By publication date

Exploited and new serious CVEs: July 2025

335 records · 14 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 4

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
47Plan	CVE-2025-6934Proof of concept	Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'wpopal · opal estate pro – property management and submission · CWE-269 Pre-auth	Critical9.8	—	25.3%	Jul 1, 2025
44Plan	CVE-2025-41656Proof of concept	Pilz: Missing Authentication in Node-RED integrationpilz · industrialpi 4 with firmware bullseye · CWE-306 Pre-auth Auth bypass	Critical10.0	—	12.3%	Jul 1, 2025
37Monitor	CVE-2025-49029Proof of concept	WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerabilitybitto.kazi · custom login and signup widget · CWE-94 RCE	Critical9.1	—	2.3%	Jul 1, 2025
27Monitor	CVE-2025-34065Proof of concept	AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via /nobody URL Pathavtech · ip camera, dvr, and nvr devices · CWE-290 Pre-auth Auth bypass	Medium6.9	—	0.6%	Jul 1, 2025
44Plan	CVE-2025-37098No exploit	A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.hpe · insight remote support · CWE-22 Pre-auth Path traversal	High7.5	—	46.3%	Jul 1, 2025
37Monitor	CVE-2025-53107No exploit	@cyanheads/git-mcp-server vulnerable to command injection in several toolscyanheads · git-mcp-server · CWE-77 pre-auth RCE Command injection	High7.5	—	24.5%	Jul 1, 2025
36Monitor	CVE-2025-53104Proof of concept	gluestack-ui Command Injection Vulnerability via discussion-to-slack GitHub Action Workflowgluestack · gluestack-ui · CWE-77 pre-auth RCE Command injection	Critical9.1	—	1.1%	Jul 1, 2025
31Monitor	CVE-2025-49741Proof of concept	Microsoft Edge (Chromium-based) Information Disclosure Vulnerabilitymicrosoft · edge chromium · CWE-268 Pre-auth	High7.5	—	3.9%	Jul 1, 2025
52Plan	CVE-2025-4380Proof of concept	Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusionscripteo · ads pro · CWE-98 pre-auth RCE	Critical9.8	—	42.5%	Jul 2, 2025
40Plan	CVE-2025-6463No exploit	Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submissincsub · forminator · CWE-73 pre-auth RCE Path traversal	High8.8	—	15.0%	Jul 2, 2025
37Monitor	CVE-2025-34057No exploit	Ruijie NBR Router Administrative Credential Disclosureruijie · nbr router · CWE-306 Pre-auth Auth bypass	High8.7	—	10.1%	Jul 2, 2025
47Plan	CVE-2025-34067No exploit	Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjsonhikvision · integrated security management platform · CWE-502 pre-auth RCE Deserialization	Critical10.0	—	21.9%	Jul 2, 2025
38Monitor	CVE-2025-34069Proof of concept	GFI Kerio Control GFIAgent Authentication Bypass via Proxy Forwardinggfi · kerio control · CWE-306 Pre-auth Auth bypass	Critical9.5	—	0.6%	Jul 2, 2025
37Monitor	CVE-2025-34071Proof of concept	GFI Kerio Control Unsigned System Image Upload Root Code Executiongfi · kerio control · CWE-306 RCE Auth bypass	Critical9.4	—	0.8%	Jul 2, 2025
60This week	CVE-2025-34073Weaponized	stamparm/maltrail <=0.54 Remote Command Executionstamparm · maltrail · CWE-78 pre-auth RCE Command injection	Critical10.0	—	5.4%	Jul 2, 2025
40Plan	CVE-2025-20309No exploit	Cisco Unified Communications Manager Static SSH Credentials Vulnerabilitycisco · unified communications manager · CWE-798 pre-auth RCE Hard-coded credentials	Critical10.0	—	1.1%	Jul 2, 2025
40Plan	CVE-2025-34074Weaponized	Lucee Admin Interface Authenticated Remote Code Execution via Scheduled Job File Writelucee association switzerland · lucee · CWE-94 RCE	Critical9.4	—	2.1%	Jul 2, 2025
40Plan	CVE-2025-34078Weaponized	NSClient++ 0.5.2.35 Local Privilege Escalation via ExternalScripts and Web Interfacensclient · nsclient\+\+ · CWE-522 RCE Local privilege escalation Info leak	High7.3	—	0.7%	Jul 2, 2025
40Plan	CVE-2025-34079Weaponized	NSClient++ Authenticated Remote Code Execution via ExternalScripts APInsclient · nsclient\+\+ · CWE-94 RCE	High7.5	—	1.6%	Jul 2, 2025
40Plan	CVE-2025-34076Weaponized	Microweber CMS Authenticated Local File Inclusion via Backup APImicroweber · microweber · CWE-22 Path traversal	Medium6.1	—	2.2%	Jul 2, 2025
19Monitor	CVE-2025-6563Proof of concept	Cross-site scripting via dst parameter in RouterOS WiFi hotspotmikrotik · routeros · CWE-20 Pre-auth XSS	Medium4.8	—	0.7%	Jul 3, 2025
23Monitor	CVE-2025-49618No exploit	In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.plesk · obsidian · CWE-402 Pre-auth	Medium5.8	—	0.4%	Jul 3, 2025
45Plan	CVE-2025-5961Proof of concept	Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Uploadwpvivid · migration\, backup\, staging · CWE-434 RCE File upload	High7.2	—	55.4%	Jul 3, 2025
16Monitor	CVE-2025-48939No exploit	tarteaucitron.js vulnerable to DOM Clobbering via document.currentScriptamauri · tarteaucitronjs · CWE-138	Medium4.2	—	0.2%	Jul 3, 2025
36Monitor	CVE-2025-23968Proof of concept	WordPress AiBud WP plugin <= 1.9 - Arbitrary File Upload vulnerabilitywebfactory · aibud wp · CWE-434 File upload	Critical9.1	—	0.4%	Jul 3, 2025
