Total
10489 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-33099 | 1 Qualcomm | 208 315 5g Iot Modem, 315 5g Iot Modem Firmware, Ar8035 and 205 more | 2025-08-07 | N/A | 7.5 HIGH |
| Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR. | |||||
| CVE-2024-33065 | 1 Qualcomm | 80 Aqt1000, Aqt1000 Firmware, Fastconnect 6200 and 77 more | 2025-08-07 | N/A | 8.4 HIGH |
| Memory corruption while taking snapshot when an offset variable is set by camera driver. | |||||
| CVE-2023-28578 | 1 Qualcomm | 680 315 5g Iot Modem, 315 5g Iot Modem Firmware, Aqt1000 and 677 more | 2025-08-07 | N/A | 9.3 CRITICAL |
| Memory corruption in Core Services while executing the command for removing a single event listener. | |||||
| CVE-2023-21671 | 1 Qualcomm | 48 Fastconnect 6700, Fastconnect 6700 Firmware, Fastconnect 6900 and 45 more | 2025-08-07 | N/A | 9.3 CRITICAL |
| Memory Corruption in Core during syscall for Sectools Fuse comparison feature. | |||||
| CVE-2023-33057 | 1 Qualcomm | 202 315 5g Iot Modem, 315 5g Iot Modem Firmware, Ar8035 and 199 more | 2025-08-07 | N/A | 7.5 HIGH |
| Transient DOS in Multi-Mode Call Processor while processing UE policy container. | |||||
| CVE-2023-45648 | 2 Apache, Debian | 2 Tomcat, Debian Linux | 2025-08-07 | N/A | 5.3 MEDIUM |
| Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue. | |||||
| CVE-2025-3777 | 1 Huggingface | 1 Transformers | 2025-08-07 | N/A | 3.5 LOW |
| Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1. | |||||
| CVE-2025-8573 | 2025-08-06 | N/A | N/A | ||
| Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks sealldev for reporting via HackerOne. | |||||
| CVE-2025-8571 | 2025-08-06 | N/A | N/A | ||
| Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and (if victim is an admin), the execution of unauthorized actions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Fortbridge https://fortbridge.co.uk/ for performing a penetration test and vulnerability assessment on Concrete CMS and reporting this issue. | |||||
| CVE-2025-54614 | 2025-08-06 | N/A | 6.2 MEDIUM | ||
| Input verification vulnerability in the home screen module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2025-50233 | 2025-08-06 | N/A | 6.5 MEDIUM | ||
| A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of the "Name" parameter in the backend template editor. By manipulating the parameter, attackers can perform directory traversal and access sensitive files outside the intended template directory, potentially exposing system configuration, PHP source code, or other sensitive information. | |||||
| CVE-2025-54636 | 2025-08-06 | N/A | 4.4 MEDIUM | ||
| Issue of buffer overflow caused by insufficient data verification in the kernel drop detection module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2025-21477 | 2025-08-06 | N/A | 7.5 HIGH | ||
| Transient DOS while processing CCCH data when NW sends data with invalid length. | |||||
| CVE-2025-54641 | 2025-08-06 | N/A | 6.7 MEDIUM | ||
| Issue of buffer overflow caused by insufficient data verification in the kernel acceleration module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2025-54642 | 2025-08-06 | N/A | 6.7 MEDIUM | ||
| Issue of buffer overflow caused by insufficient data verification in the kernel gyroscope module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2020-3538 | 1 Cisco | 1 Data Center Network Manager | 2025-08-06 | N/A | 4.6 MEDIUM |
| A vulnerability in a certain REST API endpoint of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to perform a path traversal attack on an affected device. The vulnerability is due to insufficient path restriction enforcement. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to overwrite or list arbitrary files on the affected device.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. | |||||
| CVE-2024-20271 | 1 Cisco | 14 Business 140ac, Business 140ac Access Point, Business 141acm and 11 more | 2025-08-06 | N/A | 8.6 HIGH |
| A vulnerability in the IP packet processing of Cisco Access Point (AP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of certain IPv4 packets. An attacker could exploit this vulnerability by sending a crafted IPv4 packet either to or through an affected device. A successful exploit could allow the attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. To successfully exploit this vulnerability, the attacker does not need to be associated with the affected AP. This vulnerability cannot be exploited by sending IPv6 packets. | |||||
| CVE-2025-2611 | 2025-08-05 | N/A | N/A | ||
| The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable. | |||||
| CVE-2025-7674 | 2025-08-05 | N/A | N/A | ||
| Improper Input Validation vulnerability in Roche Diagnostics navify Monitoring allows an attacker to manipulate input data, which may lead to a denial of service (DoS) due to negatively impacting the server's performance. This vulnerability has no impact on data confidentiality or integrity. This issue affects navify Monitoring before 1.08.00. | |||||
| CVE-2025-20183 | 1 Cisco | 8 Asyncos, Secure Web Appliance S196, Secure Web Appliance S396 and 5 more | 2025-08-05 | N/A | 5.8 MEDIUM |
| A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious file onto an endpoint. The vulnerability is due to improper handling of a crafted range request header. An attacker could exploit this vulnerability by sending an HTTP request with a crafted range request header through the affected device. A successful exploit could allow the attacker to evade the antivirus scanner and download malware onto the endpoint without detection by Cisco Secure Web Appliance. | |||||