Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,528 results · page 30 of 111
Jul 21, 2025IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2025-7267 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26179.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7266 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26174.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2025-7265 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26173.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2025-7264 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26171.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2025-7263 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26170.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2025-7262 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26132.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2025-7261 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26130.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2025-7260 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26129.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2025-7258 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26127.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7257 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26126.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7256 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26119.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7255 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26118.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7254 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26113.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7253 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26112.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2025-7252 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26109.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2025-7251 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26108.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2025-7250 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26107.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7249 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26100.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7248 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26098.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2025-7247 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26096.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7246 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26095.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7244 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26093.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7243 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26091.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2025-7242 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26088.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7241 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26087.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7240 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26086.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7239 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26085.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2025-7238 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26084.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7237 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26083.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability.CVE-2025-7236 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26080.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2025-7235 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26075.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin CGM File Parsing Out-of-Bounds Write Remote Code Execution Vulnerability.CVE-2025-7234 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comHigh 7.8
IrfanView CADImage Plugin CGM File Parsing Out-of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26074.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2025-7233 · Other software · IrfanView · reported by zdi-disclosures@trendmicro.comMedium 5.5
IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26072.
- Product
- IrfanView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025apko allows users to build and publish OCI container images built from apk packages.CVE-2025-53945 · Other software · chainguard-dev · reported by GitHubHigh 7
apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.
- Product
- apko
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025Vertical scroll image slideshow gallery: Stored Cross-Site ScriptingCVE-2025-5752 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Vertical scroll image slideshow gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Vertical scroll image slideshow gallery
- Affected
- up to 11.1
- What to do
- Affects up to 11.1. Update Vertical scroll image slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 16, 2025Image Wall: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48156 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Parakoos Image Wall image-wall allows Stored XSS.This issue affects Image Wall: from n/a through <= 3.1.
- Product
- Image Wall
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Image Wall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Import CDN-Remote Images: Cross-Site Request Forgery (CSRF)CVE-2025-48153 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au Import CDN-Remote Images import-cdn-remote-images allows Stored XSS.This issue affects Import CDN-Remote Images: from n/a through <= 2.1.2.
- Product
- Import CDN-Remote Images
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Import CDN-Remote Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 15, 2025Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Native Image).CVE-2025-50065 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 3.7
Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Native Image). The supported version that is affected is Oracle GraalVM for JDK: 24.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
- Product
- Oracle GraalVM for JDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025A buffer overflow vulnerability exists in PDF Shaper versions 3.5 and 3.6 when converting a crafted PDF file to an image using the 'Convert PDF to Image' functiCVE-2025-34106 · Other software · Burnaware · reported by VulnCheckHigh 8.4
A buffer overflow vulnerability exists in PDF Shaper versions 3.5 and 3.6 when converting a crafted PDF file to an image using the 'Convert PDF to Image' functionality. An attacker can exploit this vulnerability by tricking a user into opening a maliciously crafted PDF file, leading to arbitrary code execution under the context of the user. This vulnerability has been verified on Windows XP, 7, 8, and 10 platforms using the PDFTools.exe component.
- Product
- PDF Shaper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comvulners.com
Jul 14, 2025ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2025-53101 · Other software · ImageMagick · reported by GitHubHigh 7.4
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2025-53019 · Other software · ImageMagick · reported by GitHubLow 3.7
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 14, 2025ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2025-53015 · Other software · ImageMagick · reported by GitHubHigh 7.5
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jul 14, 2025ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2025-53014 · Other software · ImageMagick · reported by GitHubLow 3.7
ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 11, 2025FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel: Stored Cross-Site ScriptingCVE-2025-6068 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel
- Affected
- up to 2.4.31
- What to do
- Affects up to 2.4.31. Update FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2025ImpactThis is an information disclosure vulnerability originating from PHP's base image.CVE-2025-7381 · Other software · mautic · reported by security@mautic.orgMedium 5.3
ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses. WorkaroundsThe mitigation requires changing the expose_php variable from "On" to "Off" in the file located at /usr/local/etc/php/php.ini.
- Product
- Docker Mautic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2025Simple Featured Image: Stored Cross-Site ScriptingCVE-2025-7059 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slideshow’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Simple Featured Image
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Simple Featured Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 8, 2025A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c).CVE-2025-7345 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding, allowing out-of-bounds reads from heap memory, potentially causing application crashes or arbitrary code execution.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 8, 2025Memory corruption during the image encoding process.CVE-2025-27055 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption during the image encoding process.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_utiCVE-2025-6209 · Other software · run-llama · reported by security@huntr.devHigh 7.5
A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_utils.py`. This vulnerability allows an attacker to manipulate the `image_path` input to read arbitrary files on the server, including sensitive system files. The issue arises due to improper validation or sanitization of the file path, enabling path traversal sequences to access files outside the intended directory. The vulnerability is fixed in version 0.12.41.
- Product
- run-llama/llama_index
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file.CVE-2025-3777 · Other software · huggingface · reported by security@huntr.devLow 3.5
Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1.
- Product
- huggingface/transformers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.