21Monitor	CVE-2025-45809Proof of concept	SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/klitellm · litellm · CWE-89 pre-auth RCE SQL injection	Medium5.4	—	0.2%	Jul 3, 2025
60This week	CVE-2025-34061Weaponized	PHPStudy 2016-2018 Backdoor Remote Code Execution Vulnerabilityhenan xiaopi security technology co., ltd. · phpstudy · CWE-94 pre-auth RCE	Critical9.3	—	1.9%	Jul 3, 2025
60This week	CVE-2025-34082Weaponized	IGEL OS Secure Terminal and Secure Shadow Remote Code Executionigel technology gmbh · os · CWE-78 pre-auth RCE Command injection	Critical9.3	—	6.5%	Jul 3, 2025
40Plan	CVE-2025-34087Weaponized	Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Executionpi-hole · pi-hole · CWE-78 RCE Command injection	Critical9.0	—	6.8%	Jul 3, 2025
40Plan	CVE-2025-34088Weaponized	Pandora FMS Authenticated Remote Code Execution via Ping Modulepandorafms · pandora fms · CWE-78 RCE Command injection	High8.6	—	7.2%	Jul 3, 2025
60This week	CVE-2025-34089Weaponized	Remote for Mac Unauthenticated Remote Code Execution via AppleScript Injectionaexol studio · remote for mac · CWE-94 pre-auth RCE	Critical9.3	—	2.3%	Jul 3, 2025
14Monitor	CVE-2025-49005No exploit	Next.js cache poisoning due to omission of Vary headervercel · next.js · CWE-444 Pre-auth	Low3.7	—	0.4%	Jul 3, 2025
33Monitor	CVE-2025-53367Proof of concept	DjVuLibre OOB-Write Vulnerability in MMRDecoderdjvunet · djvulibre · CWE-125 Memory safety	High8.4	—	0.8%	Jul 3, 2025
40Plan	CVE-2025-34086Weaponized	Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Renameboltcms · bolt · CWE-94 RCE	High7.5	—	4.2%	Jul 3, 2025
28Monitor	CVE-2025-6586Proof of concept	Download Plugin <= 2.2.8 - Authenticated (Administrator+) Arbitrary File Uploadmetagauss · download plugin · CWE-434 RCE File upload	High7.2	—	1.2%	Jul 3, 2025
30Monitor	CVE-2025-6782Proof of concept	GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via dirGZActiveForm()optinlyhq · gozen forms · CWE-89 Pre-auth SQL injection	High7.5	—	0.3%	Jul 3, 2025
30Monitor	CVE-2025-6783Proof of concept	GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via emdedSc()optinlyhq · gozen forms · CWE-89 Pre-auth SQL injection	High7.5	—	0.4%	Jul 3, 2025
31Monitor	CVE-2025-47227Proof of concept	In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandlescriptcase · scriptcase · CWE-684 Pre-auth Auth bypass	High7.5	—	1.9%	Jul 4, 2025
33Monitor	CVE-2025-47228Proof of concept	In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows ascriptcase · scriptcase · CWE-78 RCE Command injection	Medium6.7	—	23.0%	Jul 4, 2025
14Monitor	CVE-2025-7081No exploit	Belkin F9K1122 webs formSetWanStatic os command injectionbelkin · f9k1122 firmware · CWE-77 RCE Command injection	Low2.1	—	19.9%	Jul 6, 2025
13Monitor	CVE-2025-7082No exploit	Belkin F9K1122 webs formBSSetSitesurvey os command injectionbelkin · f9k1122 firmware · CWE-77 RCE Command injection	Low2.1	—	17.1%	Jul 6, 2025
22Monitor	CVE-2025-7083No exploit	Belkin F9K1122 webs mp os command injectionbelkin · f9k1122 firmware · CWE-77 RCE Command injection	Low2.1	—	46.2%	Jul 6, 2025
33Monitor	CVE-2025-7087No exploit	Belkin F9K1122 webs formL2TPSetup stack-based overflowbelkin · f9k1122 firmware · CWE-119 Memory safety	High7.4	—	13.3%	Jul 6, 2025
33Monitor	CVE-2025-7088No exploit	Belkin F9K1122 webs formPPPoESetup stack-based overflowbelkin · f9k1122 firmware · CWE-119 Memory safety	High7.4	—	13.8%	Jul 6, 2025
26Monitor	CVE-2025-6713Proof of concept	MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stagemongodb · mongodb · CWE-285 Broken access control (IDOR)	Medium6.5	—	0.4%	Jul 7, 2025
60This week	CVE-2025-6793Weaponized	Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerabilitymarvell · qconvergeconsole · CWE-22 Pre-auth Path traversal	Critical9.4	—	17.4%	Jul 7, 2025
33Monitor	CVE-2025-32023Proof of concept	Redis allows out of bounds writes in hyperloglog commands leading to RCEredis · redis · CWE-680 RCE	High7.8	—	6.4%	Jul 7, 2025
24Monitor	CVE-2024-37656Proof of concept	An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL paramsir · gnuboard · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.5%	Jul 7, 2025
23Monitor	CVE-2025-7160Proof of concept	PHPGurukul Zoo Management System index.php sql injectionphpgurukul · zoo management system · CWE-74 Pre-auth SQL injection	Medium5.5	—	2.0%	Jul 8, 2025
38Monitor	CVE-2025-40737No exploit	A vulnerability has been identified in SINEC NMS (All versions < V4.0).siemens · sinec nms · CWE-22 Path traversal	High8.7	—	13.4%	Jul 8, 2025
38Monitor	CVE-2025-40738No exploit	A vulnerability has been identified in SINEC NMS (All versions < V4.0).siemens · sinec nms · CWE-22 Path traversal	High8.7	—	13.4%	Jul 8, 2025
34Monitor	CVE-2025-6770No exploit	OS command injection in Ivanti Endpoint Managerivanti · endpoint manager mobile · CWE-78 RCE Command injection	High7.2	—	19.5%	Jul 8, 2025
