CVEs published August 23, 2025
29 CVEs were published on August 23, 2025: 2 critical, 10 high.
- Published
- 29
- Critical
- 2
- High
- 10
- Medium
- 17
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Liferay Portal · Liferay DXP +1
- 7
- Linksys RE6250 · Linksys RE6300 +4
- 7
- anzia Ni WooCommerce Customer Product Report
- 1
- arraytics Eventin – Event Calendar, Event Registration, Tic…
- 1
- Bravis-Themes Bravis User
- 1
- Case-Themes Case Theme User
- 1
- evigeo WP Filter & Combine RSS Feeds
- 1
- lunary-ai/lunary
- 1
- Ogulo – 360° Tour
- 1
- pokornydavid Restore Permanently delete Post or Page Data
- 1
Critical 2
High 10
- CVE-2025-9363Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 portTriggerManageRule stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-9361Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 ipRangeBlockManageRule stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-9360Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 accessControlAdd stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-9359Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP_checkCredentialsByBBS stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-9358Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setSysAdm stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-5352Environment Variable XSS in Analytics Component in lunary-ai/lunarylunary-ai/lunary
- CVE-2025-5060Bravis User <= 1.0.1 - Authentication Bypass to Account TakeoverBravis-Themes Bravis User
- CVE-2025-9357Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 langSwitchByBBS stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-7813Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgeryarraytics Eventin – Event Calendar, Event Registration, Tic…
- CVE-2025-9048Wptobe-memberships <= 3.4.2 - Authenticated (Subscriber+) Arbitrary File DeletionWptobe-memberships
Medium, low and unrated 17
- CVE-2025-9362Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 urlFilterManageRule stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-43764Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal Liferay Portal · Liferay DXP +1
- CVE-2025-43765A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024Liferay Portal · Liferay DXP +1
- CVE-2025-7957ShortcodeHub <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via author_link_target Parametersurror ShortcodeHub – MultiPurpose Shortcode Builder
- CVE-2025-7841Sertifier Certificate & Badge Maker for WordPress – Tutor LMS <= 1.19 - Cross-Site Request Forgery to Settings UpdateSertifier Certificate & Badge Maker for WordPress – Tutor L…
- CVE-2025-7821WC Plus <= 1.2.0 - Missing Authorization to Unauthenticated Settings Manipulationwcplus WC Plus
- CVE-2025-7828WP Filter & Combine RSS Feeds <= 0.4 - Missing Authorization to Authenticated (Contributor+) Feed Deletionevigeo WP Filter & Combine RSS Feeds
- CVE-2025-7839Restore Permanently delete Post or Page Data <= 1.0 - Cross-Site Request Forgerypokornydavid Restore Permanently delete Post or Page Data
- CVE-2025-7842Silencesoft RSS Reader <= 0.6 - Cross-Site Request Forgery to RSS Feed DeletionSilencesoft RSS Reader
- CVE-2025-8062WS Theme Addons <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ws_weather Shortcodewen-solutions WS Theme Addons
- CVE-2025-7827Ni WooCommerce Customer Product Report <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Settings Updateanzia Ni WooCommerce Customer Product Report
- CVE-2025-9131Ogulo – 360° Tour <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug ParameterOgulo – 360° Tour
- CVE-2025-43766The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1Liferay Portal · Liferay DXP +1
- CVE-2025-43767Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 202Liferay Portal · Liferay DXP +1
- CVE-2025-43768Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2Liferay Portal · Liferay DXP +1
- CVE-2025-43769Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024Liferay Portal · Liferay DXP +1
- CVE-2025-43770A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.QLiferay Portal · Liferay DXP +1