Patch Tuesday - July 2025

Microsoft is addressing 137 vulnerabilities this July 2025 Patch Tuesday, which is above average. Microsoft is aware of public disclosure for just one of the vulnerabilities published today, and Microsoft isn’t aware of in-the-wild exploitation for any of today’s batch. This is the tenth...

CVE-2024-40809

creationtimestamp| type| source ---|---|--- 2025-07-15 04:32:33+00:00| seen| https://bsky.app/profile/lizp.bsky.social/post/3lty33vrqss2d 2025-07-15 04:32:35+00:00| seen| https://bsky.app/profile/lizp.bsky.social/post/3lty33w7hc22d...

CVE-2025-5037

creationtimestamp| type| source ---|---|--- 2025-07-15 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-597/ 2025-07-15 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-594/ 2025-07-15 03:00:00+00:00| seen|...

CVE-2025-53015

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue...

CVE-2025-53101

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's magick mogrify command, specifying multiple consecutive %d format specifiers in a filename template causes internal pointer arithmetic to...

GHSA-QH3H-J545-H8C9

creationtimestamp| type| source ---|---|--- 2025-07-14 19:49:41+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114853319755970178...

CVE-2025-7555

creationtimestamp| type| source ---|---|--- 2025-07-14 01:04:58+00:00| seen| https://bsky.app/profile/potato.software/post/3ltv6zsxdc52u...

PT-2025-90: Local Privilege Escalation in SyncBackTouch

The vulnerability was identified in SyncBackTouch, version 1.7.9.0. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 14.07.2025 Recommendations: Update to version 1.7.12 ...

CVE-2025-15340

creationtimestamp| type| source ---|---|--- 2025-07-13 16:07:41+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3ltuayxootk2q...

CVE-2025-7505

creationtimestamp| type| source ---|---|--- 2025-07-12 22:50:16+00:00| seen| https://bsky.app/profile/potato.software/post/3ltsh224ev62b...

CVE-2025-7489

creationtimestamp| type| source ---|---|--- 2025-07-12 21:22:01+00:00| seen| https://bsky.app/profile/potato.software/post/3ltsc4awr562j...

CVE-2025-6058

creationtimestamp| type| source ---|---|--- 2025-07-12 19:00:08+00:00| published-proof-of-concept| Telegram/vQGaba-QVKaOvDSuX7y4y7EZTA90-d6xov3MefrlRfg 2025-07-13 03:00:05+00:00| published-proof-of-concept| Telegram/qSyMCObkKGA7Q7HpzeouiC5p1gyRUk9NSeKtBswwYL551E 2025-07-22 21:02:24+00:00| seen|...

WordPress WPBookit plugin <= 1.0.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by stealthcopter in WordPress Plugin WPBookit versions = 1.0.4...

CVE-2025-7424

creationtimestamp| type| source ---|---|--- 2025-07-11 19:10:57+00:00| seen| https://seclists.org/oss-sec/2025/q3/33 2025-07-14 10:22:52+00:00| seen| https://bsky.app/profile/buherator.bsky.social/post/3ltw67fyiun2p 2025-08-03 13:46:51+00:00| seen|...

CVE-2025-48924

Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass... can throw StackOverflowError on very long input...

CVE-2025-6838

creationtimestamp| type| source ---|---|--- 2025-07-11 10:14:25+00:00| seen| https://bsky.app/profile/potato.software/post/3ltomdlapvz2t...

CVE-2025-53628

creationtimestamp| type| source ---|---|--- 2025-07-10 20:06:30+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114830736752967340...

CVE-2025-49630

In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in modproxyhttp2. Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with...

CVE-2025-23048

In some modssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when modssl is configured for multiple virtual hosts, with each restricted to a different set of...

CVE-2025-23048

creationtimestamp| type| source ---|---|--- 2025-07-10 15:52:45+00:00| seen| https://seclists.org/oss-sec/2025/q3/26 2025-07-10 17:02:07+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114830011674092966 2025-07-10 18:29:06+00:00| seen|...