Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,460entries in the database

15,261 results · page 77 of 306

Aug 11, 2025Stirling-PDF is a locally hosted web application that performs various operations on PDF files.CVE-2025-55151 · Other software · Stirling-Tools · reported by GitHubHigh 8.6
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, the "convert file to pdf" functionality (/api/v1/convert/file/pdf) uses LibreOffice's unoconvert tool for conversion, and SSRF vulnerabilities exist during the conversion process. This issue has been patched in version 1.1.0.
Product
Stirling-PDF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 11, 2025Stirling-PDF is a locally hosted web application that performs various operations on PDF files.CVE-2025-55150 · Other software · Stirling-Tools · reported by GitHubHigh 8.6
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/html/pdf endpoint to convert HTML to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF. This issue has been patched in version 1.1.0.
Product
Stirling-PDF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 10, 2025A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0.CVE-2025-8806 · Other software · zhilink 智互联(深圳)科技有限公司 · reported by VulDBLow 2.1
A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. It has been classified as critical. This affects an unknown part of the file /adpweb/a/sys/office/treeData. The manipulation of the argument extId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Product
ADP Application Developer Platform 应用开发者平台
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com vuldb.com
Aug 8, 2025A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to conducCVE-2025-52914 · Email & office · Mitel · reported by MITREHigh 8.8
A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary SQL database commands.
Product
Micollab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mitel.com mitel.com
Aug 8, 2025A TLS vulnerability exists in the phone application used to manage a connected device.CVE-2025-8393 · Other software · Dreame Technology · reported by ics-cert@hq.dhs.govHigh 8.5
A TLS vulnerability exists in the phone application used to manage a connected device. The phone application accepts self-signed certificates when establishing TLS communication which may result in man-in-the-middle attacks on untrusted networks. Captured communications may include user credentials and sensitive session tokens.
Product
Dreamehome iOS app
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.dreametech.com cisa.gov
Aug 8, 2025The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation.CVE-2025-52586 · Other software · EG4 Electronics · reported by ics-cert@hq.dhs.govHigh 7.5
The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerability may allow an attacker with access to a local network to intercept, manipulate, replay, or forge critical data, including read/write operations for voltage, current, and power configuration, operational status, alarms, telemetry, system reset, or inverter control commands, potentially disrupting power generation or reconfiguring inverter settings.
Product
EG4 12kPV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record eg4electronics.com eg4electronics.com
Aug 7, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54787 · Other software · SuiteCRM · reported by GitHubLow 3.7
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a vulnerability in SuiteCRM version 7.14.6 which allows unauthenticated downloads of any file from the upload-directory, as long as it is named by an ID (e.g. attachments). An unauthenticated attacker could download internal files when he discovers a valid file-ID. Valid IDs could be brute-forced, but this is quite time-consuming as the file-IDs are usually UUIDs. This issue is fixed in version 7.14.7.
Product
SuiteCRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.suitecrm.com github.com
Aug 7, 2025Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote MicrosoCVE-2025-55077 · Other software · Tyler Technologies · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.3
Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment settings to all ERP Pro 9 SaaS customer environments as of 2025-08-01.
Product
ERP Pro 9 SaaS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com cve.org
Aug 7, 2025IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restricCVE-2024-56339 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a failure to honor security configuration.
Product
WebSphere Application Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
Aug 6, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54784 · Other software · SuiteCRM · reported by GitHubHigh 8.6
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a Cross Site Scripting (XSS) vulnerability in the email viewer in versions 7.14.0 through 7.14.6. An external attacker could send a prepared message to the inbox of the SuiteCRM-instance. By simply viewing emails as the logged-in user, the payload can be triggered. With that, an attacker is able to run arbitrary actions as the logged-in user - like extracting data, or if it is an admin executing the payload, takeover the instance. This is fixed in versions 7.14.7.
Product
SuiteCRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.suitecrm.com github.com
Aug 6, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54783 · Other software · SuiteCRM · reported by GitHubMedium 5.1
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include some arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but allow the JavaScript code to execute. This is fixed in version 7.14.7.
Product
SuiteCRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.suitecrm.com github.com
Aug 6, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54788 · Other software · SuiteCRM · reported by GitHubHigh 8.8
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7.
Product
SuiteCRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.suitecrm.com github.com
Aug 6, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54786 · Other software · SuiteCRM · reported by GitHubMedium 5.3
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event) data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and 8.8.1.
Product
SuiteCRM-Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.suitecrm.com github.com
Aug 6, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54785 · Other software · SuiteCRM · reported by GitHubHigh 8.8
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, user-supplied input is not validated/sanitized before it is passed to the unserialize function, which could lead to penetration, privilege escalation, sensitive data exposure, Denial of Service, cryptomining and ransomware. This issue is fixed in version 7.14.7 and 8.8.1.
Product
SuiteCRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.suitecrm.com github.com
Aug 6, 2025In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the application without expiration, due to incCVE-2025-51306 · Other software · Gatling · reported by MITREMedium 6.5
In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the application without expiration, due to incorrect session management.