35Monitor	CVE-2025-6771No exploit	OS command injection in Ivanti Endpoint Managerivanti · endpoint manager mobile · CWE-78 RCE Command injection	High7.2	—	23.0%	Jul 8, 2025
33Monitor	CVE-2025-47178Proof of concept	Microsoft Configuration Manager Remote Code Execution Vulnerabilitymicrosoft · configuration manager 2503 · CWE-89 RCE SQL injection	High8.0	—	3.0%	Jul 8, 2025
51Plan	CVE-2025-47981Proof of concept	SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 pre-auth RCE Memory safety	Critical9.8	—	41.1%	Jul 8, 2025
37Monitor	CVE-2025-47984No exploit	Windows GDI Information Disclosure Vulnerabilitymicrosoft · windows 10 1507 · CWE-693 Pre-auth	High7.5	—	23.2%	Jul 8, 2025
32Monitor	CVE-2025-47987Proof of concept	Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 Local privilege escalation Memory safety	High7.8	—	1.7%	Jul 8, 2025
31Monitor	CVE-2025-48799Proof of concept	Windows Update Service Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-59 Local privilege escalation	High7.8	—	1.2%	Jul 8, 2025
27Monitor	CVE-2025-48804Proof of concept	Windows BitLocker Security Feature Bypass Vulnerabilitymicrosoft · windows 10 1507 · CWE-349	Medium6.8	—	0.6%	Jul 8, 2025
28Monitor	CVE-2025-49666Proof of concept	Windows Server Setup and Boot Event Collection Remote Code Execution Vulnerabilitymicrosoft · windows server 2016 · CWE-122 RCE Memory safety	High7.2	—	1.4%	Jul 8, 2025
28Monitor	CVE-2025-49677Proof of concept	Microsoft Brokering File System Elevation of Privilege Vulnerabilitymicrosoft · windows 11 22h2 · CWE-416 Local privilege escalation Memory safety	High7.0	—	1.1%	Jul 8, 2025
32Monitor	CVE-2025-49683Proof of concept	Microsoft Virtual Hard Disk Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 RCE Memory safety	High7.8	—	2.0%	Jul 8, 2025
95Now	CVE-2025-49704Weaponized	Microsoft SharePoint Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-94 RCE	High8.8	KEV	99.9%	Jul 8, 2025
86Now	CVE-2025-49706Weaponized	Microsoft SharePoint Server Spoofing Vulnerabilitymicrosoft · sharepoint enterprise server · CWE-287 Pre-auth Auth bypass	Medium6.5	KEV	99.0%	Jul 8, 2025
35Monitor	CVE-2025-49719No exploit	Microsoft SQL Server Information Disclosure Vulnerabilitymicrosoft · sql server 2016 · CWE-20 Pre-auth	High7.5	—	15.4%	Jul 8, 2025
31Monitor	CVE-2025-49730Proof of concept	Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 Local privilege escalation Memory safety Race condition	High7.8	—	0.6%	Jul 8, 2025
28Monitor	CVE-2025-49744Proof of concept	Windows Graphics Component Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 Local privilege escalation Memory safety	High7.0	—	0.8%	Jul 8, 2025
63This week	CVE-2025-48384Weaponized	Git allows arbitrary code execution through broken config quotinggit-scm · git · CWE-59 RCE	High8.0	KEV	4.3%	Jul 8, 2025
55Plan	CVE-2025-49533Proof of concept	Adobe Experience Manager (MS) \| Deserialization of Untrusted Data (CWE-502)adobe · experience manager · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	51.6%	Jul 8, 2025
34Monitor	CVE-2025-53547Proof of concept	Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Executionhelm · helm · CWE-94 RCE	High8.6	—	0.4%	Jul 8, 2025
29Monitor	CVE-2025-6759Proof of concept	Local Privilege escalation allows a low-privileged user to gain SYSTEM privilegescitrix · virtual apps and desktops · CWE-269 Local privilege escalation	High7.3	—	0.2%	Jul 8, 2025
42Plan	CVE-2025-7206No exploit	D-Link DIR-825 httpd switch_language.cgi sub_410DDC stack-based overflowdlink · dir-825 firmware · CWE-119 Pre-auth Memory safety	High8.9	—	21.6%	Jul 8, 2025
60This week	CVE-2025-34077Weaponized	WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCEgenetech solutions · wordpress pie register plugin · CWE-94 pre-auth RCE Auth bypass	Critical10.0	—	16.3%	Jul 8, 2025
39Monitor	CVE-2025-4606Proof of concept	Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeoveruxper · sala - startup & saas wordpress theme · CWE-620 Pre-auth	Critical9.8	—	0.6%	Jul 9, 2025
31Monitor	CVE-2025-38248Proof of concept	bridge: mcast: Fix use-after-free during router port configurationlinux · linux kernel · CWE-416 Memory safety	High7.8	—	0.3%	Jul 9, 2025
61This week	CVE-2025-6514Proof of concept	OS command injection in mcp-remote when connecting to untrusted MCP serversCWE-78 pre-auth RCE Command injection	Critical9.6	—	77.0%	Jul 9, 2025
36Monitor	CVE-2025-53546Proof of concept	Folo allows secrets exfiltration via `pull_request_target`rssnext · folo · CWE-829 Pre-auth	Critical9.1	—	0.3%	Jul 9, 2025
33Monitor	CVE-2025-44177Proof of concept	A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpwss · protop · CWE-22 Pre-auth Path traversal	High8.2	—	4.4%	Jul 9, 2025
32Monitor	CVE-2025-53652Proof of concept	Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches ojenkins · git parameter · CWE-20 Pre-auth	High8.2	—	0.6%	Jul 9, 2025
