Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2025

330 records · 12 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 3 of 4

  • CVE-2025-38502
    28Monitor

    bpf: Fix oob access in cgroup local storage

    HighCVSS 7.1Proof of conceptEPSS 0%

    linux · linux kernelAug 16, 2025

  • CVE-2023-3866
    26Monitor

    ksmbd: validate session id and tree id in the compound request

    MediumCVSS 5.5No exploitEPSS 12%

    linux · linux kernelAug 16, 2025

  • CVE-2025-9090
    13Monitor

    Tenda AC20 Telnet Service telnet websFormDefine command injection

    LowCVSS 2.1Proof of conceptEPSS 16%

    tenda · ac20 firmwareAug 16, 2025

  • CVE-2025-41242
    24Monitor

    CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers

    MediumCVSS 5.9Proof of conceptEPSS 2%

    vmware · spring frameworkAug 18, 2025

  • CVE-2025-3639
    8Monitor

    Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13

    LowCVSS 2.0Proof of conceptEPSS 0%

    liferay · portalAug 18, 2025

  • CVE-2025-55287
    21Monitor

    Genealogy has a stored XSS vulnerability

    MediumCVSS 5.4Proof of conceptEPSS 0%

    kreaweb · genealogyAug 18, 2025

  • CVE-2025-55296
    25Monitor

    LibreNMS allows stored XSS in Alert Template name field

    MediumCVSS 5.4No exploitEPSS 14%

    librenms · librenmsAug 18, 2025

  • CVE-2025-6758
    39Monitor

    Real Spaces - WordPress Properties Directory Theme <= 3.6 - Unauthenticated Privilege Escalation to Administrator via 'imic_agent_register'

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    imithemes · real spaces - wordpress properties directory themeAug 19, 2025

  • CVE-2025-8723
    44Plan

    Cloudflare Image Resizing <= 1.5.6 - Missing Authentication to Unauthenticated Remote Code Execution via rest_pre_dispatch Hook

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    mecanik · cloudflare image resizing – optimize & accelerate your imagesAug 19, 2025

  • CVE-2025-50461
    26Monitor

    A deserialization vulnerability exists in Volcengine's verl 3.0.0, specifically in the scripts/model_merger.py script when using the "fsdp"

    MediumCVSS 6.5Proof of conceptEPSS 0%

    Aug 19, 2025

  • CVE-2025-9140
    8Monitor

    Shanghai Lingdang Information Technology Lingdang CRM tabdetail_moduleSave.php sql injection

    LowCVSS 2.1Proof of conceptEPSS 0%

    51mis · lingdang crmAug 19, 2025

  • CVE-2025-51529
    21Monitor

    Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 a

    MediumCVSS 5.3Proof of conceptEPSS 0%

    followmedarling · cookies and content security policyAug 19, 2025

  • CVE-2025-38561
    18Monitor

    ksmbd: fix Preauh_HashValue race condition

    MediumCVSS 4.7Proof of conceptEPSS 0%

    linux · linux kernelAug 19, 2025

  • CVE-2025-38562
    26Monitor

    ksmbd: fix null pointer dereference error in generate_encryptionkey

    MediumCVSS 5.5No exploitEPSS 11%

    linux · linux kernelAug 19, 2025

  • CVE-2025-55303
    27Monitor

    Unauthorized third-party images in Astro’s _image endpoint

    MediumCVSS 6.9Proof of conceptEPSS 0%

    astro · astroAug 19, 2025

  • CVE-2025-57788
    60This week

    Unauthorized API Access Risk

    MediumCVSS 6.9WeaponizedEPSS 7%

    commvault · commvaultAug 20, 2025

  • CVE-2025-57789
    21Monitor

    Vulnerability in Initial Administrator Login Process

    MediumCVSS 5.3Proof of conceptEPSS 1%

    commvault · commvaultAug 20, 2025

  • CVE-2025-57790
    43Plan

    Path Traversal Vulnerability

    HighCVSS 8.7WeaponizedEPSS 28%

    commvault · commvaultAug 20, 2025

  • CVE-2025-57791
    60This week

    Argument Injection Vulnerability in CommServe

    MediumCVSS 6.9WeaponizedEPSS 37%

    commvault · commvaultAug 20, 2025

  • CVE-2025-48148
    45Plan

    WordPress StoreKeeper for WooCommerce Plugin <= 14.4.4 - Arbitrary File Upload Vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    storekeeper b.v. · storekeeper for woocommerceAug 20, 2025

