Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: July 2025

340 records · 14 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 3 of 4

  • CVE-2025-54352
    14Monitor

    WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests.

    LowCVSS 3.7Proof of conceptEPSS 0%

    wordpress · wordpressJul 21, 2025

  • CVE-2025-2301
    17Monitor

    IDOR in Akbim Software's Online Exam Registration

    MediumCVSS 4.4Proof of conceptEPSS 0%

    akbim software · online exam registrationJul 21, 2025

  • CVE-2024-13973
    32Monitor

    A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to adminis

    HighCVSS 7.2No exploitEPSS 12%

    sophos · firewall firmwareJul 21, 2025

  • CVE-2025-6704
    43Plan

    An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) ca

    CriticalCVSS 9.8No exploitEPSS 11%

    sophos · firewall firmwareJul 21, 2025

  • CVE-2025-7624
    42Plan

    An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to r

    CriticalCVSS 9.8No exploitEPSS 10%

    sophos · firewall firmwareJul 21, 2025

  • CVE-2024-55040
    24Monitor

    Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary

    MediumCVSS 6.1Proof of conceptEPSS 0%

    sensaphone · web600 firmwareJul 21, 2025

  • CVE-2025-36845
    35Monitor

    An issue was discovered in Eveo URVE Web Manager 27.02.2025.

    HighCVSS 8.6Proof of conceptEPSS 1%

    eveo · urve web managerJul 21, 2025

  • CVE-2025-51396
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via in

    MediumCVSS 5.4Proof of conceptEPSS 1%

    livehelperchat · live helper chatJul 21, 2025

  • CVE-2025-51397
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrar

    MediumCVSS 5.4Proof of conceptEPSS 0%

    livehelperchat · live helper chatJul 21, 2025

  • CVE-2025-51398
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute ar

    MediumCVSS 5.4Proof of conceptEPSS 0%

    livehelperchat · live helper chatJul 21, 2025

  • CVE-2025-51400
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbi

    MediumCVSS 5.4Proof of conceptEPSS 0%

    livehelperchat · live helper chatJul 21, 2025

  • CVE-2025-51401
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitr

    MediumCVSS 5.4Proof of conceptEPSS 0%

    livehelperchat · live helper chatJul 21, 2025

  • CVE-2025-51403
    26Monitor

    A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers

    MediumCVSS 6.5Proof of conceptEPSS 1%

    livehelperchat · live helper chatJul 21, 2025

  • CVE-2025-51868
    30Monitor

    Insecure Direct Object Reference (IDOR) vulnerability in Dippy (chat.dippy.ai) v2 allows attackers to gain sensitive information via the con

    HighCVSS 7.5Proof of conceptEPSS 0%

    Jul 21, 2025

  • CVE-2025-51869
    30Monitor

    Insecure Direct Object Reference (IDOR) vulnerability in Liner thru 2025-06-03 allows attackers to gain sensitive information via crafted sp

    HighCVSS 7.5Proof of conceptEPSS 0%

    Jul 21, 2025

  • CVE-2025-53832
    33Monitor

    @translated/lara-mcp vulnerable to command injection in import_tmx tool

    HighCVSS 7.5No exploitEPSS 10%

    translated · lara-mcpJul 21, 2025

  • CVE-2012-10020
    60This week

    FoxyPress <= 0.4.2.1 - Arbitrary File Upload

    CriticalCVSS 9.8WeaponizedEPSS 4%

    webmovementllc · foxypressJul 21, 2025

  • CVE-2015-10137
    60This week

    Website Contact Form With File Upload <= 1.3.4 - Arbitrary File Upload

    CriticalCVSS 9.8WeaponizedEPSS 5%

    najeebmedia · website contact form with file uploadJul 21, 2025

  • CVE-2025-7952
    15Monitor

    TOTOLINK T6 MQTT Packet wireless.so ckeckKeepAlive command injection

    LowCVSS 2.1No exploitEPSS 24%

    totolink · t6 firmwareJul 21, 2025

  • CVE-2025-38352
    61This week

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    linux · linux kernelJul 22, 2025

