Skip to content
OpenAdvisories

Archive

July 2025

Vulnerabilities first published in this month (UTC), newest first.

← June 2025 2025 / July August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

50 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-7545 Public exploit

    GNU Binutils objcopy.c copy_section heap-based overflow

    A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The…

    GNU Binutils binutils binutils Debian Ubuntu Azure Linux Wolfi
  • Medium 5.3
    CVE-2025-48924 Public exploit

    Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

    Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can thr…

    Apache Software Foundation Apache Commons Lang druid thingsboard-tb-node Debian Ubuntu Azure Linux Wolfi Maven
  • Medium 4.1
    CVE-2025-52357 Public exploit

    Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (fir…

  • Medium 6.5
    CVE-2025-49706 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Microsoft SharePoint Server Spoofing Vulnerability

    Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server Subscription Edition
    KEV Jul 22, 2025
  • Medium 6.8
    CVE-2025-48804 Public exploit

    Windows BitLocker Security Feature Bypass Vulnerability

    Acceptance of extraneous untrusted data with trusted data in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Medium 6.7
    CVE-2025-47228 Public exploit EPSS 23%

    In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connect…

    ScriptCase ScriptCase
  • Medium 4.8
    CVE-2025-6563 Public exploit

    Cross-site scripting via dst parameter in RouterOS WiFi hotspot

    A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS executes…

    MikroTik RouterOS Network devices
  • Medium 5.4
    CVE-2025-45809 Public exploit

    SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key…

  • Medium 6.1
    CVE-2025-34076 Public exploit

    Microweber CMS Authenticated Local File Inclusion via Backup API

    An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files fr…

    microweber CMS microweber/microweber Packagist
  • Medium 6.9
    CVE-2025-34065 Public exploit

    AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via /nobody URL Path

    An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls.

    AVTECH IP camera, DVR, and NVR Devices