  • CVE-2025-48157
    33Monitor

    WordPress Formality <= 1.5.9 - Local File Inclusion Vulnerability

    HighCVSS 8.1Proof of conceptEPSS 2%

    michele giorgi · formalityAug 20, 2025

  • CVE-2025-53580
    39Monitor

    WordPress Simple Business Directory Pro Plugin < 15.6.9 - Privilege Escalation Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    quantumcloud · simple business directory proAug 20, 2025

  • CVE-2025-54677
    28Monitor

    WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.5.3 - Arbitrary File Upload Vulnerability

    HighCVSS 7.2Proof of conceptEPSS 0%

    vcita · online booking \& scheduling calendarAug 20, 2025

  • CVE-2025-54726
    37Monitor

    WordPress JS Archive List Plugin < 6.1.6 - SQL Injection Vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    miguel useche · js archive listAug 20, 2025

  • CVE-2025-9074
    38Monitor

    Docker Desktop allows unauthenticated access to Docker Engine API from containers

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    docker · docker desktopAug 20, 2025

  • CVE-2025-51990
    19Monitor

    XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, spec

    MediumCVSS 4.8Proof of conceptEPSS 0%

    xwiki · xwikiAug 20, 2025

  • CVE-2025-51991
    36Monitor

    XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the

    HighCVSS 8.8Proof of conceptEPSS 3%

    xwiki · xwikiAug 20, 2025

  • CVE-2010-10014
    60This week

    Odin Secure FTP <= 4.1 Stack Buffer Overflow via LIST Response

    HighCVSS 8.7WeaponizedEPSS 1%

    odin software · odin secure ftpAug 20, 2025

  • CVE-2010-20042
    40Plan

    Xion Audio Player ≤ 1.0.126 Unicode Stack Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    xion · audio playerAug 20, 2025

  • CVE-2010-20045
    40Plan

    FileWrangler <= 5.30 Stack Buffer Overflow

    HighCVSS 8.5WeaponizedEPSS 0%

    cursorarts · filewranglerAug 20, 2025

  • CVE-2010-20049
    60This week

    LeapFTP < 3.1.x Stack Buffer Overflow

    CriticalCVSS 9.3WeaponizedEPSS 1%

    leapware · leapftpAug 20, 2025

  • CVE-2010-20059
    60This week

    FreeNAS < 0.7.2 rev 5543 exec_raw.php Arbitrary Command Execution

    CriticalCVSS 9.3WeaponizedEPSS 1%

    ixsystems · freenasAug 20, 2025

  • CVE-2010-20103
    60This week

    ProFTPD 1.3.3c Backdoor Command Execution

    CriticalCVSS 9.3WeaponizedEPSS 13%

    proftpd · proftpdAug 20, 2025

  • CVE-2011-10020
    60This week

    Kaillera 0.86 Server DoS via Malformed UDP Packet

    HighCVSS 8.7WeaponizedEPSS 1%

    kaillera project · serverAug 20, 2025

  • CVE-2011-10021
    40Plan

    Magix Musik Maker <= v16 .mmm Stack-Based Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    magix software gmbh · magix musik makerAug 20, 2025

  • CVE-2011-10022
    60This week

    SPlayer 3.7 Content-Type Header Buffer Overflow

    HighCVSS 8.6WeaponizedEPSS 1%

    splayer project · splayerAug 20, 2025

  • CVE-2011-10023
    40Plan

    MJM QuickPlayer <= 2010 .s3m Stack-Based Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    mjm software · quickplayerAug 20, 2025

  • CVE-2011-10024
    40Plan

    MJM Core Player 2011 .s3m File Stack-Based Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    mjm software · core playerAug 20, 2025

