSS 2.1, Apache Software Foundation Apache Log4cxx)
- [CVE-2025-54813](https://cve.now/CVE-2025-54813.md): Apache Log4cxx: Improper escaping with JSONLayout (CVSS 6.3, Apache Software Foundation Apache Log4cxx)
- [CVE-2025-43762](https://cve.now/CVE-2025-43762.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3. (CVSS 5.3, Liferay Portal · Liferay DXP +2)
- [CVE-2024-48988](https://cve.now/CVE-2024-48988.md): Apache StreamPark: SQL injection vulnerability (CVSS 7.6, Apache Software Foundation Apache StreamPark)
- [CVE-2025-43758](https://cve.now/CVE-2025-43758.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3. (CVSS 5.3, Liferay Portal · Liferay DXP +3)
- [CVE-2025-43760](https://cve.now/CVE-2025-43760.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q (CVSS 5.3, Liferay Portal · Liferay DXP +1)
- [CVE-2025-57800](https://cve.now/CVE-2025-57800.md): Audiobookshelf vulnerable to OIDC token exfiltration and account takeover (CVSS 8.8, advplyr audiobookshelf)
- [CVE-2025-57770](https://cve.now/CVE-2025-57770.md): ZITADEL user enumeration vulnerability in login UI (CVSS 5.3, zitadel)
- [CVE-2025-57771](https://cve.now/CVE-2025-57771.md): Roo-Code potential remote code execution via auto-execute command parsing flaw (CVSS 8.1, RooCodeInc Roo-Code)
- [CVE-2025-55745](https://cve.now/CVE-2025-55745.md): UnoPim Quick Export feature is vulnerable to CSV injection (CVSS 2.5, unopim · unopim/unopim)
- [CVE-2025-55741](https://cve.now/CVE-2025-55741.md): unopim/unopim allows unauthorized product deletion via mass-delete endpoint (CVSS 8.1, unopim · unopim/unopim)
- [CVE-2025-38675](https://cve.now/CVE-2025-38675.md): xfrm: state: initialize state\_ptrs earlier in xfrm\_state\_find (CVSS 7.8, Linux)
- [CVE-2025-38674](https://cve.now/CVE-2025-38674.md): Revert "drm/prime: Use dma\_buf from GEM object instance" (no CVSS, Linux)
- [CVE-2025-38673](https://cve.now/CVE-2025-38673.md): Revert "drm/gem-framebuffer: Use dma\_buf from GEM object instance" (no CVSS, Linux)
- [CVE-2025-38672](https://cve.now/CVE-2025-38672.md): Revert "drm/gem-dma: Use dma\_buf from GEM object instance" (no CVSS, Linux)
- [CVE-2025-38671](https://cve.now/CVE-2025-38671.md): i2c: qup: jump out of the loop in case of timeout (no CVSS, Linux)
- [CVE-2025-38670](https://cve.now/CVE-2025-38670.md): arm64/entry: Mask DAIF in cpu\_switch\_to(), call\_on\_irq\_stack() (CVSS 7.8, Linux)
- [CVE-2025-38669](https://cve.now/CVE-2025-38669.md): Revert "drm/gem-shmem: Use dma\_buf from GEM object instance" (no CVSS, Linux)
- [CVE-2025-38668](https://cve.now/CVE-2025-38668.md): regulator: core: fix NULL dereference on unbind due to stale coupling data (no CVSS, Linux)
- [CVE-2025-38667](https://cve.now/CVE-2025-38667.md): iio: fix potential out-of-bound write (CVSS 7.8, Linux)
- [CVE-2025-38666](https://cve.now/CVE-2025-38666.md): net: appletalk: Fix use-after-free in AARP proxy probe (no CVSS, Linux)
- [CVE-2025-38665](https://cve.now/CVE-2025-38665.md): can: netlink: can\_changelink(): fix NULL pointer deref of struct can\_priv::do\_set\_mode (no CVSS, Linux)
- [CVE-2025-38664](https://cve.now/CVE-2025-38664.md): ice: Fix a null pointer dereference in ice\_copy\_and\_init\_pkg() (no CVSS, Linux)
- [CVE-2025-38663](https://cve.now/CVE-2025-38663.md): nilfs2: reject invalid file types when reading inodes (no CVSS, Linux)