  • CVE-2025-6082
    22Monitor

    Birth Chart Compatibility <= 2.0 - Unauthenticated Full Path Exposure

    MediumCVSS 5.3Proof of conceptEPSS 1%

    mia4 · birth chart compatibilityJul 22, 2025

  • CVE-2025-34141
    21Monitor

    ETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`

    MediumCVSS 5.1Proof of conceptEPSS 2%

    etq · reliance cg (legacy)Jul 22, 2025

  • CVE-2025-34143
    48Plan

    ETQ Reliance CG Authentication Bypass via Trailing Space RCE

    CriticalCVSS 9.3Proof of conceptEPSS 38%

    etq · reliance cg (legacy)Jul 22, 2025

  • CVE-2015-10140
    40Plan

    Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion

    HighCVSS 8.8WeaponizedEPSS 1%

    connekthq · ajax load moreJul 22, 2025

  • CVE-2025-51867
    26Monitor

    Insecure Direct Object Reference (IDOR) vulnerability in Deepfiction AI (deepfiction.ai) thru June 3, 2025, allowing attackers to chat with

    MediumCVSS 6.5Proof of conceptEPSS 0%

    Jul 22, 2025

  • CVE-2025-8017
    33Monitor

    Tenda AC7 httpd setMacFilterCfg formSetMacFilterCfg stack-based overflow

    HighCVSS 7.4No exploitEPSS 13%

    tenda · ac7 firmwareJul 22, 2025

  • CVE-2025-51858
    24Monitor

    Self Cross-Site Scripting (XSS) vulnerability in ChatPlayground.ai through 2025-05-24, allows attackers to execute arbitrary code and gain s

    MediumCVSS 6.1Proof of conceptEPSS 0%

    Jul 22, 2025

  • CVE-2025-51859
    26Monitor

    Stored Cross-Site Scripting (XSS) vulnerability in Chaindesk thru 2025-05-26 in its agent chat component.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    Jul 22, 2025

  • CVE-2025-51860
    24Monitor

    Stored Cross-Site Scripting (XSS) in TelegAI (telegai.com) 2025-05-26 in its chat component and character container component.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    Jul 22, 2025

  • CVE-2025-51862
    24Monitor

    Insecure Direct Object Reference (IDOR) vulnerability in TelegAI (telegai.com) thru 2025-05-26 in its chat component.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    Jul 22, 2025

  • CVE-2025-51863
    24Monitor

    Self Cross Site Scripting (XSS) vulnerability in ChatGPT Unli (ChatGPTUnli.com) thru 2025-05-26 allows attackers to execute arbitrary code v

    MediumCVSS 6.1Proof of conceptEPSS 0%

    Jul 22, 2025

  • CVE-2025-51864
    26Monitor

    A reflected cross-site scripting (XSS) vulnerability exists in AIBOX LLM chat (chat.aibox365.cn) through 2025-05-27, allowing attackers to h

    MediumCVSS 6.5Proof of conceptEPSS 0%

    Jul 22, 2025

  • CVE-2025-51865
    35Monitor

    Ai2 playground web service (playground.allenai.org) LLM chat through 2025-06-03 is vulnerable to Insecure Direct Object Reference (IDOR), al

    HighCVSS 8.8Proof of conceptEPSS 0%

    Jul 22, 2025

  • CVE-2025-8018
    8Monitor

    code-projects Food Ordering Review System reservation_page.php sql injection

    LowCVSS 2.1Proof of conceptEPSS 0%

    carmelo · food ordering review systemJul 22, 2025

  • CVE-2025-51482
    36Monitor

    Remote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows remote attackers to exe

    HighCVSS 8.8Proof of conceptEPSS 2%

    letta · lettaJul 22, 2025

  • CVE-2025-51471
    33Monitor

    Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and

    MediumCVSS 6.9Proof of conceptEPSS 18%

    ollama · ollamaJul 22, 2025

  • CVE-2025-51458
    26Monitor

    SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary SQL statements via cr

    MediumCVSS 6.5Proof of conceptEPSS 0%

    dbgpt · db-gptJul 22, 2025

  • CVE-2025-7766
    35Monitor

    Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference

    HighCVSS 8.6Proof of conceptEPSS 2%

    lantronix · provisioning managerJul 22, 2025

  • CVE-2025-54439
    39Monitor

    Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue aff

    HighCVSS 8.8No exploitEPSS 13%

    samsung · magicinfo 9 serverJul 23, 2025

  • CVE-2025-54441
    40Plan

    Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue aff

    HighCVSS 8.8No exploitEPSS 15%

    samsung · magicinfo 9 serverJul 23, 2025

  • CVE-2025-54445
    44Plan

    Improper Restriction of XML External Entity Reference vulnerability in Samsung Electronics MagicINFO 9 Server allows Server Side Request For