16Monitor	CVE-2025-52357Proof of concept	Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allowCWE-79 RCE XSS Denial of service	Medium4.1	—	0.3%	Jul 9, 2025
41Plan	CVE-2025-53624Proof of concept	docusaurus-plugin-content-gists Exposes GitHub Personal Access Tokenwebbertakken · docusaurus-plugin-content-gists · CWE-200 Pre-auth Info leak	Critical10.0	—	2.0%	Jul 9, 2025
47Plan	CVE-2025-6970Proof of concept	Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameterpixelite · events manager · CWE-89 Pre-auth SQL injection	High7.5	—	56.0%	Jul 9, 2025
12Monitor	CVE-2025-7407No exploit	Netgear D6400 diag.cgi os command injectionnetgear · d6400 firmware · CWE-77 RCE Command injection	Low2.1	—	12.1%	Jul 10, 2025
21Monitor	CVE-2025-53364Proof of concept	Parse Server exposes the data schema via GraphQL APIparse-community · parse-server · CWE-497 Pre-auth Info leak	Medium5.3	—	0.9%	Jul 10, 2025
36Monitor	CVE-2025-23048Proof of concept	Apache HTTP Server: mod_ssl access control bypass with session resumptionapache · http server · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	1.0%	Jul 10, 2025
98Now	CVE-2025-47812Weaponized	In Wing FTP Server before 7.4.4.wftpserver · wing ftp server · CWE-158 pre-auth RCE	Critical10.0	KEV	93.8%	Jul 10, 2025
66This week	CVE-2025-47813Weaponized	loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UIwftpserver · wing ftp server · CWE-209 Info leak	Medium4.3	KEV	62.5%	Jul 10, 2025
29Monitor	CVE-2025-49812Proof of concept	Apache HTTP Server: mod_ssl TLS upgrade attackapache · http server · CWE-287 Pre-auth Auth bypass	High7.4	—	0.6%	Jul 10, 2025
31Monitor	CVE-2025-53020Proof of concept	Apache HTTP Server: HTTP/2 DoS by Memory Increaseapache · http server · CWE-401 Pre-auth Denial of service	High7.5	—	4.9%	Jul 10, 2025
40Plan	CVE-2025-34093Weaponized	Polycom HDX Series Telnet Command Injection via lan traceroutepolycom · hdx series · CWE-78 RCE Auth bypass Command injection	High7.5	—	2.8%	Jul 10, 2025
60This week	CVE-2025-34095Weaponized	Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lspreal time logic · mako server · CWE-78 pre-auth RCE Command injection	Critical9.3	—	6.2%	Jul 10, 2025
60This week	CVE-2025-34096Weaponized	Easy File Sharing HTTP Server 7.2 Buffer Overflow via POST to /sendemail.ghpefs software inc. · easy file sharing http server · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	1.8%	Jul 10, 2025
40Plan	CVE-2025-34097Weaponized	ProcessMaker < 3.5.4 Authenticated Plugin Upload RCEprocessmaker inc. · processmaker · CWE-434 RCE File upload	High8.6	—	1.7%	Jul 10, 2025
40Plan	CVE-2025-34098Weaponized	Riverbed SteelHead VCX Authenticated Arbitrary File Read via Log Filter Injectionriverbed technology · steelhead vcx · CWE-200 Path traversal Info leak	High7.1	—	1.2%	Jul 10, 2025
60This week	CVE-2025-34099Weaponized	VICIdial vicidial_sales_viewer.php Unauthenticated Command Injection via Basic Auth Passwordvicidial group · vicidial · CWE-20 pre-auth RCE Command injection	Critical9.3	—	1.6%	Jul 10, 2025
60This week	CVE-2025-34100Weaponized	BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Uploadbuilderengine · cms · CWE-20 pre-auth RCE File upload	Critical9.3	—	3.8%	Jul 10, 2025
60This week	CVE-2025-34101Weaponized	Serviio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO Parameterserviio · media server · CWE-20 pre-auth RCE Command injection	Critical9.3	—	4.3%	Jul 10, 2025
60This week	CVE-2025-34102Weaponized	CryptoLog Unauthenticated RCE via SQL Injection and Command Injectioncrypttech · cryptolog · CWE-20 pre-auth RCE Auth bypass SQL injection Command injection	Critical9.3	—	9.4%	Jul 10, 2025
35Monitor	CVE-2025-53632Proof of concept	Chall-Manager's scenario decoding process does not check for zip slipsctfer-io · chall-manager · CWE-22 Pre-auth Path traversal	High8.8	—	0.8%	Jul 10, 2025
12Monitor	CVE-2025-7414No exploit	Tenda O3V2 httpd setPingInfo fromNetToolGet os command injectiontenda · o3 firmware · CWE-77 RCE Command injection	Low2.1	—	12.6%	Jul 10, 2025

CVE-2025-6934
47Plan
Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'
CriticalCVSS 9.8Proof of conceptEPSS 25%
- Pre-auth
wpopal · opal estate pro – property management and submissionJul 1, 2025
CVE-2025-41656
44Plan
Pilz: Missing Authentication in Node-RED integration
CriticalCVSS 10.0Proof of conceptEPSS 12%
- Pre-auth
- Auth bypass
pilz · industrialpi 4 with firmware bullseyeJul 1, 2025
CVE-2025-49029
37Monitor
WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability
CriticalCVSS 9.1Proof of conceptEPSS 2%
- RCE
bitto.kazi · custom login and signup widgetJul 1, 2025
CVE-2025-34065
27Monitor
AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via /nobody URL Path
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
avtech · ip camera, dvr, and nvr devicesJul 1, 2025
CVE-2025-37098
44Plan
A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.