- [CVE-2025-38662](https://cve.now/CVE-2025-38662.md): ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365\_dai\_set\_priv (CVSS 7.1, Linux)
- [CVE-2025-38661](https://cve.now/CVE-2025-38661.md): platform/x86: alienware-wmi-wmax: Fix \`dmi\_system\_id\` array (CVSS 7.1, Linux)
- [CVE-2025-38660](https://cve.now/CVE-2025-38660.md): \[ceph\] parse\_longname(): strrchr() expects NUL-terminated string (CVSS 9.8, Linux)
- [CVE-2025-38659](https://cve.now/CVE-2025-38659.md): gfs2: No more self recovery (CVSS 7.8, Linux)
- [CVE-2025-38658](https://cve.now/CVE-2025-38658.md): nvmet: pci-epf: Do not complete commands twice if nvmet\_req\_init() fails (CVSS 8.8, Linux)
- [CVE-2025-38657](https://cve.now/CVE-2025-38657.md): wifi: rtw89: mcc: prevent shift wrapping in rtw89\_core\_mlsr\_switch() (CVSS 7.3, Linux)
- [CVE-2025-38656](https://cve.now/CVE-2025-38656.md): wifi: iwlwifi: Fix error code in iwl\_op\_mode\_dvm\_start() (CVSS 7.8, Linux)
- [CVE-2025-38655](https://cve.now/CVE-2025-38655.md): pinctrl: canaan: k230: add NULL check in DT parse (no CVSS, Linux)
- [CVE-2025-38654](https://cve.now/CVE-2025-38654.md): pinctrl: canaan: k230: Fix order of DT parse and pinctrl register (no CVSS, Linux)
- [CVE-2025-38653](https://cve.now/CVE-2025-38653.md): proc: use the same treatment to check proc\_lseek as ones for proc\_read\_iter et.al (CVSS 7.8, Linux)
- [CVE-2025-38652](https://cve.now/CVE-2025-38652.md): f2fs: fix to avoid out-of-boundary access in devs.path (CVSS 7.3, Linux)
- [CVE-2025-38651](https://cve.now/CVE-2025-38651.md): landlock: Fix warning from KUnit tests (no CVSS, Linux)
- [CVE-2025-38650](https://cve.now/CVE-2025-38650.md): hfsplus: remove mutex\_lock check in hfsplus\_free\_extents (no CVSS, Linux)
- [CVE-2025-38649](https://cve.now/CVE-2025-38649.md): arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight (no CVSS, Linux)
- [CVE-2025-38648](https://cve.now/CVE-2025-38648.md): spi: stm32: Check for cfg availability in stm32\_spi\_probe (no CVSS, Linux)
- [CVE-2025-38647](https://cve.now/CVE-2025-38647.md): wifi: rtw89: sar: drop lockdep assertion in rtw89\_set\_sar\_from\_acpi (no CVSS, Linux)
- [CVE-2025-38646](https://cve.now/CVE-2025-38646.md): wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (no CVSS, Linux)
- [CVE-2025-38645](https://cve.now/CVE-2025-38645.md): net/mlx5: Check device memory pointer before usage (no CVSS, Linux)
- [CVE-2025-38644](https://cve.now/CVE-2025-38644.md): wifi: mac80211: reject TDLS operations when station is not associated (no CVSS, Linux)
- [CVE-2025-38643](https://cve.now/CVE-2025-38643.md): wifi: cfg80211: Add missing lock in cfg80211\_check\_and\_end\_cac() (CVSS 8.8, Linux)
- [CVE-2025-38642](https://cve.now/CVE-2025-38642.md): wifi: mac80211: fix WARN\_ON for monitor mode on some devices (no CVSS, Linux)
- [CVE-2025-38641](https://cve.now/CVE-2025-38641.md): Bluetooth: btusb: Fix potential NULL dereference on kmalloc failure (no CVSS, Linux)
- [CVE-2025-38640](https://cve.now/CVE-2025-38640.md): bpf: Disable migration in nf\_hook\_run\_bpf(). (CVSS 7.8, Linux)
- [CVE-2025-38639](https://cve.now/CVE-2025-38639.md): netfilter: xt\_nfacct: don't assume acct name is null-terminated (CVSS 7.1, Linux)
- [CVE-2025-38638](https://cve.now/CVE-2025-38638.md): ipv6: add a retry logic in net6\_rt\_notify() (no CVSS, Linux)