  • CVE-2011-10025
    40Plan

    Subtitle Processor 7.7.1 .m3u SEH Unicode Buffer Overflow

    HighCVSS 8.5WeaponizedEPSS 0%

    subtitle processor · subtitle processorAug 20, 2025

  • CVE-2011-10026
    60This week

    Spreecommerce < 0.50.x API RCE

    CriticalCVSS 9.3WeaponizedEPSS 3%

    spreecommerce · spreeAug 20, 2025

  • CVE-2011-10027
    40Plan

    AOL Desktop 9.6 RTX Stack-Based Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    aol inc. · aol desktopAug 20, 2025

  • CVE-2011-10028
    60This week

    RealNetworks Arcade Games StubbyUtil.ProcessMgr ActiveX Arbitrary Code Execution

    HighCVSS 8.7WeaponizedEPSS 1%

    realnetworks · realarcade activexAug 20, 2025

  • CVE-2011-10029
    60This week

    Solar FTP Server <= 2.1.1 Malformed USER Denial of Service

    HighCVSS 8.7WeaponizedEPSS 1%

    flexbyte software · solar ftp serverAug 20, 2025

  • CVE-2011-10030
    40Plan

    Foxit PDF Reader < 4.3.1.0218 JavaScript File Write

    HighCVSS 8.4WeaponizedEPSS 0%

    foxit software · foxit pdf readerAug 20, 2025

  • CVE-2012-10061
    60This week

    Sockso Music Host Server <= 1.5 Path Traversal

    HighCVSS 8.7WeaponizedEPSS 1%

    sockso project · music host serverAug 20, 2025

  • CVE-2010-20010
    40Plan

    Foxit PDF Reader < 4.2.0.0928 Title Stack Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    foxit software · foxit pdf readerAug 20, 2025

  • CVE-2025-55746
    30Monitor

    Directus allows unauthenticated file upload and file modification due to lacking input sanitization

    HighCVSS 7.5Proof of conceptEPSS 1%

    monospace · directusAug 20, 2025

  • CVE-2009-10005
    60This week

    ContentKeeper Web Appliance < 125.10 Arbitrary File Access via mimencode

    HighCVSS 8.7WeaponizedEPSS 1%

    contentkeeper technologies · web applianceAug 20, 2025

  • CVE-2025-54988
    47Plan

    Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA

    HighCVSS 8.4WeaponizedEPSS 47%

    apache · tikaAug 20, 2025

  • CVE-2025-43300
    80Now

    An out-of-bounds write issue was addressed with improved bounds checking.

    CriticalCVSS 10.0KEVWeaponizedEPSS 32%

    apple · ipadosAug 20, 2025

  • CVE-2025-34158
    34Monitor

    Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/a

    HighCVSS 8.5Proof of conceptEPSS 0%

    plex · media serverAug 21, 2025

  • CVE-2025-55523
    14Monitor

    An issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows attackers to execute a directory traversal.

    LowCVSS 3.5Proof of conceptEPSS 1%

    agent-zero · agent-zeroAug 21, 2025

  • CVE-2010-10015
    40Plan

    AOL <= 9.5 Phobos.Playlist 'Import()' Stack-Based Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    aol · aolAug 21, 2025

  • CVE-2010-20109
    60This week

    Barracuda Spam & Virus Firewall "locale" Path Traversal

    HighCVSS 8.7WeaponizedEPSS 1%

    barracuda networks · spam & virus firewallAug 21, 2025

  • CVE-2010-20111
    40Plan

    Digital Music Pad <= 8.2.3.3.4 Stack Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    digital music pad · digital music padAug 21, 2025

  • CVE-2010-20112
    60This week

    Amlibweb NetOpacs webquery.dll Stack Buffer Overflow

    CriticalCVSS 9.3WeaponizedEPSS 1%

    amlib · amlibweb library management systemAug 21, 2025

  • CVE-2010-20119
    60This week

    CommuniCrypt Mail <= 1.16 ANSMTP/AOSMTP ActiveX Control Buffer Overflow

    HighCVSS 8.6WeaponizedEPSS 1%

    communicrypt software · communicrypt mailAug 21, 2025

  • CVE-2010-20121
    60This week

    EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow

    CriticalCVSS 9.3WeaponizedEPSS 4%

    easyftp server project · easyftp serverAug 21, 2025

  • CVE-2009-20002
    40Plan

    Millenium MP3 Studio <= 2.0 .pls File Stack-Based Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    millenium · mp3 studioAug 21, 2025