HighCVSS 7.5No exploitEPSS 46%
- Pre-auth
- Path traversal
hpe · insight remote supportJul 1, 2025
CVE-2025-53107
37Monitor
@cyanheads/git-mcp-server vulnerable to command injection in several tools
HighCVSS 7.5No exploitEPSS 24%
- pre-auth RCE
- Command injection
cyanheads · git-mcp-serverJul 1, 2025
CVE-2025-53104
36Monitor
gluestack-ui Command Injection Vulnerability via discussion-to-slack GitHub Action Workflow
CriticalCVSS 9.1Proof of conceptEPSS 1%
- pre-auth RCE
- Command injection
gluestack · gluestack-uiJul 1, 2025
CVE-2025-49741
31Monitor
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
HighCVSS 7.5Proof of conceptEPSS 3%
- Pre-auth
microsoft · edge chromiumJul 1, 2025
CVE-2025-4380
52Plan
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion
CriticalCVSS 9.8Proof of conceptEPSS 42%
- pre-auth RCE
scripteo · ads proJul 2, 2025
CVE-2025-6463
40Plan
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submiss
HighCVSS 8.8No exploitEPSS 15%
- pre-auth RCE
- Path traversal
incsub · forminatorJul 2, 2025
CVE-2025-34057
37Monitor
Ruijie NBR Router Administrative Credential Disclosure
HighCVSS 8.7No exploitEPSS 10%
- Pre-auth
- Auth bypass
ruijie · nbr routerJul 2, 2025
CVE-2025-34067
47Plan
Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson
CriticalCVSS 10.0No exploitEPSS 21%
- pre-auth RCE
- Deserialization
hikvision · integrated security management platformJul 2, 2025
CVE-2025-34069
38Monitor
GFI Kerio Control GFIAgent Authentication Bypass via Proxy Forwarding
CriticalCVSS 9.5Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
gfi · kerio controlJul 2, 2025
CVE-2025-34071
37Monitor
GFI Kerio Control Unsigned System Image Upload Root Code Execution
CriticalCVSS 9.4Proof of conceptEPSS 0%
- RCE
- Auth bypass
gfi · kerio controlJul 2, 2025
CVE-2025-34073
60This week
stamparm/maltrail <=0.54 Remote Command Execution
CriticalCVSS 10.0WeaponizedEPSS 5%
- pre-auth RCE
- Command injection
stamparm · maltrailJul 2, 2025
CVE-2025-20309
40Plan
Cisco Unified Communications Manager Static SSH Credentials Vulnerability
CriticalCVSS 10.0No exploitEPSS 1%
- pre-auth RCE
- Hard-coded credentials
cisco · unified communications managerJul 2, 2025
CVE-2025-34074
40Plan
Lucee Admin Interface Authenticated Remote Code Execution via Scheduled Job File Write
CriticalCVSS 9.4WeaponizedEPSS 2%
- RCE
lucee association switzerland · luceeJul 2, 2025
CVE-2025-34078
40Plan
NSClient++ 0.5.2.35 Local Privilege Escalation via ExternalScripts and Web Interface
HighCVSS 7.3WeaponizedEPSS 0%
- RCE
- Local privilege escalation
- Info leak
nsclient · nsclient\+\+Jul 2, 2025
CVE-2025-34079
40Plan
NSClient++ Authenticated Remote Code Execution via ExternalScripts API
HighCVSS 7.5WeaponizedEPSS 1%
- RCE
nsclient · nsclient\+\+Jul 2, 2025
CVE-2025-34076
40Plan
Microweber CMS Authenticated Local File Inclusion via Backup API
MediumCVSS 6.1WeaponizedEPSS 2%
- Path traversal
microweber · microweberJul 2, 2025
CVE-2025-6563
19Monitor
Cross-site scripting via dst parameter in RouterOS WiFi hotspot
MediumCVSS 4.8Proof of conceptEPSS 0%
- Pre-auth
- XSS
mikrotik · routerosJul 3, 2025
CVE-2025-49618
23Monitor
In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.