- [CVE-2025-38636](https://cve.now/CVE-2025-38636.md): rv: Use strings in da monitors tracepoints (no CVSS, Linux)
- [CVE-2025-38635](https://cve.now/CVE-2025-38635.md): clk: davinci: Add NULL check in davinci\_lpsc\_clk\_register() (no CVSS, Linux)
- [CVE-2025-38634](https://cve.now/CVE-2025-38634.md): power: supply: cpcap-charger: Fix null check for power\_supply\_get\_by\_name (no CVSS, Linux)
- [CVE-2025-38633](https://cve.now/CVE-2025-38633.md): clk: spacemit: mark K1 pll1\_d8 as critical (no CVSS, Linux)
- [CVE-2025-38632](https://cve.now/CVE-2025-38632.md): pinmux: fix race causing mux\_owner NULL with active mux\_usecount (no CVSS, Linux)
- [CVE-2025-38631](https://cve.now/CVE-2025-38631.md): clk: imx95-blk-ctl: Fix synchronous abort (no CVSS, Linux)
- [CVE-2025-38630](https://cve.now/CVE-2025-38630.md): fbdev: imxfb: Check fb\_add\_videomode to prevent null-ptr-deref (no CVSS, Linux)
- [CVE-2025-38629](https://cve.now/CVE-2025-38629.md): ALSA: usb: scarlett2: Fix missing NULL check (no CVSS, Linux)
- [CVE-2025-38628](https://cve.now/CVE-2025-38628.md): vdpa/mlx5: Fix release of uninitialized resources on error path (no CVSS, Linux)
- [CVE-2025-38627](https://cve.now/CVE-2025-38627.md): f2fs: compress: fix UAF of f2fs\_inode\_info in f2fs\_free\_dic (CVSS 7.8, Linux)
- [CVE-2025-38626](https://cve.now/CVE-2025-38626.md): f2fs: fix to trigger foreground gc during f2fs\_map\_blocks() in lfs mode (no CVSS, Linux)
- [CVE-2025-38625](https://cve.now/CVE-2025-38625.md): vfio/pds: Fix missing detach\_ioas op (no CVSS, Linux)
- [CVE-2025-38624](https://cve.now/CVE-2025-38624.md): PCI: pnv\_php: Clean up allocated IRQs on unplug (no CVSS, Linux)
- [CVE-2025-38623](https://cve.now/CVE-2025-38623.md): PCI: pnv\_php: Fix surprise plug detection and recovery (no CVSS, Linux)
- [CVE-2025-38622](https://cve.now/CVE-2025-38622.md): net: drop UFO packets in udp\_rcv\_segment() (no CVSS, Linux)
- [CVE-2025-38621](https://cve.now/CVE-2025-38621.md): md: make rdev\_addable usable for rcu mode (no CVSS, Linux)
- [CVE-2025-38620](https://cve.now/CVE-2025-38620.md): zloop: fix KASAN use-after-free of tag set (no CVSS, Linux)
- [CVE-2025-38619](https://cve.now/CVE-2025-38619.md): media: ti: j721e-csi2rx: fix list\_del corruption (CVSS 7.8, Linux)
- [CVE-2025-43751](https://cve.now/CVE-2025-43751.md): User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 202 (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-53363](https://cve.now/CVE-2025-53363.md): Dpanel has an arbitrary file read vulnerability (CVSS 4.8, donknap dpanel · github.com/donknap/dpanel)
- [CVE-2025-36042](https://cve.now/CVE-2025-36042.md): IBM QRadar SIEM cross-site scripting (CVSS 5.4, IBM QRadar SIEM)
- [CVE-2025-33120](https://cve.now/CVE-2025-33120.md): IBM QRadar SIEM privilege escalation (CVSS 7.8, IBM QRadar SIEM)
- [CVE-2009-10006](https://cve.now/CVE-2009-10006.md): UFO: Alien Invasion \<= 2.2.1 IRC Client Buffer Overflow (CVSS 9.3, UFO: Alien Invasion Project UFO: Alien Invasion)
- [CVE-2025-38618](https://cve.now/CVE-2025-38618.md): vsock: Do not allow binding to VMADDR\_PORT\_ANY (CVSS 7.8, Linux)
- [CVE-2025-38617](https://cve.now/CVE-2025-38617.md): net/packet: fix a race in packet\_set\_ring() and packet\_notifier() (CVSS 7.8, Linux)
