CVSS: 8.6EPSS: 0%CPEs: 8EXPL: 0CVE-2025-48385 – Git alllows arbitrary file writes via bundle-uri parameter injection
https://notcve.org/view.php?id=CVE-2025-48385
08 Jul 2025 — The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. ... An attacker could possibly use this issue to create or write to arbitrary files on the system. ... If a user were tricked into cloning a malicious Git repository, an attacker could possibly use this issue to run arbitrary commands. • https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655 • CWE-73: External Control of File Name or Path CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-30312 – Dimension | Out-of-bounds Write (CWE-787)
https://notcve.org/view.php?id=CVE-2025-30312
08 Jul 2025 — Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. • https://helpx.adobe.com/security/products/dimension/apsb25-63.html • CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 0%CPEs: 9EXPL: 0CVE-2025-6691 – SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion
https://notcve.org/view.php?id=CVE-2025-6691
08 Jul 2025 — The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). • https://plugins.trac.wordpress.org/browser/sureforms/trunk/admin/views/entries-list-table.php#L661 • CWE-73: External Control of File Name or Path •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2025-0928 – Arbitrary executable upload via authenticated endpoint
https://notcve.org/view.php?id=CVE-2025-0928
08 Jul 2025 — In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution. • https://github.com/juju/juju/security/advisories/GHSA-4vc8-wvhw-m5gv • CWE-285: Improper Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-47988 – Azure Monitor Agent Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2025-47988
08 Jul 2025 — Improper control of generation of code ('code injection') in Azure Monitor Agent allows an unauthorized attacker to execute code over an adjacent network. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47988 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 17EXPL: 0CVE-2025-49729 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2025-49729
08 Jul 2025 — Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49729 • CWE-122: Heap-based Buffer Overflow •
CVSS: 10.0EPSS: 0%CPEs: 13EXPL: 0CVE-2025-49724 – Windows Connected Devices Platform Service Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2025-49724
08 Jul 2025 — Use after free in Windows Connected Devices Platform Service allows an unauthorized attacker to execute code over a network. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49724 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-49714 – Visual Studio Code Python Extension Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2025-49714
08 Jul 2025 — Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code locally. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49714 • CWE-501: Trust Boundary Violation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-49705 – Microsoft PowerPoint Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2025-49705
08 Jul 2025 — Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49705 • CWE-122: Heap-based Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2025-49703 – Microsoft Word Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2025-49703
08 Jul 2025 — Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49703 • CWE-416: Use After Free •