MediumCVSS 5.8No exploitEPSS 0%
- Pre-auth
plesk · obsidianJul 3, 2025
CVE-2025-5961
45Plan
Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload
HighCVSS 7.2Proof of conceptEPSS 55%
- RCE
- File upload
wpvivid · migration\, backup\, stagingJul 3, 2025
CVE-2025-48939
16Monitor
tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript
MediumCVSS 4.2No exploitEPSS 0%
amauri · tarteaucitronjsJul 3, 2025
CVE-2025-23968
36Monitor
WordPress AiBud WP plugin <= 1.9 - Arbitrary File Upload vulnerability
CriticalCVSS 9.1Proof of conceptEPSS 0%
- File upload
webfactory · aibud wpJul 3, 2025
CVE-2025-45809
21Monitor
SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/k
MediumCVSS 5.4Proof of conceptEPSS 0%
- pre-auth RCE
- SQL injection
litellm · litellmJul 3, 2025
CVE-2025-34061
60This week
PHPStudy 2016-2018 Backdoor Remote Code Execution Vulnerability
CriticalCVSS 9.3WeaponizedEPSS 1%
- pre-auth RCE
henan xiaopi security technology co., ltd. · phpstudyJul 3, 2025
CVE-2025-34082
60This week
IGEL OS Secure Terminal and Secure Shadow Remote Code Execution
CriticalCVSS 9.3WeaponizedEPSS 6%
- pre-auth RCE
- Command injection
igel technology gmbh · osJul 3, 2025
CVE-2025-34087
40Plan
Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution
CriticalCVSS 9.0WeaponizedEPSS 6%
- RCE
- Command injection
pi-hole · pi-holeJul 3, 2025
CVE-2025-34088
40Plan
Pandora FMS Authenticated Remote Code Execution via Ping Module
HighCVSS 8.6WeaponizedEPSS 7%
- RCE
- Command injection
pandorafms · pandora fmsJul 3, 2025
CVE-2025-34089
60This week
Remote for Mac Unauthenticated Remote Code Execution via AppleScript Injection
CriticalCVSS 9.3WeaponizedEPSS 2%
- pre-auth RCE
aexol studio · remote for macJul 3, 2025
CVE-2025-49005
14Monitor
Next.js cache poisoning due to omission of Vary header
LowCVSS 3.7No exploitEPSS 0%
- Pre-auth
vercel · next.jsJul 3, 2025
CVE-2025-53367
33Monitor
DjVuLibre OOB-Write Vulnerability in MMRDecoder
HighCVSS 8.4Proof of conceptEPSS 0%
- Memory safety
djvunet · djvulibreJul 3, 2025
CVE-2025-34086
40Plan
Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename
HighCVSS 7.5WeaponizedEPSS 4%
- RCE
boltcms · boltJul 3, 2025
CVE-2025-6586
28Monitor
Download Plugin <= 2.2.8 - Authenticated (Administrator+) Arbitrary File Upload
HighCVSS 7.2Proof of conceptEPSS 1%
- RCE
- File upload
metagauss · download pluginJul 3, 2025
CVE-2025-6782
30Monitor
GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via dirGZActiveForm()
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
optinlyhq · gozen formsJul 3, 2025
CVE-2025-6783
30Monitor
GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via emdedSc()
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
optinlyhq · gozen formsJul 3, 2025
CVE-2025-47227
31Monitor
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandle
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- Auth bypass
scriptcase · scriptcaseJul 4, 2025
CVE-2025-47228
33Monitor
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows a
MediumCVSS 6.7Proof of conceptEPSS 23%
- RCE
- Command injection
scriptcase · scriptcaseJul 4, 2025
CVE-2025-7081
14Monitor
Belkin F9K1122 webs formSetWanStatic os command injection
LowCVSS 2.1No exploitEPSS 19%
- RCE
- Command injection
belkin · f9k1122 firmwareJul 6, 2025
CVE-2025-7082
13Monitor
Belkin F9K1122 webs formBSSetSitesurvey os command injection
LowCVSS 2.1No exploitEPSS 17%
- RCE
- Command injection
belkin · f9k1122 firmwareJul 6, 2025
CVE-2025-7083
22Monitor
Belkin F9K1122 webs mp os command injection
LowCVSS 2.1No exploitEPSS 46%
- RCE
- Command injection
belkin · f9k1122 firmwareJul 6, 2025
CVE-2025-7087
33Monitor
Belkin F9K1122 webs formL2TPSetup stack-based overflow
HighCVSS 7.4No exploitEPSS 13%
- Memory safety
belkin · f9k1122 firmwareJul 6, 2025
CVE-2025-7088
33Monitor
Belkin F9K1122 webs formPPPoESetup stack-based overflow
HighCVSS 7.4No exploitEPSS 13%
- Memory safety
belkin · f9k1122 firmwareJul 6, 2025
CVE-2025-6713
26Monitor
MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage
MediumCVSS 6.5Proof of conceptEPSS 0%
- Broken access control (IDOR)
mongodb · mongodbJul 7, 2025
CVE-2025-6793
60This week
Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability
CriticalCVSS 9.4WeaponizedEPSS 17%
- Pre-auth
- Path traversal
marvell · qconvergeconsoleJul 7, 2025
CVE-2025-32023
33Monitor
Redis allows out of bounds writes in hyperloglog commands leading to RCE
HighCVSS 7.8Proof of conceptEPSS 6%
- RCE
redis · redisJul 7, 2025
CVE-2024-37656
24Monitor
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL param
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- Open redirect
sir · gnuboardJul 7, 2025
CVE-2025-7160
23Monitor
PHPGurukul Zoo Management System index.php sql injection
MediumCVSS 5.5Proof of conceptEPSS 2%
- Pre-auth
- SQL injection
phpgurukul · zoo management systemJul 8, 2025
CVE-2025-40737
38Monitor
A vulnerability has been identified in SINEC NMS (All versions < V4.0).