  • CVE-2009-20003
    40Plan

    Xenorate <= 2.50 .xpl File Stack-Based Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    xenorate · xenorateAug 21, 2025

  • CVE-2009-20004
    40Plan

    gAlan <= 0.2.1 Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    galan · galanAug 21, 2025

  • CVE-2010-20007
    40Plan

    Seagull FTP v3.3 Build 409 Stack Buffer Overflow

    HighCVSS 8.5WeaponizedEPSS 0%

    rocket software · seagull ftp clientAug 21, 2025

  • CVE-2010-20034
    40Plan

    Gekko Manager FTP Client <= 0.77 Stack Buffer Overflow

    HighCVSS 8.5WeaponizedEPSS 0%

    new software s.c. · gekko manager ftp clientAug 21, 2025

  • CVE-2010-20107
    40Plan

    FTP Synchronizer Professional <= 4.0.73.274 Stack Buffer Overflow

    HighCVSS 8.5WeaponizedEPSS 0%

    liuxz software · ftp synchronizer professionalAug 21, 2025

  • CVE-2010-20108
    40Plan

    FTPPad <= 1.2.0 Stack Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    ftppad · ftppad ftp clientAug 21, 2025

  • CVE-2010-20113
    60This week

    EasyFTP Server list.html path Stack Buffer Overflow

    CriticalCVSS 9.3WeaponizedEPSS 2%

    easyftp server project · easyftp serverAug 21, 2025

  • CVE-2010-20114
    40Plan

    VariCAD EN <= 2010-2.05 .dwb File Stack Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    varicad · varicad enAug 21, 2025

  • CVE-2010-20115
    60This week

    Vermillion FTP <= 1.31 Daemon PORT Command Memory Corruption

    CriticalCVSS 9.3WeaponizedEPSS 1%

    arcane software · vermillion ftp daemonAug 21, 2025

  • CVE-2010-20120
    40Plan

    Maple <= v13 Maplet File Creation and Command Execution

    HighCVSS 8.4WeaponizedEPSS 0%

    maplesoft · mapleAug 21, 2025

  • CVE-2010-20122
    60This week

    Xftp FTP Client <= 3.0 PWD Response Buffer Overflow

    CriticalCVSS 9.3WeaponizedEPSS 1%

    netsarang computer, inc. · xftp ftp clientAug 21, 2025

  • CVE-2010-20123
    40Plan

    Steinberg MyMP3Player <= 3.0.0.67 Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    steinberg · mymp3playerAug 21, 2025

  • CVE-2009-10006
    60This week

    UFO: Alien Invasion <= 2.2.1 IRC Client Buffer Overflow

    CriticalCVSS 9.3WeaponizedEPSS 1%

    ufo: alien invasion project · ufo: alien invasionAug 22, 2025

  • CVE-2024-58239
    22Monitor

    tls: stop recv() if initial process_rx_list gave us non-DATA

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelAug 22, 2025

  • CVE-2022-31491
    40Plan

    Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote at

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    Aug 22, 2025

  • CVE-2022-43110
    39Monitor

    Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    Aug 22, 2025

  • CVE-2025-5352
    38Monitor

    Environment Variable XSS in Analytics Component in lunary-ai/lunary

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    lunary · lunaryAug 23, 2025

