2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-71465 | MEDIUM | 6.1 | — | Nov 14, 2026 | @kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from... |
| CVE-2025-71464 | MEDIUM | 6.1 | — | Nov 14, 2026 | @kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns sou... |
| CVE-2025-53700 | MEDIUM | 6.3 | — | Nov 13, 2026 | CWE‑922 Insecure Storage of Sensitive Information vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR ... |
| CVE-2025-53699 | HIGH | 7 | — | Nov 13, 2026 | Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra, Johnson Con... |
| CVE-2025-53698 | HIGH | 7 | — | Nov 13, 2026 | Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson ... |
| CVE-2025-53697 | HIGH | 8.4 | — | Nov 13, 2026 | Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Contr... |
| CVE-2025-43874 | HIGH | 8.7 | — | Nov 13, 2026 | : Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra, Johns... |
| CVE-2025-43867 | HIGH | 8.5 | — | Nov 13, 2026 | - Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80, and... |
| CVE-2025-41725 | MEDIUM | 6.5 | — | Nov 13, 2026 | Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malfo... |
| CVE-2025-71463 | MEDIUM | 6.7 | 0.3% | Nov 13, 2026 | Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers... |
| CVE-2025-71462 | MEDIUM | 6.1 | 0.3% | Nov 13, 2026 | Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute J... |
| CVE-2025-71461 | MEDIUM | 5.3 | 0.3% | Nov 13, 2026 | Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload fi... |
| CVE-2025-71460 | MEDIUM | 4.2 | 0.3% | Nov 13, 2026 | Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that all... |
| CVE-2025-71459 | HIGH | 8.1 | 0.5% | Nov 13, 2026 | Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside... |
| CVE-2025-54507 | MEDIUM | 5.9 | 0.2% | Nov 12, 2026 | Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an att... |
| CVE-2025-0043 | HIGH | 7 | 0.1% | Nov 12, 2026 | Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalat... |
| CVE-2025-54501 | MEDIUM | 5.9 | 0.2% | Nov 12, 2026 | Improper access control on an internal debug interface could allow a high privileged attacker to bypass memory access co... |
| CVE-2025-10698 | MEDIUM | 6 | 0.1% | Nov 12, 2026 | Incorrect default permissions and Product released in Non-Release configuration vulnerability in OpenText Identity Conso... |
| CVE-2025-10935 | HIGH | 7.8 | 0.2% | Nov 12, 2026 | libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remo... |
| CVE-2025-59848 | MEDIUM | 6.8 | 0.4% | Nov 11, 2026 | HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attack... |
| CVE-2025-59847 | MEDIUM | 6.8 | 0.4% | Nov 11, 2026 | HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an att... |
| CVE-2025-15714 | LOW | 3.5 | 0.2% | Nov 11, 2026 | The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before... |
| CVE-2025-15713 | LOW | 3.5 | 0.2% | Nov 11, 2026 | The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings ... |
| CVE-2025-15712 | LOW | 3.5 | 0.2% | Nov 11, 2026 | The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before ... |
| CVE-2025-15711 | LOW | 3.5 | 0.2% | Nov 11, 2026 | The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before output... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now