HighCVSS 8.7No exploitEPSS 13%
- Path traversal
siemens · sinec nmsJul 8, 2025
CVE-2025-40738
38Monitor
A vulnerability has been identified in SINEC NMS (All versions < V4.0).
HighCVSS 8.7No exploitEPSS 13%
- Path traversal
siemens · sinec nmsJul 8, 2025
CVE-2025-6770
34Monitor
OS command injection in Ivanti Endpoint Manager
HighCVSS 7.2No exploitEPSS 19%
- RCE
- Command injection
ivanti · endpoint manager mobileJul 8, 2025
CVE-2025-6771
35Monitor
OS command injection in Ivanti Endpoint Manager
HighCVSS 7.2No exploitEPSS 23%
- RCE
- Command injection
ivanti · endpoint manager mobileJul 8, 2025
CVE-2025-47178
33Monitor
Microsoft Configuration Manager Remote Code Execution Vulnerability
HighCVSS 8.0Proof of conceptEPSS 3%
- RCE
- SQL injection
microsoft · configuration manager 2503Jul 8, 2025
CVE-2025-47981
51Plan
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 41%
- pre-auth RCE
- Memory safety
microsoft · windows 10 1507Jul 8, 2025
CVE-2025-47984
37Monitor
Windows GDI Information Disclosure Vulnerability
HighCVSS 7.5No exploitEPSS 23%
- Pre-auth
microsoft · windows 10 1507Jul 8, 2025
CVE-2025-47987
32Monitor
Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability
HighCVSS 7.8Proof of conceptEPSS 1%
- Local privilege escalation
- Memory safety
microsoft · windows 10 1507Jul 8, 2025
CVE-2025-48799
31Monitor
Windows Update Service Elevation of Privilege Vulnerability
HighCVSS 7.8Proof of conceptEPSS 1%
- Local privilege escalation
microsoft · windows 10 1607Jul 8, 2025
CVE-2025-48804
27Monitor
Windows BitLocker Security Feature Bypass Vulnerability
MediumCVSS 6.8Proof of conceptEPSS 0%
microsoft · windows 10 1507Jul 8, 2025
CVE-2025-49666
28Monitor
Windows Server Setup and Boot Event Collection Remote Code Execution Vulnerability
HighCVSS 7.2Proof of conceptEPSS 1%
- RCE
- Memory safety
microsoft · windows server 2016Jul 8, 2025
CVE-2025-49677
28Monitor
Microsoft Brokering File System Elevation of Privilege Vulnerability
HighCVSS 7.0Proof of conceptEPSS 1%
- Local privilege escalation
- Memory safety
microsoft · windows 11 22h2Jul 8, 2025
CVE-2025-49683
32Monitor
Microsoft Virtual Hard Disk Remote Code Execution Vulnerability
HighCVSS 7.8Proof of conceptEPSS 2%
- RCE
- Memory safety
microsoft · windows 10 1507Jul 8, 2025
CVE-2025-49704
95Now
Microsoft SharePoint Remote Code Execution Vulnerability
HighCVSS 8.8KEVWeaponizedEPSS 99%
- RCE
microsoft · sharepoint serverJul 8, 2025
CVE-2025-49706
86Now
Microsoft SharePoint Server Spoofing Vulnerability
MediumCVSS 6.5KEVWeaponizedEPSS 99%
- Pre-auth
- Auth bypass
microsoft · sharepoint enterprise serverJul 8, 2025
CVE-2025-49719
35Monitor
Microsoft SQL Server Information Disclosure Vulnerability
HighCVSS 7.5No exploitEPSS 15%
- Pre-auth
microsoft · sql server 2016Jul 8, 2025
CVE-2025-49730
31Monitor
Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
- Memory safety
- Race condition
microsoft · windows 10 1507Jul 8, 2025
CVE-2025-49744
28Monitor
Windows Graphics Component Elevation of Privilege Vulnerability
HighCVSS 7.0Proof of conceptEPSS 0%
- Local privilege escalation
- Memory safety
microsoft · windows 10 1507Jul 8, 2025
CVE-2025-48384
63This week
Git allows arbitrary code execution through broken config quoting
HighCVSS 8.0KEVWeaponizedEPSS 4%
- RCE
git-scm · gitJul 8, 2025
CVE-2025-49533
55Plan
Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)
CriticalCVSS 9.8Proof of conceptEPSS 51%
- pre-auth RCE
- Deserialization
adobe · experience managerJul 8, 2025
CVE-2025-53547
34Monitor
Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
HighCVSS 8.6Proof of conceptEPSS 0%
- RCE
helm · helmJul 8, 2025
CVE-2025-6759
29Monitor
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges
HighCVSS 7.3Proof of conceptEPSS 0%
- Local privilege escalation
citrix · virtual apps and desktopsJul 8, 2025
CVE-2025-7206
42Plan
D-Link DIR-825 httpd switch_language.cgi sub_410DDC stack-based overflow
HighCVSS 8.9No exploitEPSS 21%
- Pre-auth
- Memory safety
dlink · dir-825 firmwareJul 8, 2025
CVE-2025-34077
60This week
WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCE
CriticalCVSS 10.0WeaponizedEPSS 16%
- pre-auth RCE
- Auth bypass
genetech solutions · wordpress pie register pluginJul 8, 2025
CVE-2025-4606
39Monitor
Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
uxper · sala - startup & saas wordpress themeJul 9, 2025
CVE-2025-38248
31Monitor
bridge: mcast: Fix use-after-free during router port configuration
HighCVSS 7.8Proof of conceptEPSS 0%
- Memory safety
linux · linux kernelJul 9, 2025
CVE-2025-6514
61This week
OS command injection in mcp-remote when connecting to untrusted MCP servers