- [CVE-2025-38616](https://cve.now/CVE-2025-38616.md): tls: handle data disappearing from under the TLS ULP (CVSS 7.8, Linux)
- [CVE-2024-58239](https://cve.now/CVE-2024-58239.md): tls: stop recv() if initial process\_rx\_list gave us non-DATA (CVSS 8.2, Linux)
- [CVE-2025-57896](https://cve.now/CVE-2025-57896.md): WordPress Church Admin Plugin \<= 5.0.26 - Broken Access Control Vulnerability (CVSS 5.3, andy\_moyle Church Admin)
- [CVE-2025-57895](https://cve.now/CVE-2025-57895.md): WordPress JobWP Plugin \<= 2.4.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Hossni Mubarak JobWP)
- [CVE-2025-57894](https://cve.now/CVE-2025-57894.md): WordPress WPPizza Plugin \<= 3.19.8 - Broken Access Control Vulnerability (CVSS 4.3, ollybach WPPizza)
- [CVE-2025-57893](https://cve.now/CVE-2025-57893.md): WordPress WP Fast Total Search Plugin \<= 1.79.270 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Epsiloncool WP Fast Total Search)
- [CVE-2025-57892](https://cve.now/CVE-2025-57892.md): WordPress Simple Statistics for Feeds Plugin \<= 20250322 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Jeff Starr Simple Statistics for Feeds)
- [CVE-2025-57891](https://cve.now/CVE-2025-57891.md): WordPress Recurring PayPal Donations Plugin \<= 1.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, wpecommerce Recurring PayPal Donations)
- [CVE-2025-57890](https://cve.now/CVE-2025-57890.md): WordPress Sessions Plugin \<= 3.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Pierre Lannoy Sessions)
- [CVE-2025-57888](https://cve.now/CVE-2025-57888.md): WordPress Jobmonster Theme \<= 4.8.0 - Sensitive Data Exposure Vulnerability (CVSS 5.3, NooTheme Jobmonster)
- [CVE-2025-57887](https://cve.now/CVE-2025-57887.md): WordPress Jobmonster Theme \<= 4.8.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, NooTheme Jobmonster)
- [CVE-2025-57886](https://cve.now/CVE-2025-57886.md): WordPress Accessibility Checker by Equalize Digital Plugin \<= 1.30.0 - Insecure Direct Object References (IDOR) Vulnerability (CVSS 5.4, Accessibility Checker by Equalize Digital)
- [CVE-2025-57885](https://cve.now/CVE-2025-57885.md): WordPress Fluent Support Plugin \<= 1.9.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Shahjahan Jewel Fluent Support)
- [CVE-2025-57884](https://cve.now/CVE-2025-57884.md): WordPress Greenshift Plugin \<= 12.1.1 - Broken Access Control Vulnerability (CVSS 4.3, wpsoul Greenshift)
- [CVE-2025-9259](https://cve.now/CVE-2025-9259.md): Uniong｜WebITR - Arbitrary File Reading through Path Traversal (CVSS 7.1, Uniong WebITR)
- [CVE-2025-9258](https://cve.now/CVE-2025-9258.md): Uniong｜WebITR - Arbitrary File Reading through Path Traversal (CVSS 7.1, Uniong WebITR)
- [CVE-2025-9257](https://cve.now/CVE-2025-9257.md): Uniong｜WebITR - Arbitrary File Reading through Path Traversal (CVSS 7.1, Uniong WebITR)
- [CVE-2025-9256](https://cve.now/CVE-2025-9256.md): Uniong｜WebITR - Arbitrary File Reading through Path Traversal (CVSS 7.1, Uniong WebITR)
- [CVE-2025-9255](https://cve.now/CVE-2025-9255.md): Uniong｜WebITR - SQL Injection (CVSS 8.7, Uniong WebITR)
- [CVE-2025-9254](https://cve.now/CVE-2025-9254.md): Uniong｜WebITR - Missing Authentication (CVSS 9.3, Uniong WebITR)