    CriticalCVSS 9.8No exploitEPSS 17%

    samsung · magicinfo 9 serverJul 23, 2025

  • CVE-2025-54453
    49Plan

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allow

    CriticalCVSS 9.8No exploitEPSS 34%

    samsung · magicinfo 9 serverJul 23, 2025

  • CVE-2025-6174
    24Monitor

    WordPress Qwizcards <= 3.9.4 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    unknown · qwizcards | online quizzes and flashcardsJul 23, 2025

  • CVE-2025-31700
    32Monitor

    A vulnerability has been found in Dahua products.

    HighCVSS 8.1Proof of conceptEPSS 0%

    dahua · ipcJul 23, 2025

  • CVE-2010-10012
    60This week

    httpdASM 0.92 Path Traversal

    HighCVSS 8.7WeaponizedEPSS 2%

    japheth · httpdasmJul 23, 2025

  • CVE-2015-10141
    60This week

    Xdebug Remote Debugger Unauthenticated OS Command Execution

    CriticalCVSS 9.3WeaponizedEPSS 7%

    xdebug · xdebugJul 23, 2025

  • CVE-2016-15045
    40Plan

    Deepin lastore-daemon Privilege Escalation via Unsigned .deb Installation

    HighCVSS 8.5WeaponizedEPSS 0%

    wuhan deepin technology co., ltd. · deepin linuxJul 23, 2025

  • CVE-2017-20198
    60This week

    DC/OS Marathon UI < 1.9.0 Unauthenticated RCE via Docker Mount Abuse

    CriticalCVSS 9.3WeaponizedEPSS 1%

    d2iq, inc. · dc/os marathonJul 23, 2025

  • CVE-2018-25113
    60This week

    Dicoogle PACS Web Server 2.5.0 Unauthenticated Path Traversal

    HighCVSS 8.7WeaponizedEPSS 1%

    dicoogle project · pacs web serverJul 23, 2025

  • CVE-2018-25114
    60This week

    osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution

    CriticalCVSS 9.3WeaponizedEPSS 4%

    oscommerce · online merchantJul 23, 2025

  • CVE-2022-4978
    60This week

    Steppschuh Remote Control Server 3.1.1.12 Unauthenticated RCE

    CriticalCVSS 9.3WeaponizedEPSS 2%

    steppschuh · remote control collection serverJul 23, 2025

  • CVE-2025-46099
    28Monitor

    In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it v

    HighCVSS 7.2Proof of conceptEPSS 0%

    pluck-cms · pluckJul 23, 2025

  • CVE-2025-40596
    43Plan

    A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Se

    HighCVSS 7.3No exploitEPSS 45%

    sonicwall · sma 500v firmwareJul 23, 2025

  • CVE-2025-40597
    37Monitor

    A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Ser

    HighCVSS 7.5No exploitEPSS 22%

    sonicwall · sma 500v firmwareJul 23, 2025

  • CVE-2025-40598
    38Monitor

    A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker t

    MediumCVSS 6.1No exploitEPSS 46%

    sonicwall · sma 500v firmwareJul 23, 2025

  • CVE-2025-6018
    31Monitor

    Pam-config: lpe from unprivileged to allow_active in pam

    HighCVSS 7.8Proof of conceptEPSS 1%

    suse · pam-configJul 23, 2025

  • CVE-2025-46171
    21Monitor

    vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    vbulletin · vbulletinJul 23, 2025

  • CVE-2025-50481
    19Monitor

    A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary

    MediumCVSS 4.8Proof of conceptEPSS 0%

    jupo · mezzanineJul 23, 2025

  • CVE-2016-15044
    60This week

    Kaltura < 11.1.0-2 PHP Object Injection RCE

    CriticalCVSS 9.3WeaponizedEPSS 2%

    kaltura · video platformJul 23, 2025

  • CVE-2025-4822
    39Monitor

    SQLi in Bayraktar Solar Energies' ScadaWatt Otopilot

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    bayraktar solar energies · scadawatt otopilotJul 24, 2025

  • CVE-2025-5243
    40Plan

    Arbitrary File Upload in SMG Software's Information Portal

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    smg software · information portalJul 24, 2025

  • CVE-2025-51087
    38Monitor

    Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/saveParentControlInfo.