Product
Gatling
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gatling.io github.com
Aug 6, 2025The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to atCVE-2024-52885 · Other software · checkpoint · reported by cve@checkpoint.comMedium 5
The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to at least one File Share application) to list the file names of 'nobody'-accessible directories on the Mobile Access gateway.
Product
Check Point Mobile Access
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.checkpoint.com
Aug 6, 2025Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information.CVE-2025-21014 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.3
Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Aug 5, 2025ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.CVE-2025-54571 · Other software · owasp-modsecurity · reported by GitHubMedium 6.9
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
Product
ModSecurity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 5, 2025XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2025-54125 · Other software · xwiki · reported by GitHubHigh 8.7
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1. To work around this issue, the file templates/xml.vm in the deployed WAR can be deleted if the XML isn't needed. There isn't any feature in XWiki itself that depends on the XML export.
Product
xwiki-platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 5, 2025XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2025-54124 · Other software · xwiki · reported by GitHubHigh 7.1
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 9.8-rc-1 through 16.4.6, 16.5.0-rc-1 through 16.10.4, and 17.0.0-rc-1 through 17.1.0, any user with editing rights can create an XClass with a database list property that references a password property. When adding an object of that XClass, the content of that password property is displayed. In practice, with a standard rights setup, this means that any user with an account on the wiki can access password hashes of all users, and possibly other password properties (with hashed or plain storage) that are on pages that the user can view. This issue is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1.
Product
xwiki-platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 5, 2025XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2025-32430 · Other software · xwiki · reported by GitHubMedium 6.5
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, two templates contain reflected XSS vulnerabilities, allowing an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL. This permits the attacker to perform arbitrary actions using the permissions of the victim. This issue is fixed in versions 16.4.8, 16.10.6 and 17.3.0-rc-1. To workaround the issue, manually patch the WAR with the same changes as the original patch.
Product
xwiki-platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 5, 2025An Authentication Bypass vulnerability in Blue Access' Cobalt X1 thru 02.000.187 allows an unauthorized attacker to log into the application as an administratorCVE-2025-50454 · Other software · reported by MITREMedium 6.5
An Authentication Bypass vulnerability in Blue Access' Cobalt X1 thru 02.000.187 allows an unauthorized attacker to log into the application as an administrator without valid credentials.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blueaccesstech.com snakemacready.github.io
Aug 5, 2025The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that gCVE-2025-2611 · Other software · ICT Innovations · reported by VulnCheckCritical 9.3
The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.
Product
ICTBroadcast
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Aug 4, 2025Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases.CVE-2025-53544 · Other software · TriliumNext · reported by GitHubHigh 7.5
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0.97.0, a brute-force protection bypass in the initial sync seed retrieval endpoint allows unauthenticated attackers to guess the login password without triggering rate limiting. Trilium is a single-user app without a username requirement, and brute-force protection bypass makes exploitation much more feasible. Multiple features provided by Trilium (e.g. MFA, share notes, custom request handler) indicate that Trilium can be exposed to the internet. This is fixed in version 0.97.0.
Product
Trilium
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 4, 2025EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP.CVE-2025-52892 · Other software · espocrm · reported by GitHubMedium 4.5
EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes (e.g https://domain//#Admin) and the webserver does not strip the double slash, it can cause a corrupted Slim router's cache. This will make the instance unusable until there is a completed rebuild. This is fixed in version 9.1.7.
Product
espocrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 3, 2025The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import.CVE-2025-52133 · Other software · xwiki-contrib · reported by MITREMedium 6.4
The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import.
Product
Mocca Calendar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record extensions.xwiki.org github.com
Aug 3, 2025The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page.CVE-2025-52132 · Other software · xwiki-contrib · reported by MITREMedium 6.4
The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page.
Product
Mocca Calendar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record extensions.xwiki.org github.com
Aug 3, 2025The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field.CVE-2025-52131 · Other software · xwiki-contrib · reported by MITREMedium 6.4
The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field.
Product
Mocca Calendar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record extensions.xwiki.org github.com
Aug 2, 2025In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt.CVE-2025-54350 · Other software · ES · reported by MITRELow 3.7
In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt.
Product
iperf3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 1, 2025Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job butCVE-2025-6078 · Other software · Partner Software · reported by cret@cert.orgMedium 5.4
Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job but does not completely sanitize input, making it possible to add notes with HTML tags and JavaScript, enabling an attacker to add a note containing malicious JavaScript, leading to stored XSS (cross-site scripting).
Product
Partner Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record partnersoftware.com kb.cert.org
Aug 1, 2025Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account aCVE-2025-6077 · Other software · Partner Software · reported by cret@cert.orgCritical 9.8
Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions.
Product
Partner Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record partnersoftware.com kb.cert.org
Aug 1, 2025Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacCVE-2025-6076 · Other software · Partner Software · reported by cret@cert.orgHigh 8.8
Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the vulnerability.