- [CVE-2025-9331](https://cve.now/CVE-2025-9331.md): Spacious \<= 1.9.11 - Missing Authorization to Autheticated (Subscriber+) Demo Data Import (CVSS 4.3, themegrill Spacious)
- [CVE-2025-9340](https://cve.now/CVE-2025-9340.md): native encrypt/decrypt operations in JCE may corrupt data if same byte array used for input and output. (CVSS 0.0, Legion of the Bouncy Castle Bouncy Castle for Java · org.bo…)
- [CVE-2025-9341](https://cve.now/CVE-2025-9341.md): Garbage collection can delay for AES CBC Native support, resulting in heap exhaustion (CVSS 5.9, Legion of the Bouncy Castle Bouncy Castle for Java FIPS… +2)
- [CVE-2025-8678](https://cve.now/CVE-2025-8678.md): WP Crontrol - 1.17.0 - 1.19.1 - Authenticated (Administrator+) Blind Server-Side Request Forgery (CVSS 5.9, johnbillion WP Crontrol · johnbillion/wp-crontrol)
- [CVE-2025-57699](https://cve.now/CVE-2025-57699.md): Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path. (CVSS 6.7, Western Digital Kitfox for Windows)
- [CVE-2025-8281](https://cve.now/CVE-2025-8281.md): WP Talroo \<= 2.4 - Reflected XSS (CVSS 7.1, WP Talroo)
- [CVE-2025-41452](https://cve.now/CVE-2025-41452.md): Post auth nginx configuration injection in Danfoss AK-SM8xxA Series (CVSS 6.8, Danfoss AK-SM8xxA Series)
- [CVE-2025-41451](https://cve.now/CVE-2025-41451.md): Post-Authentication OS Command Injection RCE in Danfoss AK-SM8xxA Series (CVSS 8.7, Danfoss AK-SM8xxA Series)
- [CVE-2025-43752](https://cve.now/CVE-2025-43752.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3. (CVSS 5.3, Liferay Portal · Liferay DXP +1)
- [CVE-2022-31491](https://cve.now/CVE-2022-31491.md): Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote at (CVSS 10.0)
- [CVE-2022-43110](https://cve.now/CVE-2022-43110.md): Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via (CVSS 9.8)
- [CVE-2022-45133](https://cve.now/CVE-2022-45133.md): Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skins. (CVSS 6.5)
- [CVE-2022-45134](https://cve.now/CVE-2022-45134.md): Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely during skin import. (CVSS 9.8)
- [CVE-2024-50644](https://cve.now/CVE-2024-50644.md): zhisheng17 blog 3.0.1-SNAPSHOT has an authentication bypass vulnerability. (CVSS 9.8)
- [CVE-2024-50645](https://cve.now/CVE-2024-50645.md): MallChat v1.0-SNAPSHOT has an authentication bypass vulnerability. (CVSS 9.8)
- [CVE-2024-52786](https://cve.now/CVE-2024-52786.md): An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a (CVSS 9.8)
- [CVE-2024-53494](https://cve.now/CVE-2024-53494.md): Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authenti (CVSS 7.5)
- [CVE-2024-53496](https://cve.now/CVE-2024-53496.md): Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authenti (CVSS 9.8)
- [CVE-2024-53499](https://cve.now/CVE-2024-53499.md): Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API. (CVSS 9.8)
- [CVE-2024-56179](https://cve.now/CVE-2024-56179.md): In MindManager Windows versions prior to 24.1.150, attackers could potentially write to unexpected directories in victims' machines via dire (CVSS 7.8)
- [CVE-2025-29365](https://cve.now/CVE-2025-29365.md): spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in READ\_STRING\_SYSCALL. (CVSS 9.8)
- [CVE-2025-29366](https://cve.now/CVE-2025-29366.md): In mupen64plus v2.6.0 there is an array overflow vulnerability in the write\_rdram\_regs and write\_rdram\_regs functions, which enables executi (CVSS 9.8)