  • CVE-2025-43960
    34Monitor

    Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using

    HighCVSS 8.6Proof of conceptEPSS 0%

    adminer · adminerAug 25, 2025

  • CVE-2025-53118
    49Plan

    Securden Unified PAM Authentication Bypass

    CriticalCVSS 9.8Proof of conceptEPSS 32%

    securden · unified pamAug 25, 2025

  • CVE-2025-53119
    34Monitor

    Securden Unified PAM Unauthenticated Unrestricted File Upload

    HighCVSS 7.5No exploitEPSS 14%

    securden · unified pamAug 25, 2025

  • CVE-2025-55575
    39Monitor

    SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    Aug 25, 2025

  • CVE-2025-53120
    40Plan

    Securden Unified PAM Path Traversal In File Upload

    CriticalCVSS 9.4No exploitEPSS 11%

    securden · unified pamAug 25, 2025

  • CVE-2025-57772
    35Monitor

    Dataease H2 JDBC RCE Bypass

    HighCVSS 8.2No exploitEPSS 10%

    dataease · dataeaseAug 25, 2025

  • CVE-2025-50383
    32Monitor

    alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter.

    HighCVSS 8.1Proof of conceptEPSS 0%

    easyappointments · easy\!appointmentsAug 25, 2025

  • CVE-2025-9424
    13Monitor

    Ruijie WS7204-A branch_import.php os command injection

    LowCVSS 2.0No exploitEPSS 15%

    ruijie · ws7204-a firmwareAug 25, 2025

  • CVE-2025-9172
    30Monitor

    Vibes <= 2.2.0 - Unauthenticated SQL Injection via `resource` Parameter

    HighCVSS 7.5Proof of conceptEPSS 0%

    pierrelannoy · vibesAug 26, 2025

  • CVE-2025-38676
    31Monitor

    iommu/amd: Avoid stack buffer overflow from kernel cmdline

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelAug 26, 2025

  • CVE-2025-7775
    72This week

    Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service

    CriticalCVSS 9.2KEVWeaponizedEPSS 20%

    citrix · netscaler application delivery controllerAug 26, 2025

  • CVE-2025-9491
    40Plan

    Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability

    MediumCVSS 4.6Proof of conceptEPSS 73%

    microsoft · windows 11 23h2Aug 26, 2025

  • CVE-2025-9478
    37Monitor

    Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a craf

    HighCVSS 8.8Proof of conceptEPSS 7%

    google · chromeAug 26, 2025

  • CVE-2023-21125
    32Monitor

    In btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a use after free.

    HighCVSS 8.0Proof of conceptEPSS 0%

    google · androidAug 26, 2025

  • CVE-2025-26417
    16Monitor

    In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage

    MediumCVSS 4.0Proof of conceptEPSS 0%

    google · androidAug 26, 2025

  • CVE-2025-9528
    24Monitor

    Linksys E1700 systemCommand os command injection

    LowCVSS 2.0No exploitEPSS 54%

    linksys · e1700 firmwareAug 27, 2025

  • CVE-2025-50989
    39Monitor

    OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_ed

    CriticalCVSS 9.1No exploitEPSS 10%

    opnsense · opnsenseAug 27, 2025

  • CVE-2025-52122
    39Monitor

    Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbit

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    solspace · freeformAug 27, 2025

  • CVE-2025-9533
    25Monitor

    TOTOLINK T10 formLoginAuth.htm improper authentication

    MediumCVSS 5.5No exploitEPSS 10%

    totolink · t10 firmwareAug 27, 2025

  • CVE-2025-20262
    20Monitor

    Cisco Nexus 3000 and 9000 Series Switches Protocol Independent Multicast Version 6 Denial of Service Vulnerability

    MediumCVSS 5.0No exploitEPSS 0%

    cisco · cisco nx-os softwareAug 27, 2025

  • CVE-2025-34157
    37Monitor

    Coolify Stored Cross-Site Scripting (XSS) in Project Name Field

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    coollabs · coolifyAug 27, 2025

  • CVE-2025-34159
    37Monitor

    Coolify Docker Compose Directive Injection in Application Deployment Workflow

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    coollabs · coolifyAug 27, 2025

  • CVE-2025-34161
    38Monitor

    Coolify Git Repository Field Command Injection in Project Deployment Workflow

    CriticalCVSS 9.4Proof of conceptEPSS 2%

    coollabs · coolifyAug 27, 2025

  • CVE-2025-50428
    39Monitor

    In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    raspap · raspap-webguiAug 27, 2025