Product
Partner Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record partnersoftware.com kb.cert.org
Aug 1, 2025Nest is a framework for building scalable Node.js server-side applications.CVE-2025-54782 · Other software · nestjs · reported by GitHubCritical 9.4
Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.
Product
nest
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 1, 2025MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers.CVE-2025-53012 · Other software · AcademySoftwareFoundation · reported by GitHubMedium 5.5
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, nested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the "import chain" depth. When parsing file imports, recursion is used to process nested files; however, there is no limit imposed to the depth of files that can be parsed by the library. By building a sufficiently deep chain of MaterialX files one referencing the next, it is possible to crash the process using the MaterialX library via stack exhaustion. This is fixed in version 1.39.3.
Product
MaterialX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 1, 2025MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers.CVE-2025-53011 · Other software · AcademySoftwareFoundation · reported by GitHubLow 2
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files. An attacker could intentionally crash a target program that uses MaterialX by sending a malicious MTLX file. This is fixed in version 1.39.3.
Product
MaterialX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 1, 2025MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers.CVE-2025-53010 · Other software · AcademySoftwareFoundation · reported by GitHubLow 2
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3.
Product
MaterialX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 1, 2025MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers.CVE-2025-53009 · Other software · AcademySoftwareFoundation · reported by GitHubMedium 5.5
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, when parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3.
Product
MaterialX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 1, 2025A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via injecCVE-2025-45778 · Other software · Languagesloth · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Description text field.
Product
The Language Sloth
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record languagesloth.com packetstorm.news
Jul 30, 2025GitProxy is an application that stands between developers and a Git remote endpoint.CVE-2025-54586 · Other software · finos · reported by GitHubHigh 7.1
GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visible history, GitHub still serves them at their direct commit URLs. This lets an attacker exfiltrate sensitive data without ever leaving a trace in the branch view. We rate this a High‑impact vulnerability because it completely compromises repository confidentiality. This is fixed in version 1.19.2.
Product
git-proxy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 30, 2025GitProxy is an application that stands between developers and a Git remote endpoint.CVE-2025-54585 · Other software · finos · reported by GitHubHigh 8.2
GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can exploit the way GitProxy handles new branch creation to bypass the approval of prior commits on the parent branch. The vulnerability impacts all users or organizations relying on GitProxy to enforce policy and prevent unapproved changes. It requires no elevated privileges beyond regular push access, and no extra user interaction. It does however, require a GitProxy administrator or designated user (canUserApproveRejectPush) to approve pushes to the child branch. This is fixed in version 1.19.2.
Product
git-proxy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 30, 2025GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com).CVE-2025-54584 · Other software · finos · reported by GitHubHigh 7
GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits. This issue is fixed in version 1.19.2.
Product
git-proxy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 30, 2025GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com).CVE-2025-54583 · Other software · finos · reported by GitHubHigh 8.3
GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote repositories while bypassing policies and explicit approvals. Since checks and plugins are skipped, code containing secrets or unwanted changes could be pushed into a repository. This is fixed in version 1.19.2.
Product
git-proxy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 29, 2025The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs.CVE-2025-50738 · Other software · Usememos · reported by MITRECritical 9.8
The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction beyond viewing the memo. This can be exploited by an attacker to disclose the viewing user's IP address, browser User-Agent string, and potentially other request-specific information to the attacker-controlled server, leading to information disclosure and user tracking.
Product
Memos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 28, 2025An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users.CVE-2025-54768 · Other software · Xorux · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Medium 5.3
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive information.
Product
LPAR2RRD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record korelogic.com lpar2rrd.com
Jul 28, 2025An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users.CVE-2025-54766 · Other software · Xorux · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Medium 5.3
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.
Product
XorMon-NG
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record korelogic.com xormon.com
Jul 28, 2025An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users.CVE-2025-54765 · Other software · Xorux · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Medium 5.3
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.
Product
XorMon-NG
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record korelogic.com xormon.com
Jul 28, 2025OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device fiCVE-2025-53695 · Other software · Johnson Controls, Inc · reported by ot-cert@dragos.comCritical 9.4
OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.
Product
iSTAR Ultra
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com
Jul 26, 2025XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2025-54385 · Other software · xwiki · reported by GitHubHigh 8.6
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki#searchDocuments APIs pass queries directly to Hibernate without sanitization. Even when these APIs enforce a specific SELECT clause, attackers can still inject malicious code through HQL's native function support in other parts of the query (such as the WHERE clause). This is fixed in versions 16.10.6 and 17.3.0-rc-1.
Product
xwiki-platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.oracle.com github.com
Jul 25, 2025Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays uCVE-2025-45960 · Other software · Tawk · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encoding
Product
Tawk.to
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jul 25, 2025Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vCVE-2025-29631 · Other software · Gardyn · reported by MITRECritical 9.8
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an attacker to execute arbitrary operating system commands on a target Home Kit.
Product
Home Kit Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com mygardyn.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.