- [CVE-2025-50674](https://cve.now/CVE-2025-50674.md): An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowing (CVSS 7.8)
- [CVE-2025-50691](https://cve.now/CVE-2025-50691.md): MCSManager 10.5.3 daemon process runs as a root account by default, and its sensitive data (including tokens and terminal content) is stored (CVSS 5.3)
- [CVE-2025-50733](https://cve.now/CVE-2025-50733.md): NextChat contains a cross-site scripting (XSS) vulnerability in the HTMLPreview component of artifacts.tsx that allows attackers to execute (CVSS 6.1)
- [CVE-2025-50858](https://cve.now/CVE-2025-50858.md): Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated atta (CVSS 6.1)
- [CVE-2025-50859](https://cve.now/CVE-2025-50859.md): Reflected Cross-Site Scripting in the Change Template function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers (CVSS 6.1)
- [CVE-2025-51092](https://cve.now/CVE-2025-51092.md): The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. (CVSS 9.8)
- [CVE-2025-51605](https://cve.now/CVE-2025-51605.md): An issue was discovered in Shopizer 3.2.7. (CVSS 8.1)
- [CVE-2025-51825](https://cve.now/CVE-2025-51825.md): JeecgBoot versions from 3.4.3 up to 3.8.0 were found to contain a SQL injection vulnerability in the /jeecg-boot/online/cgreport/head/parseS (CVSS 6.5, org.jeecgframework.boot:jeecg-boot-base-core)
- [CVE-2025-52085](https://cve.now/CVE-2025-52085.md): An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a b (CVSS 8.8)
- [CVE-2025-52094](https://cve.now/CVE-2025-52094.md): Insecure Permissions vulnerability in PDQ Smart Deploy V.3.0.2040 allows a local attacker to execute arbtirary code via the \\HKLM\\SYSTEM\\Set (CVSS 7.8)
- [CVE-2025-52095](https://cve.now/CVE-2025-52095.md): An issue in PDQ Smart Deploy V.3.0.2040 allows an attacker to escalate privileges via the Credential encryption routines in SDCommon.dll (CVSS 9.8)
- [CVE-2025-52287](https://cve.now/CVE-2025-52287.md): OperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability. (CVSS 8.8)
- [CVE-2025-55398](https://cve.now/CVE-2025-55398.md): An issue was discovered in mouse07410 asn1c thru 0.9.29 (2025-03-20) - a fork of vlm asn1c. (CVSS 9.8)
- [CVE-2025-55454](https://cve.now/CVE-2025-55454.md): An authenticated arbitrary file upload vulnerability in the component /msg/sendfiles of DooTask v1.0.51 allows attackers to execute arbitrar (CVSS 8.8)
- [CVE-2025-55455](https://cve.now/CVE-2025-55455.md): DooTask v1.0.51 was dicovered to contain an authenticated arbitrary download vulnerability via the component /msg/sendtext. (CVSS 3.5)
- [CVE-2025-55573](https://cve.now/CVE-2025-55573.md): QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS). (CVSS 8.8)
- [CVE-2025-55581](https://cve.now/CVE-2025-55581.md): D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script. (CVSS 7.3)
- [CVE-2025-55599](https://cve.now/CVE-2025-55599.md): D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formWlanSetup function via the parameter f\_wds\_wepKey. (CVSS 9.8)
- [CVE-2025-55602](https://cve.now/CVE-2025-55602.md): D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formSysCmd function via the submit-url parameter. (CVSS 9.8)
- [CVE-2025-55603](https://cve.now/CVE-2025-55603.md): Tenda AX3 V16.03.12.10\_CN is vulnerable to Buffer Overflow in the fromSetSysTime function via the ntpServer parameter. (CVSS 9.8)