    HighCVSS 8.6No exploitEPSS 12%

    tenda · ac8 firmwareJul 24, 2025

  • CVE-2025-6998
    34Monitor

    Calibre Web 0.6.24 & Autocaliweb 0.7.0 - ReDoS

    HighCVSS 8.7Proof of conceptEPSS 0%

    calibre web · calibre webJul 24, 2025

  • CVE-2025-7404
    24Monitor

    Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C

    MediumCVSS 5.9Proof of conceptEPSS 2%

    gelbphoenix · autocaliwebJul 24, 2025

  • CVE-2025-32429
    63This week

    XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

    CriticalCVSS 9.3Proof of conceptEPSS 85%

    xwiki · xwikiJul 24, 2025

  • CVE-2015-10143
    60This week

    Platform < 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Options Update

    CriticalCVSS 9.8WeaponizedEPSS 3%

    pagelines · platform themeJul 24, 2025

  • CVE-2015-10144
    40Plan

    Responsive Thumbnail Slider < 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload

    HighCVSS 8.8WeaponizedEPSS 3%

    i13websolution · thumbnail carousel sliderJul 24, 2025

  • CVE-2019-25224
    60This week

    WP Database Backup < 5.2 - Unauthenticated OS Command Injection

    CriticalCVSS 9.8WeaponizedEPSS 22%

    wpseeds · wp database backupJul 24, 2025

  • CVE-2025-8138
    32Monitor

    TOTOLINK A702R HTTP POST Request formOneKeyAccessButton buffer overflow

    HighCVSS 7.4No exploitEPSS 11%

    totolink · a702r firmwareJul 25, 2025

  • CVE-2025-8140
    32Monitor

    TOTOLINK A702R HTTP POST Request formWlanMultipleAP buffer overflow

    HighCVSS 7.4No exploitEPSS 11%

    totolink · a702r firmwareJul 25, 2025

  • CVE-2025-8155
    16Monitor

    D-Link DCS-6010L Management Application vb.htm cross site scripting

    LowCVSS 2.0No exploitEPSS 25%

    dlink · dcs-6010l firmwareJul 25, 2025

  • CVE-2025-51411
    24Monitor

    A reflected cross-site scripting (XSS) vulnerability exists in Institute-of-Current-Students v1.0 via the email parameter in the /postqueryp

    MediumCVSS 6.1Proof of conceptEPSS 0%

    vishalmathur · institute-of-current-studentsJul 25, 2025

  • CVE-2025-44608
    26Monitor

    CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    vishalmathur · cloudclassroom-php projectJul 25, 2025

  • CVE-2025-45467
    28Monitor

    Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an

    HighCVSS 7.1Proof of conceptEPSS 0%

    unitree · go1 firmwareJul 25, 2025

  • CVE-2025-8159
    35Monitor

    D-Link DIR-513 HTTP POST Request formLanguageChange stack-based overflow

    HighCVSS 7.4No exploitEPSS 20%

    dlink · dir-513 firmwareJul 25, 2025

  • CVE-2013-10032
    40Plan

    GetSimple CMS 3.2.1 Authenticated RCE via Arbitrary PHP File Upload

    HighCVSS 8.7WeaponizedEPSS 4%

    get-simple · getsimplecmsJul 25, 2025

  • CVE-2014-125114
    40Plan

    i-Ftp 2.20 Schedule.xml Stack-Based Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    i-ftp · i-ftpJul 25, 2025

