Total
94382 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-7395 | 2025-07-22 | N/A | N/A | ||
| A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL client failing to properly verify the server certificate's domain name, allowing any certificate issued by a trusted CA to be accepted regardless of the hostname. | |||||
| CVE-2025-4569 | 2025-07-22 | N/A | N/A | ||
| An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services. Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information. | |||||
| CVE-2025-54082 | 2025-07-22 | N/A | N/A | ||
| marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the application. The vulnerability is due to missing authentication middleware (Nova and Nova.Auth) on the /nova-tiptap/api/file upload endpoint, the lack of validation on uploaded files (no MIME/type or extension restrictions), and the ability for an attacker to choose the disk parameter dynamically. This means an attacker can craft a custom form and send a POST request to /nova-tiptap/api/file, supplying a valid CSRF token, and upload executable or malicious files (e.g., .php, binaries) to public disks such as local, public, or s3. If a publicly accessible storage path is used (e.g. S3 with public access, or Laravel’s public disk), the attacker may gain the ability to execute or distribute arbitrary files — amounting to a potential Remote Code Execution (RCE) vector in some environments. This vulnerability was fixed in 5.7.0. | |||||
| CVE-2025-54071 | 2025-07-22 | N/A | N/A | ||
| RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. In versions 4.0.0-beta.3 and below, an authenticated arbitrary file write vulnerability exists in the /api/saves endpoint. This can lead to Remote Code Execution on the system. The vulnerability permits arbitrary file write operations, allowing attackers to create or modify files at any filesystem location with user-supplied content. A user with viewer role or Scope.ASSETS_WRITE permission or above is required to pass authentication checks. The vulnerability is fixed in version 4.0.0-beta.4. | |||||
| CVE-2025-7900 | 2025-07-22 | N/A | N/A | ||
| The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0 | |||||
| CVE-2025-7899 | 2025-07-22 | N/A | N/A | ||
| The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0 | |||||
| CVE-2025-38352 | 2025-07-22 | N/A | N/A | ||
| In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case. | |||||
| CVE-2025-54362 | 2025-07-22 | N/A | N/A | ||
| Rejected reason: Not used | |||||
| CVE-2025-54361 | 2025-07-22 | N/A | N/A | ||
| Rejected reason: Not used | |||||
| CVE-2025-54360 | 2025-07-22 | N/A | N/A | ||
| Rejected reason: Not used | |||||
| CVE-2025-54359 | 2025-07-22 | N/A | N/A | ||
| Rejected reason: Not used | |||||
| CVE-2025-54358 | 2025-07-22 | N/A | N/A | ||
| Rejected reason: Not used | |||||
| CVE-2025-54357 | 2025-07-22 | N/A | N/A | ||
| Rejected reason: Not used | |||||
| CVE-2025-54356 | 2025-07-22 | N/A | N/A | ||
| Rejected reason: Not used | |||||
| CVE-2025-54355 | 2025-07-22 | N/A | N/A | ||
| Rejected reason: Not used | |||||
| CVE-2025-54354 | 2025-07-22 | N/A | N/A | ||
| Rejected reason: Not used | |||||
| CVE-2025-23090 | 2025-07-18 | N/A | N/A | ||
| Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083. | |||||
| CVE-2025-53817 | 2025-07-18 | N/A | N/A | ||
| 7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference in the Compound handler may lead to denial of service. Version 25.0.0 contains a fix cor the issue. | |||||
| CVE-2025-53816 | 2025-07-18 | N/A | N/A | ||
| 7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue. | |||||
| CVE-2025-4318 | 2025-07-18 | N/A | N/A | ||
| The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process. | |||||