CVSS: 7.1EPSS: %CPEs: 1EXPL: 0CVE-2025-54134 – HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service
https://notcve.org/view.php?id=CVE-2025-54134
21 Jul 2025 — HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9. • https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/listFiles.js#L22 • CWE-20: Improper Input Validation CWE-248: Uncaught Exception CWE-703: Improper Check or Handling of Exceptional Conditions •
CVSS: 5.3EPSS: %CPEs: 1EXPL: 0CVE-2025-54121 – Starlette has possible denial-of-service vector when parsing large files in multipart forms
https://notcve.org/view.php?id=CVE-2025-54121
21 Jul 2025 — Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_memory, the lo... • https://github.com/encode/starlette/blob/fa5355442753f794965ae1af0f87f9fec1b9a3de/starlette/datastructures.py#L436C5-L447C14 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2025-41679 – Unauthenticated Buffer Overflow in Conftool Service Leading to Denial of Service
https://notcve.org/view.php?id=CVE-2025-41679
21 Jul 2025 — An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service. • https://certvde.com/de/advisories/VDE-2025-058 • CWE-787: Out-of-bounds Write •
CVSS: -EPSS: 0%CPEs: -EXPL: 0CVE-2025-44650
https://notcve.org/view.php?id=CVE-2025-44650
21 Jul 2025 — This can cause DoS attacks when unlimited users are connected. • https://gist.github.com/TPCchecker/d13d15dfa8965ba88a9437718f77f67d •
CVSS: -EPSS: 0%CPEs: -EXPL: 0CVE-2025-44651
https://notcve.org/view.php?id=CVE-2025-44651
21 Jul 2025 — This can cause DoS attacks when unlimited users are connected. • http://trendnet.com •
CVSS: -EPSS: 0%CPEs: -EXPL: 0CVE-2025-44652
https://notcve.org/view.php?id=CVE-2025-44652
21 Jul 2025 — This can cause DoS attacks when unlimited users are connected. • https://www.netgear.com/about/security •
CVSS: -EPSS: 0%CPEs: -EXPL: 0CVE-2025-44653
https://notcve.org/view.php?id=CVE-2025-44653
21 Jul 2025 — This can cause DoS attacks when unlimited users are connected. • http://h3c.com •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2025-53901 – Wasmtime has host panic with `fd_renumber` WASIp1 function
https://notcve.org/view.php?id=CVE-2025-53901
18 Jul 2025 — A panic in the host is considered a denial-of-service vector for WebAssembly embedders and is thus a security issue in Wasmtime. • https://docs.wasmtime.dev/security-what-is-considered-a-security-vulnerability.html • CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-7697 – Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection via verify_field_val Function
https://notcve.org/view.php?id=CVE-2025-7697
18 Jul 2025 — The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted. • https://plugins.trac.wordpress.org/browser/integration-for-contact-form-7-and-google-sheets/tags/1.1.1/integration-for-contact-form-7-and-google-sheets.php#L923 • CWE-502: Deserialization of Untrusted Data •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-7696 – Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.3 - Unauthenticated PHP Object Injection via verify_field_val Function
https://notcve.org/view.php?id=CVE-2025-7696
18 Jul 2025 — The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted. • https://plugins.trac.wordpress.org/browser/integration-for-contact-form-7-and-pipedrive/tags/1.2.3/integration-for-contact-form-7-and-pipedrive.php#L953 • CWE-502: Deserialization of Untrusted Data •