- [CVE-2025-55605](https://cve.now/CVE-2025-55605.md): Tenda AX3 V16.03.12.10\_CN is vulnerable to Buffer Overflow in the saveParentControlInfo function via the deviceName parameter. (CVSS 9.8)
- [CVE-2025-55606](https://cve.now/CVE-2025-55606.md): Tenda AX3 V16.03.12.10\_CN is vulnerable to Buffer Overflow in the fromAdvSetMacMtuWan function via the serverName parameter. (CVSS 9.8)
- [CVE-2025-55611](https://cve.now/CVE-2025-55611.md): D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formLanguageChange function via the nextPage parameter. (CVSS 9.8)
- [CVE-2025-55613](https://cve.now/CVE-2025-55613.md): Tenda O3V2 1.0.0.12(3880) is vulnerable to Buffer Overflow in the fromSafeSetMacFilter function via the mac parameter. (CVSS 9.8)
- [CVE-2025-55619](https://cve.now/CVE-2025-55619.md): Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. (CVSS 9.8)
- [CVE-2025-55620](https://cve.now/CVE-2025-55620.md): A cross-site scripting (XSS) vulnerability in the valuateJavascript() function of Reolink v4.54.0.4.20250526 allows attackers to execute arb (CVSS 6.1)
- [CVE-2025-55621](https://cve.now/CVE-2025-55621.md): An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download (CVSS 6.5)
- [CVE-2025-55622](https://cve.now/CVE-2025-55622.md): Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskAffinity settings. (CVSS 6.5)
- [CVE-2025-55623](https://cve.now/CVE-2025-55623.md): An issue in the lock screen component of Reolink v4.54.0.4.20250526 allows attackers to bypass authentication via using an ADB (Android Debu (CVSS 5.4)
- [CVE-2025-55624](https://cve.now/CVE-2025-55624.md): An intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access internal functions or access non-p (CVSS 5.3)
- [CVE-2025-55625](https://cve.now/CVE-2025-55625.md): An open redirect vulnerability in Reolink v4.54.0.4.20250526 allows attackers to redirect users to a malicious site via a crafted URL. (CVSS 6.3)
- [CVE-2025-55626](https://cve.now/CVE-2025-55626.md): An Insecure Direct Object Reference (IDOR) vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662 (CVSS 5.3)
- [CVE-2025-55627](https://cve.now/CVE-2025-55627.md): Insufficient privilege verification in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662\_2503122283 allows au (CVSS 5.3)
- [CVE-2025-55629](https://cve.now/CVE-2025-55629.md): Insecure permissions in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662\_2503122283 allow attackers to arbit (CVSS 6.5)
- [CVE-2025-55630](https://cve.now/CVE-2025-55630.md): A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3 (CVSS 7.3)
- [CVE-2025-55631](https://cve.now/CVE-2025-55631.md): Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662\_2503122283 was discovered to manage users' sessions system (CVSS 4.0)
- [CVE-2025-55634](https://cve.now/CVE-2025-55634.md): Incorrect access control in the RTMP server settings of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662\_250 (CVSS 7.5)
- [CVE-2025-55637](https://cve.now/CVE-2025-55637.md): Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662\_2503122283 was discovered to contain a command injection vu (CVSS 6.5)
- [CVE-2025-57105](https://cve.now/CVE-2025-57105.md): The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.