CriticalCVSS 9.6Proof of conceptEPSS 77%
- pre-auth RCE
- Command injection
Jul 9, 2025
CVE-2025-53546
36Monitor
Folo allows secrets exfiltration via `pull_request_target`
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
rssnext · foloJul 9, 2025
CVE-2025-44177
33Monitor
A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endp
HighCVSS 8.2Proof of conceptEPSS 4%
- Pre-auth
- Path traversal
wss · protopJul 9, 2025
CVE-2025-53652
32Monitor
Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches o
HighCVSS 8.2Proof of conceptEPSS 0%
- Pre-auth
jenkins · git parameterJul 9, 2025
CVE-2025-52357
16Monitor
Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allow
MediumCVSS 4.1Proof of conceptEPSS 0%
- RCE
- XSS
- Denial of service
Jul 9, 2025
CVE-2025-53624
41Plan
docusaurus-plugin-content-gists Exposes GitHub Personal Access Token
CriticalCVSS 10.0Proof of conceptEPSS 2%
- Pre-auth
- Info leak
webbertakken · docusaurus-plugin-content-gistsJul 9, 2025
CVE-2025-6970
47Plan
Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter
HighCVSS 7.5Proof of conceptEPSS 56%
- Pre-auth
- SQL injection
pixelite · events managerJul 9, 2025
CVE-2025-7407
12Monitor
Netgear D6400 diag.cgi os command injection
LowCVSS 2.1No exploitEPSS 12%
- RCE
- Command injection
netgear · d6400 firmwareJul 10, 2025
CVE-2025-53364
21Monitor
Parse Server exposes the data schema via GraphQL API
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Info leak
parse-community · parse-serverJul 10, 2025
CVE-2025-23048
36Monitor
Apache HTTP Server: mod_ssl access control bypass with session resumption
CriticalCVSS 9.1Proof of conceptEPSS 1%
- Pre-auth
- Broken access control (IDOR)
apache · http serverJul 10, 2025
CVE-2025-47812
98Now
In Wing FTP Server before 7.4.4.
CriticalCVSS 10.0KEVWeaponizedEPSS 93%
- pre-auth RCE
wftpserver · wing ftp serverJul 10, 2025
CVE-2025-47813
66This week
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UI
MediumCVSS 4.3KEVWeaponizedEPSS 62%
- Info leak
wftpserver · wing ftp serverJul 10, 2025
CVE-2025-49812
29Monitor
Apache HTTP Server: mod_ssl TLS upgrade attack
HighCVSS 7.4Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
apache · http serverJul 10, 2025
CVE-2025-53020
31Monitor
Apache HTTP Server: HTTP/2 DoS by Memory Increase
HighCVSS 7.5Proof of conceptEPSS 4%
- Pre-auth
- Denial of service
apache · http serverJul 10, 2025
CVE-2025-34093
40Plan
Polycom HDX Series Telnet Command Injection via lan traceroute
HighCVSS 7.5WeaponizedEPSS 2%
- RCE
- Auth bypass
- Command injection
polycom · hdx seriesJul 10, 2025
CVE-2025-34095
60This week
Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lsp
CriticalCVSS 9.3WeaponizedEPSS 6%
- pre-auth RCE
- Command injection
real time logic · mako serverJul 10, 2025
CVE-2025-34096
60This week
Easy File Sharing HTTP Server 7.2 Buffer Overflow via POST to /sendemail.ghp
CriticalCVSS 9.3WeaponizedEPSS 1%
- pre-auth RCE
- Memory safety
efs software inc. · easy file sharing http serverJul 10, 2025
CVE-2025-34097
40Plan
ProcessMaker < 3.5.4 Authenticated Plugin Upload RCE
HighCVSS 8.6WeaponizedEPSS 1%
- RCE
- File upload
processmaker inc. · processmakerJul 10, 2025
CVE-2025-34098
40Plan
Riverbed SteelHead VCX Authenticated Arbitrary File Read via Log Filter Injection
HighCVSS 7.1WeaponizedEPSS 1%
- Path traversal
- Info leak
riverbed technology · steelhead vcxJul 10, 2025
CVE-2025-34099
60This week
VICIdial vicidial_sales_viewer.php Unauthenticated Command Injection via Basic Auth Password
CriticalCVSS 9.3WeaponizedEPSS 1%
- pre-auth RCE
- Command injection
vicidial group · vicidialJul 10, 2025
CVE-2025-34100
60This week
BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Upload
CriticalCVSS 9.3WeaponizedEPSS 3%
- pre-auth RCE
- File upload
builderengine · cmsJul 10, 2025
CVE-2025-34101
60This week
Serviio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO Parameter
CriticalCVSS 9.3WeaponizedEPSS 4%
- pre-auth RCE
- Command injection
serviio · media serverJul 10, 2025
CVE-2025-34102
60This week
CryptoLog Unauthenticated RCE via SQL Injection and Command Injection
CriticalCVSS 9.3WeaponizedEPSS 9%
- pre-auth RCE
- Auth bypass
- SQL injection
- Command injection
crypttech · cryptologJul 10, 2025
CVE-2025-53632
35Monitor
Chall-Manager's scenario decoding process does not check for zip slips
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
ctfer-io · chall-managerJul 10, 2025
CVE-2025-7414
12Monitor
Tenda O3V2 httpd setPingInfo fromNetToolGet os command injection
LowCVSS 2.1No exploitEPSS 12%
- RCE
- Command injection
tenda · o3 firmwareJul 10, 2025