  • CVE-2014-125115
    60This week

    Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE

    CriticalCVSS 10.0WeaponizedEPSS 2%

    artica st · pandora fmsJul 25, 2025

  • CVE-2014-125116
    60This week

    HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection

    CriticalCVSS 9.3WeaponizedEPSS 2%

    hybridauth · hybridauthJul 25, 2025

  • CVE-2014-125117
    60This week

    D-Link info.cgi POST Request Stack-Based Buffer Overflow RCE

    CriticalCVSS 9.3WeaponizedEPSS 9%

    dlink · dsp-w215 firmwareJul 25, 2025

  • CVE-2014-125118
    40Plan

    eScan 5.5-2 Web Management Console Command Injection

    CriticalCVSS 9.4WeaponizedEPSS 4%

    microworld · escan web management consoleJul 25, 2025

  • CVE-2014-125119
    40Plan

    WinRAR < 5.00 Filename Spoofing RCE

    HighCVSS 8.4WeaponizedEPSS 1%

    rarlab · winrarJul 25, 2025

  • CVE-2025-45466
    35Monitor

    Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext.

    HighCVSS 8.8Proof of conceptEPSS 0%

    unitree · go1 firmwareJul 25, 2025

  • CVE-2025-29628
    37Monitor

    A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    gardyn · home kit firmwareJul 25, 2025

  • CVE-2025-45960
    24Monitor

    Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application s

    MediumCVSS 6.1Proof of conceptEPSS 0%

    tawk · tawk.toJul 25, 2025

  • CVE-2025-54415
    36Monitor

    dag-factory's CI/CD Workflow Allows for Repository Takeover and Secret Exfiltration

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    astronomer · dag-factoryJul 26, 2025

  • CVE-2025-54416
    36Monitor

    tj-actions/branch-names Contains Command Injection Vulnerability

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    tj-actions · branch-namesJul 26, 2025

  • CVE-2025-8180
    33Monitor

    Tenda CH22 deleteUserName formdeleteUserName buffer overflow

    HighCVSS 7.4No exploitEPSS 12%

    tenda · ch22 firmwareJul 26, 2025

  • CVE-2025-8184
    34Monitor

    D-Link DIR-513 HTTP POST Request formSetWanL2TPtriggers formSetWanL2TPcallback stack-based overflow

    HighCVSS 7.4No exploitEPSS 15%

    dlink · dir-513 firmwareJul 26, 2025

  • CVE-2025-8191
    9Monitor

    macrozheng mall Swagger UI index.html cross site scripting

    LowCVSS 2.0Proof of conceptEPSS 1%

    macrozheng · mallJul 26, 2025

  • CVE-2025-54597
    24Monitor

    LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    linuxserver · heimdall application dashboardJul 26, 2025

  • CVE-2025-8220
    22Monitor

    Engeman Web Password Recovery RecoveryPass sql injection

    MediumCVSS 5.5Proof of conceptEPSS 0%

    engeman · webJul 27, 2025

  • CVE-2025-5120
    48Plan

    Sandbox Escape Vulnerability in huggingface/smolagents

    CriticalCVSS 10.0No exploitEPSS 26%

    huggingface · smolagentsJul 27, 2025

  • CVE-2025-8266
    8Monitor

    yanyutao0402 ChanCMS collect.js getArticle deserialization

    LowCVSS 2.1Proof of conceptEPSS 1%

    chancms · chancmsJul 28, 2025

  • CVE-2025-54769
    36Monitor

    KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal

    HighCVSS 8.8Proof of conceptEPSS 3%

    xorux · lpar2rrdJul 28, 2025

  • CVE-2025-50738
    40Plan

    The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs.

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    usememos · memosJul 29, 2025

  • CVE-2025-51970
    30Monitor

    A SQL Injection vulnerability exists in the action.php endpoint of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper saniti

    HighCVSS 7.7Proof of conceptEPSS 0%

    puneethreddyhc · online shopping system advancedJul 29, 2025

  • CVE-2025-44136
    40Plan

    MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS).

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    maptiler · tileserver phpJul 29, 2025

  • CVE-2025-44137
    32Monitor

    MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal.

    HighCVSS 8.2Proof of conceptEPSS 1%

    maptiler · tileserver phpJul 29, 2025

  • CVE-2024-43018
    25Monitor

    Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register.

    MediumCVSS 6.4Proof of conceptEPSS 0%

    piwigo · piwigoJul 29, 2025